To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 819
- compare with another revision
- download diff
- download tarball
- view history from revision 819
- Committer: Teddy Hogeborn
- Date: 2016-03-05 20:11:10 UTC
- Revision ID: teddy@recompile.se-20160305201110-6f7nws77k1h96e8k
errno is of type int, not error_t
* plugins.d/mandos-client.c (raise_privileges,
raise_privileges_permanently, lower_privileges,
lower_privileges_permanently, bring_up_interface,
take_down_interface, ): Change return type and all errno-containing
variables to type "int".
(get_flags): Change all errno-containing variables to type "int".
(main): Change all errno-containing variables to type "int", except
for values which are explicitly of type error_t.
* plugins.d/mandos-client.c (raise_privileges,
raise_privileges_permanently, lower_privileges,
lower_privileges_permanently, bring_up_interface,
take_down_interface, ): Change return type and all errno-containing
variables to type "int".
(get_flags): Change all errno-containing variables to type "int".
(main): Change all errno-containing variables to type "int", except
for values which are explicitly of type error_t.
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
77
73
import itertools
78
74
import collections
79
75
import codecs
80
import unittest
81
76
82
77
import dbus
83
78
import dbus.service
84
import gi
85
from gi.repository import GLib
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
86
84
from dbus.mainloop.glib import DBusGMainLoop
87
85
import ctypes
88
86
import ctypes.util
89
87
import xml.dom.minidom
90
88
import inspect
91
89
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
95
# Try to find the value of SO_BINDTODEVICE:
96
90
try:
97
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
98
# newer, and it is also the most natural place for it:
99
91
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
100
92
except AttributeError:
101
93
try:
102
# This is where SO_BINDTODEVICE was up to and including Python
103
# 2.6, and also 3.2:
104
94
from IN import SO_BINDTODEVICE
105
95
except ImportError:
106
# In Python 2.7 it seems to have been removed entirely.
107
# Try running the C preprocessor:
108
try:
109
cc = subprocess.Popen(["cc", "--language=c", "-E",
110
"/dev/stdin"],
111
stdin=subprocess.PIPE,
112
stdout=subprocess.PIPE)
113
stdout = cc.communicate(
114
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
115
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
116
except (OSError, ValueError, IndexError):
117
# No value found
118
SO_BINDTODEVICE = None
96
SO_BINDTODEVICE = None
119
97
120
98
if sys.version_info.major == 2:
121
99
str = unicode
122
100
123
if sys.version_info < (3, 2):
124
configparser.Configparser = configparser.SafeConfigParser
125
126
version = "1.8.8"
101
version = "1.7.3"
127
102
stored_state_file = "clients.pickle"
128
103
129
104
logger = logging.getLogger()
133
108
if_nametoindex = ctypes.cdll.LoadLibrary(
134
109
ctypes.util.find_library("c")).if_nametoindex
135
110
except (OSError, AttributeError):
136
111
137
112
def if_nametoindex(interface):
138
113
"Get an interface index the hard way, i.e. using fcntl()"
139
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
144
119
return interface_index
145
120
146
121
147
def copy_function(func):
148
"""Make a copy of a function"""
149
if sys.version_info.major == 2:
150
return types.FunctionType(func.func_code,
151
func.func_globals,
152
func.func_name,
153
func.func_defaults,
154
func.func_closure)
155
else:
156
return types.FunctionType(func.__code__,
157
func.__globals__,
158
func.__name__,
159
func.__defaults__,
160
func.__closure__)
161
162
163
122
def initlogger(debug, level=logging.WARNING):
164
123
"""init logger and add loglevel"""
165
124
166
125
global syslogger
167
126
syslogger = (logging.handlers.SysLogHandler(
168
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
169
address="/dev/log"))
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
170
129
syslogger.setFormatter(logging.Formatter
171
130
('Mandos [%(process)d]: %(levelname)s:'
172
131
' %(message)s'))
173
132
logger.addHandler(syslogger)
174
133
175
134
if debug:
176
135
console = logging.StreamHandler()
177
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
187
146
pass
188
147
189
148
190
class PGPEngine:
149
class PGPEngine(object):
191
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
192
151
193
152
def __init__(self):
194
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
195
154
self.gpg = "gpg"
196
155
try:
197
156
output = subprocess.check_output(["gpgconf"])
198
157
for line in output.splitlines():
199
name, text, path = line.split(b":")
158
name, text, path = line.split(":")
200
159
if name == "gpg":
201
160
self.gpg = path
202
161
break
206
165
self.gnupgargs = ['--batch',
207
166
'--homedir', self.tempdir,
208
167
'--force-mdc',
209
'--quiet']
210
# Only GPG version 1 has the --no-use-agent option.
211
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
212
self.gnupgargs.append("--no-use-agent")
213
168
'--quiet',
169
'--no-use-agent']
170
214
171
def __enter__(self):
215
172
return self
216
173
217
174
def __exit__(self, exc_type, exc_value, traceback):
218
175
self._cleanup()
219
176
return False
220
177
221
178
def __del__(self):
222
179
self._cleanup()
223
180
224
181
def _cleanup(self):
225
182
if self.tempdir is not None:
226
183
# Delete contents of tempdir
227
184
for root, dirs, files in os.walk(self.tempdir,
228
topdown=False):
185
topdown = False):
229
186
for filename in files:
230
187
os.remove(os.path.join(root, filename))
231
188
for dirname in dirs:
233
190
# Remove tempdir
234
191
os.rmdir(self.tempdir)
235
192
self.tempdir = None
236
193
237
194
def password_encode(self, password):
238
195
# Passphrase can not be empty and can not contain newlines or
239
196
# NUL bytes. So we prefix it and hex encode it.
244
201
.replace(b"\n", b"\\n")
245
202
.replace(b"\0", b"\\x00"))
246
203
return encoded
247
204
248
205
def encrypt(self, data, password):
249
206
passphrase = self.password_encode(password)
250
207
with tempfile.NamedTemporaryFile(
255
212
'--passphrase-file',
256
213
passfile.name]
257
214
+ self.gnupgargs,
258
stdin=subprocess.PIPE,
259
stdout=subprocess.PIPE,
260
stderr=subprocess.PIPE)
261
ciphertext, err = proc.communicate(input=data)
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
262
219
if proc.returncode != 0:
263
220
raise PGPError(err)
264
221
return ciphertext
265
222
266
223
def decrypt(self, data, password):
267
224
passphrase = self.password_encode(password)
268
225
with tempfile.NamedTemporaryFile(
269
dir=self.tempdir) as passfile:
226
dir = self.tempdir) as passfile:
270
227
passfile.write(passphrase)
271
228
passfile.flush()
272
229
proc = subprocess.Popen([self.gpg, '--decrypt',
273
230
'--passphrase-file',
274
231
passfile.name]
275
232
+ self.gnupgargs,
276
stdin=subprocess.PIPE,
277
stdout=subprocess.PIPE,
278
stderr=subprocess.PIPE)
279
decrypted_plaintext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
280
237
if proc.returncode != 0:
281
238
raise PGPError(err)
282
239
return decrypted_plaintext
283
240
284
241
285
# Pretend that we have an Avahi module
286
class avahi:
287
"""This isn't so much a class as it is a module-like namespace."""
288
IF_UNSPEC = -1 # avahi-common/address.h
289
PROTO_UNSPEC = -1 # avahi-common/address.h
290
PROTO_INET = 0 # avahi-common/address.h
291
PROTO_INET6 = 1 # avahi-common/address.h
292
DBUS_NAME = "org.freedesktop.Avahi"
293
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
294
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
295
DBUS_PATH_SERVER = "/"
296
297
@staticmethod
298
def string_array_to_txt_array(t):
299
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
300
for s in t), signature="ay")
301
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
302
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
303
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
304
SERVER_INVALID = 0 # avahi-common/defs.h
305
SERVER_REGISTERING = 1 # avahi-common/defs.h
306
SERVER_RUNNING = 2 # avahi-common/defs.h
307
SERVER_COLLISION = 3 # avahi-common/defs.h
308
SERVER_FAILURE = 4 # avahi-common/defs.h
309
310
311
242
class AvahiError(Exception):
312
243
def __init__(self, value, *args, **kwargs):
313
244
self.value = value
323
254
pass
324
255
325
256
326
class AvahiService:
257
class AvahiService(object):
327
258
"""An Avahi (Zeroconf) service.
328
259
329
260
Attributes:
330
261
interface: integer; avahi.IF_UNSPEC or an interface index.
331
262
Used to optionally bind to the specified interface.
343
274
server: D-Bus Server
344
275
bus: dbus.SystemBus()
345
276
"""
346
277
347
278
def __init__(self,
348
interface=avahi.IF_UNSPEC,
349
name=None,
350
servicetype=None,
351
port=None,
352
TXT=None,
353
domain="",
354
host="",
355
max_renames=32768,
356
protocol=avahi.PROTO_UNSPEC,
357
bus=None):
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
358
289
self.interface = interface
359
290
self.name = name
360
291
self.type = servicetype
369
300
self.server = None
370
301
self.bus = bus
371
302
self.entry_group_state_changed_match = None
372
303
373
304
def rename(self, remove=True):
374
305
"""Derived from the Avahi example code"""
375
306
if self.rename_count >= self.max_renames:
395
326
logger.critical("D-Bus Exception", exc_info=error)
396
327
self.cleanup()
397
328
os._exit(1)
398
329
399
330
def remove(self):
400
331
"""Derived from the Avahi example code"""
401
332
if self.entry_group_state_changed_match is not None:
403
334
self.entry_group_state_changed_match = None
404
335
if self.group is not None:
405
336
self.group.Reset()
406
337
407
338
def add(self):
408
339
"""Derived from the Avahi example code"""
409
340
self.remove()
426
357
dbus.UInt16(self.port),
427
358
avahi.string_array_to_txt_array(self.TXT))
428
359
self.group.Commit()
429
360
430
361
def entry_group_state_changed(self, state, error):
431
362
"""Derived from the Avahi example code"""
432
363
logger.debug("Avahi entry group state change: %i", state)
433
364
434
365
if state == avahi.ENTRY_GROUP_ESTABLISHED:
435
366
logger.debug("Zeroconf service established.")
436
367
elif state == avahi.ENTRY_GROUP_COLLISION:
440
371
logger.critical("Avahi: Error in group state changed %s",
441
372
str(error))
442
373
raise AvahiGroupError("State changed: {!s}".format(error))
443
374
444
375
def cleanup(self):
445
376
"""Derived from the Avahi example code"""
446
377
if self.group is not None:
451
382
pass
452
383
self.group = None
453
384
self.remove()
454
385
455
386
def server_state_changed(self, state, error=None):
456
387
"""Derived from the Avahi example code"""
457
388
logger.debug("Avahi server state change: %i", state)
486
417
logger.debug("Unknown state: %r", state)
487
418
else:
488
419
logger.debug("Unknown state: %r: %r", state, error)
489
420
490
421
def activate(self):
491
422
"""Derived from the Avahi example code"""
492
423
if self.server is None:
503
434
class AvahiServiceToSyslog(AvahiService):
504
435
def rename(self, *args, **kwargs):
505
436
"""Add the new name to the syslog messages"""
506
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
437
ret = AvahiService.rename(self, *args, **kwargs)
507
438
syslogger.setFormatter(logging.Formatter(
508
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
509
440
.format(self.name)))
510
441
return ret
511
442
512
513
443
# Pretend that we have a GnuTLS module
514
class gnutls:
515
"""This isn't so much a class as it is a module-like namespace."""
516
517
library = ctypes.util.find_library("gnutls")
518
if library is None:
519
library = ctypes.util.find_library("gnutls-deb0")
520
_library = ctypes.cdll.LoadLibrary(library)
521
del library
522
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
523
459
# Unless otherwise indicated, the constants and types below are
524
460
# all from the gnutls/gnutls.h C header file.
525
461
526
462
# Constants
527
463
E_SUCCESS = 0
528
464
E_INTERRUPTED = -52
529
465
E_AGAIN = -28
530
466
CRT_OPENPGP = 2
531
CRT_RAWPK = 3
532
467
CLIENT = 2
533
468
SHUT_RDWR = 0
534
469
CRD_CERTIFICATE = 1
535
470
E_NO_CERTIFICATE_FOUND = -49
536
X509_FMT_DER = 0
537
NO_TICKETS = 1<<10
538
ENABLE_RAWPK = 1<<18
539
CTYPE_PEERS = 3
540
KEYID_USE_SHA256 = 1 # gnutls/x509.h
541
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
542
472
543
473
# Types
544
474
class session_int(ctypes.Structure):
545
475
_fields_ = []
546
476
session_t = ctypes.POINTER(session_int)
547
548
477
class certificate_credentials_st(ctypes.Structure):
549
478
_fields_ = []
550
479
certificate_credentials_t = ctypes.POINTER(
551
480
certificate_credentials_st)
552
481
certificate_type_t = ctypes.c_int
553
554
482
class datum_t(ctypes.Structure):
555
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
556
484
('size', ctypes.c_uint)]
557
558
485
class openpgp_crt_int(ctypes.Structure):
559
486
_fields_ = []
560
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
561
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
562
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
563
credentials_type_t = ctypes.c_int
490
credentials_type_t = ctypes.c_int #
564
491
transport_ptr_t = ctypes.c_void_p
565
492
close_request_t = ctypes.c_int
566
493
567
494
# Exceptions
568
495
class Error(Exception):
569
def __init__(self, message=None, code=None, args=()):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
570
501
# Default usage is by a message string, but if a return
571
502
# code is passed, convert it to a string with
572
503
# gnutls.strerror()
573
504
self.code = code
574
505
if message is None and code is not None:
575
message = gnutls.strerror(code)
576
return super(gnutls.Error, self).__init__(
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
577
508
message, *args)
578
509
579
510
class CertificateSecurityError(Error):
580
511
pass
581
512
582
513
# Classes
583
class Credentials:
514
class Credentials(object):
584
515
def __init__(self):
585
516
self._c_object = gnutls.certificate_credentials_t()
586
517
gnutls.certificate_allocate_credentials(
587
518
ctypes.byref(self._c_object))
588
519
self.type = gnutls.CRD_CERTIFICATE
589
520
590
521
def __del__(self):
591
522
gnutls.certificate_free_credentials(self._c_object)
592
593
class ClientSession:
594
def __init__(self, socket, credentials=None):
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
595
526
self._c_object = gnutls.session_t()
596
gnutls_flags = gnutls.CLIENT
597
if gnutls.check_version(b"3.5.6"):
598
gnutls_flags |= gnutls.NO_TICKETS
599
if gnutls.has_rawpk:
600
gnutls_flags |= gnutls.ENABLE_RAWPK
601
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
602
del gnutls_flags
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
603
528
gnutls.set_default_priority(self._c_object)
604
529
gnutls.transport_set_ptr(self._c_object, socket.fileno())
605
530
gnutls.handshake_set_private_extensions(self._c_object,
611
536
ctypes.cast(credentials._c_object,
612
537
ctypes.c_void_p))
613
538
self.credentials = credentials
614
539
615
540
def __del__(self):
616
541
gnutls.deinit(self._c_object)
617
542
618
543
def handshake(self):
619
544
return gnutls.handshake(self._c_object)
620
545
621
546
def send(self, data):
622
547
data = bytes(data)
623
548
data_len = len(data)
625
550
data_len -= gnutls.record_send(self._c_object,
626
551
data[-data_len:],
627
552
data_len)
628
553
629
554
def bye(self):
630
555
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
631
556
632
557
# Error handling functions
633
558
def _error_code(result):
634
559
"""A function to raise exceptions on errors, suitable
636
561
if result >= 0:
637
562
return result
638
563
if result == gnutls.E_NO_CERTIFICATE_FOUND:
639
raise gnutls.CertificateSecurityError(code=result)
640
raise gnutls.Error(code=result)
641
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
642
567
def _retry_on_error(result, func, arguments):
643
568
"""A function to retry on some errors, suitable
644
569
for the 'errcheck' attribute on ctypes functions"""
647
572
return _error_code(result)
648
573
result = func(*arguments)
649
574
return result
650
575
651
576
# Unless otherwise indicated, the function declarations below are
652
577
# all from the gnutls/gnutls.h C header file.
653
578
654
579
# Functions
655
580
priority_set_direct = _library.gnutls_priority_set_direct
656
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
657
582
ctypes.POINTER(ctypes.c_char_p)]
658
583
priority_set_direct.restype = _error_code
659
584
660
585
init = _library.gnutls_init
661
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
662
587
init.restype = _error_code
663
588
664
589
set_default_priority = _library.gnutls_set_default_priority
665
590
set_default_priority.argtypes = [session_t]
666
591
set_default_priority.restype = _error_code
667
592
668
593
record_send = _library.gnutls_record_send
669
594
record_send.argtypes = [session_t, ctypes.c_void_p,
670
595
ctypes.c_size_t]
671
596
record_send.restype = ctypes.c_ssize_t
672
597
record_send.errcheck = _retry_on_error
673
598
674
599
certificate_allocate_credentials = (
675
600
_library.gnutls_certificate_allocate_credentials)
676
601
certificate_allocate_credentials.argtypes = [
677
602
ctypes.POINTER(certificate_credentials_t)]
678
603
certificate_allocate_credentials.restype = _error_code
679
604
680
605
certificate_free_credentials = (
681
606
_library.gnutls_certificate_free_credentials)
682
certificate_free_credentials.argtypes = [
683
certificate_credentials_t]
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
684
608
certificate_free_credentials.restype = None
685
609
686
610
handshake_set_private_extensions = (
687
611
_library.gnutls_handshake_set_private_extensions)
688
612
handshake_set_private_extensions.argtypes = [session_t,
689
613
ctypes.c_int]
690
614
handshake_set_private_extensions.restype = None
691
615
692
616
credentials_set = _library.gnutls_credentials_set
693
617
credentials_set.argtypes = [session_t, credentials_type_t,
694
618
ctypes.c_void_p]
695
619
credentials_set.restype = _error_code
696
620
697
621
strerror = _library.gnutls_strerror
698
622
strerror.argtypes = [ctypes.c_int]
699
623
strerror.restype = ctypes.c_char_p
700
624
701
625
certificate_type_get = _library.gnutls_certificate_type_get
702
626
certificate_type_get.argtypes = [session_t]
703
627
certificate_type_get.restype = _error_code
704
628
705
629
certificate_get_peers = _library.gnutls_certificate_get_peers
706
630
certificate_get_peers.argtypes = [session_t,
707
631
ctypes.POINTER(ctypes.c_uint)]
708
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
709
633
710
634
global_set_log_level = _library.gnutls_global_set_log_level
711
635
global_set_log_level.argtypes = [ctypes.c_int]
712
636
global_set_log_level.restype = None
713
637
714
638
global_set_log_function = _library.gnutls_global_set_log_function
715
639
global_set_log_function.argtypes = [log_func]
716
640
global_set_log_function.restype = None
717
641
718
642
deinit = _library.gnutls_deinit
719
643
deinit.argtypes = [session_t]
720
644
deinit.restype = None
721
645
722
646
handshake = _library.gnutls_handshake
723
647
handshake.argtypes = [session_t]
724
648
handshake.restype = _error_code
725
649
handshake.errcheck = _retry_on_error
726
650
727
651
transport_set_ptr = _library.gnutls_transport_set_ptr
728
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
729
653
transport_set_ptr.restype = None
730
654
731
655
bye = _library.gnutls_bye
732
656
bye.argtypes = [session_t, close_request_t]
733
657
bye.restype = _error_code
734
658
bye.errcheck = _retry_on_error
735
659
736
660
check_version = _library.gnutls_check_version
737
661
check_version.argtypes = [ctypes.c_char_p]
738
662
check_version.restype = ctypes.c_char_p
739
740
_need_version = b"3.3.0"
741
if check_version(_need_version) is None:
742
raise self.Error("Needs GnuTLS {} or later"
743
.format(_need_version))
744
745
_tls_rawpk_version = b"3.6.6"
746
has_rawpk = bool(check_version(_tls_rawpk_version))
747
748
if has_rawpk:
749
# Types
750
class pubkey_st(ctypes.Structure):
751
_fields = []
752
pubkey_t = ctypes.POINTER(pubkey_st)
753
754
x509_crt_fmt_t = ctypes.c_int
755
756
# All the function declarations below are from gnutls/abstract.h
757
pubkey_init = _library.gnutls_pubkey_init
758
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
759
pubkey_init.restype = _error_code
760
761
pubkey_import = _library.gnutls_pubkey_import
762
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
763
x509_crt_fmt_t]
764
pubkey_import.restype = _error_code
765
766
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
767
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
768
ctypes.POINTER(ctypes.c_ubyte),
769
ctypes.POINTER(ctypes.c_size_t)]
770
pubkey_get_key_id.restype = _error_code
771
772
pubkey_deinit = _library.gnutls_pubkey_deinit
773
pubkey_deinit.argtypes = [pubkey_t]
774
pubkey_deinit.restype = None
775
else:
776
# All the function declarations below are from gnutls/openpgp.h
777
778
openpgp_crt_init = _library.gnutls_openpgp_crt_init
779
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
780
openpgp_crt_init.restype = _error_code
781
782
openpgp_crt_import = _library.gnutls_openpgp_crt_import
783
openpgp_crt_import.argtypes = [openpgp_crt_t,
784
ctypes.POINTER(datum_t),
785
openpgp_crt_fmt_t]
786
openpgp_crt_import.restype = _error_code
787
788
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
789
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
790
ctypes.POINTER(ctypes.c_uint)]
791
openpgp_crt_verify_self.restype = _error_code
792
793
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
794
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
795
openpgp_crt_deinit.restype = None
796
797
openpgp_crt_get_fingerprint = (
798
_library.gnutls_openpgp_crt_get_fingerprint)
799
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
800
ctypes.c_void_p,
801
ctypes.POINTER(
802
ctypes.c_size_t)]
803
openpgp_crt_get_fingerprint.restype = _error_code
804
805
if check_version(b"3.6.4"):
806
certificate_type_get2 = _library.gnutls_certificate_type_get2
807
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
808
certificate_type_get2.restype = _error_code
809
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
810
693
# Remove non-public functions
811
694
del _error_code, _retry_on_error
812
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
813
697
814
698
def call_pipe(connection, # : multiprocessing.Connection
815
699
func, *args, **kwargs):
816
700
"""This function is meant to be called by multiprocessing.Process
817
701
818
702
This function runs func(*args, **kwargs), and writes the resulting
819
703
return value on the provided multiprocessing.Connection.
820
704
"""
821
705
connection.send(func(*args, **kwargs))
822
706
connection.close()
823
707
824
825
class Client:
708
class Client(object):
826
709
"""A representation of a client host served by this server.
827
710
828
711
Attributes:
829
712
approved: bool(); 'None' if not yet approved/disapproved
830
713
approval_delay: datetime.timedelta(); Time to wait for approval
831
714
approval_duration: datetime.timedelta(); Duration of one approval
832
checker: multiprocessing.Process(); a running checker process used
833
to see if the client lives. 'None' if no process is
834
running.
835
checker_callback_tag: a GLib event source tag, or None
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a gobject event source tag, or None
836
719
checker_command: string; External command which is run to check
837
720
if client lives. %() expansions are done at
838
721
runtime with vars(self) as dict, so that for
839
722
instance %(name)s can be used in the command.
840
checker_initiator_tag: a GLib event source tag, or None
723
checker_initiator_tag: a gobject event source tag, or None
841
724
created: datetime.datetime(); (UTC) object creation
842
725
client_structure: Object describing what attributes a client has
843
726
and is used for storing the client at exit
844
727
current_checker_command: string; current running checker_command
845
disable_initiator_tag: a GLib event source tag, or None
728
disable_initiator_tag: a gobject event source tag, or None
846
729
enabled: bool()
847
730
fingerprint: string (40 or 32 hexadecimal digits); used to
848
uniquely identify an OpenPGP client
849
key_id: string (64 hexadecimal digits); used to uniquely identify
850
a client using raw public keys
731
uniquely identify the client
851
732
host: string; available for use by the checker command
852
733
interval: datetime.timedelta(); How often to start a new checker
853
734
last_approval_request: datetime.datetime(); (UTC) or None
869
750
disabled, or None
870
751
server_settings: The server_settings dict from main()
871
752
"""
872
753
873
754
runtime_expansions = ("approval_delay", "approval_duration",
874
"created", "enabled", "expires", "key_id",
755
"created", "enabled", "expires",
875
756
"fingerprint", "host", "interval",
876
757
"last_approval_request", "last_checked_ok",
877
758
"last_enabled", "name", "timeout")
886
767
"approved_by_default": "True",
887
768
"enabled": "True",
888
769
}
889
770
890
771
@staticmethod
891
772
def config_parser(config):
892
773
"""Construct a new dict of client settings of this form:
899
780
for client_name in config.sections():
900
781
section = dict(config.items(client_name))
901
782
client = settings[client_name] = {}
902
783
903
784
client["host"] = section["host"]
904
785
# Reformat values from string types to Python types
905
786
client["approved_by_default"] = config.getboolean(
906
787
client_name, "approved_by_default")
907
788
client["enabled"] = config.getboolean(client_name,
908
789
"enabled")
909
910
# Uppercase and remove spaces from key_id and fingerprint
911
# for later comparison purposes with return value from the
912
# key_id() and fingerprint() functions
913
client["key_id"] = (section.get("key_id", "").upper()
914
.replace(" ", ""))
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
915
794
client["fingerprint"] = (section["fingerprint"].upper()
916
795
.replace(" ", ""))
917
796
if "secret" in section:
918
client["secret"] = codecs.decode(section["secret"]
919
.encode("utf-8"),
920
"base64")
797
client["secret"] = section["secret"].decode("base64")
921
798
elif "secfile" in section:
922
799
with open(os.path.expanduser(os.path.expandvars
923
800
(section["secfile"])),
938
815
client["last_approval_request"] = None
939
816
client["last_checked_ok"] = None
940
817
client["last_checker_status"] = -2
941
818
942
819
return settings
943
944
def __init__(self, settings, name=None, server_settings=None):
820
821
def __init__(self, settings, name = None, server_settings=None):
945
822
self.name = name
946
823
if server_settings is None:
947
824
server_settings = {}
949
826
# adding all client settings
950
827
for setting, value in settings.items():
951
828
setattr(self, setting, value)
952
829
953
830
if self.enabled:
954
831
if not hasattr(self, "last_enabled"):
955
832
self.last_enabled = datetime.datetime.utcnow()
959
836
else:
960
837
self.last_enabled = None
961
838
self.expires = None
962
839
963
840
logger.debug("Creating client %r", self.name)
964
logger.debug(" Key ID: %s", self.key_id)
965
841
logger.debug(" Fingerprint: %s", self.fingerprint)
966
842
self.created = settings.get("created",
967
843
datetime.datetime.utcnow())
968
844
969
845
# attributes specific for this server instance
970
846
self.checker = None
971
847
self.checker_initiator_tag = None
977
853
self.changedstate = multiprocessing_manager.Condition(
978
854
multiprocessing_manager.Lock())
979
855
self.client_structure = [attr
980
for attr in self.__dict__.keys()
856
for attr in self.__dict__.iterkeys()
981
857
if not attr.startswith("_")]
982
858
self.client_structure.append("client_structure")
983
859
984
860
for name, t in inspect.getmembers(
985
861
type(self), lambda obj: isinstance(obj, property)):
986
862
if not name.startswith("_"):
987
863
self.client_structure.append(name)
988
864
989
865
# Send notice to process children that client state has changed
990
866
def send_changedstate(self):
991
867
with self.changedstate:
992
868
self.changedstate.notify_all()
993
869
994
870
def enable(self):
995
871
"""Start this client's checker and timeout hooks"""
996
872
if getattr(self, "enabled", False):
1001
877
self.last_enabled = datetime.datetime.utcnow()
1002
878
self.init_checker()
1003
879
self.send_changedstate()
1004
880
1005
881
def disable(self, quiet=True):
1006
882
"""Disable this client."""
1007
883
if not getattr(self, "enabled", False):
1009
885
if not quiet:
1010
886
logger.info("Disabling client %s", self.name)
1011
887
if getattr(self, "disable_initiator_tag", None) is not None:
1012
GLib.source_remove(self.disable_initiator_tag)
888
gobject.source_remove(self.disable_initiator_tag)
1013
889
self.disable_initiator_tag = None
1014
890
self.expires = None
1015
891
if getattr(self, "checker_initiator_tag", None) is not None:
1016
GLib.source_remove(self.checker_initiator_tag)
892
gobject.source_remove(self.checker_initiator_tag)
1017
893
self.checker_initiator_tag = None
1018
894
self.stop_checker()
1019
895
self.enabled = False
1020
896
if not quiet:
1021
897
self.send_changedstate()
1022
# Do not run this again if called by a GLib.timeout_add
898
# Do not run this again if called by a gobject.timeout_add
1023
899
return False
1024
900
1025
901
def __del__(self):
1026
902
self.disable()
1027
903
1028
904
def init_checker(self):
1029
905
# Schedule a new checker to be started an 'interval' from now,
1030
906
# and every interval from then on.
1031
907
if self.checker_initiator_tag is not None:
1032
GLib.source_remove(self.checker_initiator_tag)
1033
self.checker_initiator_tag = GLib.timeout_add(
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
1034
910
int(self.interval.total_seconds() * 1000),
1035
911
self.start_checker)
1036
912
# Schedule a disable() when 'timeout' has passed
1037
913
if self.disable_initiator_tag is not None:
1038
GLib.source_remove(self.disable_initiator_tag)
1039
self.disable_initiator_tag = GLib.timeout_add(
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
1040
916
int(self.timeout.total_seconds() * 1000), self.disable)
1041
917
# Also start a new checker *right now*.
1042
918
self.start_checker()
1043
919
1044
920
def checker_callback(self, source, condition, connection,
1045
921
command):
1046
922
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
924
self.checker = None
1047
925
# Read return code from connection (see call_pipe)
1048
926
returncode = connection.recv()
1049
927
connection.close()
1050
self.checker.join()
1051
self.checker_callback_tag = None
1052
self.checker = None
1053
928
1054
929
if returncode >= 0:
1055
930
self.last_checker_status = returncode
1056
931
self.last_checker_signal = None
1066
941
logger.warning("Checker for %(name)s crashed?",
1067
942
vars(self))
1068
943
return False
1069
944
1070
945
def checked_ok(self):
1071
946
"""Assert that the client has been seen, alive and well."""
1072
947
self.last_checked_ok = datetime.datetime.utcnow()
1073
948
self.last_checker_status = 0
1074
949
self.last_checker_signal = None
1075
950
self.bump_timeout()
1076
951
1077
952
def bump_timeout(self, timeout=None):
1078
953
"""Bump up the timeout for this client."""
1079
954
if timeout is None:
1080
955
timeout = self.timeout
1081
956
if self.disable_initiator_tag is not None:
1082
GLib.source_remove(self.disable_initiator_tag)
957
gobject.source_remove(self.disable_initiator_tag)
1083
958
self.disable_initiator_tag = None
1084
959
if getattr(self, "enabled", False):
1085
self.disable_initiator_tag = GLib.timeout_add(
960
self.disable_initiator_tag = gobject.timeout_add(
1086
961
int(timeout.total_seconds() * 1000), self.disable)
1087
962
self.expires = datetime.datetime.utcnow() + timeout
1088
963
1089
964
def need_approval(self):
1090
965
self.last_approval_request = datetime.datetime.utcnow()
1091
966
1092
967
def start_checker(self):
1093
968
"""Start a new checker subprocess if one is not running.
1094
969
1095
970
If a checker already exists, leave it running and do
1096
971
nothing."""
1097
972
# The reason for not killing a running checker is that if we
1102
977
# checkers alone, the checker would have to take more time
1103
978
# than 'timeout' for the client to be disabled, which is as it
1104
979
# should be.
1105
980
1106
981
if self.checker is not None and not self.checker.is_alive():
1107
982
logger.warning("Checker was not alive; joining")
1108
983
self.checker.join()
1112
987
# Escape attributes for the shell
1113
988
escaped_attrs = {
1114
989
attr: re.escape(str(getattr(self, attr)))
1115
for attr in self.runtime_expansions}
990
for attr in self.runtime_expansions }
1116
991
try:
1117
992
command = self.checker_command % escaped_attrs
1118
993
except TypeError as error:
1130
1005
# The exception is when not debugging but nevertheless
1131
1006
# running in the foreground; use the previously
1132
1007
# created wnull.
1133
popen_args = {"close_fds": True,
1134
"shell": True,
1135
"cwd": "/"}
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1136
1011
if (not self.server_settings["debug"]
1137
1012
and self.server_settings["foreground"]):
1138
1013
popen_args.update({"stdout": wnull,
1139
"stderr": wnull})
1140
pipe = multiprocessing.Pipe(duplex=False)
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1141
1016
self.checker = multiprocessing.Process(
1142
target=call_pipe,
1143
args=(pipe[1], subprocess.call, command),
1144
kwargs=popen_args)
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1145
1020
self.checker.start()
1146
self.checker_callback_tag = GLib.io_add_watch(
1147
pipe[0].fileno(), GLib.IO_IN,
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1148
1023
self.checker_callback, pipe[0], command)
1149
# Re-run this periodically if run by GLib.timeout_add
1024
# Re-run this periodically if run by gobject.timeout_add
1150
1025
return True
1151
1026
1152
1027
def stop_checker(self):
1153
1028
"""Force the checker process, if any, to stop."""
1154
1029
if self.checker_callback_tag:
1155
GLib.source_remove(self.checker_callback_tag)
1030
gobject.source_remove(self.checker_callback_tag)
1156
1031
self.checker_callback_tag = None
1157
1032
if getattr(self, "checker", None) is None:
1158
1033
return
1167
1042
byte_arrays=False):
1168
1043
"""Decorators for marking methods of a DBusObjectWithProperties to
1169
1044
become properties on the D-Bus.
1170
1045
1171
1046
The decorated method will be called with no arguments by "Get"
1172
1047
and with one argument by "Set".
1173
1048
1174
1049
The parameters, where they are supported, are the same as
1175
1050
dbus.service.method, except there is only "signature", since the
1176
1051
type from Get() and the type sent to Set() is the same.
1180
1055
if byte_arrays and signature != "ay":
1181
1056
raise ValueError("Byte arrays not supported for non-'ay'"
1182
1057
" signature {!r}".format(signature))
1183
1058
1184
1059
def decorator(func):
1185
1060
func._dbus_is_property = True
1186
1061
func._dbus_interface = dbus_interface
1189
1064
func._dbus_name = func.__name__
1190
1065
if func._dbus_name.endswith("_dbus_property"):
1191
1066
func._dbus_name = func._dbus_name[:-14]
1192
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1193
1068
return func
1194
1069
1195
1070
return decorator
1196
1071
1197
1072
1198
1073
def dbus_interface_annotations(dbus_interface):
1199
1074
"""Decorator for marking functions returning interface annotations
1200
1075
1201
1076
Usage:
1202
1077
1203
1078
@dbus_interface_annotations("org.example.Interface")
1204
1079
def _foo(self): # Function name does not matter
1205
1080
return {"org.freedesktop.DBus.Deprecated": "true",
1206
1081
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1207
1082
"false"}
1208
1083
"""
1209
1084
1210
1085
def decorator(func):
1211
1086
func._dbus_is_interface = True
1212
1087
func._dbus_interface = dbus_interface
1213
1088
func._dbus_name = dbus_interface
1214
1089
return func
1215
1090
1216
1091
return decorator
1217
1092
1218
1093
1219
1094
def dbus_annotations(annotations):
1220
1095
"""Decorator to annotate D-Bus methods, signals or properties
1221
1096
Usage:
1222
1097
1223
1098
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1224
1099
"org.freedesktop.DBus.Property."
1225
1100
"EmitsChangedSignal": "false"})
1227
1102
access="r")
1228
1103
def Property_dbus_property(self):
1229
1104
return dbus.Boolean(False)
1230
1105
1231
1106
See also the DBusObjectWithAnnotations class.
1232
1107
"""
1233
1108
1234
1109
def decorator(func):
1235
1110
func._dbus_annotations = annotations
1236
1111
return func
1237
1112
1238
1113
return decorator
1239
1114
1240
1115
1258
1133
1259
1134
class DBusObjectWithAnnotations(dbus.service.Object):
1260
1135
"""A D-Bus object with annotations.
1261
1136
1262
1137
Classes inheriting from this can use the dbus_annotations
1263
1138
decorator to add annotations to methods or signals.
1264
1139
"""
1265
1140
1266
1141
@staticmethod
1267
1142
def _is_dbus_thing(thing):
1268
1143
"""Returns a function testing if an attribute is a D-Bus thing
1269
1144
1270
1145
If called like _is_dbus_thing("method") it returns a function
1271
1146
suitable for use as predicate to inspect.getmembers().
1272
1147
"""
1273
1148
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1274
1149
False)
1275
1150
1276
1151
def _get_all_dbus_things(self, thing):
1277
1152
"""Returns a generator of (name, attribute) pairs
1278
1153
"""
1281
1156
for cls in self.__class__.__mro__
1282
1157
for name, athing in
1283
1158
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1284
1159
1285
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1286
out_signature="s",
1287
path_keyword='object_path',
1288
connection_keyword='connection')
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1289
1164
def Introspect(self, object_path, connection):
1290
1165
"""Overloading of standard D-Bus method.
1291
1166
1292
1167
Inserts annotation tags on methods and signals.
1293
1168
"""
1294
1169
xmlstring = dbus.service.Object.Introspect(self, object_path,
1295
1170
connection)
1296
1171
try:
1297
1172
document = xml.dom.minidom.parseString(xmlstring)
1298
1173
1299
1174
for if_tag in document.getElementsByTagName("interface"):
1300
1175
# Add annotation tags
1301
1176
for typ in ("method", "signal"):
1328
1203
if_tag.appendChild(ann_tag)
1329
1204
# Fix argument name for the Introspect method itself
1330
1205
if (if_tag.getAttribute("name")
1331
== dbus.INTROSPECTABLE_IFACE):
1206
== dbus.INTROSPECTABLE_IFACE):
1332
1207
for cn in if_tag.getElementsByTagName("method"):
1333
1208
if cn.getAttribute("name") == "Introspect":
1334
1209
for arg in cn.getElementsByTagName("arg"):
1347
1222
1348
1223
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1349
1224
"""A D-Bus object with properties.
1350
1225
1351
1226
Classes inheriting from this can use the dbus_service_property
1352
1227
decorator to expose methods as D-Bus properties. It exposes the
1353
1228
standard Get(), Set(), and GetAll() methods on the D-Bus.
1354
1229
"""
1355
1230
1356
1231
def _get_dbus_property(self, interface_name, property_name):
1357
1232
"""Returns a bound method if one exists which is a D-Bus
1358
1233
property with the specified name and interface.
1363
1238
if (value._dbus_name == property_name
1364
1239
and value._dbus_interface == interface_name):
1365
1240
return value.__get__(self)
1366
1241
1367
1242
# No such property
1368
1243
raise DBusPropertyNotFound("{}:{}.{}".format(
1369
1244
self.dbus_object_path, interface_name, property_name))
1370
1245
1371
1246
@classmethod
1372
1247
def _get_all_interface_names(cls):
1373
1248
"""Get a sequence of all interfaces supported by an object"""
1376
1251
for x in (inspect.getmro(cls))
1377
1252
for attr in dir(x))
1378
1253
if name is not None)
1379
1254
1380
1255
@dbus.service.method(dbus.PROPERTIES_IFACE,
1381
1256
in_signature="ss",
1382
1257
out_signature="v")
1390
1265
if not hasattr(value, "variant_level"):
1391
1266
return value
1392
1267
return type(value)(value, variant_level=value.variant_level+1)
1393
1268
1394
1269
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1395
1270
def Set(self, interface_name, property_name, value):
1396
1271
"""Standard D-Bus property Set() method, see D-Bus standard.
1408
1283
value = dbus.ByteArray(b''.join(chr(byte)
1409
1284
for byte in value))
1410
1285
prop(value)
1411
1286
1412
1287
@dbus.service.method(dbus.PROPERTIES_IFACE,
1413
1288
in_signature="s",
1414
1289
out_signature="a{sv}")
1415
1290
def GetAll(self, interface_name):
1416
1291
"""Standard D-Bus property GetAll() method, see D-Bus
1417
1292
standard.
1418
1293
1419
1294
Note: Will not include properties with access="write".
1420
1295
"""
1421
1296
properties = {}
1432
1307
properties[name] = value
1433
1308
continue
1434
1309
properties[name] = type(value)(
1435
value, variant_level=value.variant_level + 1)
1310
value, variant_level = value.variant_level + 1)
1436
1311
return dbus.Dictionary(properties, signature="sv")
1437
1312
1438
1313
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1439
1314
def PropertiesChanged(self, interface_name, changed_properties,
1440
1315
invalidated_properties):
1442
1317
standard.
1443
1318
"""
1444
1319
pass
1445
1320
1446
1321
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1447
1322
out_signature="s",
1448
1323
path_keyword='object_path',
1449
1324
connection_keyword='connection')
1450
1325
def Introspect(self, object_path, connection):
1451
1326
"""Overloading of standard D-Bus method.
1452
1327
1453
1328
Inserts property tags and interface annotation tags.
1454
1329
"""
1455
1330
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1457
1332
connection)
1458
1333
try:
1459
1334
document = xml.dom.minidom.parseString(xmlstring)
1460
1335
1461
1336
def make_tag(document, name, prop):
1462
1337
e = document.createElement("property")
1463
1338
e.setAttribute("name", name)
1464
1339
e.setAttribute("type", prop._dbus_signature)
1465
1340
e.setAttribute("access", prop._dbus_access)
1466
1341
return e
1467
1342
1468
1343
for if_tag in document.getElementsByTagName("interface"):
1469
1344
# Add property tags
1470
1345
for tag in (make_tag(document, name, prop)
1512
1387
exc_info=error)
1513
1388
return xmlstring
1514
1389
1515
1516
1390
try:
1517
1391
dbus.OBJECT_MANAGER_IFACE
1518
1392
except AttributeError:
1519
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1520
1394
1521
1522
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1523
1396
"""A D-Bus object with an ObjectManager.
1524
1397
1525
1398
Classes inheriting from this exposes the standard
1526
1399
GetManagedObjects call and the InterfacesAdded and
1527
1400
InterfacesRemoved signals on the standard
1528
1401
"org.freedesktop.DBus.ObjectManager" interface.
1529
1402
1530
1403
Note: No signals are sent automatically; they must be sent
1531
1404
manually.
1532
1405
"""
1533
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1534
out_signature="a{oa{sa{sv}}}")
1407
out_signature = "a{oa{sa{sv}}}")
1535
1408
def GetManagedObjects(self):
1536
1409
"""This function must be overridden"""
1537
1410
raise NotImplementedError()
1538
1411
1539
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1540
signature="oa{sa{sv}}")
1413
signature = "oa{sa{sv}}")
1541
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1542
1415
pass
1543
1544
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1545
1418
def InterfacesRemoved(self, object_path, interfaces):
1546
1419
pass
1547
1420
1548
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1549
out_signature="s",
1550
path_keyword='object_path',
1551
connection_keyword='connection')
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1552
1425
def Introspect(self, object_path, connection):
1553
1426
"""Overloading of standard D-Bus method.
1554
1427
1555
1428
Override return argument name of GetManagedObjects to be
1556
1429
"objpath_interfaces_and_properties"
1557
1430
"""
1560
1433
connection)
1561
1434
try:
1562
1435
document = xml.dom.minidom.parseString(xmlstring)
1563
1436
1564
1437
for if_tag in document.getElementsByTagName("interface"):
1565
1438
# Fix argument name for the GetManagedObjects method
1566
1439
if (if_tag.getAttribute("name")
1567
== dbus.OBJECT_MANAGER_IFACE):
1440
== dbus.OBJECT_MANAGER_IFACE):
1568
1441
for cn in if_tag.getElementsByTagName("method"):
1569
1442
if (cn.getAttribute("name")
1570
1443
== "GetManagedObjects"):
1580
1453
except (AttributeError, xml.dom.DOMException,
1581
1454
xml.parsers.expat.ExpatError) as error:
1582
1455
logger.error("Failed to override Introspection method",
1583
exc_info=error)
1456
exc_info = error)
1584
1457
return xmlstring
1585
1458
1586
1587
1459
def datetime_to_dbus(dt, variant_level=0):
1588
1460
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1589
1461
if dt is None:
1590
return dbus.String("", variant_level=variant_level)
1462
return dbus.String("", variant_level = variant_level)
1591
1463
return dbus.String(dt.isoformat(), variant_level=variant_level)
1592
1464
1593
1465
1596
1468
dbus.service.Object, it will add alternate D-Bus attributes with
1597
1469
interface names according to the "alt_interface_names" mapping.
1598
1470
Usage:
1599
1471
1600
1472
@alternate_dbus_interfaces({"org.example.Interface":
1601
1473
"net.example.AlternateInterface"})
1602
1474
class SampleDBusObject(dbus.service.Object):
1603
1475
@dbus.service.method("org.example.Interface")
1604
1476
def SampleDBusMethod():
1605
1477
pass
1606
1478
1607
1479
The above "SampleDBusMethod" on "SampleDBusObject" will be
1608
1480
reachable via two interfaces: "org.example.Interface" and
1609
1481
"net.example.AlternateInterface", the latter of which will have
1610
1482
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1611
1483
"true", unless "deprecate" is passed with a False value.
1612
1484
1613
1485
This works for methods and signals, and also for D-Bus properties
1614
1486
(from DBusObjectWithProperties) and interfaces (from the
1615
1487
dbus_interface_annotations decorator).
1616
1488
"""
1617
1489
1618
1490
def wrapper(cls):
1619
1491
for orig_interface_name, alt_interface_name in (
1620
1492
alt_interface_names.items()):
1635
1507
interface_names.add(alt_interface)
1636
1508
# Is this a D-Bus signal?
1637
1509
if getattr(attribute, "_dbus_is_signal", False):
1638
# Extract the original non-method undecorated
1639
# function by black magic
1640
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1641
1513
nonmethod_func = (dict(
1642
1514
zip(attribute.func_code.co_freevars,
1643
1515
attribute.__closure__))
1644
1516
["func"].cell_contents)
1645
1517
else:
1646
nonmethod_func = (dict(
1647
zip(attribute.__code__.co_freevars,
1648
attribute.__closure__))
1649
["func"].cell_contents)
1518
nonmethod_func = attribute
1650
1519
# Create a new, but exactly alike, function
1651
1520
# object, and decorate it to be a new D-Bus signal
1652
1521
# with the alternate D-Bus interface name
1653
new_function = copy_function(nonmethod_func)
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1654
1536
new_function = (dbus.service.signal(
1655
1537
alt_interface,
1656
1538
attribute._dbus_signature)(new_function))
1660
1542
attribute._dbus_annotations)
1661
1543
except AttributeError:
1662
1544
pass
1663
1664
1545
# Define a creator of a function to call both the
1665
1546
# original and alternate functions, so both the
1666
1547
# original and alternate signals gets sent when
1669
1550
"""This function is a scope container to pass
1670
1551
func1 and func2 to the "call_both" function
1671
1552
outside of its arguments"""
1672
1553
1673
1554
@functools.wraps(func2)
1674
1555
def call_both(*args, **kwargs):
1675
1556
"""This function will emit two D-Bus
1676
1557
signals by calling func1 and func2"""
1677
1558
func1(*args, **kwargs)
1678
1559
func2(*args, **kwargs)
1679
# Make wrapper function look like a D-Bus
1680
# signal
1560
# Make wrapper function look like a D-Bus signal
1681
1561
for name, attr in inspect.getmembers(func2):
1682
1562
if name.startswith("_dbus_"):
1683
1563
setattr(call_both, name, attr)
1684
1564
1685
1565
return call_both
1686
1566
# Create the "call_both" function and add it to
1687
1567
# the class
1697
1577
alt_interface,
1698
1578
attribute._dbus_in_signature,
1699
1579
attribute._dbus_out_signature)
1700
(copy_function(attribute)))
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1701
1585
# Copy annotations, if any
1702
1586
try:
1703
1587
attr[attrname]._dbus_annotations = dict(
1715
1599
attribute._dbus_access,
1716
1600
attribute._dbus_get_args_options
1717
1601
["byte_arrays"])
1718
(copy_function(attribute)))
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1719
1608
# Copy annotations, if any
1720
1609
try:
1721
1610
attr[attrname]._dbus_annotations = dict(
1730
1619
# to the class.
1731
1620
attr[attrname] = (
1732
1621
dbus_interface_annotations(alt_interface)
1733
(copy_function(attribute)))
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1734
1627
if deprecate:
1735
1628
# Deprecate all alternate interfaces
1736
iname = "_AlternateDBusNames_interface_annotation{}"
1629
iname="_AlternateDBusNames_interface_annotation{}"
1737
1630
for interface_name in interface_names:
1738
1631
1739
1632
@dbus_interface_annotations(interface_name)
1740
1633
def func(self):
1741
return {"org.freedesktop.DBus.Deprecated":
1742
"true"}
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1743
1636
# Find an unused name
1744
1637
for aname in (iname.format(i)
1745
1638
for i in itertools.count()):
1749
1642
if interface_names:
1750
1643
# Replace the class with a new subclass of it with
1751
1644
# methods, signals, etc. as created above.
1752
if sys.version_info.major == 2:
1753
cls = type(b"{}Alternate".format(cls.__name__),
1754
(cls, ), attr)
1755
else:
1756
cls = type("{}Alternate".format(cls.__name__),
1757
(cls, ), attr)
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1758
1647
return cls
1759
1648
1760
1649
return wrapper
1761
1650
1762
1651
1764
1653
"se.bsnet.fukt.Mandos"})
1765
1654
class ClientDBus(Client, DBusObjectWithProperties):
1766
1655
"""A Client class using D-Bus
1767
1656
1768
1657
Attributes:
1769
1658
dbus_object_path: dbus.ObjectPath
1770
1659
bus: dbus.SystemBus()
1771
1660
"""
1772
1661
1773
1662
runtime_expansions = (Client.runtime_expansions
1774
1663
+ ("dbus_object_path", ))
1775
1664
1776
1665
_interface = "se.recompile.Mandos.Client"
1777
1666
1778
1667
# dbus.service.Object doesn't use super(), so we can't either.
1779
1780
def __init__(self, bus=None, *args, **kwargs):
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1781
1670
self.bus = bus
1782
1671
Client.__init__(self, *args, **kwargs)
1783
1672
# Only now, when this client is initialized, can it show up on
1789
1678
"/clients/" + client_object_name)
1790
1679
DBusObjectWithProperties.__init__(self, self.bus,
1791
1680
self.dbus_object_path)
1792
1681
1793
1682
def notifychangeproperty(transform_func, dbus_name,
1794
1683
type_func=lambda x: x,
1795
1684
variant_level=1,
1797
1686
_interface=_interface):
1798
1687
""" Modify a variable so that it's a property which announces
1799
1688
its changes to DBus.
1800
1689
1801
1690
transform_fun: Function that takes a value and a variant_level
1802
1691
and transforms it to a D-Bus type.
1803
1692
dbus_name: D-Bus name of the variable
1806
1695
variant_level: D-Bus variant level. Default: 1
1807
1696
"""
1808
1697
attrname = "_{}".format(dbus_name)
1809
1698
1810
1699
def setter(self, value):
1811
1700
if hasattr(self, "dbus_object_path"):
1812
1701
if (not hasattr(self, attrname) or
1819
1708
else:
1820
1709
dbus_value = transform_func(
1821
1710
type_func(value),
1822
variant_level=variant_level)
1711
variant_level = variant_level)
1823
1712
self.PropertyChanged(dbus.String(dbus_name),
1824
1713
dbus_value)
1825
1714
self.PropertiesChanged(
1826
1715
_interface,
1827
dbus.Dictionary({dbus.String(dbus_name):
1828
dbus_value}),
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1829
1718
dbus.Array())
1830
1719
setattr(self, attrname, value)
1831
1720
1832
1721
return property(lambda self: getattr(self, attrname), setter)
1833
1722
1834
1723
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1835
1724
approvals_pending = notifychangeproperty(dbus.Boolean,
1836
1725
"ApprovalPending",
1837
type_func=bool)
1726
type_func = bool)
1838
1727
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1839
1728
last_enabled = notifychangeproperty(datetime_to_dbus,
1840
1729
"LastEnabled")
1841
1730
checker = notifychangeproperty(
1842
1731
dbus.Boolean, "CheckerRunning",
1843
type_func=lambda checker: checker is not None)
1732
type_func = lambda checker: checker is not None)
1844
1733
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1845
1734
"LastCheckedOK")
1846
1735
last_checker_status = notifychangeproperty(dbus.Int16,
1851
1740
"ApprovedByDefault")
1852
1741
approval_delay = notifychangeproperty(
1853
1742
dbus.UInt64, "ApprovalDelay",
1854
type_func=lambda td: td.total_seconds() * 1000)
1743
type_func = lambda td: td.total_seconds() * 1000)
1855
1744
approval_duration = notifychangeproperty(
1856
1745
dbus.UInt64, "ApprovalDuration",
1857
type_func=lambda td: td.total_seconds() * 1000)
1746
type_func = lambda td: td.total_seconds() * 1000)
1858
1747
host = notifychangeproperty(dbus.String, "Host")
1859
1748
timeout = notifychangeproperty(
1860
1749
dbus.UInt64, "Timeout",
1861
type_func=lambda td: td.total_seconds() * 1000)
1750
type_func = lambda td: td.total_seconds() * 1000)
1862
1751
extended_timeout = notifychangeproperty(
1863
1752
dbus.UInt64, "ExtendedTimeout",
1864
type_func=lambda td: td.total_seconds() * 1000)
1753
type_func = lambda td: td.total_seconds() * 1000)
1865
1754
interval = notifychangeproperty(
1866
1755
dbus.UInt64, "Interval",
1867
type_func=lambda td: td.total_seconds() * 1000)
1756
type_func = lambda td: td.total_seconds() * 1000)
1868
1757
checker_command = notifychangeproperty(dbus.String, "Checker")
1869
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1870
1759
invalidate_only=True)
1871
1760
1872
1761
del notifychangeproperty
1873
1762
1874
1763
def __del__(self, *args, **kwargs):
1875
1764
try:
1876
1765
self.remove_from_connection()
1879
1768
if hasattr(DBusObjectWithProperties, "__del__"):
1880
1769
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1881
1770
Client.__del__(self, *args, **kwargs)
1882
1771
1883
1772
def checker_callback(self, source, condition,
1884
1773
connection, command, *args, **kwargs):
1885
1774
ret = Client.checker_callback(self, source, condition,
1901
1790
| self.last_checker_signal),
1902
1791
dbus.String(command))
1903
1792
return ret
1904
1793
1905
1794
def start_checker(self, *args, **kwargs):
1906
1795
old_checker_pid = getattr(self.checker, "pid", None)
1907
1796
r = Client.start_checker(self, *args, **kwargs)
1911
1800
# Emit D-Bus signal
1912
1801
self.CheckerStarted(self.current_checker_command)
1913
1802
return r
1914
1803
1915
1804
def _reset_approved(self):
1916
1805
self.approved = None
1917
1806
return False
1918
1807
1919
1808
def approve(self, value=True):
1920
1809
self.approved = value
1921
GLib.timeout_add(int(self.approval_duration.total_seconds()
1922
* 1000), self._reset_approved)
1810
gobject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1923
1812
self.send_changedstate()
1924
1925
# D-Bus methods, signals & properties
1926
1927
# Interfaces
1928
1929
# Signals
1930
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1931
1820
# CheckerCompleted - signal
1932
1821
@dbus.service.signal(_interface, signature="nxs")
1933
1822
def CheckerCompleted(self, exitcode, waitstatus, command):
1934
1823
"D-Bus signal"
1935
1824
pass
1936
1825
1937
1826
# CheckerStarted - signal
1938
1827
@dbus.service.signal(_interface, signature="s")
1939
1828
def CheckerStarted(self, command):
1940
1829
"D-Bus signal"
1941
1830
pass
1942
1831
1943
1832
# PropertyChanged - signal
1944
1833
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1945
1834
@dbus.service.signal(_interface, signature="sv")
1946
1835
def PropertyChanged(self, property, value):
1947
1836
"D-Bus signal"
1948
1837
pass
1949
1838
1950
1839
# GotSecret - signal
1951
1840
@dbus.service.signal(_interface)
1952
1841
def GotSecret(self):
1955
1844
server to mandos-client
1956
1845
"""
1957
1846
pass
1958
1847
1959
1848
# Rejected - signal
1960
1849
@dbus.service.signal(_interface, signature="s")
1961
1850
def Rejected(self, reason):
1962
1851
"D-Bus signal"
1963
1852
pass
1964
1853
1965
1854
# NeedApproval - signal
1966
1855
@dbus.service.signal(_interface, signature="tb")
1967
1856
def NeedApproval(self, timeout, default):
1968
1857
"D-Bus signal"
1969
1858
return self.need_approval()
1970
1971
# Methods
1972
1859
1860
## Methods
1861
1973
1862
# Approve - method
1974
1863
@dbus.service.method(_interface, in_signature="b")
1975
1864
def Approve(self, value):
1976
1865
self.approve(value)
1977
1866
1978
1867
# CheckedOK - method
1979
1868
@dbus.service.method(_interface)
1980
1869
def CheckedOK(self):
1981
1870
self.checked_ok()
1982
1871
1983
1872
# Enable - method
1984
1873
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1985
1874
@dbus.service.method(_interface)
1986
1875
def Enable(self):
1987
1876
"D-Bus method"
1988
1877
self.enable()
1989
1878
1990
1879
# StartChecker - method
1991
1880
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1992
1881
@dbus.service.method(_interface)
1993
1882
def StartChecker(self):
1994
1883
"D-Bus method"
1995
1884
self.start_checker()
1996
1885
1997
1886
# Disable - method
1998
1887
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1999
1888
@dbus.service.method(_interface)
2000
1889
def Disable(self):
2001
1890
"D-Bus method"
2002
1891
self.disable()
2003
1892
2004
1893
# StopChecker - method
2005
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2006
1895
@dbus.service.method(_interface)
2007
1896
def StopChecker(self):
2008
1897
self.stop_checker()
2009
2010
# Properties
2011
1898
1899
## Properties
1900
2012
1901
# ApprovalPending - property
2013
1902
@dbus_service_property(_interface, signature="b", access="read")
2014
1903
def ApprovalPending_dbus_property(self):
2015
1904
return dbus.Boolean(bool(self.approvals_pending))
2016
1905
2017
1906
# ApprovedByDefault - property
2018
1907
@dbus_service_property(_interface,
2019
1908
signature="b",
2022
1911
if value is None: # get
2023
1912
return dbus.Boolean(self.approved_by_default)
2024
1913
self.approved_by_default = bool(value)
2025
1914
2026
1915
# ApprovalDelay - property
2027
1916
@dbus_service_property(_interface,
2028
1917
signature="t",
2032
1921
return dbus.UInt64(self.approval_delay.total_seconds()
2033
1922
* 1000)
2034
1923
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2035
1924
2036
1925
# ApprovalDuration - property
2037
1926
@dbus_service_property(_interface,
2038
1927
signature="t",
2042
1931
return dbus.UInt64(self.approval_duration.total_seconds()
2043
1932
* 1000)
2044
1933
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2045
1934
2046
1935
# Name - property
2047
1936
@dbus_annotations(
2048
1937
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2049
1938
@dbus_service_property(_interface, signature="s", access="read")
2050
1939
def Name_dbus_property(self):
2051
1940
return dbus.String(self.name)
2052
2053
# KeyID - property
2054
@dbus_annotations(
2055
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2056
@dbus_service_property(_interface, signature="s", access="read")
2057
def KeyID_dbus_property(self):
2058
return dbus.String(self.key_id)
2059
1941
2060
1942
# Fingerprint - property
2061
1943
@dbus_annotations(
2062
1944
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2063
1945
@dbus_service_property(_interface, signature="s", access="read")
2064
1946
def Fingerprint_dbus_property(self):
2065
1947
return dbus.String(self.fingerprint)
2066
1948
2067
1949
# Host - property
2068
1950
@dbus_service_property(_interface,
2069
1951
signature="s",
2072
1954
if value is None: # get
2073
1955
return dbus.String(self.host)
2074
1956
self.host = str(value)
2075
1957
2076
1958
# Created - property
2077
1959
@dbus_annotations(
2078
1960
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2079
1961
@dbus_service_property(_interface, signature="s", access="read")
2080
1962
def Created_dbus_property(self):
2081
1963
return datetime_to_dbus(self.created)
2082
1964
2083
1965
# LastEnabled - property
2084
1966
@dbus_service_property(_interface, signature="s", access="read")
2085
1967
def LastEnabled_dbus_property(self):
2086
1968
return datetime_to_dbus(self.last_enabled)
2087
1969
2088
1970
# Enabled - property
2089
1971
@dbus_service_property(_interface,
2090
1972
signature="b",
2096
1978
self.enable()
2097
1979
else:
2098
1980
self.disable()
2099
1981
2100
1982
# LastCheckedOK - property
2101
1983
@dbus_service_property(_interface,
2102
1984
signature="s",
2106
1988
self.checked_ok()
2107
1989
return
2108
1990
return datetime_to_dbus(self.last_checked_ok)
2109
1991
2110
1992
# LastCheckerStatus - property
2111
1993
@dbus_service_property(_interface, signature="n", access="read")
2112
1994
def LastCheckerStatus_dbus_property(self):
2113
1995
return dbus.Int16(self.last_checker_status)
2114
1996
2115
1997
# Expires - property
2116
1998
@dbus_service_property(_interface, signature="s", access="read")
2117
1999
def Expires_dbus_property(self):
2118
2000
return datetime_to_dbus(self.expires)
2119
2001
2120
2002
# LastApprovalRequest - property
2121
2003
@dbus_service_property(_interface, signature="s", access="read")
2122
2004
def LastApprovalRequest_dbus_property(self):
2123
2005
return datetime_to_dbus(self.last_approval_request)
2124
2006
2125
2007
# Timeout - property
2126
2008
@dbus_service_property(_interface,
2127
2009
signature="t",
2142
2024
if (getattr(self, "disable_initiator_tag", None)
2143
2025
is None):
2144
2026
return
2145
GLib.source_remove(self.disable_initiator_tag)
2146
self.disable_initiator_tag = GLib.timeout_add(
2027
gobject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = gobject.timeout_add(
2147
2029
int((self.expires - now).total_seconds() * 1000),
2148
2030
self.disable)
2149
2031
2150
2032
# ExtendedTimeout - property
2151
2033
@dbus_service_property(_interface,
2152
2034
signature="t",
2156
2038
return dbus.UInt64(self.extended_timeout.total_seconds()
2157
2039
* 1000)
2158
2040
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2159
2041
2160
2042
# Interval - property
2161
2043
@dbus_service_property(_interface,
2162
2044
signature="t",
2169
2051
return
2170
2052
if self.enabled:
2171
2053
# Reschedule checker run
2172
GLib.source_remove(self.checker_initiator_tag)
2173
self.checker_initiator_tag = GLib.timeout_add(
2054
gobject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = gobject.timeout_add(
2174
2056
value, self.start_checker)
2175
self.start_checker() # Start one now, too
2176
2057
self.start_checker() # Start one now, too
2058
2177
2059
# Checker - property
2178
2060
@dbus_service_property(_interface,
2179
2061
signature="s",
2182
2064
if value is None: # get
2183
2065
return dbus.String(self.checker_command)
2184
2066
self.checker_command = str(value)
2185
2067
2186
2068
# CheckerRunning - property
2187
2069
@dbus_service_property(_interface,
2188
2070
signature="b",
2194
2076
self.start_checker()
2195
2077
else:
2196
2078
self.stop_checker()
2197
2079
2198
2080
# ObjectPath - property
2199
2081
@dbus_annotations(
2200
2082
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2201
2083
"org.freedesktop.DBus.Deprecated": "true"})
2202
2084
@dbus_service_property(_interface, signature="o", access="read")
2203
2085
def ObjectPath_dbus_property(self):
2204
return self.dbus_object_path # is already a dbus.ObjectPath
2205
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2206
2088
# Secret = property
2207
2089
@dbus_annotations(
2208
2090
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2213
2095
byte_arrays=True)
2214
2096
def Secret_dbus_property(self, value):
2215
2097
self.secret = bytes(value)
2216
2098
2217
2099
del _interface
2218
2100
2219
2101
2220
class ProxyClient:
2221
def __init__(self, child_pipe, key_id, fpr, address):
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2222
2104
self._pipe = child_pipe
2223
self._pipe.send(('init', key_id, fpr, address))
2105
self._pipe.send(('init', fpr, address))
2224
2106
if not self._pipe.recv():
2225
raise KeyError(key_id or fpr)
2226
2107
raise KeyError(fpr)
2108
2227
2109
def __getattribute__(self, name):
2228
2110
if name == '_pipe':
2229
2111
return super(ProxyClient, self).__getattribute__(name)
2232
2114
if data[0] == 'data':
2233
2115
return data[1]
2234
2116
if data[0] == 'function':
2235
2117
2236
2118
def func(*args, **kwargs):
2237
2119
self._pipe.send(('funcall', name, args, kwargs))
2238
2120
return self._pipe.recv()[1]
2239
2121
2240
2122
return func
2241
2123
2242
2124
def __setattr__(self, name, value):
2243
2125
if name == '_pipe':
2244
2126
return super(ProxyClient, self).__setattr__(name, value)
2247
2129
2248
2130
class ClientHandler(socketserver.BaseRequestHandler, object):
2249
2131
"""A class to handle client connections.
2250
2132
2251
2133
Instantiated once for each connection to handle it.
2252
2134
Note: This will run in its own forked process."""
2253
2135
2254
2136
def handle(self):
2255
2137
with contextlib.closing(self.server.child_pipe) as child_pipe:
2256
2138
logger.info("TCP connection from: %s",
2257
2139
str(self.client_address))
2258
2140
logger.debug("Pipe FD: %d",
2259
2141
self.server.child_pipe.fileno())
2260
2142
2261
2143
session = gnutls.ClientSession(self.request)
2262
2263
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2264
# "+AES-256-CBC", "+SHA1",
2265
# "+COMP-NULL", "+CTYPE-OPENPGP",
2266
# "+DHE-DSS"))
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2267
2149
# Use a fallback default, since this MUST be set.
2268
2150
priority = self.server.gnutls_priority
2269
2151
if priority is None:
2270
2152
priority = "NORMAL"
2271
gnutls.priority_set_direct(session._c_object,
2272
priority.encode("utf-8"),
2153
gnutls.priority_set_direct(session._c_object, priority,
2273
2154
None)
2274
2155
2275
2156
# Start communication using the Mandos protocol
2276
2157
# Get protocol number
2277
2158
line = self.request.makefile().readline()
2282
2163
except (ValueError, IndexError, RuntimeError) as error:
2283
2164
logger.error("Unknown protocol version: %s", error)
2284
2165
return
2285
2166
2286
2167
# Start GnuTLS connection
2287
2168
try:
2288
2169
session.handshake()
2292
2173
# established. Just abandon the request.
2293
2174
return
2294
2175
logger.debug("Handshake succeeded")
2295
2176
2296
2177
approval_required = False
2297
2178
try:
2298
if gnutls.has_rawpk:
2299
fpr = b""
2300
try:
2301
key_id = self.key_id(
2302
self.peer_certificate(session))
2303
except (TypeError, gnutls.Error) as error:
2304
logger.warning("Bad certificate: %s", error)
2305
return
2306
logger.debug("Key ID: %s", key_id)
2307
2308
else:
2309
key_id = b""
2310
try:
2311
fpr = self.fingerprint(
2312
self.peer_certificate(session))
2313
except (TypeError, gnutls.Error) as error:
2314
logger.warning("Bad certificate: %s", error)
2315
return
2316
logger.debug("Fingerprint: %s", fpr)
2317
2318
try:
2319
client = ProxyClient(child_pipe, key_id, fpr,
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2320
2189
self.client_address)
2321
2190
except KeyError:
2322
2191
return
2323
2192
2324
2193
if client.approval_delay:
2325
2194
delay = client.approval_delay
2326
2195
client.approvals_pending += 1
2327
2196
approval_required = True
2328
2197
2329
2198
while True:
2330
2199
if not client.enabled:
2331
2200
logger.info("Client %s is disabled",
2334
2203
# Emit D-Bus signal
2335
2204
client.Rejected("Disabled")
2336
2205
return
2337
2206
2338
2207
if client.approved or not client.approval_delay:
2339
# We are approved or approval is disabled
2208
#We are approved or approval is disabled
2340
2209
break
2341
2210
elif client.approved is None:
2342
2211
logger.info("Client %s needs approval",
2353
2222
# Emit D-Bus signal
2354
2223
client.Rejected("Denied")
2355
2224
return
2356
2357
# wait until timeout or approved
2225
2226
#wait until timeout or approved
2358
2227
time = datetime.datetime.now()
2359
2228
client.changedstate.acquire()
2360
2229
client.changedstate.wait(delay.total_seconds())
2373
2242
break
2374
2243
else:
2375
2244
delay -= time2 - time
2376
2245
2377
2246
try:
2378
2247
session.send(client.secret)
2379
2248
except gnutls.Error as error:
2380
2249
logger.warning("gnutls send failed",
2381
exc_info=error)
2250
exc_info = error)
2382
2251
return
2383
2252
2384
2253
logger.info("Sending secret to %s", client.name)
2385
2254
# bump the timeout using extended_timeout
2386
2255
client.bump_timeout(client.extended_timeout)
2387
2256
if self.server.use_dbus:
2388
2257
# Emit D-Bus signal
2389
2258
client.GotSecret()
2390
2259
2391
2260
finally:
2392
2261
if approval_required:
2393
2262
client.approvals_pending -= 1
2396
2265
except gnutls.Error as error:
2397
2266
logger.warning("GnuTLS bye failed",
2398
2267
exc_info=error)
2399
2268
2400
2269
@staticmethod
2401
2270
def peer_certificate(session):
2402
"Return the peer's certificate as a bytestring"
2403
try:
2404
cert_type = gnutls.certificate_type_get2(session._c_object,
2405
gnutls.CTYPE_PEERS)
2406
except AttributeError:
2407
cert_type = gnutls.certificate_type_get(session._c_object)
2408
if gnutls.has_rawpk:
2409
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2410
else:
2411
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2412
# If not a valid certificate type...
2413
if cert_type not in valid_cert_types:
2414
logger.info("Cert type %r not in %r", cert_type,
2415
valid_cert_types)
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2416
2275
# ...return invalid data
2417
2276
return b""
2418
2277
list_size = ctypes.c_uint(1)
2424
2283
return None
2425
2284
cert = cert_list[0]
2426
2285
return ctypes.string_at(cert.data, cert.size)
2427
2428
@staticmethod
2429
def key_id(certificate):
2430
"Convert a certificate bytestring to a hexdigit key ID"
2431
# New GnuTLS "datum" with the public key
2432
datum = gnutls.datum_t(
2433
ctypes.cast(ctypes.c_char_p(certificate),
2434
ctypes.POINTER(ctypes.c_ubyte)),
2435
ctypes.c_uint(len(certificate)))
2436
# XXX all these need to be created in the gnutls "module"
2437
# New empty GnuTLS certificate
2438
pubkey = gnutls.pubkey_t()
2439
gnutls.pubkey_init(ctypes.byref(pubkey))
2440
# Import the raw public key into the certificate
2441
gnutls.pubkey_import(pubkey,
2442
ctypes.byref(datum),
2443
gnutls.X509_FMT_DER)
2444
# New buffer for the key ID
2445
buf = ctypes.create_string_buffer(32)
2446
buf_len = ctypes.c_size_t(len(buf))
2447
# Get the key ID from the raw public key into the buffer
2448
gnutls.pubkey_get_key_id(pubkey,
2449
gnutls.KEYID_USE_SHA256,
2450
ctypes.cast(ctypes.byref(buf),
2451
ctypes.POINTER(ctypes.c_ubyte)),
2452
ctypes.byref(buf_len))
2453
# Deinit the certificate
2454
gnutls.pubkey_deinit(pubkey)
2455
2456
# Convert the buffer to a Python bytestring
2457
key_id = ctypes.string_at(buf, buf_len.value)
2458
# Convert the bytestring to hexadecimal notation
2459
hex_key_id = binascii.hexlify(key_id).upper()
2460
return hex_key_id
2461
2286
2462
2287
@staticmethod
2463
2288
def fingerprint(openpgp):
2464
2289
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2479
2304
ctypes.byref(crtverify))
2480
2305
if crtverify.value != 0:
2481
2306
gnutls.openpgp_crt_deinit(crt)
2482
raise gnutls.CertificateSecurityError(code
2483
=crtverify.value)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2484
2308
# New buffer for the fingerprint
2485
2309
buf = ctypes.create_string_buffer(20)
2486
2310
buf_len = ctypes.c_size_t()
2496
2320
return hex_fpr
2497
2321
2498
2322
2499
class MultiprocessingMixIn:
2323
class MultiprocessingMixIn(object):
2500
2324
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2501
2325
2502
2326
def sub_process_main(self, request, address):
2503
2327
try:
2504
2328
self.finish_request(request, address)
2505
2329
except Exception:
2506
2330
self.handle_error(request, address)
2507
2331
self.close_request(request)
2508
2332
2509
2333
def process_request(self, request, address):
2510
2334
"""Start a new process to process the request."""
2511
proc = multiprocessing.Process(target=self.sub_process_main,
2512
args=(request, address))
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2513
2337
proc.start()
2514
2338
return proc
2515
2339
2516
2340
2517
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2518
2342
""" adds a pipe to the MixIn """
2519
2343
2520
2344
def process_request(self, request, client_address):
2521
2345
"""Overrides and wraps the original process_request().
2522
2346
2523
2347
This function creates a new pipe in self.pipe
2524
2348
"""
2525
2349
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2526
2350
2527
2351
proc = MultiprocessingMixIn.process_request(self, request,
2528
2352
client_address)
2529
2353
self.child_pipe.close()
2530
2354
self.add_pipe(parent_pipe, proc)
2531
2355
2532
2356
def add_pipe(self, parent_pipe, proc):
2533
2357
"""Dummy function; override as necessary"""
2534
2358
raise NotImplementedError()
2535
2359
2536
2360
2537
2361
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2538
socketserver.TCPServer):
2362
socketserver.TCPServer, object):
2539
2363
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2540
2364
2541
2365
Attributes:
2542
2366
enabled: Boolean; whether this server is activated yet
2543
2367
interface: None or a network interface name (string)
2544
2368
use_ipv6: Boolean; to use IPv6 or not
2545
2369
"""
2546
2370
2547
2371
def __init__(self, server_address, RequestHandlerClass,
2548
2372
interface=None,
2549
2373
use_ipv6=True,
2559
2383
self.socketfd = socketfd
2560
2384
# Save the original socket.socket() function
2561
2385
self.socket_socket = socket.socket
2562
2563
2386
# To implement --socket, we monkey patch socket.socket.
2564
#
2387
#
2565
2388
# (When socketserver.TCPServer is a new-style class, we
2566
2389
# could make self.socket into a property instead of monkey
2567
2390
# patching socket.socket.)
2568
#
2391
#
2569
2392
# Create a one-time-only replacement for socket.socket()
2570
2393
@functools.wraps(socket.socket)
2571
2394
def socket_wrapper(*args, **kwargs):
2583
2406
# socket_wrapper(), if socketfd was set.
2584
2407
socketserver.TCPServer.__init__(self, server_address,
2585
2408
RequestHandlerClass)
2586
2409
2587
2410
def server_bind(self):
2588
2411
"""This overrides the normal server_bind() function
2589
2412
to bind to an interface if one was specified, and also NOT to
2590
2413
bind to an address or port if they were not specified."""
2591
global SO_BINDTODEVICE
2592
2414
if self.interface is not None:
2593
2415
if SO_BINDTODEVICE is None:
2594
# Fall back to a hard-coded value which seems to be
2595
# common enough.
2596
logger.warning("SO_BINDTODEVICE not found, trying 25")
2597
SO_BINDTODEVICE = 25
2598
try:
2599
self.socket.setsockopt(
2600
socket.SOL_SOCKET, SO_BINDTODEVICE,
2601
(self.interface + "\0").encode("utf-8"))
2602
except socket.error as error:
2603
if error.errno == errno.EPERM:
2604
logger.error("No permission to bind to"
2605
" interface %s", self.interface)
2606
elif error.errno == errno.ENOPROTOOPT:
2607
logger.error("SO_BINDTODEVICE not available;"
2608
" cannot bind to interface %s",
2609
self.interface)
2610
elif error.errno == errno.ENODEV:
2611
logger.error("Interface %s does not exist,"
2612
" cannot bind", self.interface)
2613
else:
2614
raise
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2615
2437
# Only bind(2) the socket if we really need to.
2616
2438
if self.server_address[0] or self.server_address[1]:
2617
if self.server_address[1]:
2618
self.allow_reuse_address = True
2619
2439
if not self.server_address[0]:
2620
2440
if self.address_family == socket.AF_INET6:
2621
any_address = "::" # in6addr_any
2441
any_address = "::" # in6addr_any
2622
2442
else:
2623
any_address = "0.0.0.0" # INADDR_ANY
2443
any_address = "0.0.0.0" # INADDR_ANY
2624
2444
self.server_address = (any_address,
2625
2445
self.server_address[1])
2626
2446
elif not self.server_address[1]:
2636
2456
2637
2457
class MandosServer(IPv6_TCPServer):
2638
2458
"""Mandos server.
2639
2459
2640
2460
Attributes:
2641
2461
clients: set of Client objects
2642
2462
gnutls_priority GnuTLS priority string
2643
2463
use_dbus: Boolean; to emit D-Bus signals or not
2644
2645
Assumes a GLib.MainLoop event loop.
2464
2465
Assumes a gobject.MainLoop event loop.
2646
2466
"""
2647
2467
2648
2468
def __init__(self, server_address, RequestHandlerClass,
2649
2469
interface=None,
2650
2470
use_ipv6=True,
2660
2480
self.gnutls_priority = gnutls_priority
2661
2481
IPv6_TCPServer.__init__(self, server_address,
2662
2482
RequestHandlerClass,
2663
interface=interface,
2664
use_ipv6=use_ipv6,
2665
socketfd=socketfd)
2666
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2667
2487
def server_activate(self):
2668
2488
if self.enabled:
2669
2489
return socketserver.TCPServer.server_activate(self)
2670
2490
2671
2491
def enable(self):
2672
2492
self.enabled = True
2673
2493
2674
2494
def add_pipe(self, parent_pipe, proc):
2675
2495
# Call "handle_ipc" for both data and EOF events
2676
GLib.io_add_watch(
2496
gobject.io_add_watch(
2677
2497
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2498
gobject.IO_IN | gobject.IO_HUP,
2679
2499
functools.partial(self.handle_ipc,
2680
parent_pipe=parent_pipe,
2681
proc=proc))
2682
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2683
2503
def handle_ipc(self, source, condition,
2684
2504
parent_pipe=None,
2685
proc=None,
2505
proc = None,
2686
2506
client_object=None):
2687
2507
# error, or the other end of multiprocessing.Pipe has closed
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2689
2509
# Wait for other process to exit
2690
2510
proc.join()
2691
2511
return False
2692
2512
2693
2513
# Read a request from the child
2694
2514
request = parent_pipe.recv()
2695
2515
command = request[0]
2696
2516
2697
2517
if command == 'init':
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2701
2702
for c in self.clients.values():
2703
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2704
continue
2705
if key_id and c.key_id == key_id:
2706
client = c
2707
break
2708
if fpr and c.fingerprint == fpr:
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2709
2523
client = c
2710
2524
break
2711
2525
else:
2712
logger.info("Client not found for key ID: %s, address"
2713
": %s", key_id or fpr, address)
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2714
2528
if self.use_dbus:
2715
2529
# Emit D-Bus signal
2716
mandos_dbus_service.ClientNotFound(key_id or fpr,
2530
mandos_dbus_service.ClientNotFound(fpr,
2717
2531
address[0])
2718
2532
parent_pipe.send(False)
2719
2533
return False
2720
2721
GLib.io_add_watch(
2534
2535
gobject.io_add_watch(
2722
2536
parent_pipe.fileno(),
2723
GLib.IO_IN | GLib.IO_HUP,
2537
gobject.IO_IN | gobject.IO_HUP,
2724
2538
functools.partial(self.handle_ipc,
2725
parent_pipe=parent_pipe,
2726
proc=proc,
2727
client_object=client))
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2728
2542
parent_pipe.send(True)
2729
2543
# remove the old hook in favor of the new above hook on
2730
2544
# same fileno
2733
2547
funcname = request[1]
2734
2548
args = request[2]
2735
2549
kwargs = request[3]
2736
2550
2737
2551
parent_pipe.send(('data', getattr(client_object,
2738
2552
funcname)(*args,
2739
2553
**kwargs)))
2740
2554
2741
2555
if command == 'getattr':
2742
2556
attrname = request[1]
2743
2557
if isinstance(client_object.__getattribute__(attrname),
2746
2560
else:
2747
2561
parent_pipe.send((
2748
2562
'data', client_object.__getattribute__(attrname)))
2749
2563
2750
2564
if command == 'setattr':
2751
2565
attrname = request[1]
2752
2566
value = request[2]
2753
2567
setattr(client_object, attrname, value)
2754
2568
2755
2569
return True
2756
2570
2757
2571
2758
2572
def rfc3339_duration_to_delta(duration):
2759
2573
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2760
2574
2761
2575
>>> rfc3339_duration_to_delta("P7D")
2762
2576
datetime.timedelta(7)
2763
2577
>>> rfc3339_duration_to_delta("PT60S")
2773
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2774
2588
datetime.timedelta(1, 200)
2775
2589
"""
2776
2590
2777
2591
# Parsing an RFC 3339 duration with regular expressions is not
2778
2592
# possible - there would have to be multiple places for the same
2779
2593
# values, like seconds. The current code, while more esoteric, is
2780
2594
# cleaner without depending on a parsing library. If Python had a
2781
2595
# built-in library for parsing we would use it, but we'd like to
2782
2596
# avoid excessive use of external libraries.
2783
2597
2784
2598
# New type for defining tokens, syntax, and semantics all-in-one
2785
2599
Token = collections.namedtuple("Token", (
2786
2600
"regexp", # To match token; if "value" is not None, must have
2819
2633
frozenset((token_year, token_month,
2820
2634
token_day, token_time,
2821
2635
token_week)))
2822
# Define starting values:
2823
# Value so far
2824
value = datetime.timedelta()
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2825
2638
found_token = None
2826
# Following valid tokens
2827
followers = frozenset((token_duration, ))
2828
# String left to parse
2829
s = duration
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2830
2641
# Loop until end token is found
2831
2642
while found_token is not token_end:
2832
2643
# Search for any currently valid tokens
2856
2667
2857
2668
def string_to_delta(interval):
2858
2669
"""Parse a string and return a datetime.timedelta
2859
2670
2860
2671
>>> string_to_delta('7d')
2861
2672
datetime.timedelta(7)
2862
2673
>>> string_to_delta('60s')
2870
2681
>>> string_to_delta('5m 30s')
2871
2682
datetime.timedelta(0, 330)
2872
2683
"""
2873
2684
2874
2685
try:
2875
2686
return rfc3339_duration_to_delta(interval)
2876
2687
except ValueError:
2877
2688
pass
2878
2689
2879
2690
timevalue = datetime.timedelta(0)
2880
2691
for s in interval.split():
2881
2692
try:
2899
2710
return timevalue
2900
2711
2901
2712
2902
def daemon(nochdir=False, noclose=False):
2713
def daemon(nochdir = False, noclose = False):
2903
2714
"""See daemon(3). Standard BSD Unix function.
2904
2715
2905
2716
This should really exist as os.daemon, but it doesn't (yet)."""
2906
2717
if os.fork():
2907
2718
sys.exit()
2925
2736
2926
2737
2927
2738
def main():
2928
2739
2929
2740
##################################################################
2930
2741
# Parsing of options, both command line and config file
2931
2742
2932
2743
parser = argparse.ArgumentParser()
2933
2744
parser.add_argument("-v", "--version", action="version",
2934
version="%(prog)s {}".format(version),
2745
version = "%(prog)s {}".format(version),
2935
2746
help="show version number and exit")
2936
2747
parser.add_argument("-i", "--interface", metavar="IF",
2937
2748
help="Bind to interface IF")
2973
2784
parser.add_argument("--no-zeroconf", action="store_false",
2974
2785
dest="zeroconf", help="Do not use Zeroconf",
2975
2786
default=None)
2976
2787
2977
2788
options = parser.parse_args()
2978
2789
2790
if options.check:
2791
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
2979
2795
# Default values for config file for server-global settings
2980
if gnutls.has_rawpk:
2981
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2982
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2983
else:
2984
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2985
":+SIGN-DSA-SHA256")
2986
server_defaults = {"interface": "",
2987
"address": "",
2988
"port": "",
2989
"debug": "False",
2990
"priority": priority,
2991
"servicename": "Mandos",
2992
"use_dbus": "True",
2993
"use_ipv6": "True",
2994
"debuglevel": "",
2995
"restore": "True",
2996
"socket": "",
2997
"statedir": "/var/lib/mandos",
2998
"foreground": "False",
2999
"zeroconf": "True",
3000
}
3001
del priority
3002
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
3003
2814
# Parse config file for server-global settings
3004
server_config = configparser.ConfigParser(server_defaults)
2815
server_config = configparser.SafeConfigParser(server_defaults)
3005
2816
del server_defaults
3006
2817
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3007
# Convert the ConfigParser object to a dict
2818
# Convert the SafeConfigParser object to a dict
3008
2819
server_settings = server_config.defaults()
3009
2820
# Use the appropriate methods on the non-string config options
3010
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3011
"foreground", "zeroconf"):
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3012
2822
server_settings[option] = server_config.getboolean("DEFAULT",
3013
2823
option)
3014
2824
if server_settings["port"]:
3024
2834
server_settings["socket"] = os.dup(server_settings
3025
2835
["socket"])
3026
2836
del server_config
3027
2837
3028
2838
# Override the settings from the config file with command line
3029
2839
# options, if set.
3030
2840
for option in ("interface", "address", "port", "debug",
3048
2858
if server_settings["debug"]:
3049
2859
server_settings["foreground"] = True
3050
2860
# Now we have our good server settings in "server_settings"
3051
2861
3052
2862
##################################################################
3053
2863
3054
2864
if (not server_settings["zeroconf"]
3055
2865
and not (server_settings["port"]
3056
2866
or server_settings["socket"] != "")):
3057
2867
parser.error("Needs port or socket to work without Zeroconf")
3058
2868
3059
2869
# For convenience
3060
2870
debug = server_settings["debug"]
3061
2871
debuglevel = server_settings["debuglevel"]
3065
2875
stored_state_file)
3066
2876
foreground = server_settings["foreground"]
3067
2877
zeroconf = server_settings["zeroconf"]
3068
2878
3069
2879
if debug:
3070
2880
initlogger(debug, logging.DEBUG)
3071
2881
else:
3074
2884
else:
3075
2885
level = getattr(logging, debuglevel.upper())
3076
2886
initlogger(debug, level)
3077
2887
3078
2888
if server_settings["servicename"] != "Mandos":
3079
2889
syslogger.setFormatter(
3080
2890
logging.Formatter('Mandos ({}) [%(process)d]:'
3081
2891
' %(levelname)s: %(message)s'.format(
3082
2892
server_settings["servicename"])))
3083
2893
3084
2894
# Parse config file with clients
3085
client_config = configparser.ConfigParser(Client.client_defaults)
2895
client_config = configparser.SafeConfigParser(Client
2896
.client_defaults)
3086
2897
client_config.read(os.path.join(server_settings["configdir"],
3087
2898
"clients.conf"))
3088
2899
3089
2900
global mandos_dbus_service
3090
2901
mandos_dbus_service = None
3091
2902
3092
2903
socketfd = None
3093
2904
if server_settings["socket"] != "":
3094
2905
socketfd = server_settings["socket"]
3110
2921
except IOError as e:
3111
2922
logger.error("Could not open file %r", pidfilename,
3112
2923
exc_info=e)
3113
2924
3114
2925
for name, group in (("_mandos", "_mandos"),
3115
2926
("mandos", "mandos"),
3116
2927
("nobody", "nogroup")):
3126
2937
try:
3127
2938
os.setgid(gid)
3128
2939
os.setuid(uid)
3129
if debug:
3130
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3131
gid))
3132
2940
except OSError as error:
3133
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3134
.format(uid, gid, os.strerror(error.errno)))
3135
2941
if error.errno != errno.EPERM:
3136
2942
raise
3137
2943
3138
2944
if debug:
3139
2945
# Enable all possible GnuTLS debugging
3140
2946
3141
2947
# "Use a log level over 10 to enable all debugging options."
3142
2948
# - GnuTLS manual
3143
2949
gnutls.global_set_log_level(11)
3144
2950
3145
2951
@gnutls.log_func
3146
2952
def debug_gnutls(level, string):
3147
2953
logger.debug("GnuTLS: %s", string[:-1])
3148
2954
3149
2955
gnutls.global_set_log_function(debug_gnutls)
3150
2956
3151
2957
# Redirect stdin so all checkers get /dev/null
3152
2958
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3153
2959
os.dup2(null, sys.stdin.fileno())
3154
2960
if null > 2:
3155
2961
os.close(null)
3156
2962
3157
2963
# Need to fork before connecting to D-Bus
3158
2964
if not foreground:
3159
2965
# Close all input and output, do double fork, etc.
3160
2966
daemon()
3161
3162
if gi.version_info < (3, 10, 2):
3163
# multiprocessing will use threads, so before we use GLib we
3164
# need to inform GLib that threads will be used.
3165
GLib.threads_init()
3166
2967
2968
# multiprocessing will use threads, so before we use gobject we
2969
# need to inform gobject that threads will be used.
2970
gobject.threads_init()
2971
3167
2972
global main_loop
3168
2973
# From the Avahi example code
3169
2974
DBusGMainLoop(set_as_default=True)
3170
main_loop = GLib.MainLoop()
2975
main_loop = gobject.MainLoop()
3171
2976
bus = dbus.SystemBus()
3172
2977
# End of Avahi example code
3173
2978
if use_dbus:
3186
2991
if zeroconf:
3187
2992
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3188
2993
service = AvahiServiceToSyslog(
3189
name=server_settings["servicename"],
3190
servicetype="_mandos._tcp",
3191
protocol=protocol,
3192
bus=bus)
2994
name = server_settings["servicename"],
2995
servicetype = "_mandos._tcp",
2996
protocol = protocol,
2997
bus = bus)
3193
2998
if server_settings["interface"]:
3194
2999
service.interface = if_nametoindex(
3195
3000
server_settings["interface"].encode("utf-8"))
3196
3001
3197
3002
global multiprocessing_manager
3198
3003
multiprocessing_manager = multiprocessing.Manager()
3199
3004
3200
3005
client_class = Client
3201
3006
if use_dbus:
3202
client_class = functools.partial(ClientDBus, bus=bus)
3203
3007
client_class = functools.partial(ClientDBus, bus = bus)
3008
3204
3009
client_settings = Client.config_parser(client_config)
3205
3010
old_client_settings = {}
3206
3011
clients_data = {}
3207
3012
3208
3013
# This is used to redirect stdout and stderr for checker processes
3209
3014
global wnull
3210
wnull = open(os.devnull, "w") # A writable /dev/null
3015
wnull = open(os.devnull, "w") # A writable /dev/null
3211
3016
# Only used if server is running in foreground but not in debug
3212
3017
# mode
3213
3018
if debug or not foreground:
3214
3019
wnull.close()
3215
3020
3216
3021
# Get client data and settings from last running state.
3217
3022
if server_settings["restore"]:
3218
3023
try:
3219
3024
with open(stored_state_path, "rb") as stored_state:
3220
if sys.version_info.major == 2:
3221
clients_data, old_client_settings = pickle.load(
3222
stored_state)
3223
else:
3224
bytes_clients_data, bytes_old_client_settings = (
3225
pickle.load(stored_state, encoding="bytes"))
3226
# Fix bytes to strings
3227
# clients_data
3228
# .keys()
3229
clients_data = {(key.decode("utf-8")
3230
if isinstance(key, bytes)
3231
else key): value
3232
for key, value in
3233
bytes_clients_data.items()}
3234
del bytes_clients_data
3235
for key in clients_data:
3236
value = {(k.decode("utf-8")
3237
if isinstance(k, bytes) else k): v
3238
for k, v in
3239
clients_data[key].items()}
3240
clients_data[key] = value
3241
# .client_structure
3242
value["client_structure"] = [
3243
(s.decode("utf-8")
3244
if isinstance(s, bytes)
3245
else s) for s in
3246
value["client_structure"]]
3247
# .name & .host
3248
for k in ("name", "host"):
3249
if isinstance(value[k], bytes):
3250
value[k] = value[k].decode("utf-8")
3251
if "key_id" not in value:
3252
value["key_id"] = ""
3253
elif "fingerprint" not in value:
3254
value["fingerprint"] = ""
3255
# old_client_settings
3256
# .keys()
3257
old_client_settings = {
3258
(key.decode("utf-8")
3259
if isinstance(key, bytes)
3260
else key): value
3261
for key, value in
3262
bytes_old_client_settings.items()}
3263
del bytes_old_client_settings
3264
# .host
3265
for value in old_client_settings.values():
3266
if isinstance(value["host"], bytes):
3267
value["host"] = (value["host"]
3268
.decode("utf-8"))
3025
clients_data, old_client_settings = pickle.load(
3026
stored_state)
3269
3027
os.remove(stored_state_path)
3270
3028
except IOError as e:
3271
3029
if e.errno == errno.ENOENT:
3279
3037
logger.warning("Could not load persistent state: "
3280
3038
"EOFError:",
3281
3039
exc_info=e)
3282
3040
3283
3041
with PGPEngine() as pgp:
3284
3042
for client_name, client in clients_data.items():
3285
3043
# Skip removed clients
3286
3044
if client_name not in client_settings:
3287
3045
continue
3288
3046
3289
3047
# Decide which value to use after restoring saved state.
3290
3048
# We have three different values: Old config file,
3291
3049
# new config file, and saved state.
3302
3060
client[name] = value
3303
3061
except KeyError:
3304
3062
pass
3305
3063
3306
3064
# Clients who has passed its expire date can still be
3307
3065
# enabled if its last checker was successful. A Client
3308
3066
# whose checker succeeded before we stored its state is
3341
3099
client_name))
3342
3100
client["secret"] = (client_settings[client_name]
3343
3101
["secret"])
3344
3102
3345
3103
# Add/remove clients based on new changes made to config
3346
3104
for client_name in (set(old_client_settings)
3347
3105
- set(client_settings)):
3349
3107
for client_name in (set(client_settings)
3350
3108
- set(old_client_settings)):
3351
3109
clients_data[client_name] = client_settings[client_name]
3352
3110
3353
3111
# Create all client objects
3354
3112
for client_name, client in clients_data.items():
3355
3113
tcp_server.clients[client_name] = client_class(
3356
name=client_name,
3357
settings=client,
3358
server_settings=server_settings)
3359
3114
name = client_name,
3115
settings = client,
3116
server_settings = server_settings)
3117
3360
3118
if not tcp_server.clients:
3361
3119
logger.warning("No clients defined")
3362
3120
3363
3121
if not foreground:
3364
3122
if pidfile is not None:
3365
3123
pid = os.getpid()
3371
3129
pidfilename, pid)
3372
3130
del pidfile
3373
3131
del pidfilename
3374
3375
for termsig in (signal.SIGHUP, signal.SIGTERM):
3376
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3377
lambda: main_loop.quit() and False)
3378
3132
3133
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3134
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3135
3379
3136
if use_dbus:
3380
3137
3381
3138
@alternate_dbus_interfaces(
3382
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3139
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3383
3140
class MandosDBusService(DBusObjectWithObjectManager):
3384
3141
"""A D-Bus proxy object"""
3385
3142
3386
3143
def __init__(self):
3387
3144
dbus.service.Object.__init__(self, bus, "/")
3388
3145
3389
3146
_interface = "se.recompile.Mandos"
3390
3147
3391
3148
@dbus.service.signal(_interface, signature="o")
3392
3149
def ClientAdded(self, objpath):
3393
3150
"D-Bus signal"
3394
3151
pass
3395
3152
3396
3153
@dbus.service.signal(_interface, signature="ss")
3397
def ClientNotFound(self, key_id, address):
3154
def ClientNotFound(self, fingerprint, address):
3398
3155
"D-Bus signal"
3399
3156
pass
3400
3157
3401
3158
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3402
3159
"true"})
3403
3160
@dbus.service.signal(_interface, signature="os")
3404
3161
def ClientRemoved(self, objpath, name):
3405
3162
"D-Bus signal"
3406
3163
pass
3407
3164
3408
3165
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3409
3166
"true"})
3410
3167
@dbus.service.method(_interface, out_signature="ao")
3411
3168
def GetAllClients(self):
3412
3169
"D-Bus method"
3413
3170
return dbus.Array(c.dbus_object_path for c in
3414
tcp_server.clients.values())
3415
3171
tcp_server.clients.itervalues())
3172
3416
3173
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3417
3174
"true"})
3418
3175
@dbus.service.method(_interface,
3420
3177
def GetAllClientsWithProperties(self):
3421
3178
"D-Bus method"
3422
3179
return dbus.Dictionary(
3423
{c.dbus_object_path: c.GetAll(
3180
{ c.dbus_object_path: c.GetAll(
3424
3181
"se.recompile.Mandos.Client")
3425
for c in tcp_server.clients.values()},
3182
for c in tcp_server.clients.itervalues() },
3426
3183
signature="oa{sv}")
3427
3184
3428
3185
@dbus.service.method(_interface, in_signature="o")
3429
3186
def RemoveClient(self, object_path):
3430
3187
"D-Bus method"
3431
for c in tcp_server.clients.values():
3188
for c in tcp_server.clients.itervalues():
3432
3189
if c.dbus_object_path == object_path:
3433
3190
del tcp_server.clients[c.name]
3434
3191
c.remove_from_connection()
3438
3195
self.client_removed_signal(c)
3439
3196
return
3440
3197
raise KeyError(object_path)
3441
3198
3442
3199
del _interface
3443
3200
3444
3201
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3445
out_signature="a{oa{sa{sv}}}")
3202
out_signature = "a{oa{sa{sv}}}")
3446
3203
def GetManagedObjects(self):
3447
3204
"""D-Bus method"""
3448
3205
return dbus.Dictionary(
3449
{client.dbus_object_path:
3450
dbus.Dictionary(
3451
{interface: client.GetAll(interface)
3452
for interface in
3453
client._get_all_interface_names()})
3454
for client in tcp_server.clients.values()})
3455
3206
{ client.dbus_object_path:
3207
dbus.Dictionary(
3208
{ interface: client.GetAll(interface)
3209
for interface in
3210
client._get_all_interface_names()})
3211
for client in tcp_server.clients.values()})
3212
3456
3213
def client_added_signal(self, client):
3457
3214
"""Send the new standard signal and the old signal"""
3458
3215
if use_dbus:
3460
3217
self.InterfacesAdded(
3461
3218
client.dbus_object_path,
3462
3219
dbus.Dictionary(
3463
{interface: client.GetAll(interface)
3464
for interface in
3465
client._get_all_interface_names()}))
3220
{ interface: client.GetAll(interface)
3221
for interface in
3222
client._get_all_interface_names()}))
3466
3223
# Old signal
3467
3224
self.ClientAdded(client.dbus_object_path)
3468
3225
3469
3226
def client_removed_signal(self, client):
3470
3227
"""Send the new standard signal and the old signal"""
3471
3228
if use_dbus:
3476
3233
# Old signal
3477
3234
self.ClientRemoved(client.dbus_object_path,
3478
3235
client.name)
3479
3236
3480
3237
mandos_dbus_service = MandosDBusService()
3481
3482
# Save modules to variables to exempt the modules from being
3483
# unloaded before the function registered with atexit() is run.
3484
mp = multiprocessing
3485
wn = wnull
3486
3238
3487
3239
def cleanup():
3488
3240
"Cleanup function; run on exit"
3489
3241
if zeroconf:
3490
3242
service.cleanup()
3491
3492
mp.active_children()
3493
wn.close()
3243
3244
multiprocessing.active_children()
3245
wnull.close()
3494
3246
if not (tcp_server.clients or client_settings):
3495
3247
return
3496
3248
3497
3249
# Store client before exiting. Secrets are encrypted with key
3498
3250
# based on what config file has. If config file is
3499
3251
# removed/edited, old secret will thus be unrecovable.
3500
3252
clients = {}
3501
3253
with PGPEngine() as pgp:
3502
for client in tcp_server.clients.values():
3254
for client in tcp_server.clients.itervalues():
3503
3255
key = client_settings[client.name]["secret"]
3504
3256
client.encrypted_secret = pgp.encrypt(client.secret,
3505
3257
key)
3506
3258
client_dict = {}
3507
3259
3508
3260
# A list of attributes that can not be pickled
3509
3261
# + secret.
3510
exclude = {"bus", "changedstate", "secret",
3511
"checker", "server_settings"}
3262
exclude = { "bus", "changedstate", "secret",
3263
"checker", "server_settings" }
3512
3264
for name, typ in inspect.getmembers(dbus.service
3513
3265
.Object):
3514
3266
exclude.add(name)
3515
3267
3516
3268
client_dict["encrypted_secret"] = (client
3517
3269
.encrypted_secret)
3518
3270
for attr in client.client_structure:
3519
3271
if attr not in exclude:
3520
3272
client_dict[attr] = getattr(client, attr)
3521
3273
3522
3274
clients[client.name] = client_dict
3523
3275
del client_settings[client.name]["secret"]
3524
3276
3525
3277
try:
3526
3278
with tempfile.NamedTemporaryFile(
3527
3279
mode='wb',
3529
3281
prefix='clients-',
3530
3282
dir=os.path.dirname(stored_state_path),
3531
3283
delete=False) as stored_state:
3532
pickle.dump((clients, client_settings), stored_state,
3533
protocol=2)
3284
pickle.dump((clients, client_settings), stored_state)
3534
3285
tempname = stored_state.name
3535
3286
os.rename(tempname, stored_state_path)
3536
3287
except (IOError, OSError) as e:
3546
3297
logger.warning("Could not save persistent state:",
3547
3298
exc_info=e)
3548
3299
raise
3549
3300
3550
3301
# Delete all clients, and settings from config
3551
3302
while tcp_server.clients:
3552
3303
name, client = tcp_server.clients.popitem()
3558
3309
if use_dbus:
3559
3310
mandos_dbus_service.client_removed_signal(client)
3560
3311
client_settings.clear()
3561
3312
3562
3313
atexit.register(cleanup)
3563
3564
for client in tcp_server.clients.values():
3314
3315
for client in tcp_server.clients.itervalues():
3565
3316
if use_dbus:
3566
3317
# Emit D-Bus signal for adding
3567
3318
mandos_dbus_service.client_added_signal(client)
3568
3319
# Need to initiate checking of clients
3569
3320
if client.enabled:
3570
3321
client.init_checker()
3571
3322
3572
3323
tcp_server.enable()
3573
3324
tcp_server.server_activate()
3574
3325
3575
3326
# Find out what port we got
3576
3327
if zeroconf:
3577
3328
service.port = tcp_server.socket.getsockname()[1]
3582
3333
else: # IPv4
3583
3334
logger.info("Now listening on address %r, port %d",
3584
3335
*tcp_server.socket.getsockname())
3585
3586
# service.interface = tcp_server.socket.getsockname()[3]
3587
3336
3337
#service.interface = tcp_server.socket.getsockname()[3]
3338
3588
3339
try:
3589
3340
if zeroconf:
3590
3341
# From the Avahi example code
3595
3346
cleanup()
3596
3347
sys.exit(1)
3597
3348
# End of Avahi example code
3598
3599
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3600
lambda *args, **kwargs:
3601
(tcp_server.handle_request
3602
(*args[2:], **kwargs) or True))
3603
3349
3350
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3351
lambda *args, **kwargs:
3352
(tcp_server.handle_request
3353
(*args[2:], **kwargs) or True))
3354
3604
3355
logger.debug("Starting main loop")
3605
3356
main_loop.run()
3606
3357
except AvahiError as error:
3615
3366
# Must run before the D-Bus bus name gets deregistered
3616
3367
cleanup()
3617
3368
3618
3619
def should_only_run_tests():
3620
parser = argparse.ArgumentParser(add_help=False)
3621
parser.add_argument("--check", action='store_true')
3622
args, unknown_args = parser.parse_known_args()
3623
run_tests = args.check
3624
if run_tests:
3625
# Remove --check argument from sys.argv
3626
sys.argv[1:] = unknown_args
3627
return run_tests
3628
3629
# Add all tests from doctest strings
3630
def load_tests(loader, tests, none):
3631
import doctest
3632
tests.addTests(doctest.DocTestSuite())
3633
return tests
3634
3369
3635
3370
if __name__ == '__main__':
3636
try:
3637
if should_only_run_tests():
3638
# Call using ./mandos --check [--verbose]
3639
unittest.main()
3640
else:
3641
main()
3642
finally:
3643
logging.shutdown()
3371
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0