To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 815
- compare with another revision
- download diff
- download tarball
- view history from revision 815
- Committer: Teddy Hogeborn
- Date: 2016-03-02 16:45:38 UTC
- Revision ID: teddy@recompile.se-20160302164538-n9ocll4izthzw1ov
Ignore any error from initramfs-tools' "configure_networking".
* initramfs-tools-script: Wrap call to "configure_networking" with
"set +e" and "set -e", since configure_networking was not designed
to run in a "set -e" environment.
Closes: 816513
Thanks: Carlos Alberto Lopez Perez <clopez@igalia.com>
Thanks: Ben Hutchings <ben@decadent.org.uk>
* initramfs-tools-script: Wrap call to "configure_networking" with
"set +e" and "set -e", since configure_networking was not designed
to run in a "set -e" environment.
Closes: 816513
Thanks: Carlos Alberto Lopez Perez <clopez@igalia.com>
Thanks: Ben Hutchings <ben@decadent.org.uk>
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
39
try:
48
40
import SocketServer as socketserver
49
41
except ImportError:
50
42
import socketserver
51
43
import socket
44
import argparse
52
45
import datetime
53
46
import errno
54
47
try:
55
48
import ConfigParser as configparser
56
49
except ImportError:
57
50
import configparser
51
import sys
58
52
import re
53
import os
59
54
import signal
60
55
import subprocess
61
56
import atexit
62
57
import stat
58
import logging
63
59
import logging.handlers
64
60
import pwd
65
61
import contextlib
77
73
import itertools
78
74
import collections
79
75
import codecs
80
import random
81
import shlex
82
76
83
77
import dbus
84
78
import dbus.service
85
import gi
86
from gi.repository import GLib
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
89
86
import ctypes.util
90
87
import xml.dom.minidom
91
88
import inspect
92
89
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Add os.set_inheritable if it does not exist
114
try:
115
os.set_inheritable
116
except AttributeError:
117
def set_inheritable(fd, inheritable):
118
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
119
if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):
120
fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)
121
elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):
122
fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)
123
os.set_inheritable = set_inheritable
124
del set_inheritable
125
126
# Show warnings by default
127
if not sys.warnoptions:
128
import warnings
129
warnings.simplefilter("default")
130
131
# Try to find the value of SO_BINDTODEVICE:
132
try:
133
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
134
# newer, and it is also the most natural place for it:
90
try:
135
91
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
136
92
except AttributeError:
137
93
try:
138
# This is where SO_BINDTODEVICE was up to and including Python
139
# 2.6, and also 3.2:
140
94
from IN import SO_BINDTODEVICE
141
95
except ImportError:
142
# In Python 2.7 it seems to have been removed entirely.
143
# Try running the C preprocessor:
144
try:
145
cc = subprocess.Popen(["cc", "--language=c", "-E",
146
"/dev/stdin"],
147
stdin=subprocess.PIPE,
148
stdout=subprocess.PIPE)
149
stdout = cc.communicate(
150
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
151
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
152
except (OSError, ValueError, IndexError):
153
# No value found
154
SO_BINDTODEVICE = None
155
156
if sys.version_info < (3, 2):
157
configparser.Configparser = configparser.SafeConfigParser
158
159
version = "1.8.17"
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.3"
160
102
stored_state_file = "clients.pickle"
161
103
162
log = logging.getLogger(os.path.basename(sys.argv[0]))
163
logging.captureWarnings(True) # Show warnings via the logging system
104
logger = logging.getLogger()
164
105
syslogger = None
165
106
166
107
try:
167
108
if_nametoindex = ctypes.cdll.LoadLibrary(
168
109
ctypes.util.find_library("c")).if_nametoindex
169
110
except (OSError, AttributeError):
170
111
171
112
def if_nametoindex(interface):
172
113
"Get an interface index the hard way, i.e. using fcntl()"
173
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
178
119
return interface_index
179
120
180
121
181
def copy_function(func):
182
"""Make a copy of a function"""
183
if sys.version_info.major == 2:
184
return types.FunctionType(func.func_code,
185
func.func_globals,
186
func.func_name,
187
func.func_defaults,
188
func.func_closure)
189
else:
190
return types.FunctionType(func.__code__,
191
func.__globals__,
192
func.__name__,
193
func.__defaults__,
194
func.__closure__)
195
196
197
122
def initlogger(debug, level=logging.WARNING):
198
123
"""init logger and add loglevel"""
199
124
200
125
global syslogger
201
126
syslogger = (logging.handlers.SysLogHandler(
202
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
203
address="/dev/log"))
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
204
129
syslogger.setFormatter(logging.Formatter
205
("Mandos [%(process)d]: %(levelname)s:"
206
" %(message)s"))
207
log.addHandler(syslogger)
208
130
('Mandos [%(process)d]: %(levelname)s:'
131
' %(message)s'))
132
logger.addHandler(syslogger)
133
209
134
if debug:
210
135
console = logging.StreamHandler()
211
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
212
" [%(process)d]:"
213
" %(levelname)s:"
214
" %(message)s"))
215
log.addHandler(console)
216
log.setLevel(level)
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
137
' [%(process)d]:'
138
' %(levelname)s:'
139
' %(message)s'))
140
logger.addHandler(console)
141
logger.setLevel(level)
217
142
218
143
219
144
class PGPError(Exception):
221
146
pass
222
147
223
148
224
class PGPEngine:
149
class PGPEngine(object):
225
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
226
151
227
152
def __init__(self):
228
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
229
154
self.gpg = "gpg"
230
155
try:
231
156
output = subprocess.check_output(["gpgconf"])
232
157
for line in output.splitlines():
233
name, text, path = line.split(b":")
234
if name == b"gpg":
158
name, text, path = line.split(":")
159
if name == "gpg":
235
160
self.gpg = path
236
161
break
237
162
except OSError as e:
238
163
if e.errno != errno.ENOENT:
239
164
raise
240
self.gnupgargs = ["--batch",
241
"--homedir", self.tempdir,
242
"--force-mdc",
243
"--quiet"]
244
# Only GPG version 1 has the --no-use-agent option.
245
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
246
self.gnupgargs.append("--no-use-agent")
247
165
self.gnupgargs = ['--batch',
166
'--homedir', self.tempdir,
167
'--force-mdc',
168
'--quiet',
169
'--no-use-agent']
170
248
171
def __enter__(self):
249
172
return self
250
173
251
174
def __exit__(self, exc_type, exc_value, traceback):
252
175
self._cleanup()
253
176
return False
254
177
255
178
def __del__(self):
256
179
self._cleanup()
257
180
258
181
def _cleanup(self):
259
182
if self.tempdir is not None:
260
183
# Delete contents of tempdir
261
184
for root, dirs, files in os.walk(self.tempdir,
262
topdown=False):
185
topdown = False):
263
186
for filename in files:
264
187
os.remove(os.path.join(root, filename))
265
188
for dirname in dirs:
267
190
# Remove tempdir
268
191
os.rmdir(self.tempdir)
269
192
self.tempdir = None
270
193
271
194
def password_encode(self, password):
272
195
# Passphrase can not be empty and can not contain newlines or
273
196
# NUL bytes. So we prefix it and hex encode it.
278
201
.replace(b"\n", b"\\n")
279
202
.replace(b"\0", b"\\x00"))
280
203
return encoded
281
204
282
205
def encrypt(self, data, password):
283
206
passphrase = self.password_encode(password)
284
207
with tempfile.NamedTemporaryFile(
285
208
dir=self.tempdir) as passfile:
286
209
passfile.write(passphrase)
287
210
passfile.flush()
288
proc = subprocess.Popen([self.gpg, "--symmetric",
289
"--passphrase-file",
211
proc = subprocess.Popen([self.gpg, '--symmetric',
212
'--passphrase-file',
290
213
passfile.name]
291
214
+ self.gnupgargs,
292
stdin=subprocess.PIPE,
293
stdout=subprocess.PIPE,
294
stderr=subprocess.PIPE)
295
ciphertext, err = proc.communicate(input=data)
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
296
219
if proc.returncode != 0:
297
220
raise PGPError(err)
298
221
return ciphertext
299
222
300
223
def decrypt(self, data, password):
301
224
passphrase = self.password_encode(password)
302
225
with tempfile.NamedTemporaryFile(
303
dir=self.tempdir) as passfile:
226
dir = self.tempdir) as passfile:
304
227
passfile.write(passphrase)
305
228
passfile.flush()
306
proc = subprocess.Popen([self.gpg, "--decrypt",
307
"--passphrase-file",
229
proc = subprocess.Popen([self.gpg, '--decrypt',
230
'--passphrase-file',
308
231
passfile.name]
309
232
+ self.gnupgargs,
310
stdin=subprocess.PIPE,
311
stdout=subprocess.PIPE,
312
stderr=subprocess.PIPE)
313
decrypted_plaintext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
314
237
if proc.returncode != 0:
315
238
raise PGPError(err)
316
239
return decrypted_plaintext
317
240
318
241
319
# Pretend that we have an Avahi module
320
class avahi:
321
"""This isn't so much a class as it is a module-like namespace."""
322
IF_UNSPEC = -1 # avahi-common/address.h
323
PROTO_UNSPEC = -1 # avahi-common/address.h
324
PROTO_INET = 0 # avahi-common/address.h
325
PROTO_INET6 = 1 # avahi-common/address.h
326
DBUS_NAME = "org.freedesktop.Avahi"
327
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
328
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
329
DBUS_PATH_SERVER = "/"
330
331
@staticmethod
332
def string_array_to_txt_array(t):
333
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
334
for s in t), signature="ay")
335
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
336
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
337
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
338
SERVER_INVALID = 0 # avahi-common/defs.h
339
SERVER_REGISTERING = 1 # avahi-common/defs.h
340
SERVER_RUNNING = 2 # avahi-common/defs.h
341
SERVER_COLLISION = 3 # avahi-common/defs.h
342
SERVER_FAILURE = 4 # avahi-common/defs.h
343
344
345
242
class AvahiError(Exception):
346
243
def __init__(self, value, *args, **kwargs):
347
244
self.value = value
357
254
pass
358
255
359
256
360
class AvahiService:
257
class AvahiService(object):
361
258
"""An Avahi (Zeroconf) service.
362
259
363
260
Attributes:
364
261
interface: integer; avahi.IF_UNSPEC or an interface index.
365
262
Used to optionally bind to the specified interface.
366
name: string; Example: "Mandos"
367
type: string; Example: "_mandos._tcp".
263
name: string; Example: 'Mandos'
264
type: string; Example: '_mandos._tcp'.
368
265
See <https://www.iana.org/assignments/service-names-port-numbers>
369
266
port: integer; what port to announce
370
267
TXT: list of strings; TXT record for the service
377
274
server: D-Bus Server
378
275
bus: dbus.SystemBus()
379
276
"""
380
277
381
278
def __init__(self,
382
interface=avahi.IF_UNSPEC,
383
name=None,
384
servicetype=None,
385
port=None,
386
TXT=None,
387
domain="",
388
host="",
389
max_renames=32768,
390
protocol=avahi.PROTO_UNSPEC,
391
bus=None):
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
392
289
self.interface = interface
393
290
self.name = name
394
291
self.type = servicetype
403
300
self.server = None
404
301
self.bus = bus
405
302
self.entry_group_state_changed_match = None
406
303
407
304
def rename(self, remove=True):
408
305
"""Derived from the Avahi example code"""
409
306
if self.rename_count >= self.max_renames:
410
log.critical("No suitable Zeroconf service name found"
411
" after %i retries, exiting.",
412
self.rename_count)
307
logger.critical("No suitable Zeroconf service name found"
308
" after %i retries, exiting.",
309
self.rename_count)
413
310
raise AvahiServiceError("Too many renames")
414
311
self.name = str(
415
312
self.server.GetAlternativeServiceName(self.name))
416
313
self.rename_count += 1
417
log.info("Changing Zeroconf service name to %r ...",
418
self.name)
314
logger.info("Changing Zeroconf service name to %r ...",
315
self.name)
419
316
if remove:
420
317
self.remove()
421
318
try:
423
320
except dbus.exceptions.DBusException as error:
424
321
if (error.get_dbus_name()
425
322
== "org.freedesktop.Avahi.CollisionError"):
426
log.info("Local Zeroconf service name collision.")
323
logger.info("Local Zeroconf service name collision.")
427
324
return self.rename(remove=False)
428
325
else:
429
log.critical("D-Bus Exception", exc_info=error)
326
logger.critical("D-Bus Exception", exc_info=error)
430
327
self.cleanup()
431
328
os._exit(1)
432
329
433
330
def remove(self):
434
331
"""Derived from the Avahi example code"""
435
332
if self.entry_group_state_changed_match is not None:
437
334
self.entry_group_state_changed_match = None
438
335
if self.group is not None:
439
336
self.group.Reset()
440
337
441
338
def add(self):
442
339
"""Derived from the Avahi example code"""
443
340
self.remove()
448
345
avahi.DBUS_INTERFACE_ENTRY_GROUP)
449
346
self.entry_group_state_changed_match = (
450
347
self.group.connect_to_signal(
451
"StateChanged", self.entry_group_state_changed))
452
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
453
self.name, self.type)
348
'StateChanged', self.entry_group_state_changed))
349
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
350
self.name, self.type)
454
351
self.group.AddService(
455
352
self.interface,
456
353
self.protocol,
460
357
dbus.UInt16(self.port),
461
358
avahi.string_array_to_txt_array(self.TXT))
462
359
self.group.Commit()
463
360
464
361
def entry_group_state_changed(self, state, error):
465
362
"""Derived from the Avahi example code"""
466
log.debug("Avahi entry group state change: %i", state)
467
363
logger.debug("Avahi entry group state change: %i", state)
364
468
365
if state == avahi.ENTRY_GROUP_ESTABLISHED:
469
log.debug("Zeroconf service established.")
366
logger.debug("Zeroconf service established.")
470
367
elif state == avahi.ENTRY_GROUP_COLLISION:
471
log.info("Zeroconf service name collision.")
368
logger.info("Zeroconf service name collision.")
472
369
self.rename()
473
370
elif state == avahi.ENTRY_GROUP_FAILURE:
474
log.critical("Avahi: Error in group state changed %s",
475
str(error))
371
logger.critical("Avahi: Error in group state changed %s",
372
str(error))
476
373
raise AvahiGroupError("State changed: {!s}".format(error))
477
374
478
375
def cleanup(self):
479
376
"""Derived from the Avahi example code"""
480
377
if self.group is not None:
485
382
pass
486
383
self.group = None
487
384
self.remove()
488
385
489
386
def server_state_changed(self, state, error=None):
490
387
"""Derived from the Avahi example code"""
491
log.debug("Avahi server state change: %i", state)
388
logger.debug("Avahi server state change: %i", state)
492
389
bad_states = {
493
390
avahi.SERVER_INVALID: "Zeroconf server invalid",
494
391
avahi.SERVER_REGISTERING: None,
498
395
if state in bad_states:
499
396
if bad_states[state] is not None:
500
397
if error is None:
501
log.error(bad_states[state])
398
logger.error(bad_states[state])
502
399
else:
503
log.error(bad_states[state] + ": %r", error)
400
logger.error(bad_states[state] + ": %r", error)
504
401
self.cleanup()
505
402
elif state == avahi.SERVER_RUNNING:
506
403
try:
508
405
except dbus.exceptions.DBusException as error:
509
406
if (error.get_dbus_name()
510
407
== "org.freedesktop.Avahi.CollisionError"):
511
log.info("Local Zeroconf service name collision.")
408
logger.info("Local Zeroconf service name"
409
" collision.")
512
410
return self.rename(remove=False)
513
411
else:
514
log.critical("D-Bus Exception", exc_info=error)
412
logger.critical("D-Bus Exception", exc_info=error)
515
413
self.cleanup()
516
414
os._exit(1)
517
415
else:
518
416
if error is None:
519
log.debug("Unknown state: %r", state)
417
logger.debug("Unknown state: %r", state)
520
418
else:
521
log.debug("Unknown state: %r: %r", state, error)
522
419
logger.debug("Unknown state: %r: %r", state, error)
420
523
421
def activate(self):
524
422
"""Derived from the Avahi example code"""
525
423
if self.server is None:
536
434
class AvahiServiceToSyslog(AvahiService):
537
435
def rename(self, *args, **kwargs):
538
436
"""Add the new name to the syslog messages"""
539
ret = super(AvahiServiceToSyslog, self).rename(*args,
540
**kwargs)
437
ret = AvahiService.rename(self, *args, **kwargs)
541
438
syslogger.setFormatter(logging.Formatter(
542
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
543
440
.format(self.name)))
544
441
return ret
545
442
546
547
443
# Pretend that we have a GnuTLS module
548
class gnutls:
549
"""This isn't so much a class as it is a module-like namespace."""
550
551
library = ctypes.util.find_library("gnutls")
552
if library is None:
553
library = ctypes.util.find_library("gnutls-deb0")
554
_library = ctypes.cdll.LoadLibrary(library)
555
del library
556
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
557
459
# Unless otherwise indicated, the constants and types below are
558
460
# all from the gnutls/gnutls.h C header file.
559
461
560
462
# Constants
561
463
E_SUCCESS = 0
562
464
E_INTERRUPTED = -52
563
465
E_AGAIN = -28
564
466
CRT_OPENPGP = 2
565
CRT_RAWPK = 3
566
467
CLIENT = 2
567
468
SHUT_RDWR = 0
568
469
CRD_CERTIFICATE = 1
569
470
E_NO_CERTIFICATE_FOUND = -49
570
X509_FMT_DER = 0
571
NO_TICKETS = 1<<10
572
ENABLE_RAWPK = 1<<18
573
CTYPE_PEERS = 3
574
KEYID_USE_SHA256 = 1 # gnutls/x509.h
575
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
576
472
577
473
# Types
578
class _session_int(ctypes.Structure):
474
class session_int(ctypes.Structure):
579
475
_fields_ = []
580
session_t = ctypes.POINTER(_session_int)
581
476
session_t = ctypes.POINTER(session_int)
582
477
class certificate_credentials_st(ctypes.Structure):
583
478
_fields_ = []
584
479
certificate_credentials_t = ctypes.POINTER(
585
480
certificate_credentials_st)
586
481
certificate_type_t = ctypes.c_int
587
588
482
class datum_t(ctypes.Structure):
589
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
590
("size", ctypes.c_uint)]
591
592
class _openpgp_crt_int(ctypes.Structure):
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
('size', ctypes.c_uint)]
485
class openpgp_crt_int(ctypes.Structure):
593
486
_fields_ = []
594
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
595
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
596
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
597
credentials_type_t = ctypes.c_int
490
credentials_type_t = ctypes.c_int #
598
491
transport_ptr_t = ctypes.c_void_p
599
492
close_request_t = ctypes.c_int
600
493
601
494
# Exceptions
602
495
class Error(Exception):
603
def __init__(self, message=None, code=None, args=()):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
604
501
# Default usage is by a message string, but if a return
605
502
# code is passed, convert it to a string with
606
503
# gnutls.strerror()
607
504
self.code = code
608
505
if message is None and code is not None:
609
message = gnutls.strerror(code).decode(
610
"utf-8", errors="replace")
611
return super(gnutls.Error, self).__init__(
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
612
508
message, *args)
613
509
614
510
class CertificateSecurityError(Error):
615
511
pass
616
617
class PointerTo:
618
def __init__(self, cls):
619
self.cls = cls
620
621
def from_param(self, obj):
622
if not isinstance(obj, self.cls):
623
raise TypeError("Not of type {}: {!r}"
624
.format(self.cls.__name__, obj))
625
return ctypes.byref(obj.from_param(obj))
626
627
class CastToVoidPointer:
628
def __init__(self, cls):
629
self.cls = cls
630
631
def from_param(self, obj):
632
if not isinstance(obj, self.cls):
633
raise TypeError("Not of type {}: {!r}"
634
.format(self.cls.__name__, obj))
635
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
636
637
class With_from_param:
638
@classmethod
639
def from_param(cls, obj):
640
return obj._as_parameter_
641
512
642
513
# Classes
643
class Credentials(With_from_param):
514
class Credentials(object):
644
515
def __init__(self):
645
self._as_parameter_ = gnutls.certificate_credentials_t()
646
gnutls.certificate_allocate_credentials(self)
516
self._c_object = gnutls.certificate_credentials_t()
517
gnutls.certificate_allocate_credentials(
518
ctypes.byref(self._c_object))
647
519
self.type = gnutls.CRD_CERTIFICATE
648
520
649
521
def __del__(self):
650
gnutls.certificate_free_credentials(self)
651
652
class ClientSession(With_from_param):
653
def __init__(self, socket, credentials=None):
654
self._as_parameter_ = gnutls.session_t()
655
gnutls_flags = gnutls.CLIENT
656
if gnutls.check_version(b"3.5.6"):
657
gnutls_flags |= gnutls.NO_TICKETS
658
if gnutls.has_rawpk:
659
gnutls_flags |= gnutls.ENABLE_RAWPK
660
gnutls.init(self, gnutls_flags)
661
del gnutls_flags
662
gnutls.set_default_priority(self)
663
gnutls.transport_set_ptr(self, socket.fileno())
664
gnutls.handshake_set_private_extensions(self, True)
522
gnutls.certificate_free_credentials(self._c_object)
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
526
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
528
gnutls.set_default_priority(self._c_object)
529
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
gnutls.handshake_set_private_extensions(self._c_object,
531
True)
665
532
self.socket = socket
666
533
if credentials is None:
667
534
credentials = gnutls.Credentials()
668
gnutls.credentials_set(self, credentials.type,
669
credentials)
535
gnutls.credentials_set(self._c_object, credentials.type,
536
ctypes.cast(credentials._c_object,
537
ctypes.c_void_p))
670
538
self.credentials = credentials
671
539
672
540
def __del__(self):
673
gnutls.deinit(self)
674
541
gnutls.deinit(self._c_object)
542
675
543
def handshake(self):
676
return gnutls.handshake(self)
677
544
return gnutls.handshake(self._c_object)
545
678
546
def send(self, data):
679
547
data = bytes(data)
680
548
data_len = len(data)
681
549
while data_len > 0:
682
data_len -= gnutls.record_send(self, data[-data_len:],
550
data_len -= gnutls.record_send(self._c_object,
551
data[-data_len:],
683
552
data_len)
684
553
685
554
def bye(self):
686
return gnutls.bye(self, gnutls.SHUT_RDWR)
687
555
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
688
557
# Error handling functions
689
558
def _error_code(result):
690
559
"""A function to raise exceptions on errors, suitable
691
for the "restype" attribute on ctypes functions"""
692
if result >= gnutls.E_SUCCESS:
560
for the 'restype' attribute on ctypes functions"""
561
if result >= 0:
693
562
return result
694
563
if result == gnutls.E_NO_CERTIFICATE_FOUND:
695
raise gnutls.CertificateSecurityError(code=result)
696
raise gnutls.Error(code=result)
697
698
def _retry_on_error(result, func, arguments,
699
_error_code=_error_code):
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
567
def _retry_on_error(result, func, arguments):
700
568
"""A function to retry on some errors, suitable
701
for the "errcheck" attribute on ctypes functions"""
702
while result < gnutls.E_SUCCESS:
569
for the 'errcheck' attribute on ctypes functions"""
570
while result < 0:
703
571
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
704
572
return _error_code(result)
705
573
result = func(*arguments)
706
574
return result
707
575
708
576
# Unless otherwise indicated, the function declarations below are
709
577
# all from the gnutls/gnutls.h C header file.
710
578
711
579
# Functions
712
580
priority_set_direct = _library.gnutls_priority_set_direct
713
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
714
582
ctypes.POINTER(ctypes.c_char_p)]
715
583
priority_set_direct.restype = _error_code
716
584
717
585
init = _library.gnutls_init
718
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
719
587
init.restype = _error_code
720
588
721
589
set_default_priority = _library.gnutls_set_default_priority
722
set_default_priority.argtypes = [ClientSession]
590
set_default_priority.argtypes = [session_t]
723
591
set_default_priority.restype = _error_code
724
592
725
593
record_send = _library.gnutls_record_send
726
record_send.argtypes = [ClientSession, ctypes.c_void_p,
594
record_send.argtypes = [session_t, ctypes.c_void_p,
727
595
ctypes.c_size_t]
728
596
record_send.restype = ctypes.c_ssize_t
729
597
record_send.errcheck = _retry_on_error
730
598
731
599
certificate_allocate_credentials = (
732
600
_library.gnutls_certificate_allocate_credentials)
733
601
certificate_allocate_credentials.argtypes = [
734
PointerTo(Credentials)]
602
ctypes.POINTER(certificate_credentials_t)]
735
603
certificate_allocate_credentials.restype = _error_code
736
604
737
605
certificate_free_credentials = (
738
606
_library.gnutls_certificate_free_credentials)
739
certificate_free_credentials.argtypes = [Credentials]
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
740
608
certificate_free_credentials.restype = None
741
609
742
610
handshake_set_private_extensions = (
743
611
_library.gnutls_handshake_set_private_extensions)
744
handshake_set_private_extensions.argtypes = [ClientSession,
612
handshake_set_private_extensions.argtypes = [session_t,
745
613
ctypes.c_int]
746
614
handshake_set_private_extensions.restype = None
747
615
748
616
credentials_set = _library.gnutls_credentials_set
749
credentials_set.argtypes = [ClientSession, credentials_type_t,
750
CastToVoidPointer(Credentials)]
617
credentials_set.argtypes = [session_t, credentials_type_t,
618
ctypes.c_void_p]
751
619
credentials_set.restype = _error_code
752
620
753
621
strerror = _library.gnutls_strerror
754
622
strerror.argtypes = [ctypes.c_int]
755
623
strerror.restype = ctypes.c_char_p
756
624
757
625
certificate_type_get = _library.gnutls_certificate_type_get
758
certificate_type_get.argtypes = [ClientSession]
626
certificate_type_get.argtypes = [session_t]
759
627
certificate_type_get.restype = _error_code
760
628
761
629
certificate_get_peers = _library.gnutls_certificate_get_peers
762
certificate_get_peers.argtypes = [ClientSession,
630
certificate_get_peers.argtypes = [session_t,
763
631
ctypes.POINTER(ctypes.c_uint)]
764
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
765
633
766
634
global_set_log_level = _library.gnutls_global_set_log_level
767
635
global_set_log_level.argtypes = [ctypes.c_int]
768
636
global_set_log_level.restype = None
769
637
770
638
global_set_log_function = _library.gnutls_global_set_log_function
771
639
global_set_log_function.argtypes = [log_func]
772
640
global_set_log_function.restype = None
773
641
774
642
deinit = _library.gnutls_deinit
775
deinit.argtypes = [ClientSession]
643
deinit.argtypes = [session_t]
776
644
deinit.restype = None
777
645
778
646
handshake = _library.gnutls_handshake
779
handshake.argtypes = [ClientSession]
780
handshake.restype = ctypes.c_int
647
handshake.argtypes = [session_t]
648
handshake.restype = _error_code
781
649
handshake.errcheck = _retry_on_error
782
650
783
651
transport_set_ptr = _library.gnutls_transport_set_ptr
784
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
785
653
transport_set_ptr.restype = None
786
654
787
655
bye = _library.gnutls_bye
788
bye.argtypes = [ClientSession, close_request_t]
789
bye.restype = ctypes.c_int
656
bye.argtypes = [session_t, close_request_t]
657
bye.restype = _error_code
790
658
bye.errcheck = _retry_on_error
791
659
792
660
check_version = _library.gnutls_check_version
793
661
check_version.argtypes = [ctypes.c_char_p]
794
662
check_version.restype = ctypes.c_char_p
795
796
_need_version = b"3.3.0"
797
if check_version(_need_version) is None:
798
raise self.Error("Needs GnuTLS {} or later"
799
.format(_need_version))
800
801
_tls_rawpk_version = b"3.6.6"
802
has_rawpk = bool(check_version(_tls_rawpk_version))
803
804
if has_rawpk:
805
# Types
806
class pubkey_st(ctypes.Structure):
807
_fields = []
808
pubkey_t = ctypes.POINTER(pubkey_st)
809
810
x509_crt_fmt_t = ctypes.c_int
811
812
# All the function declarations below are from
813
# gnutls/abstract.h
814
pubkey_init = _library.gnutls_pubkey_init
815
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
816
pubkey_init.restype = _error_code
817
818
pubkey_import = _library.gnutls_pubkey_import
819
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
820
x509_crt_fmt_t]
821
pubkey_import.restype = _error_code
822
823
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
824
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
825
ctypes.POINTER(ctypes.c_ubyte),
826
ctypes.POINTER(ctypes.c_size_t)]
827
pubkey_get_key_id.restype = _error_code
828
829
pubkey_deinit = _library.gnutls_pubkey_deinit
830
pubkey_deinit.argtypes = [pubkey_t]
831
pubkey_deinit.restype = None
832
else:
833
# All the function declarations below are from
834
# gnutls/openpgp.h
835
836
openpgp_crt_init = _library.gnutls_openpgp_crt_init
837
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
838
openpgp_crt_init.restype = _error_code
839
840
openpgp_crt_import = _library.gnutls_openpgp_crt_import
841
openpgp_crt_import.argtypes = [openpgp_crt_t,
842
ctypes.POINTER(datum_t),
843
openpgp_crt_fmt_t]
844
openpgp_crt_import.restype = _error_code
845
846
openpgp_crt_verify_self = \
847
_library.gnutls_openpgp_crt_verify_self
848
openpgp_crt_verify_self.argtypes = [
849
openpgp_crt_t,
850
ctypes.c_uint,
851
ctypes.POINTER(ctypes.c_uint),
852
]
853
openpgp_crt_verify_self.restype = _error_code
854
855
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
856
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
857
openpgp_crt_deinit.restype = None
858
859
openpgp_crt_get_fingerprint = (
860
_library.gnutls_openpgp_crt_get_fingerprint)
861
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
862
ctypes.c_void_p,
863
ctypes.POINTER(
864
ctypes.c_size_t)]
865
openpgp_crt_get_fingerprint.restype = _error_code
866
867
if check_version(b"3.6.4"):
868
certificate_type_get2 = _library.gnutls_certificate_type_get2
869
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
870
certificate_type_get2.restype = _error_code
871
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
872
693
# Remove non-public functions
873
694
del _error_code, _retry_on_error
874
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
875
697
876
698
def call_pipe(connection, # : multiprocessing.Connection
877
699
func, *args, **kwargs):
878
700
"""This function is meant to be called by multiprocessing.Process
879
701
880
702
This function runs func(*args, **kwargs), and writes the resulting
881
703
return value on the provided multiprocessing.Connection.
882
704
"""
883
705
connection.send(func(*args, **kwargs))
884
706
connection.close()
885
707
886
887
class Client:
708
class Client(object):
888
709
"""A representation of a client host served by this server.
889
710
890
711
Attributes:
891
approved: bool(); None if not yet approved/disapproved
712
approved: bool(); 'None' if not yet approved/disapproved
892
713
approval_delay: datetime.timedelta(); Time to wait for approval
893
714
approval_duration: datetime.timedelta(); Duration of one approval
894
checker: multiprocessing.Process(); a running checker process used
895
to see if the client lives. None if no process is
896
running.
897
checker_callback_tag: a GLib event source tag, or None
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a gobject event source tag, or None
898
719
checker_command: string; External command which is run to check
899
720
if client lives. %() expansions are done at
900
721
runtime with vars(self) as dict, so that for
901
722
instance %(name)s can be used in the command.
902
checker_initiator_tag: a GLib event source tag, or None
723
checker_initiator_tag: a gobject event source tag, or None
903
724
created: datetime.datetime(); (UTC) object creation
904
725
client_structure: Object describing what attributes a client has
905
726
and is used for storing the client at exit
906
727
current_checker_command: string; current running checker_command
907
disable_initiator_tag: a GLib event source tag, or None
728
disable_initiator_tag: a gobject event source tag, or None
908
729
enabled: bool()
909
730
fingerprint: string (40 or 32 hexadecimal digits); used to
910
uniquely identify an OpenPGP client
911
key_id: string (64 hexadecimal digits); used to uniquely identify
912
a client using raw public keys
731
uniquely identify the client
913
732
host: string; available for use by the checker command
914
733
interval: datetime.timedelta(); How often to start a new checker
915
734
last_approval_request: datetime.datetime(); (UTC) or None
931
750
disabled, or None
932
751
server_settings: The server_settings dict from main()
933
752
"""
934
753
935
754
runtime_expansions = ("approval_delay", "approval_duration",
936
"created", "enabled", "expires", "key_id",
755
"created", "enabled", "expires",
937
756
"fingerprint", "host", "interval",
938
757
"last_approval_request", "last_checked_ok",
939
758
"last_enabled", "name", "timeout")
948
767
"approved_by_default": "True",
949
768
"enabled": "True",
950
769
}
951
770
952
771
@staticmethod
953
772
def config_parser(config):
954
773
"""Construct a new dict of client settings of this form:
961
780
for client_name in config.sections():
962
781
section = dict(config.items(client_name))
963
782
client = settings[client_name] = {}
964
783
965
784
client["host"] = section["host"]
966
785
# Reformat values from string types to Python types
967
786
client["approved_by_default"] = config.getboolean(
968
787
client_name, "approved_by_default")
969
788
client["enabled"] = config.getboolean(client_name,
970
789
"enabled")
971
972
# Uppercase and remove spaces from key_id and fingerprint
973
# for later comparison purposes with return value from the
974
# key_id() and fingerprint() functions
975
client["key_id"] = (section.get("key_id", "").upper()
976
.replace(" ", ""))
977
client["fingerprint"] = (section.get("fingerprint",
978
"").upper()
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
794
client["fingerprint"] = (section["fingerprint"].upper()
979
795
.replace(" ", ""))
980
if not (client["key_id"] or client["fingerprint"]):
981
log.error("Skipping client %s without key_id or"
982
" fingerprint", client_name)
983
del settings[client_name]
984
continue
985
796
if "secret" in section:
986
client["secret"] = codecs.decode(section["secret"]
987
.encode("utf-8"),
988
"base64")
797
client["secret"] = section["secret"].decode("base64")
989
798
elif "secfile" in section:
990
799
with open(os.path.expanduser(os.path.expandvars
991
800
(section["secfile"])),
1006
815
client["last_approval_request"] = None
1007
816
client["last_checked_ok"] = None
1008
817
client["last_checker_status"] = -2
1009
818
1010
819
return settings
1011
1012
def __init__(self, settings, name=None, server_settings=None):
820
821
def __init__(self, settings, name = None, server_settings=None):
1013
822
self.name = name
1014
823
if server_settings is None:
1015
824
server_settings = {}
1017
826
# adding all client settings
1018
827
for setting, value in settings.items():
1019
828
setattr(self, setting, value)
1020
829
1021
830
if self.enabled:
1022
831
if not hasattr(self, "last_enabled"):
1023
832
self.last_enabled = datetime.datetime.utcnow()
1027
836
else:
1028
837
self.last_enabled = None
1029
838
self.expires = None
1030
1031
log.debug("Creating client %r", self.name)
1032
log.debug(" Key ID: %s", self.key_id)
1033
log.debug(" Fingerprint: %s", self.fingerprint)
839
840
logger.debug("Creating client %r", self.name)
841
logger.debug(" Fingerprint: %s", self.fingerprint)
1034
842
self.created = settings.get("created",
1035
843
datetime.datetime.utcnow())
1036
844
1037
845
# attributes specific for this server instance
1038
846
self.checker = None
1039
847
self.checker_initiator_tag = None
1045
853
self.changedstate = multiprocessing_manager.Condition(
1046
854
multiprocessing_manager.Lock())
1047
855
self.client_structure = [attr
1048
for attr in self.__dict__.keys()
856
for attr in self.__dict__.iterkeys()
1049
857
if not attr.startswith("_")]
1050
858
self.client_structure.append("client_structure")
1051
859
1052
860
for name, t in inspect.getmembers(
1053
861
type(self), lambda obj: isinstance(obj, property)):
1054
862
if not name.startswith("_"):
1055
863
self.client_structure.append(name)
1056
864
1057
865
# Send notice to process children that client state has changed
1058
866
def send_changedstate(self):
1059
867
with self.changedstate:
1060
868
self.changedstate.notify_all()
1061
869
1062
870
def enable(self):
1063
871
"""Start this client's checker and timeout hooks"""
1064
872
if getattr(self, "enabled", False):
1065
873
# Already enabled
1066
874
return
875
self.expires = datetime.datetime.utcnow() + self.timeout
1067
876
self.enabled = True
1068
877
self.last_enabled = datetime.datetime.utcnow()
1069
878
self.init_checker()
1070
879
self.send_changedstate()
1071
880
1072
881
def disable(self, quiet=True):
1073
882
"""Disable this client."""
1074
883
if not getattr(self, "enabled", False):
1075
884
return False
1076
885
if not quiet:
1077
log.info("Disabling client %s", self.name)
886
logger.info("Disabling client %s", self.name)
1078
887
if getattr(self, "disable_initiator_tag", None) is not None:
1079
GLib.source_remove(self.disable_initiator_tag)
888
gobject.source_remove(self.disable_initiator_tag)
1080
889
self.disable_initiator_tag = None
1081
890
self.expires = None
1082
891
if getattr(self, "checker_initiator_tag", None) is not None:
1083
GLib.source_remove(self.checker_initiator_tag)
892
gobject.source_remove(self.checker_initiator_tag)
1084
893
self.checker_initiator_tag = None
1085
894
self.stop_checker()
1086
895
self.enabled = False
1087
896
if not quiet:
1088
897
self.send_changedstate()
1089
# Do not run this again if called by a GLib.timeout_add
898
# Do not run this again if called by a gobject.timeout_add
1090
899
return False
1091
900
1092
901
def __del__(self):
1093
902
self.disable()
1094
1095
def init_checker(self, randomize_start=False):
1096
# Schedule a new checker to be started a randomly selected
1097
# time (a fraction of 'interval') from now. This spreads out
1098
# the startup of checkers over time when the server is
1099
# started.
903
904
def init_checker(self):
905
# Schedule a new checker to be started an 'interval' from now,
906
# and every interval from then on.
1100
907
if self.checker_initiator_tag is not None:
1101
GLib.source_remove(self.checker_initiator_tag)
1102
interval_milliseconds = int(self.interval.total_seconds()
1103
* 1000)
1104
if randomize_start:
1105
delay_milliseconds = random.randrange(
1106
interval_milliseconds + 1)
1107
else:
1108
delay_milliseconds = interval_milliseconds
1109
self.checker_initiator_tag = GLib.timeout_add(
1110
delay_milliseconds, self.start_checker, randomize_start)
1111
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1112
# A checker might take up to an 'interval' of time, so we can
1113
# expire at the soonest one interval after a checker was
1114
# started. Since the initial checker is delayed, the expire
1115
# time might have to be extended.
1116
now = datetime.datetime.utcnow()
1117
self.expires = now + delay + self.interval
1118
# Schedule a disable() at expire time
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
910
int(self.interval.total_seconds() * 1000),
911
self.start_checker)
912
# Schedule a disable() when 'timeout' has passed
1119
913
if self.disable_initiator_tag is not None:
1120
GLib.source_remove(self.disable_initiator_tag)
1121
self.disable_initiator_tag = GLib.timeout_add(
1122
int((self.expires - now).total_seconds() * 1000),
1123
self.disable)
1124
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
916
int(self.timeout.total_seconds() * 1000), self.disable)
917
# Also start a new checker *right now*.
918
self.start_checker()
919
1125
920
def checker_callback(self, source, condition, connection,
1126
921
command):
1127
922
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
924
self.checker = None
1128
925
# Read return code from connection (see call_pipe)
1129
926
returncode = connection.recv()
1130
927
connection.close()
1131
if self.checker is not None:
1132
self.checker.join()
1133
self.checker_callback_tag = None
1134
self.checker = None
1135
928
1136
929
if returncode >= 0:
1137
930
self.last_checker_status = returncode
1138
931
self.last_checker_signal = None
1139
932
if self.last_checker_status == 0:
1140
log.info("Checker for %(name)s succeeded", vars(self))
933
logger.info("Checker for %(name)s succeeded",
934
vars(self))
1141
935
self.checked_ok()
1142
936
else:
1143
log.info("Checker for %(name)s failed", vars(self))
937
logger.info("Checker for %(name)s failed", vars(self))
1144
938
else:
1145
939
self.last_checker_status = -1
1146
940
self.last_checker_signal = -returncode
1147
log.warning("Checker for %(name)s crashed?", vars(self))
941
logger.warning("Checker for %(name)s crashed?",
942
vars(self))
1148
943
return False
1149
944
1150
945
def checked_ok(self):
1151
946
"""Assert that the client has been seen, alive and well."""
1152
947
self.last_checked_ok = datetime.datetime.utcnow()
1153
948
self.last_checker_status = 0
1154
949
self.last_checker_signal = None
1155
950
self.bump_timeout()
1156
951
1157
952
def bump_timeout(self, timeout=None):
1158
953
"""Bump up the timeout for this client."""
1159
954
if timeout is None:
1160
955
timeout = self.timeout
1161
956
if self.disable_initiator_tag is not None:
1162
GLib.source_remove(self.disable_initiator_tag)
957
gobject.source_remove(self.disable_initiator_tag)
1163
958
self.disable_initiator_tag = None
1164
959
if getattr(self, "enabled", False):
1165
self.disable_initiator_tag = GLib.timeout_add(
960
self.disable_initiator_tag = gobject.timeout_add(
1166
961
int(timeout.total_seconds() * 1000), self.disable)
1167
962
self.expires = datetime.datetime.utcnow() + timeout
1168
963
1169
964
def need_approval(self):
1170
965
self.last_approval_request = datetime.datetime.utcnow()
1171
1172
def start_checker(self, start_was_randomized=False):
966
967
def start_checker(self):
1173
968
"""Start a new checker subprocess if one is not running.
1174
969
1175
970
If a checker already exists, leave it running and do
1176
971
nothing."""
1177
972
# The reason for not killing a running checker is that if we
1182
977
# checkers alone, the checker would have to take more time
1183
978
# than 'timeout' for the client to be disabled, which is as it
1184
979
# should be.
1185
980
1186
981
if self.checker is not None and not self.checker.is_alive():
1187
log.warning("Checker was not alive; joining")
982
logger.warning("Checker was not alive; joining")
1188
983
self.checker.join()
1189
984
self.checker = None
1190
985
# Start a new checker if needed
1191
986
if self.checker is None:
1192
987
# Escape attributes for the shell
1193
988
escaped_attrs = {
1194
attr: shlex.quote(str(getattr(self, attr)))
1195
for attr in self.runtime_expansions}
989
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
1196
991
try:
1197
992
command = self.checker_command % escaped_attrs
1198
993
except TypeError as error:
1199
log.error('Could not format string "%s"',
1200
self.checker_command, exc_info=error)
994
logger.error('Could not format string "%s"',
995
self.checker_command,
996
exc_info=error)
1201
997
return True # Try again later
1202
998
self.current_checker_command = command
1203
log.info("Starting checker %r for %s", command, self.name)
999
logger.info("Starting checker %r for %s", command,
1000
self.name)
1204
1001
# We don't need to redirect stdout and stderr, since
1205
1002
# in normal mode, that is already done by daemon(),
1206
1003
# and in debug mode we don't want to. (Stdin is
1208
1005
# The exception is when not debugging but nevertheless
1209
1006
# running in the foreground; use the previously
1210
1007
# created wnull.
1211
popen_args = {"close_fds": True,
1212
"shell": True,
1213
"cwd": "/"}
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1214
1011
if (not self.server_settings["debug"]
1215
1012
and self.server_settings["foreground"]):
1216
1013
popen_args.update({"stdout": wnull,
1217
"stderr": wnull})
1218
pipe = multiprocessing.Pipe(duplex=False)
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1219
1016
self.checker = multiprocessing.Process(
1220
target=call_pipe,
1221
args=(pipe[1], subprocess.call, command),
1222
kwargs=popen_args)
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1223
1020
self.checker.start()
1224
self.checker_callback_tag = GLib.io_add_watch(
1225
GLib.IOChannel.unix_new(pipe[0].fileno()),
1226
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1227
1023
self.checker_callback, pipe[0], command)
1228
if start_was_randomized:
1229
# We were started after a random delay; Schedule a new
1230
# checker to be started an 'interval' from now, and every
1231
# interval from then on.
1232
now = datetime.datetime.utcnow()
1233
self.checker_initiator_tag = GLib.timeout_add(
1234
int(self.interval.total_seconds() * 1000),
1235
self.start_checker)
1236
self.expires = max(self.expires, now + self.interval)
1237
# Don't start a new checker again after same random delay
1238
return False
1239
# Re-run this periodically if run by GLib.timeout_add
1024
# Re-run this periodically if run by gobject.timeout_add
1240
1025
return True
1241
1026
1242
1027
def stop_checker(self):
1243
1028
"""Force the checker process, if any, to stop."""
1244
1029
if self.checker_callback_tag:
1245
GLib.source_remove(self.checker_callback_tag)
1030
gobject.source_remove(self.checker_callback_tag)
1246
1031
self.checker_callback_tag = None
1247
1032
if getattr(self, "checker", None) is None:
1248
1033
return
1249
log.debug("Stopping checker for %(name)s", vars(self))
1034
logger.debug("Stopping checker for %(name)s", vars(self))
1250
1035
self.checker.terminate()
1251
1036
self.checker = None
1252
1037
1257
1042
byte_arrays=False):
1258
1043
"""Decorators for marking methods of a DBusObjectWithProperties to
1259
1044
become properties on the D-Bus.
1260
1045
1261
1046
The decorated method will be called with no arguments by "Get"
1262
1047
and with one argument by "Set".
1263
1048
1264
1049
The parameters, where they are supported, are the same as
1265
1050
dbus.service.method, except there is only "signature", since the
1266
1051
type from Get() and the type sent to Set() is the same.
1270
1055
if byte_arrays and signature != "ay":
1271
1056
raise ValueError("Byte arrays not supported for non-'ay'"
1272
1057
" signature {!r}".format(signature))
1273
1058
1274
1059
def decorator(func):
1275
1060
func._dbus_is_property = True
1276
1061
func._dbus_interface = dbus_interface
1279
1064
func._dbus_name = func.__name__
1280
1065
if func._dbus_name.endswith("_dbus_property"):
1281
1066
func._dbus_name = func._dbus_name[:-14]
1282
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1283
1068
return func
1284
1069
1285
1070
return decorator
1286
1071
1287
1072
1288
1073
def dbus_interface_annotations(dbus_interface):
1289
1074
"""Decorator for marking functions returning interface annotations
1290
1075
1291
1076
Usage:
1292
1077
1293
1078
@dbus_interface_annotations("org.example.Interface")
1294
1079
def _foo(self): # Function name does not matter
1295
1080
return {"org.freedesktop.DBus.Deprecated": "true",
1296
1081
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1297
1082
"false"}
1298
1083
"""
1299
1084
1300
1085
def decorator(func):
1301
1086
func._dbus_is_interface = True
1302
1087
func._dbus_interface = dbus_interface
1303
1088
func._dbus_name = dbus_interface
1304
1089
return func
1305
1090
1306
1091
return decorator
1307
1092
1308
1093
1309
1094
def dbus_annotations(annotations):
1310
1095
"""Decorator to annotate D-Bus methods, signals or properties
1311
1096
Usage:
1312
1097
1313
1098
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1314
1099
"org.freedesktop.DBus.Property."
1315
1100
"EmitsChangedSignal": "false"})
1317
1102
access="r")
1318
1103
def Property_dbus_property(self):
1319
1104
return dbus.Boolean(False)
1320
1105
1321
1106
See also the DBusObjectWithAnnotations class.
1322
1107
"""
1323
1108
1324
1109
def decorator(func):
1325
1110
func._dbus_annotations = annotations
1326
1111
return func
1327
1112
1328
1113
return decorator
1329
1114
1330
1115
1348
1133
1349
1134
class DBusObjectWithAnnotations(dbus.service.Object):
1350
1135
"""A D-Bus object with annotations.
1351
1136
1352
1137
Classes inheriting from this can use the dbus_annotations
1353
1138
decorator to add annotations to methods or signals.
1354
1139
"""
1355
1140
1356
1141
@staticmethod
1357
1142
def _is_dbus_thing(thing):
1358
1143
"""Returns a function testing if an attribute is a D-Bus thing
1359
1144
1360
1145
If called like _is_dbus_thing("method") it returns a function
1361
1146
suitable for use as predicate to inspect.getmembers().
1362
1147
"""
1363
1148
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1364
1149
False)
1365
1150
1366
1151
def _get_all_dbus_things(self, thing):
1367
1152
"""Returns a generator of (name, attribute) pairs
1368
1153
"""
1371
1156
for cls in self.__class__.__mro__
1372
1157
for name, athing in
1373
1158
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1374
1159
1375
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1376
out_signature="s",
1377
path_keyword="object_path",
1378
connection_keyword="connection")
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1379
1164
def Introspect(self, object_path, connection):
1380
1165
"""Overloading of standard D-Bus method.
1381
1166
1382
1167
Inserts annotation tags on methods and signals.
1383
1168
"""
1384
1169
xmlstring = dbus.service.Object.Introspect(self, object_path,
1385
1170
connection)
1386
1171
try:
1387
1172
document = xml.dom.minidom.parseString(xmlstring)
1388
1173
1389
1174
for if_tag in document.getElementsByTagName("interface"):
1390
1175
# Add annotation tags
1391
1176
for typ in ("method", "signal"):
1418
1203
if_tag.appendChild(ann_tag)
1419
1204
# Fix argument name for the Introspect method itself
1420
1205
if (if_tag.getAttribute("name")
1421
== dbus.INTROSPECTABLE_IFACE):
1206
== dbus.INTROSPECTABLE_IFACE):
1422
1207
for cn in if_tag.getElementsByTagName("method"):
1423
1208
if cn.getAttribute("name") == "Introspect":
1424
1209
for arg in cn.getElementsByTagName("arg"):
1430
1215
document.unlink()
1431
1216
except (AttributeError, xml.dom.DOMException,
1432
1217
xml.parsers.expat.ExpatError) as error:
1433
log.error("Failed to override Introspection method",
1434
exc_info=error)
1218
logger.error("Failed to override Introspection method",
1219
exc_info=error)
1435
1220
return xmlstring
1436
1221
1437
1222
1438
1223
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1439
1224
"""A D-Bus object with properties.
1440
1225
1441
1226
Classes inheriting from this can use the dbus_service_property
1442
1227
decorator to expose methods as D-Bus properties. It exposes the
1443
1228
standard Get(), Set(), and GetAll() methods on the D-Bus.
1444
1229
"""
1445
1230
1446
1231
def _get_dbus_property(self, interface_name, property_name):
1447
1232
"""Returns a bound method if one exists which is a D-Bus
1448
1233
property with the specified name and interface.
1453
1238
if (value._dbus_name == property_name
1454
1239
and value._dbus_interface == interface_name):
1455
1240
return value.__get__(self)
1456
1241
1457
1242
# No such property
1458
1243
raise DBusPropertyNotFound("{}:{}.{}".format(
1459
1244
self.dbus_object_path, interface_name, property_name))
1460
1245
1461
1246
@classmethod
1462
1247
def _get_all_interface_names(cls):
1463
1248
"""Get a sequence of all interfaces supported by an object"""
1466
1251
for x in (inspect.getmro(cls))
1467
1252
for attr in dir(x))
1468
1253
if name is not None)
1469
1254
1470
1255
@dbus.service.method(dbus.PROPERTIES_IFACE,
1471
1256
in_signature="ss",
1472
1257
out_signature="v")
1480
1265
if not hasattr(value, "variant_level"):
1481
1266
return value
1482
1267
return type(value)(value, variant_level=value.variant_level+1)
1483
1268
1484
1269
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1485
1270
def Set(self, interface_name, property_name, value):
1486
1271
"""Standard D-Bus property Set() method, see D-Bus standard.
1495
1280
raise ValueError("Byte arrays not supported for non-"
1496
1281
"'ay' signature {!r}"
1497
1282
.format(prop._dbus_signature))
1498
value = dbus.ByteArray(bytes(value))
1283
value = dbus.ByteArray(b''.join(chr(byte)
1284
for byte in value))
1499
1285
prop(value)
1500
1286
1501
1287
@dbus.service.method(dbus.PROPERTIES_IFACE,
1502
1288
in_signature="s",
1503
1289
out_signature="a{sv}")
1504
1290
def GetAll(self, interface_name):
1505
1291
"""Standard D-Bus property GetAll() method, see D-Bus
1506
1292
standard.
1507
1293
1508
1294
Note: Will not include properties with access="write".
1509
1295
"""
1510
1296
properties = {}
1521
1307
properties[name] = value
1522
1308
continue
1523
1309
properties[name] = type(value)(
1524
value, variant_level=value.variant_level + 1)
1310
value, variant_level = value.variant_level + 1)
1525
1311
return dbus.Dictionary(properties, signature="sv")
1526
1312
1527
1313
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1528
1314
def PropertiesChanged(self, interface_name, changed_properties,
1529
1315
invalidated_properties):
1531
1317
standard.
1532
1318
"""
1533
1319
pass
1534
1320
1535
1321
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1536
1322
out_signature="s",
1537
path_keyword="object_path",
1538
connection_keyword="connection")
1323
path_keyword='object_path',
1324
connection_keyword='connection')
1539
1325
def Introspect(self, object_path, connection):
1540
1326
"""Overloading of standard D-Bus method.
1541
1327
1542
1328
Inserts property tags and interface annotation tags.
1543
1329
"""
1544
1330
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1546
1332
connection)
1547
1333
try:
1548
1334
document = xml.dom.minidom.parseString(xmlstring)
1549
1335
1550
1336
def make_tag(document, name, prop):
1551
1337
e = document.createElement("property")
1552
1338
e.setAttribute("name", name)
1553
1339
e.setAttribute("type", prop._dbus_signature)
1554
1340
e.setAttribute("access", prop._dbus_access)
1555
1341
return e
1556
1342
1557
1343
for if_tag in document.getElementsByTagName("interface"):
1558
1344
# Add property tags
1559
1345
for tag in (make_tag(document, name, prop)
1597
1383
document.unlink()
1598
1384
except (AttributeError, xml.dom.DOMException,
1599
1385
xml.parsers.expat.ExpatError) as error:
1600
log.error("Failed to override Introspection method",
1601
exc_info=error)
1386
logger.error("Failed to override Introspection method",
1387
exc_info=error)
1602
1388
return xmlstring
1603
1389
1604
1605
1390
try:
1606
1391
dbus.OBJECT_MANAGER_IFACE
1607
1392
except AttributeError:
1608
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1609
1394
1610
1611
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1612
1396
"""A D-Bus object with an ObjectManager.
1613
1397
1614
1398
Classes inheriting from this exposes the standard
1615
1399
GetManagedObjects call and the InterfacesAdded and
1616
1400
InterfacesRemoved signals on the standard
1617
1401
"org.freedesktop.DBus.ObjectManager" interface.
1618
1402
1619
1403
Note: No signals are sent automatically; they must be sent
1620
1404
manually.
1621
1405
"""
1622
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1623
out_signature="a{oa{sa{sv}}}")
1407
out_signature = "a{oa{sa{sv}}}")
1624
1408
def GetManagedObjects(self):
1625
1409
"""This function must be overridden"""
1626
1410
raise NotImplementedError()
1627
1411
1628
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1629
signature="oa{sa{sv}}")
1413
signature = "oa{sa{sv}}")
1630
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1631
1415
pass
1632
1633
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1634
1418
def InterfacesRemoved(self, object_path, interfaces):
1635
1419
pass
1636
1420
1637
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1638
out_signature="s",
1639
path_keyword="object_path",
1640
connection_keyword="connection")
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1641
1425
def Introspect(self, object_path, connection):
1642
1426
"""Overloading of standard D-Bus method.
1643
1427
1644
1428
Override return argument name of GetManagedObjects to be
1645
1429
"objpath_interfaces_and_properties"
1646
1430
"""
1649
1433
connection)
1650
1434
try:
1651
1435
document = xml.dom.minidom.parseString(xmlstring)
1652
1436
1653
1437
for if_tag in document.getElementsByTagName("interface"):
1654
1438
# Fix argument name for the GetManagedObjects method
1655
1439
if (if_tag.getAttribute("name")
1656
== dbus.OBJECT_MANAGER_IFACE):
1440
== dbus.OBJECT_MANAGER_IFACE):
1657
1441
for cn in if_tag.getElementsByTagName("method"):
1658
1442
if (cn.getAttribute("name")
1659
1443
== "GetManagedObjects"):
1668
1452
document.unlink()
1669
1453
except (AttributeError, xml.dom.DOMException,
1670
1454
xml.parsers.expat.ExpatError) as error:
1671
log.error("Failed to override Introspection method",
1672
exc_info=error)
1455
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1673
1457
return xmlstring
1674
1458
1675
1676
1459
def datetime_to_dbus(dt, variant_level=0):
1677
1460
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1678
1461
if dt is None:
1679
return dbus.String("", variant_level=variant_level)
1462
return dbus.String("", variant_level = variant_level)
1680
1463
return dbus.String(dt.isoformat(), variant_level=variant_level)
1681
1464
1682
1465
1685
1468
dbus.service.Object, it will add alternate D-Bus attributes with
1686
1469
interface names according to the "alt_interface_names" mapping.
1687
1470
Usage:
1688
1471
1689
1472
@alternate_dbus_interfaces({"org.example.Interface":
1690
1473
"net.example.AlternateInterface"})
1691
1474
class SampleDBusObject(dbus.service.Object):
1692
1475
@dbus.service.method("org.example.Interface")
1693
1476
def SampleDBusMethod():
1694
1477
pass
1695
1478
1696
1479
The above "SampleDBusMethod" on "SampleDBusObject" will be
1697
1480
reachable via two interfaces: "org.example.Interface" and
1698
1481
"net.example.AlternateInterface", the latter of which will have
1699
1482
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1700
1483
"true", unless "deprecate" is passed with a False value.
1701
1484
1702
1485
This works for methods and signals, and also for D-Bus properties
1703
1486
(from DBusObjectWithProperties) and interfaces (from the
1704
1487
dbus_interface_annotations decorator).
1705
1488
"""
1706
1489
1707
1490
def wrapper(cls):
1708
1491
for orig_interface_name, alt_interface_name in (
1709
1492
alt_interface_names.items()):
1724
1507
interface_names.add(alt_interface)
1725
1508
# Is this a D-Bus signal?
1726
1509
if getattr(attribute, "_dbus_is_signal", False):
1727
# Extract the original non-method undecorated
1728
# function by black magic
1729
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1730
1513
nonmethod_func = (dict(
1731
1514
zip(attribute.func_code.co_freevars,
1732
1515
attribute.__closure__))
1733
1516
["func"].cell_contents)
1734
1517
else:
1735
nonmethod_func = (dict(
1736
zip(attribute.__code__.co_freevars,
1737
attribute.__closure__))
1738
["func"].cell_contents)
1518
nonmethod_func = attribute
1739
1519
# Create a new, but exactly alike, function
1740
1520
# object, and decorate it to be a new D-Bus signal
1741
1521
# with the alternate D-Bus interface name
1742
new_function = copy_function(nonmethod_func)
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1743
1536
new_function = (dbus.service.signal(
1744
1537
alt_interface,
1745
1538
attribute._dbus_signature)(new_function))
1749
1542
attribute._dbus_annotations)
1750
1543
except AttributeError:
1751
1544
pass
1752
1753
1545
# Define a creator of a function to call both the
1754
1546
# original and alternate functions, so both the
1755
1547
# original and alternate signals gets sent when
1758
1550
"""This function is a scope container to pass
1759
1551
func1 and func2 to the "call_both" function
1760
1552
outside of its arguments"""
1761
1553
1762
1554
@functools.wraps(func2)
1763
1555
def call_both(*args, **kwargs):
1764
1556
"""This function will emit two D-Bus
1765
1557
signals by calling func1 and func2"""
1766
1558
func1(*args, **kwargs)
1767
1559
func2(*args, **kwargs)
1768
# Make wrapper function look like a D-Bus
1769
# signal
1560
# Make wrapper function look like a D-Bus signal
1770
1561
for name, attr in inspect.getmembers(func2):
1771
1562
if name.startswith("_dbus_"):
1772
1563
setattr(call_both, name, attr)
1773
1564
1774
1565
return call_both
1775
1566
# Create the "call_both" function and add it to
1776
1567
# the class
1786
1577
alt_interface,
1787
1578
attribute._dbus_in_signature,
1788
1579
attribute._dbus_out_signature)
1789
(copy_function(attribute)))
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1790
1585
# Copy annotations, if any
1791
1586
try:
1792
1587
attr[attrname]._dbus_annotations = dict(
1804
1599
attribute._dbus_access,
1805
1600
attribute._dbus_get_args_options
1806
1601
["byte_arrays"])
1807
(copy_function(attribute)))
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1808
1608
# Copy annotations, if any
1809
1609
try:
1810
1610
attr[attrname]._dbus_annotations = dict(
1819
1619
# to the class.
1820
1620
attr[attrname] = (
1821
1621
dbus_interface_annotations(alt_interface)
1822
(copy_function(attribute)))
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1823
1627
if deprecate:
1824
1628
# Deprecate all alternate interfaces
1825
iname = "_AlternateDBusNames_interface_annotation{}"
1629
iname="_AlternateDBusNames_interface_annotation{}"
1826
1630
for interface_name in interface_names:
1827
1631
1828
1632
@dbus_interface_annotations(interface_name)
1829
1633
def func(self):
1830
return {"org.freedesktop.DBus.Deprecated":
1831
"true"}
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1832
1636
# Find an unused name
1833
1637
for aname in (iname.format(i)
1834
1638
for i in itertools.count()):
1838
1642
if interface_names:
1839
1643
# Replace the class with a new subclass of it with
1840
1644
# methods, signals, etc. as created above.
1841
if sys.version_info.major == 2:
1842
cls = type(b"{}Alternate".format(cls.__name__),
1843
(cls, ), attr)
1844
else:
1845
cls = type("{}Alternate".format(cls.__name__),
1846
(cls, ), attr)
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1847
1647
return cls
1848
1648
1849
1649
return wrapper
1850
1650
1851
1651
1853
1653
"se.bsnet.fukt.Mandos"})
1854
1654
class ClientDBus(Client, DBusObjectWithProperties):
1855
1655
"""A Client class using D-Bus
1856
1656
1857
1657
Attributes:
1858
1658
dbus_object_path: dbus.ObjectPath
1859
1659
bus: dbus.SystemBus()
1860
1660
"""
1861
1661
1862
1662
runtime_expansions = (Client.runtime_expansions
1863
1663
+ ("dbus_object_path", ))
1864
1664
1865
1665
_interface = "se.recompile.Mandos.Client"
1866
1666
1867
1667
# dbus.service.Object doesn't use super(), so we can't either.
1868
1869
def __init__(self, bus=None, *args, **kwargs):
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1870
1670
self.bus = bus
1871
1671
Client.__init__(self, *args, **kwargs)
1872
1672
# Only now, when this client is initialized, can it show up on
1878
1678
"/clients/" + client_object_name)
1879
1679
DBusObjectWithProperties.__init__(self, self.bus,
1880
1680
self.dbus_object_path)
1881
1681
1882
1682
def notifychangeproperty(transform_func, dbus_name,
1883
1683
type_func=lambda x: x,
1884
1684
variant_level=1,
1886
1686
_interface=_interface):
1887
1687
""" Modify a variable so that it's a property which announces
1888
1688
its changes to DBus.
1889
1689
1890
1690
transform_fun: Function that takes a value and a variant_level
1891
1691
and transforms it to a D-Bus type.
1892
1692
dbus_name: D-Bus name of the variable
1895
1695
variant_level: D-Bus variant level. Default: 1
1896
1696
"""
1897
1697
attrname = "_{}".format(dbus_name)
1898
1698
1899
1699
def setter(self, value):
1900
1700
if hasattr(self, "dbus_object_path"):
1901
1701
if (not hasattr(self, attrname) or
1908
1708
else:
1909
1709
dbus_value = transform_func(
1910
1710
type_func(value),
1911
variant_level=variant_level)
1711
variant_level = variant_level)
1912
1712
self.PropertyChanged(dbus.String(dbus_name),
1913
1713
dbus_value)
1914
1714
self.PropertiesChanged(
1915
1715
_interface,
1916
dbus.Dictionary({dbus.String(dbus_name):
1917
dbus_value}),
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1918
1718
dbus.Array())
1919
1719
setattr(self, attrname, value)
1920
1720
1921
1721
return property(lambda self: getattr(self, attrname), setter)
1922
1722
1923
1723
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1924
1724
approvals_pending = notifychangeproperty(dbus.Boolean,
1925
1725
"ApprovalPending",
1926
type_func=bool)
1726
type_func = bool)
1927
1727
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1928
1728
last_enabled = notifychangeproperty(datetime_to_dbus,
1929
1729
"LastEnabled")
1930
1730
checker = notifychangeproperty(
1931
1731
dbus.Boolean, "CheckerRunning",
1932
type_func=lambda checker: checker is not None)
1732
type_func = lambda checker: checker is not None)
1933
1733
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1934
1734
"LastCheckedOK")
1935
1735
last_checker_status = notifychangeproperty(dbus.Int16,
1940
1740
"ApprovedByDefault")
1941
1741
approval_delay = notifychangeproperty(
1942
1742
dbus.UInt64, "ApprovalDelay",
1943
type_func=lambda td: td.total_seconds() * 1000)
1743
type_func = lambda td: td.total_seconds() * 1000)
1944
1744
approval_duration = notifychangeproperty(
1945
1745
dbus.UInt64, "ApprovalDuration",
1946
type_func=lambda td: td.total_seconds() * 1000)
1746
type_func = lambda td: td.total_seconds() * 1000)
1947
1747
host = notifychangeproperty(dbus.String, "Host")
1948
1748
timeout = notifychangeproperty(
1949
1749
dbus.UInt64, "Timeout",
1950
type_func=lambda td: td.total_seconds() * 1000)
1750
type_func = lambda td: td.total_seconds() * 1000)
1951
1751
extended_timeout = notifychangeproperty(
1952
1752
dbus.UInt64, "ExtendedTimeout",
1953
type_func=lambda td: td.total_seconds() * 1000)
1753
type_func = lambda td: td.total_seconds() * 1000)
1954
1754
interval = notifychangeproperty(
1955
1755
dbus.UInt64, "Interval",
1956
type_func=lambda td: td.total_seconds() * 1000)
1756
type_func = lambda td: td.total_seconds() * 1000)
1957
1757
checker_command = notifychangeproperty(dbus.String, "Checker")
1958
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1959
1759
invalidate_only=True)
1960
1760
1961
1761
del notifychangeproperty
1962
1762
1963
1763
def __del__(self, *args, **kwargs):
1964
1764
try:
1965
1765
self.remove_from_connection()
1968
1768
if hasattr(DBusObjectWithProperties, "__del__"):
1969
1769
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1970
1770
Client.__del__(self, *args, **kwargs)
1971
1771
1972
1772
def checker_callback(self, source, condition,
1973
1773
connection, command, *args, **kwargs):
1974
1774
ret = Client.checker_callback(self, source, condition,
1990
1790
| self.last_checker_signal),
1991
1791
dbus.String(command))
1992
1792
return ret
1993
1793
1994
1794
def start_checker(self, *args, **kwargs):
1995
1795
old_checker_pid = getattr(self.checker, "pid", None)
1996
1796
r = Client.start_checker(self, *args, **kwargs)
2000
1800
# Emit D-Bus signal
2001
1801
self.CheckerStarted(self.current_checker_command)
2002
1802
return r
2003
1803
2004
1804
def _reset_approved(self):
2005
1805
self.approved = None
2006
1806
return False
2007
1807
2008
1808
def approve(self, value=True):
2009
1809
self.approved = value
2010
GLib.timeout_add(int(self.approval_duration.total_seconds()
2011
* 1000), self._reset_approved)
1810
gobject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
2012
1812
self.send_changedstate()
2013
2014
# D-Bus methods, signals & properties
2015
2016
# Interfaces
2017
2018
# Signals
2019
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
2020
1820
# CheckerCompleted - signal
2021
1821
@dbus.service.signal(_interface, signature="nxs")
2022
1822
def CheckerCompleted(self, exitcode, waitstatus, command):
2023
1823
"D-Bus signal"
2024
1824
pass
2025
1825
2026
1826
# CheckerStarted - signal
2027
1827
@dbus.service.signal(_interface, signature="s")
2028
1828
def CheckerStarted(self, command):
2029
1829
"D-Bus signal"
2030
1830
pass
2031
1831
2032
1832
# PropertyChanged - signal
2033
1833
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2034
1834
@dbus.service.signal(_interface, signature="sv")
2035
1835
def PropertyChanged(self, property, value):
2036
1836
"D-Bus signal"
2037
1837
pass
2038
1838
2039
1839
# GotSecret - signal
2040
1840
@dbus.service.signal(_interface)
2041
1841
def GotSecret(self):
2044
1844
server to mandos-client
2045
1845
"""
2046
1846
pass
2047
1847
2048
1848
# Rejected - signal
2049
1849
@dbus.service.signal(_interface, signature="s")
2050
1850
def Rejected(self, reason):
2051
1851
"D-Bus signal"
2052
1852
pass
2053
1853
2054
1854
# NeedApproval - signal
2055
1855
@dbus.service.signal(_interface, signature="tb")
2056
1856
def NeedApproval(self, timeout, default):
2057
1857
"D-Bus signal"
2058
1858
return self.need_approval()
2059
2060
# Methods
2061
1859
1860
## Methods
1861
2062
1862
# Approve - method
2063
1863
@dbus.service.method(_interface, in_signature="b")
2064
1864
def Approve(self, value):
2065
1865
self.approve(value)
2066
1866
2067
1867
# CheckedOK - method
2068
1868
@dbus.service.method(_interface)
2069
1869
def CheckedOK(self):
2070
1870
self.checked_ok()
2071
1871
2072
1872
# Enable - method
2073
1873
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2074
1874
@dbus.service.method(_interface)
2075
1875
def Enable(self):
2076
1876
"D-Bus method"
2077
1877
self.enable()
2078
1878
2079
1879
# StartChecker - method
2080
1880
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2081
1881
@dbus.service.method(_interface)
2082
1882
def StartChecker(self):
2083
1883
"D-Bus method"
2084
1884
self.start_checker()
2085
1885
2086
1886
# Disable - method
2087
1887
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2088
1888
@dbus.service.method(_interface)
2089
1889
def Disable(self):
2090
1890
"D-Bus method"
2091
1891
self.disable()
2092
1892
2093
1893
# StopChecker - method
2094
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2095
1895
@dbus.service.method(_interface)
2096
1896
def StopChecker(self):
2097
1897
self.stop_checker()
2098
2099
# Properties
2100
1898
1899
## Properties
1900
2101
1901
# ApprovalPending - property
2102
1902
@dbus_service_property(_interface, signature="b", access="read")
2103
1903
def ApprovalPending_dbus_property(self):
2104
1904
return dbus.Boolean(bool(self.approvals_pending))
2105
1905
2106
1906
# ApprovedByDefault - property
2107
1907
@dbus_service_property(_interface,
2108
1908
signature="b",
2111
1911
if value is None: # get
2112
1912
return dbus.Boolean(self.approved_by_default)
2113
1913
self.approved_by_default = bool(value)
2114
1914
2115
1915
# ApprovalDelay - property
2116
1916
@dbus_service_property(_interface,
2117
1917
signature="t",
2121
1921
return dbus.UInt64(self.approval_delay.total_seconds()
2122
1922
* 1000)
2123
1923
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2124
1924
2125
1925
# ApprovalDuration - property
2126
1926
@dbus_service_property(_interface,
2127
1927
signature="t",
2131
1931
return dbus.UInt64(self.approval_duration.total_seconds()
2132
1932
* 1000)
2133
1933
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2134
1934
2135
1935
# Name - property
2136
1936
@dbus_annotations(
2137
1937
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2138
1938
@dbus_service_property(_interface, signature="s", access="read")
2139
1939
def Name_dbus_property(self):
2140
1940
return dbus.String(self.name)
2141
2142
# KeyID - property
2143
@dbus_annotations(
2144
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2145
@dbus_service_property(_interface, signature="s", access="read")
2146
def KeyID_dbus_property(self):
2147
return dbus.String(self.key_id)
2148
1941
2149
1942
# Fingerprint - property
2150
1943
@dbus_annotations(
2151
1944
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2152
1945
@dbus_service_property(_interface, signature="s", access="read")
2153
1946
def Fingerprint_dbus_property(self):
2154
1947
return dbus.String(self.fingerprint)
2155
1948
2156
1949
# Host - property
2157
1950
@dbus_service_property(_interface,
2158
1951
signature="s",
2161
1954
if value is None: # get
2162
1955
return dbus.String(self.host)
2163
1956
self.host = str(value)
2164
1957
2165
1958
# Created - property
2166
1959
@dbus_annotations(
2167
1960
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2168
1961
@dbus_service_property(_interface, signature="s", access="read")
2169
1962
def Created_dbus_property(self):
2170
1963
return datetime_to_dbus(self.created)
2171
1964
2172
1965
# LastEnabled - property
2173
1966
@dbus_service_property(_interface, signature="s", access="read")
2174
1967
def LastEnabled_dbus_property(self):
2175
1968
return datetime_to_dbus(self.last_enabled)
2176
1969
2177
1970
# Enabled - property
2178
1971
@dbus_service_property(_interface,
2179
1972
signature="b",
2185
1978
self.enable()
2186
1979
else:
2187
1980
self.disable()
2188
1981
2189
1982
# LastCheckedOK - property
2190
1983
@dbus_service_property(_interface,
2191
1984
signature="s",
2195
1988
self.checked_ok()
2196
1989
return
2197
1990
return datetime_to_dbus(self.last_checked_ok)
2198
1991
2199
1992
# LastCheckerStatus - property
2200
1993
@dbus_service_property(_interface, signature="n", access="read")
2201
1994
def LastCheckerStatus_dbus_property(self):
2202
1995
return dbus.Int16(self.last_checker_status)
2203
1996
2204
1997
# Expires - property
2205
1998
@dbus_service_property(_interface, signature="s", access="read")
2206
1999
def Expires_dbus_property(self):
2207
2000
return datetime_to_dbus(self.expires)
2208
2001
2209
2002
# LastApprovalRequest - property
2210
2003
@dbus_service_property(_interface, signature="s", access="read")
2211
2004
def LastApprovalRequest_dbus_property(self):
2212
2005
return datetime_to_dbus(self.last_approval_request)
2213
2006
2214
2007
# Timeout - property
2215
2008
@dbus_service_property(_interface,
2216
2009
signature="t",
2231
2024
if (getattr(self, "disable_initiator_tag", None)
2232
2025
is None):
2233
2026
return
2234
GLib.source_remove(self.disable_initiator_tag)
2235
self.disable_initiator_tag = GLib.timeout_add(
2027
gobject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = gobject.timeout_add(
2236
2029
int((self.expires - now).total_seconds() * 1000),
2237
2030
self.disable)
2238
2031
2239
2032
# ExtendedTimeout - property
2240
2033
@dbus_service_property(_interface,
2241
2034
signature="t",
2245
2038
return dbus.UInt64(self.extended_timeout.total_seconds()
2246
2039
* 1000)
2247
2040
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2248
2041
2249
2042
# Interval - property
2250
2043
@dbus_service_property(_interface,
2251
2044
signature="t",
2258
2051
return
2259
2052
if self.enabled:
2260
2053
# Reschedule checker run
2261
GLib.source_remove(self.checker_initiator_tag)
2262
self.checker_initiator_tag = GLib.timeout_add(
2054
gobject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = gobject.timeout_add(
2263
2056
value, self.start_checker)
2264
self.start_checker() # Start one now, too
2265
2057
self.start_checker() # Start one now, too
2058
2266
2059
# Checker - property
2267
2060
@dbus_service_property(_interface,
2268
2061
signature="s",
2271
2064
if value is None: # get
2272
2065
return dbus.String(self.checker_command)
2273
2066
self.checker_command = str(value)
2274
2067
2275
2068
# CheckerRunning - property
2276
2069
@dbus_service_property(_interface,
2277
2070
signature="b",
2283
2076
self.start_checker()
2284
2077
else:
2285
2078
self.stop_checker()
2286
2079
2287
2080
# ObjectPath - property
2288
2081
@dbus_annotations(
2289
2082
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2290
2083
"org.freedesktop.DBus.Deprecated": "true"})
2291
2084
@dbus_service_property(_interface, signature="o", access="read")
2292
2085
def ObjectPath_dbus_property(self):
2293
return self.dbus_object_path # is already a dbus.ObjectPath
2294
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2295
2088
# Secret = property
2296
2089
@dbus_annotations(
2297
2090
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2302
2095
byte_arrays=True)
2303
2096
def Secret_dbus_property(self, value):
2304
2097
self.secret = bytes(value)
2305
2098
2306
2099
del _interface
2307
2100
2308
2101
2309
class ProxyClient:
2310
def __init__(self, child_pipe, key_id, fpr, address):
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2311
2104
self._pipe = child_pipe
2312
self._pipe.send(("init", key_id, fpr, address))
2105
self._pipe.send(('init', fpr, address))
2313
2106
if not self._pipe.recv():
2314
raise KeyError(key_id or fpr)
2315
2107
raise KeyError(fpr)
2108
2316
2109
def __getattribute__(self, name):
2317
if name == "_pipe":
2110
if name == '_pipe':
2318
2111
return super(ProxyClient, self).__getattribute__(name)
2319
self._pipe.send(("getattr", name))
2112
self._pipe.send(('getattr', name))
2320
2113
data = self._pipe.recv()
2321
if data[0] == "data":
2114
if data[0] == 'data':
2322
2115
return data[1]
2323
if data[0] == "function":
2324
2116
if data[0] == 'function':
2117
2325
2118
def func(*args, **kwargs):
2326
self._pipe.send(("funcall", name, args, kwargs))
2119
self._pipe.send(('funcall', name, args, kwargs))
2327
2120
return self._pipe.recv()[1]
2328
2121
2329
2122
return func
2330
2123
2331
2124
def __setattr__(self, name, value):
2332
if name == "_pipe":
2125
if name == '_pipe':
2333
2126
return super(ProxyClient, self).__setattr__(name, value)
2334
self._pipe.send(("setattr", name, value))
2127
self._pipe.send(('setattr', name, value))
2335
2128
2336
2129
2337
2130
class ClientHandler(socketserver.BaseRequestHandler, object):
2338
2131
"""A class to handle client connections.
2339
2132
2340
2133
Instantiated once for each connection to handle it.
2341
2134
Note: This will run in its own forked process."""
2342
2135
2343
2136
def handle(self):
2344
2137
with contextlib.closing(self.server.child_pipe) as child_pipe:
2345
log.info("TCP connection from: %s",
2346
str(self.client_address))
2347
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2348
2138
logger.info("TCP connection from: %s",
2139
str(self.client_address))
2140
logger.debug("Pipe FD: %d",
2141
self.server.child_pipe.fileno())
2142
2349
2143
session = gnutls.ClientSession(self.request)
2350
2351
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2352
# "+AES-256-CBC", "+SHA1",
2353
# "+COMP-NULL", "+CTYPE-OPENPGP",
2354
# "+DHE-DSS"))
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2355
2149
# Use a fallback default, since this MUST be set.
2356
2150
priority = self.server.gnutls_priority
2357
2151
if priority is None:
2358
2152
priority = "NORMAL"
2359
gnutls.priority_set_direct(session,
2360
priority.encode("utf-8"), None)
2361
2153
gnutls.priority_set_direct(session._c_object, priority,
2154
None)
2155
2362
2156
# Start communication using the Mandos protocol
2363
2157
# Get protocol number
2364
2158
line = self.request.makefile().readline()
2365
log.debug("Protocol version: %r", line)
2159
logger.debug("Protocol version: %r", line)
2366
2160
try:
2367
2161
if int(line.strip().split()[0]) > 1:
2368
2162
raise RuntimeError(line)
2369
2163
except (ValueError, IndexError, RuntimeError) as error:
2370
log.error("Unknown protocol version: %s", error)
2164
logger.error("Unknown protocol version: %s", error)
2371
2165
return
2372
2166
2373
2167
# Start GnuTLS connection
2374
2168
try:
2375
2169
session.handshake()
2376
2170
except gnutls.Error as error:
2377
log.warning("Handshake failed: %s", error)
2171
logger.warning("Handshake failed: %s", error)
2378
2172
# Do not run session.bye() here: the session is not
2379
2173
# established. Just abandon the request.
2380
2174
return
2381
log.debug("Handshake succeeded")
2382
2175
logger.debug("Handshake succeeded")
2176
2383
2177
approval_required = False
2384
2178
try:
2385
if gnutls.has_rawpk:
2386
fpr = b""
2387
try:
2388
key_id = self.key_id(
2389
self.peer_certificate(session))
2390
except (TypeError, gnutls.Error) as error:
2391
log.warning("Bad certificate: %s", error)
2392
return
2393
log.debug("Key ID: %s",
2394
key_id.decode("utf-8",
2395
errors="replace"))
2396
2397
else:
2398
key_id = b""
2399
try:
2400
fpr = self.fingerprint(
2401
self.peer_certificate(session))
2402
except (TypeError, gnutls.Error) as error:
2403
log.warning("Bad certificate: %s", error)
2404
return
2405
log.debug("Fingerprint: %s", fpr)
2406
2407
try:
2408
client = ProxyClient(child_pipe, key_id, fpr,
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2409
2189
self.client_address)
2410
2190
except KeyError:
2411
2191
return
2412
2192
2413
2193
if client.approval_delay:
2414
2194
delay = client.approval_delay
2415
2195
client.approvals_pending += 1
2416
2196
approval_required = True
2417
2197
2418
2198
while True:
2419
2199
if not client.enabled:
2420
log.info("Client %s is disabled", client.name)
2200
logger.info("Client %s is disabled",
2201
client.name)
2421
2202
if self.server.use_dbus:
2422
2203
# Emit D-Bus signal
2423
2204
client.Rejected("Disabled")
2424
2205
return
2425
2206
2426
2207
if client.approved or not client.approval_delay:
2427
# We are approved or approval is disabled
2208
#We are approved or approval is disabled
2428
2209
break
2429
2210
elif client.approved is None:
2430
log.info("Client %s needs approval",
2431
client.name)
2211
logger.info("Client %s needs approval",
2212
client.name)
2432
2213
if self.server.use_dbus:
2433
2214
# Emit D-Bus signal
2434
2215
client.NeedApproval(
2435
2216
client.approval_delay.total_seconds()
2436
2217
* 1000, client.approved_by_default)
2437
2218
else:
2438
log.warning("Client %s was not approved",
2439
client.name)
2219
logger.warning("Client %s was not approved",
2220
client.name)
2440
2221
if self.server.use_dbus:
2441
2222
# Emit D-Bus signal
2442
2223
client.Rejected("Denied")
2443
2224
return
2444
2445
# wait until timeout or approved
2225
2226
#wait until timeout or approved
2446
2227
time = datetime.datetime.now()
2447
2228
client.changedstate.acquire()
2448
2229
client.changedstate.wait(delay.total_seconds())
2450
2231
time2 = datetime.datetime.now()
2451
2232
if (time2 - time) >= delay:
2452
2233
if not client.approved_by_default:
2453
log.warning("Client %s timed out while"
2454
" waiting for approval",
2455
client.name)
2234
logger.warning("Client %s timed out while"
2235
" waiting for approval",
2236
client.name)
2456
2237
if self.server.use_dbus:
2457
2238
# Emit D-Bus signal
2458
2239
client.Rejected("Approval timed out")
2461
2242
break
2462
2243
else:
2463
2244
delay -= time2 - time
2464
2245
2465
2246
try:
2466
2247
session.send(client.secret)
2467
2248
except gnutls.Error as error:
2468
log.warning("gnutls send failed", exc_info=error)
2249
logger.warning("gnutls send failed",
2250
exc_info = error)
2469
2251
return
2470
2471
log.info("Sending secret to %s", client.name)
2252
2253
logger.info("Sending secret to %s", client.name)
2472
2254
# bump the timeout using extended_timeout
2473
2255
client.bump_timeout(client.extended_timeout)
2474
2256
if self.server.use_dbus:
2475
2257
# Emit D-Bus signal
2476
2258
client.GotSecret()
2477
2259
2478
2260
finally:
2479
2261
if approval_required:
2480
2262
client.approvals_pending -= 1
2481
2263
try:
2482
2264
session.bye()
2483
2265
except gnutls.Error as error:
2484
log.warning("GnuTLS bye failed", exc_info=error)
2485
2266
logger.warning("GnuTLS bye failed",
2267
exc_info=error)
2268
2486
2269
@staticmethod
2487
2270
def peer_certificate(session):
2488
"Return the peer's certificate as a bytestring"
2489
try:
2490
cert_type = gnutls.certificate_type_get2(
2491
session, gnutls.CTYPE_PEERS)
2492
except AttributeError:
2493
cert_type = gnutls.certificate_type_get(session)
2494
if gnutls.has_rawpk:
2495
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2496
else:
2497
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2498
# If not a valid certificate type...
2499
if cert_type not in valid_cert_types:
2500
log.info("Cert type %r not in %r", cert_type,
2501
valid_cert_types)
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2502
2275
# ...return invalid data
2503
2276
return b""
2504
2277
list_size = ctypes.c_uint(1)
2505
2278
cert_list = (gnutls.certificate_get_peers
2506
(session, ctypes.byref(list_size)))
2279
(session._c_object, ctypes.byref(list_size)))
2507
2280
if not bool(cert_list) and list_size.value != 0:
2508
2281
raise gnutls.Error("error getting peer certificate")
2509
2282
if list_size.value == 0:
2510
2283
return None
2511
2284
cert = cert_list[0]
2512
2285
return ctypes.string_at(cert.data, cert.size)
2513
2514
@staticmethod
2515
def key_id(certificate):
2516
"Convert a certificate bytestring to a hexdigit key ID"
2517
# New GnuTLS "datum" with the public key
2518
datum = gnutls.datum_t(
2519
ctypes.cast(ctypes.c_char_p(certificate),
2520
ctypes.POINTER(ctypes.c_ubyte)),
2521
ctypes.c_uint(len(certificate)))
2522
# XXX all these need to be created in the gnutls "module"
2523
# New empty GnuTLS certificate
2524
pubkey = gnutls.pubkey_t()
2525
gnutls.pubkey_init(ctypes.byref(pubkey))
2526
# Import the raw public key into the certificate
2527
gnutls.pubkey_import(pubkey,
2528
ctypes.byref(datum),
2529
gnutls.X509_FMT_DER)
2530
# New buffer for the key ID
2531
buf = ctypes.create_string_buffer(32)
2532
buf_len = ctypes.c_size_t(len(buf))
2533
# Get the key ID from the raw public key into the buffer
2534
gnutls.pubkey_get_key_id(
2535
pubkey,
2536
gnutls.KEYID_USE_SHA256,
2537
ctypes.cast(ctypes.byref(buf),
2538
ctypes.POINTER(ctypes.c_ubyte)),
2539
ctypes.byref(buf_len))
2540
# Deinit the certificate
2541
gnutls.pubkey_deinit(pubkey)
2542
2543
# Convert the buffer to a Python bytestring
2544
key_id = ctypes.string_at(buf, buf_len.value)
2545
# Convert the bytestring to hexadecimal notation
2546
hex_key_id = binascii.hexlify(key_id).upper()
2547
return hex_key_id
2548
2286
2549
2287
@staticmethod
2550
2288
def fingerprint(openpgp):
2551
2289
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2566
2304
ctypes.byref(crtverify))
2567
2305
if crtverify.value != 0:
2568
2306
gnutls.openpgp_crt_deinit(crt)
2569
raise gnutls.CertificateSecurityError(code
2570
=crtverify.value)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2571
2308
# New buffer for the fingerprint
2572
2309
buf = ctypes.create_string_buffer(20)
2573
2310
buf_len = ctypes.c_size_t()
2583
2320
return hex_fpr
2584
2321
2585
2322
2586
class MultiprocessingMixIn:
2323
class MultiprocessingMixIn(object):
2587
2324
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2588
2325
2589
2326
def sub_process_main(self, request, address):
2590
2327
try:
2591
2328
self.finish_request(request, address)
2592
2329
except Exception:
2593
2330
self.handle_error(request, address)
2594
2331
self.close_request(request)
2595
2332
2596
2333
def process_request(self, request, address):
2597
2334
"""Start a new process to process the request."""
2598
proc = multiprocessing.Process(target=self.sub_process_main,
2599
args=(request, address))
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2600
2337
proc.start()
2601
2338
return proc
2602
2339
2603
2340
2604
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2605
2342
""" adds a pipe to the MixIn """
2606
2343
2607
2344
def process_request(self, request, client_address):
2608
2345
"""Overrides and wraps the original process_request().
2609
2346
2610
2347
This function creates a new pipe in self.pipe
2611
2348
"""
2612
2349
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2613
2350
2614
2351
proc = MultiprocessingMixIn.process_request(self, request,
2615
2352
client_address)
2616
2353
self.child_pipe.close()
2617
2354
self.add_pipe(parent_pipe, proc)
2618
2355
2619
2356
def add_pipe(self, parent_pipe, proc):
2620
2357
"""Dummy function; override as necessary"""
2621
2358
raise NotImplementedError()
2622
2359
2623
2360
2624
2361
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2625
socketserver.TCPServer):
2626
"""IPv6-capable TCP server. Accepts None as address and/or port
2627
2362
socketserver.TCPServer, object):
2363
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2364
2628
2365
Attributes:
2629
2366
enabled: Boolean; whether this server is activated yet
2630
2367
interface: None or a network interface name (string)
2631
2368
use_ipv6: Boolean; to use IPv6 or not
2632
2369
"""
2633
2370
2634
2371
def __init__(self, server_address, RequestHandlerClass,
2635
2372
interface=None,
2636
2373
use_ipv6=True,
2646
2383
self.socketfd = socketfd
2647
2384
# Save the original socket.socket() function
2648
2385
self.socket_socket = socket.socket
2649
2650
2386
# To implement --socket, we monkey patch socket.socket.
2651
#
2387
#
2652
2388
# (When socketserver.TCPServer is a new-style class, we
2653
2389
# could make self.socket into a property instead of monkey
2654
2390
# patching socket.socket.)
2655
#
2391
#
2656
2392
# Create a one-time-only replacement for socket.socket()
2657
2393
@functools.wraps(socket.socket)
2658
2394
def socket_wrapper(*args, **kwargs):
2670
2406
# socket_wrapper(), if socketfd was set.
2671
2407
socketserver.TCPServer.__init__(self, server_address,
2672
2408
RequestHandlerClass)
2673
2409
2674
2410
def server_bind(self):
2675
2411
"""This overrides the normal server_bind() function
2676
2412
to bind to an interface if one was specified, and also NOT to
2677
2413
bind to an address or port if they were not specified."""
2678
global SO_BINDTODEVICE
2679
2414
if self.interface is not None:
2680
2415
if SO_BINDTODEVICE is None:
2681
# Fall back to a hard-coded value which seems to be
2682
# common enough.
2683
log.warning("SO_BINDTODEVICE not found, trying 25")
2684
SO_BINDTODEVICE = 25
2685
try:
2686
self.socket.setsockopt(
2687
socket.SOL_SOCKET, SO_BINDTODEVICE,
2688
(self.interface + "\0").encode("utf-8"))
2689
except socket.error as error:
2690
if error.errno == errno.EPERM:
2691
log.error("No permission to bind to interface %s",
2692
self.interface)
2693
elif error.errno == errno.ENOPROTOOPT:
2694
log.error("SO_BINDTODEVICE not available; cannot"
2695
" bind to interface %s", self.interface)
2696
elif error.errno == errno.ENODEV:
2697
log.error("Interface %s does not exist, cannot"
2698
" bind", self.interface)
2699
else:
2700
raise
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2701
2437
# Only bind(2) the socket if we really need to.
2702
2438
if self.server_address[0] or self.server_address[1]:
2703
if self.server_address[1]:
2704
self.allow_reuse_address = True
2705
2439
if not self.server_address[0]:
2706
2440
if self.address_family == socket.AF_INET6:
2707
any_address = "::" # in6addr_any
2441
any_address = "::" # in6addr_any
2708
2442
else:
2709
any_address = "0.0.0.0" # INADDR_ANY
2443
any_address = "0.0.0.0" # INADDR_ANY
2710
2444
self.server_address = (any_address,
2711
2445
self.server_address[1])
2712
2446
elif not self.server_address[1]:
2722
2456
2723
2457
class MandosServer(IPv6_TCPServer):
2724
2458
"""Mandos server.
2725
2459
2726
2460
Attributes:
2727
2461
clients: set of Client objects
2728
2462
gnutls_priority GnuTLS priority string
2729
2463
use_dbus: Boolean; to emit D-Bus signals or not
2730
2731
Assumes a GLib.MainLoop event loop.
2464
2465
Assumes a gobject.MainLoop event loop.
2732
2466
"""
2733
2467
2734
2468
def __init__(self, server_address, RequestHandlerClass,
2735
2469
interface=None,
2736
2470
use_ipv6=True,
2746
2480
self.gnutls_priority = gnutls_priority
2747
2481
IPv6_TCPServer.__init__(self, server_address,
2748
2482
RequestHandlerClass,
2749
interface=interface,
2750
use_ipv6=use_ipv6,
2751
socketfd=socketfd)
2752
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2753
2487
def server_activate(self):
2754
2488
if self.enabled:
2755
2489
return socketserver.TCPServer.server_activate(self)
2756
2490
2757
2491
def enable(self):
2758
2492
self.enabled = True
2759
2493
2760
2494
def add_pipe(self, parent_pipe, proc):
2761
2495
# Call "handle_ipc" for both data and EOF events
2762
GLib.io_add_watch(
2763
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2764
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2496
gobject.io_add_watch(
2497
parent_pipe.fileno(),
2498
gobject.IO_IN | gobject.IO_HUP,
2765
2499
functools.partial(self.handle_ipc,
2766
parent_pipe=parent_pipe,
2767
proc=proc))
2768
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2769
2503
def handle_ipc(self, source, condition,
2770
2504
parent_pipe=None,
2771
proc=None,
2505
proc = None,
2772
2506
client_object=None):
2773
2507
# error, or the other end of multiprocessing.Pipe has closed
2774
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2775
2509
# Wait for other process to exit
2776
2510
proc.join()
2777
2511
return False
2778
2512
2779
2513
# Read a request from the child
2780
2514
request = parent_pipe.recv()
2781
2515
command = request[0]
2782
2783
if command == "init":
2784
key_id = request[1].decode("ascii")
2785
fpr = request[2].decode("ascii")
2786
address = request[3]
2787
2788
for c in self.clients.values():
2789
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2790
"27AE41E4649B934CA495991B7852B855"):
2791
continue
2792
if key_id and c.key_id == key_id:
2793
client = c
2794
break
2795
if fpr and c.fingerprint == fpr:
2516
2517
if command == 'init':
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2796
2523
client = c
2797
2524
break
2798
2525
else:
2799
log.info("Client not found for key ID: %s, address:"
2800
" %s", key_id or fpr, address)
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2801
2528
if self.use_dbus:
2802
2529
# Emit D-Bus signal
2803
mandos_dbus_service.ClientNotFound(key_id or fpr,
2530
mandos_dbus_service.ClientNotFound(fpr,
2804
2531
address[0])
2805
2532
parent_pipe.send(False)
2806
2533
return False
2807
2808
GLib.io_add_watch(
2809
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2810
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2534
2535
gobject.io_add_watch(
2536
parent_pipe.fileno(),
2537
gobject.IO_IN | gobject.IO_HUP,
2811
2538
functools.partial(self.handle_ipc,
2812
parent_pipe=parent_pipe,
2813
proc=proc,
2814
client_object=client))
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2815
2542
parent_pipe.send(True)
2816
2543
# remove the old hook in favor of the new above hook on
2817
2544
# same fileno
2818
2545
return False
2819
if command == "funcall":
2546
if command == 'funcall':
2820
2547
funcname = request[1]
2821
2548
args = request[2]
2822
2549
kwargs = request[3]
2823
2824
parent_pipe.send(("data", getattr(client_object,
2550
2551
parent_pipe.send(('data', getattr(client_object,
2825
2552
funcname)(*args,
2826
2553
**kwargs)))
2827
2828
if command == "getattr":
2554
2555
if command == 'getattr':
2829
2556
attrname = request[1]
2830
2557
if isinstance(client_object.__getattribute__(attrname),
2831
collections.abc.Callable):
2832
parent_pipe.send(("function", ))
2558
collections.Callable):
2559
parent_pipe.send(('function', ))
2833
2560
else:
2834
2561
parent_pipe.send((
2835
"data", client_object.__getattribute__(attrname)))
2836
2837
if command == "setattr":
2562
'data', client_object.__getattribute__(attrname)))
2563
2564
if command == 'setattr':
2838
2565
attrname = request[1]
2839
2566
value = request[2]
2840
2567
setattr(client_object, attrname, value)
2841
2568
2842
2569
return True
2843
2570
2844
2571
2845
2572
def rfc3339_duration_to_delta(duration):
2846
2573
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2847
2848
>>> timedelta = datetime.timedelta
2849
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2850
True
2851
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2852
True
2853
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2854
True
2855
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2856
True
2857
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2858
True
2859
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2860
True
2861
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2862
True
2863
>>> del timedelta
2574
2575
>>> rfc3339_duration_to_delta("P7D")
2576
datetime.timedelta(7)
2577
>>> rfc3339_duration_to_delta("PT60S")
2578
datetime.timedelta(0, 60)
2579
>>> rfc3339_duration_to_delta("PT60M")
2580
datetime.timedelta(0, 3600)
2581
>>> rfc3339_duration_to_delta("PT24H")
2582
datetime.timedelta(1)
2583
>>> rfc3339_duration_to_delta("P1W")
2584
datetime.timedelta(7)
2585
>>> rfc3339_duration_to_delta("PT5M30S")
2586
datetime.timedelta(0, 330)
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
datetime.timedelta(1, 200)
2864
2589
"""
2865
2590
2866
2591
# Parsing an RFC 3339 duration with regular expressions is not
2867
2592
# possible - there would have to be multiple places for the same
2868
2593
# values, like seconds. The current code, while more esoteric, is
2869
2594
# cleaner without depending on a parsing library. If Python had a
2870
2595
# built-in library for parsing we would use it, but we'd like to
2871
2596
# avoid excessive use of external libraries.
2872
2597
2873
2598
# New type for defining tokens, syntax, and semantics all-in-one
2874
2599
Token = collections.namedtuple("Token", (
2875
2600
"regexp", # To match token; if "value" is not None, must have
2908
2633
frozenset((token_year, token_month,
2909
2634
token_day, token_time,
2910
2635
token_week)))
2911
# Define starting values:
2912
# Value so far
2913
value = datetime.timedelta()
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2914
2638
found_token = None
2915
# Following valid tokens
2916
followers = frozenset((token_duration, ))
2917
# String left to parse
2918
s = duration
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2919
2641
# Loop until end token is found
2920
2642
while found_token is not token_end:
2921
2643
# Search for any currently valid tokens
2945
2667
2946
2668
def string_to_delta(interval):
2947
2669
"""Parse a string and return a datetime.timedelta
2948
2949
>>> string_to_delta("7d") == datetime.timedelta(7)
2950
True
2951
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2952
True
2953
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2954
True
2955
>>> string_to_delta("24h") == datetime.timedelta(1)
2956
True
2957
>>> string_to_delta("1w") == datetime.timedelta(7)
2958
True
2959
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2960
True
2670
2671
>>> string_to_delta('7d')
2672
datetime.timedelta(7)
2673
>>> string_to_delta('60s')
2674
datetime.timedelta(0, 60)
2675
>>> string_to_delta('60m')
2676
datetime.timedelta(0, 3600)
2677
>>> string_to_delta('24h')
2678
datetime.timedelta(1)
2679
>>> string_to_delta('1w')
2680
datetime.timedelta(7)
2681
>>> string_to_delta('5m 30s')
2682
datetime.timedelta(0, 330)
2961
2683
"""
2962
2684
2963
2685
try:
2964
2686
return rfc3339_duration_to_delta(interval)
2965
2687
except ValueError:
2966
2688
pass
2967
2689
2968
2690
timevalue = datetime.timedelta(0)
2969
2691
for s in interval.split():
2970
2692
try:
2988
2710
return timevalue
2989
2711
2990
2712
2991
def daemon(nochdir=False, noclose=False):
2713
def daemon(nochdir = False, noclose = False):
2992
2714
"""See daemon(3). Standard BSD Unix function.
2993
2715
2994
2716
This should really exist as os.daemon, but it doesn't (yet)."""
2995
2717
if os.fork():
2996
2718
sys.exit()
3014
2736
3015
2737
3016
2738
def main():
3017
2739
3018
2740
##################################################################
3019
2741
# Parsing of options, both command line and config file
3020
2742
3021
2743
parser = argparse.ArgumentParser()
3022
2744
parser.add_argument("-v", "--version", action="version",
3023
version="%(prog)s {}".format(version),
2745
version = "%(prog)s {}".format(version),
3024
2746
help="show version number and exit")
3025
2747
parser.add_argument("-i", "--interface", metavar="IF",
3026
2748
help="Bind to interface IF")
3062
2784
parser.add_argument("--no-zeroconf", action="store_false",
3063
2785
dest="zeroconf", help="Do not use Zeroconf",
3064
2786
default=None)
3065
2787
3066
2788
options = parser.parse_args()
3067
2789
2790
if options.check:
2791
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
3068
2795
# Default values for config file for server-global settings
3069
if gnutls.has_rawpk:
3070
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3072
else:
3073
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3074
":+SIGN-DSA-SHA256")
3075
server_defaults = {"interface": "",
3076
"address": "",
3077
"port": "",
3078
"debug": "False",
3079
"priority": priority,
3080
"servicename": "Mandos",
3081
"use_dbus": "True",
3082
"use_ipv6": "True",
3083
"debuglevel": "",
3084
"restore": "True",
3085
"socket": "",
3086
"statedir": "/var/lib/mandos",
3087
"foreground": "False",
3088
"zeroconf": "True",
3089
}
3090
del priority
3091
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
3092
2814
# Parse config file for server-global settings
3093
server_config = configparser.ConfigParser(server_defaults)
2815
server_config = configparser.SafeConfigParser(server_defaults)
3094
2816
del server_defaults
3095
2817
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3096
# Convert the ConfigParser object to a dict
2818
# Convert the SafeConfigParser object to a dict
3097
2819
server_settings = server_config.defaults()
3098
2820
# Use the appropriate methods on the non-string config options
3099
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3100
"foreground", "zeroconf"):
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3101
2822
server_settings[option] = server_config.getboolean("DEFAULT",
3102
2823
option)
3103
2824
if server_settings["port"]:
3109
2830
# Later, stdin will, and stdout and stderr might, be dup'ed
3110
2831
# over with an opened os.devnull. But we don't want this to
3111
2832
# happen with a supplied network socket.
3112
while 0 <= server_settings["socket"] <= 2:
2833
if 0 <= server_settings["socket"] <= 2:
3113
2834
server_settings["socket"] = os.dup(server_settings
3114
2835
["socket"])
3115
os.set_inheritable(server_settings["socket"], False)
3116
2836
del server_config
3117
2837
3118
2838
# Override the settings from the config file with command line
3119
2839
# options, if set.
3120
2840
for option in ("interface", "address", "port", "debug",
3138
2858
if server_settings["debug"]:
3139
2859
server_settings["foreground"] = True
3140
2860
# Now we have our good server settings in "server_settings"
3141
2861
3142
2862
##################################################################
3143
2863
3144
2864
if (not server_settings["zeroconf"]
3145
2865
and not (server_settings["port"]
3146
2866
or server_settings["socket"] != "")):
3147
2867
parser.error("Needs port or socket to work without Zeroconf")
3148
2868
3149
2869
# For convenience
3150
2870
debug = server_settings["debug"]
3151
2871
debuglevel = server_settings["debuglevel"]
3155
2875
stored_state_file)
3156
2876
foreground = server_settings["foreground"]
3157
2877
zeroconf = server_settings["zeroconf"]
3158
2878
3159
2879
if debug:
3160
2880
initlogger(debug, logging.DEBUG)
3161
2881
else:
3164
2884
else:
3165
2885
level = getattr(logging, debuglevel.upper())
3166
2886
initlogger(debug, level)
3167
2887
3168
2888
if server_settings["servicename"] != "Mandos":
3169
2889
syslogger.setFormatter(
3170
logging.Formatter("Mandos ({}) [%(process)d]:"
3171
" %(levelname)s: %(message)s".format(
2890
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
' %(levelname)s: %(message)s'.format(
3172
2892
server_settings["servicename"])))
3173
2893
3174
2894
# Parse config file with clients
3175
client_config = configparser.ConfigParser(Client.client_defaults)
2895
client_config = configparser.SafeConfigParser(Client
2896
.client_defaults)
3176
2897
client_config.read(os.path.join(server_settings["configdir"],
3177
2898
"clients.conf"))
3178
2899
3179
2900
global mandos_dbus_service
3180
2901
mandos_dbus_service = None
3181
2902
3182
2903
socketfd = None
3183
2904
if server_settings["socket"] != "":
3184
2905
socketfd = server_settings["socket"]
3198
2919
try:
3199
2920
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3200
2921
except IOError as e:
3201
log.error("Could not open file %r", pidfilename,
3202
exc_info=e)
3203
3204
for name, group in (("_mandos", "_mandos"),
3205
("mandos", "mandos"),
3206
("nobody", "nogroup")):
2922
logger.error("Could not open file %r", pidfilename,
2923
exc_info=e)
2924
2925
for name in ("_mandos", "mandos", "nobody"):
3207
2926
try:
3208
2927
uid = pwd.getpwnam(name).pw_uid
3209
gid = pwd.getpwnam(group).pw_gid
2928
gid = pwd.getpwnam(name).pw_gid
3210
2929
break
3211
2930
except KeyError:
3212
2931
continue
3216
2935
try:
3217
2936
os.setgid(gid)
3218
2937
os.setuid(uid)
3219
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3220
2938
except OSError as error:
3221
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3222
os.strerror(error.errno))
3223
2939
if error.errno != errno.EPERM:
3224
2940
raise
3225
2941
3226
2942
if debug:
3227
2943
# Enable all possible GnuTLS debugging
3228
2944
3229
2945
# "Use a log level over 10 to enable all debugging options."
3230
2946
# - GnuTLS manual
3231
2947
gnutls.global_set_log_level(11)
3232
2948
3233
2949
@gnutls.log_func
3234
2950
def debug_gnutls(level, string):
3235
log.debug("GnuTLS: %s",
3236
string[:-1].decode("utf-8", errors="replace"))
3237
2951
logger.debug("GnuTLS: %s", string[:-1])
2952
3238
2953
gnutls.global_set_log_function(debug_gnutls)
3239
2954
3240
2955
# Redirect stdin so all checkers get /dev/null
3241
2956
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3242
2957
os.dup2(null, sys.stdin.fileno())
3243
2958
if null > 2:
3244
2959
os.close(null)
3245
2960
3246
2961
# Need to fork before connecting to D-Bus
3247
2962
if not foreground:
3248
2963
# Close all input and output, do double fork, etc.
3249
2964
daemon()
3250
3251
if gi.version_info < (3, 10, 2):
3252
# multiprocessing will use threads, so before we use GLib we
3253
# need to inform GLib that threads will be used.
3254
GLib.threads_init()
3255
2965
2966
# multiprocessing will use threads, so before we use gobject we
2967
# need to inform gobject that threads will be used.
2968
gobject.threads_init()
2969
3256
2970
global main_loop
3257
2971
# From the Avahi example code
3258
2972
DBusGMainLoop(set_as_default=True)
3259
main_loop = GLib.MainLoop()
3260
if use_dbus or zeroconf:
3261
bus = dbus.SystemBus()
2973
main_loop = gobject.MainLoop()
2974
bus = dbus.SystemBus()
3262
2975
# End of Avahi example code
3263
2976
if use_dbus:
3264
2977
try:
3269
2982
"se.bsnet.fukt.Mandos", bus,
3270
2983
do_not_queue=True)
3271
2984
except dbus.exceptions.DBusException as e:
3272
log.error("Disabling D-Bus:", exc_info=e)
2985
logger.error("Disabling D-Bus:", exc_info=e)
3273
2986
use_dbus = False
3274
2987
server_settings["use_dbus"] = False
3275
2988
tcp_server.use_dbus = False
3276
2989
if zeroconf:
3277
2990
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3278
2991
service = AvahiServiceToSyslog(
3279
name=server_settings["servicename"],
3280
servicetype="_mandos._tcp",
3281
protocol=protocol,
3282
bus=bus)
2992
name = server_settings["servicename"],
2993
servicetype = "_mandos._tcp",
2994
protocol = protocol,
2995
bus = bus)
3283
2996
if server_settings["interface"]:
3284
2997
service.interface = if_nametoindex(
3285
2998
server_settings["interface"].encode("utf-8"))
3286
2999
3287
3000
global multiprocessing_manager
3288
3001
multiprocessing_manager = multiprocessing.Manager()
3289
3002
3290
3003
client_class = Client
3291
3004
if use_dbus:
3292
client_class = functools.partial(ClientDBus, bus=bus)
3293
3005
client_class = functools.partial(ClientDBus, bus = bus)
3006
3294
3007
client_settings = Client.config_parser(client_config)
3295
3008
old_client_settings = {}
3296
3009
clients_data = {}
3297
3010
3298
3011
# This is used to redirect stdout and stderr for checker processes
3299
3012
global wnull
3300
wnull = open(os.devnull, "w") # A writable /dev/null
3013
wnull = open(os.devnull, "w") # A writable /dev/null
3301
3014
# Only used if server is running in foreground but not in debug
3302
3015
# mode
3303
3016
if debug or not foreground:
3304
3017
wnull.close()
3305
3018
3306
3019
# Get client data and settings from last running state.
3307
3020
if server_settings["restore"]:
3308
3021
try:
3309
3022
with open(stored_state_path, "rb") as stored_state:
3310
if sys.version_info.major == 2:
3311
clients_data, old_client_settings = pickle.load(
3312
stored_state)
3313
else:
3314
bytes_clients_data, bytes_old_client_settings = (
3315
pickle.load(stored_state, encoding="bytes"))
3316
# Fix bytes to strings
3317
# clients_data
3318
# .keys()
3319
clients_data = {(key.decode("utf-8")
3320
if isinstance(key, bytes)
3321
else key): value
3322
for key, value in
3323
bytes_clients_data.items()}
3324
del bytes_clients_data
3325
for key in clients_data:
3326
value = {(k.decode("utf-8")
3327
if isinstance(k, bytes) else k): v
3328
for k, v in
3329
clients_data[key].items()}
3330
clients_data[key] = value
3331
# .client_structure
3332
value["client_structure"] = [
3333
(s.decode("utf-8")
3334
if isinstance(s, bytes)
3335
else s) for s in
3336
value["client_structure"]]
3337
# .name, .host, and .checker_command
3338
for k in ("name", "host", "checker_command"):
3339
if isinstance(value[k], bytes):
3340
value[k] = value[k].decode("utf-8")
3341
if "key_id" not in value:
3342
value["key_id"] = ""
3343
elif "fingerprint" not in value:
3344
value["fingerprint"] = ""
3345
# old_client_settings
3346
# .keys()
3347
old_client_settings = {
3348
(key.decode("utf-8")
3349
if isinstance(key, bytes)
3350
else key): value
3351
for key, value in
3352
bytes_old_client_settings.items()}
3353
del bytes_old_client_settings
3354
# .host and .checker_command
3355
for value in old_client_settings.values():
3356
for attribute in ("host", "checker_command"):
3357
if isinstance(value[attribute], bytes):
3358
value[attribute] = (value[attribute]
3359
.decode("utf-8"))
3023
clients_data, old_client_settings = pickle.load(
3024
stored_state)
3360
3025
os.remove(stored_state_path)
3361
3026
except IOError as e:
3362
3027
if e.errno == errno.ENOENT:
3363
log.warning("Could not load persistent state:"
3364
" %s", os.strerror(e.errno))
3028
logger.warning("Could not load persistent state:"
3029
" {}".format(os.strerror(e.errno)))
3365
3030
else:
3366
log.critical("Could not load persistent state:",
3367
exc_info=e)
3031
logger.critical("Could not load persistent state:",
3032
exc_info=e)
3368
3033
raise
3369
3034
except EOFError as e:
3370
log.warning("Could not load persistent state: EOFError:",
3371
exc_info=e)
3372
3035
logger.warning("Could not load persistent state: "
3036
"EOFError:",
3037
exc_info=e)
3038
3373
3039
with PGPEngine() as pgp:
3374
3040
for client_name, client in clients_data.items():
3375
3041
# Skip removed clients
3376
3042
if client_name not in client_settings:
3377
3043
continue
3378
3044
3379
3045
# Decide which value to use after restoring saved state.
3380
3046
# We have three different values: Old config file,
3381
3047
# new config file, and saved state.
3392
3058
client[name] = value
3393
3059
except KeyError:
3394
3060
pass
3395
3061
3396
3062
# Clients who has passed its expire date can still be
3397
3063
# enabled if its last checker was successful. A Client
3398
3064
# whose checker succeeded before we stored its state is
3401
3067
if client["enabled"]:
3402
3068
if datetime.datetime.utcnow() >= client["expires"]:
3403
3069
if not client["last_checked_ok"]:
3404
log.warning("disabling client %s - Client"
3405
" never performed a successful"
3406
" checker", client_name)
3070
logger.warning(
3071
"disabling client {} - Client never "
3072
"performed a successful checker".format(
3073
client_name))
3407
3074
client["enabled"] = False
3408
3075
elif client["last_checker_status"] != 0:
3409
log.warning("disabling client %s - Client"
3410
" last checker failed with error"
3411
" code %s", client_name,
3412
client["last_checker_status"])
3076
logger.warning(
3077
"disabling client {} - Client last"
3078
" checker failed with error code"
3079
" {}".format(
3080
client_name,
3081
client["last_checker_status"]))
3413
3082
client["enabled"] = False
3414
3083
else:
3415
3084
client["expires"] = (
3416
3085
datetime.datetime.utcnow()
3417
3086
+ client["timeout"])
3418
log.debug("Last checker succeeded, keeping %s"
3419
" enabled", client_name)
3087
logger.debug("Last checker succeeded,"
3088
" keeping {} enabled".format(
3089
client_name))
3420
3090
try:
3421
3091
client["secret"] = pgp.decrypt(
3422
3092
client["encrypted_secret"],
3423
3093
client_settings[client_name]["secret"])
3424
3094
except PGPError:
3425
3095
# If decryption fails, we use secret from new settings
3426
log.debug("Failed to decrypt %s old secret",
3427
client_name)
3096
logger.debug("Failed to decrypt {} old secret".format(
3097
client_name))
3428
3098
client["secret"] = (client_settings[client_name]
3429
3099
["secret"])
3430
3100
3431
3101
# Add/remove clients based on new changes made to config
3432
3102
for client_name in (set(old_client_settings)
3433
3103
- set(client_settings)):
3435
3105
for client_name in (set(client_settings)
3436
3106
- set(old_client_settings)):
3437
3107
clients_data[client_name] = client_settings[client_name]
3438
3108
3439
3109
# Create all client objects
3440
3110
for client_name, client in clients_data.items():
3441
3111
tcp_server.clients[client_name] = client_class(
3442
name=client_name,
3443
settings=client,
3444
server_settings=server_settings)
3445
3112
name = client_name,
3113
settings = client,
3114
server_settings = server_settings)
3115
3446
3116
if not tcp_server.clients:
3447
log.warning("No clients defined")
3448
3117
logger.warning("No clients defined")
3118
3449
3119
if not foreground:
3450
3120
if pidfile is not None:
3451
3121
pid = os.getpid()
3453
3123
with pidfile:
3454
3124
print(pid, file=pidfile)
3455
3125
except IOError:
3456
log.error("Could not write to file %r with PID %d",
3457
pidfilename, pid)
3126
logger.error("Could not write to file %r with PID %d",
3127
pidfilename, pid)
3458
3128
del pidfile
3459
3129
del pidfilename
3460
3461
for termsig in (signal.SIGHUP, signal.SIGTERM):
3462
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3463
lambda: main_loop.quit() and False)
3464
3130
3131
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3132
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3133
3465
3134
if use_dbus:
3466
3135
3467
3136
@alternate_dbus_interfaces(
3468
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3137
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3469
3138
class MandosDBusService(DBusObjectWithObjectManager):
3470
3139
"""A D-Bus proxy object"""
3471
3140
3472
3141
def __init__(self):
3473
3142
dbus.service.Object.__init__(self, bus, "/")
3474
3143
3475
3144
_interface = "se.recompile.Mandos"
3476
3145
3477
3146
@dbus.service.signal(_interface, signature="o")
3478
3147
def ClientAdded(self, objpath):
3479
3148
"D-Bus signal"
3480
3149
pass
3481
3150
3482
3151
@dbus.service.signal(_interface, signature="ss")
3483
def ClientNotFound(self, key_id, address):
3152
def ClientNotFound(self, fingerprint, address):
3484
3153
"D-Bus signal"
3485
3154
pass
3486
3155
3487
3156
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3488
3157
"true"})
3489
3158
@dbus.service.signal(_interface, signature="os")
3490
3159
def ClientRemoved(self, objpath, name):
3491
3160
"D-Bus signal"
3492
3161
pass
3493
3162
3494
3163
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3495
3164
"true"})
3496
3165
@dbus.service.method(_interface, out_signature="ao")
3497
3166
def GetAllClients(self):
3498
3167
"D-Bus method"
3499
3168
return dbus.Array(c.dbus_object_path for c in
3500
tcp_server.clients.values())
3501
3169
tcp_server.clients.itervalues())
3170
3502
3171
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3503
3172
"true"})
3504
3173
@dbus.service.method(_interface,
3506
3175
def GetAllClientsWithProperties(self):
3507
3176
"D-Bus method"
3508
3177
return dbus.Dictionary(
3509
{c.dbus_object_path: c.GetAll(
3178
{ c.dbus_object_path: c.GetAll(
3510
3179
"se.recompile.Mandos.Client")
3511
for c in tcp_server.clients.values()},
3180
for c in tcp_server.clients.itervalues() },
3512
3181
signature="oa{sv}")
3513
3182
3514
3183
@dbus.service.method(_interface, in_signature="o")
3515
3184
def RemoveClient(self, object_path):
3516
3185
"D-Bus method"
3517
for c in tcp_server.clients.values():
3186
for c in tcp_server.clients.itervalues():
3518
3187
if c.dbus_object_path == object_path:
3519
3188
del tcp_server.clients[c.name]
3520
3189
c.remove_from_connection()
3524
3193
self.client_removed_signal(c)
3525
3194
return
3526
3195
raise KeyError(object_path)
3527
3196
3528
3197
del _interface
3529
3198
3530
3199
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3531
out_signature="a{oa{sa{sv}}}")
3200
out_signature = "a{oa{sa{sv}}}")
3532
3201
def GetManagedObjects(self):
3533
3202
"""D-Bus method"""
3534
3203
return dbus.Dictionary(
3535
{client.dbus_object_path:
3536
dbus.Dictionary(
3537
{interface: client.GetAll(interface)
3538
for interface in
3539
client._get_all_interface_names()})
3540
for client in tcp_server.clients.values()})
3541
3204
{ client.dbus_object_path:
3205
dbus.Dictionary(
3206
{ interface: client.GetAll(interface)
3207
for interface in
3208
client._get_all_interface_names()})
3209
for client in tcp_server.clients.values()})
3210
3542
3211
def client_added_signal(self, client):
3543
3212
"""Send the new standard signal and the old signal"""
3544
3213
if use_dbus:
3546
3215
self.InterfacesAdded(
3547
3216
client.dbus_object_path,
3548
3217
dbus.Dictionary(
3549
{interface: client.GetAll(interface)
3550
for interface in
3551
client._get_all_interface_names()}))
3218
{ interface: client.GetAll(interface)
3219
for interface in
3220
client._get_all_interface_names()}))
3552
3221
# Old signal
3553
3222
self.ClientAdded(client.dbus_object_path)
3554
3223
3555
3224
def client_removed_signal(self, client):
3556
3225
"""Send the new standard signal and the old signal"""
3557
3226
if use_dbus:
3562
3231
# Old signal
3563
3232
self.ClientRemoved(client.dbus_object_path,
3564
3233
client.name)
3565
3234
3566
3235
mandos_dbus_service = MandosDBusService()
3567
3568
# Save modules to variables to exempt the modules from being
3569
# unloaded before the function registered with atexit() is run.
3570
mp = multiprocessing
3571
wn = wnull
3572
3236
3573
3237
def cleanup():
3574
3238
"Cleanup function; run on exit"
3575
3239
if zeroconf:
3576
3240
service.cleanup()
3577
3578
mp.active_children()
3579
wn.close()
3241
3242
multiprocessing.active_children()
3243
wnull.close()
3580
3244
if not (tcp_server.clients or client_settings):
3581
3245
return
3582
3246
3583
3247
# Store client before exiting. Secrets are encrypted with key
3584
3248
# based on what config file has. If config file is
3585
3249
# removed/edited, old secret will thus be unrecovable.
3586
3250
clients = {}
3587
3251
with PGPEngine() as pgp:
3588
for client in tcp_server.clients.values():
3252
for client in tcp_server.clients.itervalues():
3589
3253
key = client_settings[client.name]["secret"]
3590
3254
client.encrypted_secret = pgp.encrypt(client.secret,
3591
3255
key)
3592
3256
client_dict = {}
3593
3257
3594
3258
# A list of attributes that can not be pickled
3595
3259
# + secret.
3596
exclude = {"bus", "changedstate", "secret",
3597
"checker", "server_settings"}
3260
exclude = { "bus", "changedstate", "secret",
3261
"checker", "server_settings" }
3598
3262
for name, typ in inspect.getmembers(dbus.service
3599
3263
.Object):
3600
3264
exclude.add(name)
3601
3265
3602
3266
client_dict["encrypted_secret"] = (client
3603
3267
.encrypted_secret)
3604
3268
for attr in client.client_structure:
3605
3269
if attr not in exclude:
3606
3270
client_dict[attr] = getattr(client, attr)
3607
3271
3608
3272
clients[client.name] = client_dict
3609
3273
del client_settings[client.name]["secret"]
3610
3274
3611
3275
try:
3612
3276
with tempfile.NamedTemporaryFile(
3613
mode="wb",
3277
mode='wb',
3614
3278
suffix=".pickle",
3615
prefix="clients-",
3279
prefix='clients-',
3616
3280
dir=os.path.dirname(stored_state_path),
3617
3281
delete=False) as stored_state:
3618
pickle.dump((clients, client_settings), stored_state,
3619
protocol=2)
3282
pickle.dump((clients, client_settings), stored_state)
3620
3283
tempname = stored_state.name
3621
3284
os.rename(tempname, stored_state_path)
3622
3285
except (IOError, OSError) as e:
3626
3289
except NameError:
3627
3290
pass
3628
3291
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3629
log.warning("Could not save persistent state: %s",
3630
os.strerror(e.errno))
3292
logger.warning("Could not save persistent state: {}"
3293
.format(os.strerror(e.errno)))
3631
3294
else:
3632
log.warning("Could not save persistent state:",
3633
exc_info=e)
3295
logger.warning("Could not save persistent state:",
3296
exc_info=e)
3634
3297
raise
3635
3298
3636
3299
# Delete all clients, and settings from config
3637
3300
while tcp_server.clients:
3638
3301
name, client = tcp_server.clients.popitem()
3644
3307
if use_dbus:
3645
3308
mandos_dbus_service.client_removed_signal(client)
3646
3309
client_settings.clear()
3647
3310
3648
3311
atexit.register(cleanup)
3649
3650
for client in tcp_server.clients.values():
3312
3313
for client in tcp_server.clients.itervalues():
3651
3314
if use_dbus:
3652
3315
# Emit D-Bus signal for adding
3653
3316
mandos_dbus_service.client_added_signal(client)
3654
3317
# Need to initiate checking of clients
3655
3318
if client.enabled:
3656
client.init_checker(randomize_start=True)
3657
3319
client.init_checker()
3320
3658
3321
tcp_server.enable()
3659
3322
tcp_server.server_activate()
3660
3323
3661
3324
# Find out what port we got
3662
3325
if zeroconf:
3663
3326
service.port = tcp_server.socket.getsockname()[1]
3664
3327
if use_ipv6:
3665
log.info("Now listening on address %r, port %d, flowinfo %d,"
3666
" scope_id %d", *tcp_server.socket.getsockname())
3328
logger.info("Now listening on address %r, port %d,"
3329
" flowinfo %d, scope_id %d",
3330
*tcp_server.socket.getsockname())
3667
3331
else: # IPv4
3668
log.info("Now listening on address %r, port %d",
3669
*tcp_server.socket.getsockname())
3670
3671
# service.interface = tcp_server.socket.getsockname()[3]
3672
3332
logger.info("Now listening on address %r, port %d",
3333
*tcp_server.socket.getsockname())
3334
3335
#service.interface = tcp_server.socket.getsockname()[3]
3336
3673
3337
try:
3674
3338
if zeroconf:
3675
3339
# From the Avahi example code
3676
3340
try:
3677
3341
service.activate()
3678
3342
except dbus.exceptions.DBusException as error:
3679
log.critical("D-Bus Exception", exc_info=error)
3343
logger.critical("D-Bus Exception", exc_info=error)
3680
3344
cleanup()
3681
3345
sys.exit(1)
3682
3346
# End of Avahi example code
3683
3684
GLib.io_add_watch(
3685
GLib.IOChannel.unix_new(tcp_server.fileno()),
3686
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3687
lambda *args, **kwargs: (tcp_server.handle_request
3688
(*args[2:], **kwargs) or True))
3689
3690
log.debug("Starting main loop")
3347
3348
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3349
lambda *args, **kwargs:
3350
(tcp_server.handle_request
3351
(*args[2:], **kwargs) or True))
3352
3353
logger.debug("Starting main loop")
3691
3354
main_loop.run()
3692
3355
except AvahiError as error:
3693
log.critical("Avahi Error", exc_info=error)
3356
logger.critical("Avahi Error", exc_info=error)
3694
3357
cleanup()
3695
3358
sys.exit(1)
3696
3359
except KeyboardInterrupt:
3697
3360
if debug:
3698
3361
print("", file=sys.stderr)
3699
log.debug("Server received KeyboardInterrupt")
3700
log.debug("Server exiting")
3362
logger.debug("Server received KeyboardInterrupt")
3363
logger.debug("Server exiting")
3701
3364
# Must run before the D-Bus bus name gets deregistered
3702
3365
cleanup()
3703
3366
3704
3705
def parse_test_args():
3706
# type: () -> argparse.Namespace
3707
parser = argparse.ArgumentParser(add_help=False)
3708
parser.add_argument("--check", action="store_true")
3709
parser.add_argument("--prefix", )
3710
args, unknown_args = parser.parse_known_args()
3711
if args.check:
3712
# Remove test options from sys.argv
3713
sys.argv[1:] = unknown_args
3714
return args
3715
3716
# Add all tests from doctest strings
3717
def load_tests(loader, tests, none):
3718
import doctest
3719
tests.addTests(doctest.DocTestSuite())
3720
return tests
3721
3722
if __name__ == "__main__":
3723
options = parse_test_args()
3724
try:
3725
if options.check:
3726
extra_test_prefix = options.prefix
3727
if extra_test_prefix is not None:
3728
if not (unittest.main(argv=[""], exit=False)
3729
.result.wasSuccessful()):
3730
sys.exit(1)
3731
class ExtraTestLoader(unittest.TestLoader):
3732
testMethodPrefix = extra_test_prefix
3733
# Call using ./scriptname --test [--verbose]
3734
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3735
else:
3736
unittest.main(argv=[""])
3737
else:
3738
main()
3739
finally:
3740
logging.shutdown()
3741
3742
# Local Variables:
3743
# run-tests:
3744
# (lambda (&optional extra)
3745
# (if (not (funcall run-tests-in-test-buffer default-directory
3746
# extra))
3747
# (funcall show-test-buffer-in-test-window)
3748
# (funcall remove-test-window)
3749
# (if extra (message "Extra tests run successfully!"))))
3750
# run-tests-in-test-buffer:
3751
# (lambda (dir &optional extra)
3752
# (with-current-buffer (get-buffer-create "*Test*")
3753
# (setq buffer-read-only nil
3754
# default-directory dir)
3755
# (erase-buffer)
3756
# (compilation-mode))
3757
# (let ((process-result
3758
# (let ((inhibit-read-only t))
3759
# (process-file-shell-command
3760
# (funcall get-command-line extra) nil "*Test*"))))
3761
# (and (numberp process-result)
3762
# (= process-result 0))))
3763
# get-command-line:
3764
# (lambda (&optional extra)
3765
# (let ((quoted-script
3766
# (shell-quote-argument (funcall get-script-name))))
3767
# (format
3768
# (concat "%s --check" (if extra " --prefix=atest" ""))
3769
# quoted-script)))
3770
# get-script-name:
3771
# (lambda ()
3772
# (if (fboundp 'file-local-name)
3773
# (file-local-name (buffer-file-name))
3774
# (or (file-remote-p (buffer-file-name) 'localname)
3775
# (buffer-file-name))))
3776
# remove-test-window:
3777
# (lambda ()
3778
# (let ((test-window (get-buffer-window "*Test*")))
3779
# (if test-window (delete-window test-window))))
3780
# show-test-buffer-in-test-window:
3781
# (lambda ()
3782
# (when (not (get-buffer-window-list "*Test*"))
3783
# (setq next-error-last-buffer (get-buffer "*Test*"))
3784
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3785
# (display-buffer-overriding-action
3786
# `((display-buffer-in-side-window) (side . ,side)
3787
# (window-height . fit-window-to-buffer)
3788
# (window-width . fit-window-to-buffer))))
3789
# (display-buffer "*Test*"))))
3790
# eval:
3791
# (progn
3792
# (let* ((run-extra-tests (lambda () (interactive)
3793
# (funcall run-tests t)))
3794
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3795
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3796
# (setq minor-mode-overriding-map-alist
3797
# (cons `(run-tests . ,outer-keymap)
3798
# minor-mode-overriding-map-alist)))
3799
# (add-hook 'after-save-hook run-tests 90 t))
3800
# End:
3367
3368
if __name__ == '__main__':
3369
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0