To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 825
- compare with another revision
- download diff
- download tarball
- view history from revision 825
- Committer: Teddy Hogeborn
- Date: 2016-03-07 23:39:36 UTC
- Revision ID: teddy@recompile.se-20160307233936-mhgpxhggamde443n
Server bug fix: Include CAP_SETGID so it does not run as root
* debian/mandos.postinst (configure): If old version was 1.7.4-1 or
1.7.4-1~bpo8+1, fix situation where clients.pickle file is owned by
root.
* mandos (main): Print debug info about setuid() and setgid()
* mandos.service ([Service]/CapabilityBoundingSet): Add "CAP_KILL
CAP_SETGID"; the latter is needed for setgid() to be allowed.
* debian/mandos.postinst (configure): If old version was 1.7.4-1 or
1.7.4-1~bpo8+1, fix situation where clients.pickle file is owned by
root.
* mandos (main): Print debug info about setuid() and setgid()
* mandos.service ([Service]/CapabilityBoundingSet): Add "CAP_KILL
CAP_SETGID"; the latter is needed for setgid() to be allowed.
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
77
73
import itertools
78
74
import collections
79
75
import codecs
80
import unittest
81
import random
82
import shlex
83
76
84
77
import dbus
85
78
import dbus.service
86
import gi
87
from gi.repository import GLib
79
try:
80
from gi.repository import GObject
81
except ImportError:
82
import gobject as GObject
83
import avahi
88
84
from dbus.mainloop.glib import DBusGMainLoop
89
85
import ctypes
90
86
import ctypes.util
91
87
import xml.dom.minidom
92
88
import inspect
93
89
94
if sys.version_info.major == 2:
95
__metaclass__ = type
96
str = unicode
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
# Try to find the value of SO_BINDTODEVICE:
119
try:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
90
try:
122
91
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
92
except AttributeError:
124
93
try:
125
# This is where SO_BINDTODEVICE was up to and including Python
126
# 2.6, and also 3.2:
127
94
from IN import SO_BINDTODEVICE
128
95
except ImportError:
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
131
try:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
133
"/dev/stdin"],
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
140
# No value found
141
SO_BINDTODEVICE = None
142
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
145
146
version = "1.8.13"
96
SO_BINDTODEVICE = None
97
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.4"
147
102
stored_state_file = "clients.pickle"
148
103
149
104
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
151
105
syslogger = None
152
106
153
107
try:
154
108
if_nametoindex = ctypes.cdll.LoadLibrary(
155
109
ctypes.util.find_library("c")).if_nametoindex
156
110
except (OSError, AttributeError):
157
111
158
112
def if_nametoindex(interface):
159
113
"Get an interface index the hard way, i.e. using fcntl()"
160
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
165
119
return interface_index
166
120
167
121
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
172
func.func_globals,
173
func.func_name,
174
func.func_defaults,
175
func.func_closure)
176
else:
177
return types.FunctionType(func.__code__,
178
func.__globals__,
179
func.__name__,
180
func.__defaults__,
181
func.__closure__)
182
183
184
122
def initlogger(debug, level=logging.WARNING):
185
123
"""init logger and add loglevel"""
186
124
187
125
global syslogger
188
126
syslogger = (logging.handlers.SysLogHandler(
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
address="/dev/log"))
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
191
129
syslogger.setFormatter(logging.Formatter
192
130
('Mandos [%(process)d]: %(levelname)s:'
193
131
' %(message)s'))
194
132
logger.addHandler(syslogger)
195
133
196
134
if debug:
197
135
console = logging.StreamHandler()
198
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
208
146
pass
209
147
210
148
211
class PGPEngine:
149
class PGPEngine(object):
212
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
151
214
152
def __init__(self):
215
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
216
154
self.gpg = "gpg"
217
155
try:
218
156
output = subprocess.check_output(["gpgconf"])
219
157
for line in output.splitlines():
220
name, text, path = line.split(b":")
221
if name == b"gpg":
158
name, text, path = line.split(":")
159
if name == "gpg":
222
160
self.gpg = path
223
161
break
224
162
except OSError as e:
227
165
self.gnupgargs = ['--batch',
228
166
'--homedir', self.tempdir,
229
167
'--force-mdc',
230
'--quiet']
231
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
self.gnupgargs.append("--no-use-agent")
234
168
'--quiet',
169
'--no-use-agent']
170
235
171
def __enter__(self):
236
172
return self
237
173
238
174
def __exit__(self, exc_type, exc_value, traceback):
239
175
self._cleanup()
240
176
return False
241
177
242
178
def __del__(self):
243
179
self._cleanup()
244
180
245
181
def _cleanup(self):
246
182
if self.tempdir is not None:
247
183
# Delete contents of tempdir
248
184
for root, dirs, files in os.walk(self.tempdir,
249
topdown=False):
185
topdown = False):
250
186
for filename in files:
251
187
os.remove(os.path.join(root, filename))
252
188
for dirname in dirs:
254
190
# Remove tempdir
255
191
os.rmdir(self.tempdir)
256
192
self.tempdir = None
257
193
258
194
def password_encode(self, password):
259
195
# Passphrase can not be empty and can not contain newlines or
260
196
# NUL bytes. So we prefix it and hex encode it.
265
201
.replace(b"\n", b"\\n")
266
202
.replace(b"\0", b"\\x00"))
267
203
return encoded
268
204
269
205
def encrypt(self, data, password):
270
206
passphrase = self.password_encode(password)
271
207
with tempfile.NamedTemporaryFile(
276
212
'--passphrase-file',
277
213
passfile.name]
278
214
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
283
219
if proc.returncode != 0:
284
220
raise PGPError(err)
285
221
return ciphertext
286
222
287
223
def decrypt(self, data, password):
288
224
passphrase = self.password_encode(password)
289
225
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
226
dir = self.tempdir) as passfile:
291
227
passfile.write(passphrase)
292
228
passfile.flush()
293
229
proc = subprocess.Popen([self.gpg, '--decrypt',
294
230
'--passphrase-file',
295
231
passfile.name]
296
232
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
301
237
if proc.returncode != 0:
302
238
raise PGPError(err)
303
239
return decrypted_plaintext
304
240
305
241
306
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
317
318
@staticmethod
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
330
331
332
242
class AvahiError(Exception):
333
243
def __init__(self, value, *args, **kwargs):
334
244
self.value = value
344
254
pass
345
255
346
256
347
class AvahiService:
257
class AvahiService(object):
348
258
"""An Avahi (Zeroconf) service.
349
259
350
260
Attributes:
351
261
interface: integer; avahi.IF_UNSPEC or an interface index.
352
262
Used to optionally bind to the specified interface.
364
274
server: D-Bus Server
365
275
bus: dbus.SystemBus()
366
276
"""
367
277
368
278
def __init__(self,
369
interface=avahi.IF_UNSPEC,
370
name=None,
371
servicetype=None,
372
port=None,
373
TXT=None,
374
domain="",
375
host="",
376
max_renames=32768,
377
protocol=avahi.PROTO_UNSPEC,
378
bus=None):
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
379
289
self.interface = interface
380
290
self.name = name
381
291
self.type = servicetype
390
300
self.server = None
391
301
self.bus = bus
392
302
self.entry_group_state_changed_match = None
393
303
394
304
def rename(self, remove=True):
395
305
"""Derived from the Avahi example code"""
396
306
if self.rename_count >= self.max_renames:
416
326
logger.critical("D-Bus Exception", exc_info=error)
417
327
self.cleanup()
418
328
os._exit(1)
419
329
420
330
def remove(self):
421
331
"""Derived from the Avahi example code"""
422
332
if self.entry_group_state_changed_match is not None:
424
334
self.entry_group_state_changed_match = None
425
335
if self.group is not None:
426
336
self.group.Reset()
427
337
428
338
def add(self):
429
339
"""Derived from the Avahi example code"""
430
340
self.remove()
447
357
dbus.UInt16(self.port),
448
358
avahi.string_array_to_txt_array(self.TXT))
449
359
self.group.Commit()
450
360
451
361
def entry_group_state_changed(self, state, error):
452
362
"""Derived from the Avahi example code"""
453
363
logger.debug("Avahi entry group state change: %i", state)
454
364
455
365
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
366
logger.debug("Zeroconf service established.")
457
367
elif state == avahi.ENTRY_GROUP_COLLISION:
461
371
logger.critical("Avahi: Error in group state changed %s",
462
372
str(error))
463
373
raise AvahiGroupError("State changed: {!s}".format(error))
464
374
465
375
def cleanup(self):
466
376
"""Derived from the Avahi example code"""
467
377
if self.group is not None:
472
382
pass
473
383
self.group = None
474
384
self.remove()
475
385
476
386
def server_state_changed(self, state, error=None):
477
387
"""Derived from the Avahi example code"""
478
388
logger.debug("Avahi server state change: %i", state)
507
417
logger.debug("Unknown state: %r", state)
508
418
else:
509
419
logger.debug("Unknown state: %r: %r", state, error)
510
420
511
421
def activate(self):
512
422
"""Derived from the Avahi example code"""
513
423
if self.server is None:
524
434
class AvahiServiceToSyslog(AvahiService):
525
435
def rename(self, *args, **kwargs):
526
436
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
**kwargs)
437
ret = AvahiService.rename(self, *args, **kwargs)
529
438
syslogger.setFormatter(logging.Formatter(
530
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
531
440
.format(self.name)))
532
441
return ret
533
442
534
535
443
# Pretend that we have a GnuTLS module
536
class gnutls:
537
"""This isn't so much a class as it is a module-like namespace."""
538
539
library = ctypes.util.find_library("gnutls")
540
if library is None:
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
543
del library
544
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
545
459
# Unless otherwise indicated, the constants and types below are
546
460
# all from the gnutls/gnutls.h C header file.
547
461
548
462
# Constants
549
463
E_SUCCESS = 0
550
464
E_INTERRUPTED = -52
551
465
E_AGAIN = -28
552
466
CRT_OPENPGP = 2
553
CRT_RAWPK = 3
554
467
CLIENT = 2
555
468
SHUT_RDWR = 0
556
469
CRD_CERTIFICATE = 1
557
470
E_NO_CERTIFICATE_FOUND = -49
558
X509_FMT_DER = 0
559
NO_TICKETS = 1<<10
560
ENABLE_RAWPK = 1<<18
561
CTYPE_PEERS = 3
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
563
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
564
472
565
473
# Types
566
474
class session_int(ctypes.Structure):
567
475
_fields_ = []
568
476
session_t = ctypes.POINTER(session_int)
569
570
477
class certificate_credentials_st(ctypes.Structure):
571
478
_fields_ = []
572
479
certificate_credentials_t = ctypes.POINTER(
573
480
certificate_credentials_st)
574
481
certificate_type_t = ctypes.c_int
575
576
482
class datum_t(ctypes.Structure):
577
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
484
('size', ctypes.c_uint)]
579
580
485
class openpgp_crt_int(ctypes.Structure):
581
486
_fields_ = []
582
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
490
credentials_type_t = ctypes.c_int
586
491
transport_ptr_t = ctypes.c_void_p
587
492
close_request_t = ctypes.c_int
588
493
589
494
# Exceptions
590
495
class Error(Exception):
591
def __init__(self, message=None, code=None, args=()):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
592
501
# Default usage is by a message string, but if a return
593
502
# code is passed, convert it to a string with
594
503
# gnutls.strerror()
595
504
self.code = code
596
505
if message is None and code is not None:
597
message = gnutls.strerror(code)
598
return super(gnutls.Error, self).__init__(
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
599
508
message, *args)
600
509
601
510
class CertificateSecurityError(Error):
602
511
pass
603
512
604
513
# Classes
605
class Credentials:
514
class Credentials(object):
606
515
def __init__(self):
607
516
self._c_object = gnutls.certificate_credentials_t()
608
517
gnutls.certificate_allocate_credentials(
609
518
ctypes.byref(self._c_object))
610
519
self.type = gnutls.CRD_CERTIFICATE
611
520
612
521
def __del__(self):
613
522
gnutls.certificate_free_credentials(self._c_object)
614
615
class ClientSession:
616
def __init__(self, socket, credentials=None):
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
617
526
self._c_object = gnutls.session_t()
618
gnutls_flags = gnutls.CLIENT
619
if gnutls.check_version(b"3.5.6"):
620
gnutls_flags |= gnutls.NO_TICKETS
621
if gnutls.has_rawpk:
622
gnutls_flags |= gnutls.ENABLE_RAWPK
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
624
del gnutls_flags
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
625
528
gnutls.set_default_priority(self._c_object)
626
529
gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
530
gnutls.handshake_set_private_extensions(self._c_object,
633
536
ctypes.cast(credentials._c_object,
634
537
ctypes.c_void_p))
635
538
self.credentials = credentials
636
539
637
540
def __del__(self):
638
541
gnutls.deinit(self._c_object)
639
542
640
543
def handshake(self):
641
544
return gnutls.handshake(self._c_object)
642
545
643
546
def send(self, data):
644
547
data = bytes(data)
645
548
data_len = len(data)
647
550
data_len -= gnutls.record_send(self._c_object,
648
551
data[-data_len:],
649
552
data_len)
650
553
651
554
def bye(self):
652
555
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
653
556
654
557
# Error handling functions
655
558
def _error_code(result):
656
559
"""A function to raise exceptions on errors, suitable
658
561
if result >= 0:
659
562
return result
660
563
if result == gnutls.E_NO_CERTIFICATE_FOUND:
661
raise gnutls.CertificateSecurityError(code=result)
662
raise gnutls.Error(code=result)
663
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
664
567
def _retry_on_error(result, func, arguments):
665
568
"""A function to retry on some errors, suitable
666
569
for the 'errcheck' attribute on ctypes functions"""
669
572
return _error_code(result)
670
573
result = func(*arguments)
671
574
return result
672
575
673
576
# Unless otherwise indicated, the function declarations below are
674
577
# all from the gnutls/gnutls.h C header file.
675
578
676
579
# Functions
677
580
priority_set_direct = _library.gnutls_priority_set_direct
678
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
679
582
ctypes.POINTER(ctypes.c_char_p)]
680
583
priority_set_direct.restype = _error_code
681
584
682
585
init = _library.gnutls_init
683
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
684
587
init.restype = _error_code
685
588
686
589
set_default_priority = _library.gnutls_set_default_priority
687
590
set_default_priority.argtypes = [session_t]
688
591
set_default_priority.restype = _error_code
689
592
690
593
record_send = _library.gnutls_record_send
691
594
record_send.argtypes = [session_t, ctypes.c_void_p,
692
595
ctypes.c_size_t]
693
596
record_send.restype = ctypes.c_ssize_t
694
597
record_send.errcheck = _retry_on_error
695
598
696
599
certificate_allocate_credentials = (
697
600
_library.gnutls_certificate_allocate_credentials)
698
601
certificate_allocate_credentials.argtypes = [
699
602
ctypes.POINTER(certificate_credentials_t)]
700
603
certificate_allocate_credentials.restype = _error_code
701
604
702
605
certificate_free_credentials = (
703
606
_library.gnutls_certificate_free_credentials)
704
certificate_free_credentials.argtypes = [
705
certificate_credentials_t]
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
706
608
certificate_free_credentials.restype = None
707
609
708
610
handshake_set_private_extensions = (
709
611
_library.gnutls_handshake_set_private_extensions)
710
612
handshake_set_private_extensions.argtypes = [session_t,
711
613
ctypes.c_int]
712
614
handshake_set_private_extensions.restype = None
713
615
714
616
credentials_set = _library.gnutls_credentials_set
715
617
credentials_set.argtypes = [session_t, credentials_type_t,
716
618
ctypes.c_void_p]
717
619
credentials_set.restype = _error_code
718
620
719
621
strerror = _library.gnutls_strerror
720
622
strerror.argtypes = [ctypes.c_int]
721
623
strerror.restype = ctypes.c_char_p
722
624
723
625
certificate_type_get = _library.gnutls_certificate_type_get
724
626
certificate_type_get.argtypes = [session_t]
725
627
certificate_type_get.restype = _error_code
726
628
727
629
certificate_get_peers = _library.gnutls_certificate_get_peers
728
630
certificate_get_peers.argtypes = [session_t,
729
631
ctypes.POINTER(ctypes.c_uint)]
730
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
731
633
732
634
global_set_log_level = _library.gnutls_global_set_log_level
733
635
global_set_log_level.argtypes = [ctypes.c_int]
734
636
global_set_log_level.restype = None
735
637
736
638
global_set_log_function = _library.gnutls_global_set_log_function
737
639
global_set_log_function.argtypes = [log_func]
738
640
global_set_log_function.restype = None
739
641
740
642
deinit = _library.gnutls_deinit
741
643
deinit.argtypes = [session_t]
742
644
deinit.restype = None
743
645
744
646
handshake = _library.gnutls_handshake
745
647
handshake.argtypes = [session_t]
746
648
handshake.restype = _error_code
747
649
handshake.errcheck = _retry_on_error
748
650
749
651
transport_set_ptr = _library.gnutls_transport_set_ptr
750
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
751
653
transport_set_ptr.restype = None
752
654
753
655
bye = _library.gnutls_bye
754
656
bye.argtypes = [session_t, close_request_t]
755
657
bye.restype = _error_code
756
658
bye.errcheck = _retry_on_error
757
659
758
660
check_version = _library.gnutls_check_version
759
661
check_version.argtypes = [ctypes.c_char_p]
760
662
check_version.restype = ctypes.c_char_p
761
762
_need_version = b"3.3.0"
763
if check_version(_need_version) is None:
764
raise self.Error("Needs GnuTLS {} or later"
765
.format(_need_version))
766
767
_tls_rawpk_version = b"3.6.6"
768
has_rawpk = bool(check_version(_tls_rawpk_version))
769
770
if has_rawpk:
771
# Types
772
class pubkey_st(ctypes.Structure):
773
_fields = []
774
pubkey_t = ctypes.POINTER(pubkey_st)
775
776
x509_crt_fmt_t = ctypes.c_int
777
778
# All the function declarations below are from
779
# gnutls/abstract.h
780
pubkey_init = _library.gnutls_pubkey_init
781
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
782
pubkey_init.restype = _error_code
783
784
pubkey_import = _library.gnutls_pubkey_import
785
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
786
x509_crt_fmt_t]
787
pubkey_import.restype = _error_code
788
789
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
790
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
791
ctypes.POINTER(ctypes.c_ubyte),
792
ctypes.POINTER(ctypes.c_size_t)]
793
pubkey_get_key_id.restype = _error_code
794
795
pubkey_deinit = _library.gnutls_pubkey_deinit
796
pubkey_deinit.argtypes = [pubkey_t]
797
pubkey_deinit.restype = None
798
else:
799
# All the function declarations below are from
800
# gnutls/openpgp.h
801
802
openpgp_crt_init = _library.gnutls_openpgp_crt_init
803
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
804
openpgp_crt_init.restype = _error_code
805
806
openpgp_crt_import = _library.gnutls_openpgp_crt_import
807
openpgp_crt_import.argtypes = [openpgp_crt_t,
808
ctypes.POINTER(datum_t),
809
openpgp_crt_fmt_t]
810
openpgp_crt_import.restype = _error_code
811
812
openpgp_crt_verify_self = \
813
_library.gnutls_openpgp_crt_verify_self
814
openpgp_crt_verify_self.argtypes = [
815
openpgp_crt_t,
816
ctypes.c_uint,
817
ctypes.POINTER(ctypes.c_uint),
818
]
819
openpgp_crt_verify_self.restype = _error_code
820
821
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
822
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
823
openpgp_crt_deinit.restype = None
824
825
openpgp_crt_get_fingerprint = (
826
_library.gnutls_openpgp_crt_get_fingerprint)
827
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
828
ctypes.c_void_p,
829
ctypes.POINTER(
830
ctypes.c_size_t)]
831
openpgp_crt_get_fingerprint.restype = _error_code
832
833
if check_version(b"3.6.4"):
834
certificate_type_get2 = _library.gnutls_certificate_type_get2
835
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
836
certificate_type_get2.restype = _error_code
837
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
838
693
# Remove non-public functions
839
694
del _error_code, _retry_on_error
840
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
841
697
842
698
def call_pipe(connection, # : multiprocessing.Connection
843
699
func, *args, **kwargs):
844
700
"""This function is meant to be called by multiprocessing.Process
845
701
846
702
This function runs func(*args, **kwargs), and writes the resulting
847
703
return value on the provided multiprocessing.Connection.
848
704
"""
849
705
connection.send(func(*args, **kwargs))
850
706
connection.close()
851
707
852
853
class Client:
708
class Client(object):
854
709
"""A representation of a client host served by this server.
855
710
856
711
Attributes:
857
712
approved: bool(); 'None' if not yet approved/disapproved
858
713
approval_delay: datetime.timedelta(); Time to wait for approval
859
714
approval_duration: datetime.timedelta(); Duration of one approval
860
checker: multiprocessing.Process(); a running checker process used
861
to see if the client lives. 'None' if no process is
862
running.
863
checker_callback_tag: a GLib event source tag, or None
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a GObject event source tag, or None
864
719
checker_command: string; External command which is run to check
865
720
if client lives. %() expansions are done at
866
721
runtime with vars(self) as dict, so that for
867
722
instance %(name)s can be used in the command.
868
checker_initiator_tag: a GLib event source tag, or None
723
checker_initiator_tag: a GObject event source tag, or None
869
724
created: datetime.datetime(); (UTC) object creation
870
725
client_structure: Object describing what attributes a client has
871
726
and is used for storing the client at exit
872
727
current_checker_command: string; current running checker_command
873
disable_initiator_tag: a GLib event source tag, or None
728
disable_initiator_tag: a GObject event source tag, or None
874
729
enabled: bool()
875
730
fingerprint: string (40 or 32 hexadecimal digits); used to
876
uniquely identify an OpenPGP client
877
key_id: string (64 hexadecimal digits); used to uniquely identify
878
a client using raw public keys
731
uniquely identify the client
879
732
host: string; available for use by the checker command
880
733
interval: datetime.timedelta(); How often to start a new checker
881
734
last_approval_request: datetime.datetime(); (UTC) or None
897
750
disabled, or None
898
751
server_settings: The server_settings dict from main()
899
752
"""
900
753
901
754
runtime_expansions = ("approval_delay", "approval_duration",
902
"created", "enabled", "expires", "key_id",
755
"created", "enabled", "expires",
903
756
"fingerprint", "host", "interval",
904
757
"last_approval_request", "last_checked_ok",
905
758
"last_enabled", "name", "timeout")
914
767
"approved_by_default": "True",
915
768
"enabled": "True",
916
769
}
917
770
918
771
@staticmethod
919
772
def config_parser(config):
920
773
"""Construct a new dict of client settings of this form:
927
780
for client_name in config.sections():
928
781
section = dict(config.items(client_name))
929
782
client = settings[client_name] = {}
930
783
931
784
client["host"] = section["host"]
932
785
# Reformat values from string types to Python types
933
786
client["approved_by_default"] = config.getboolean(
934
787
client_name, "approved_by_default")
935
788
client["enabled"] = config.getboolean(client_name,
936
789
"enabled")
937
938
# Uppercase and remove spaces from key_id and fingerprint
939
# for later comparison purposes with return value from the
940
# key_id() and fingerprint() functions
941
client["key_id"] = (section.get("key_id", "").upper()
942
.replace(" ", ""))
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
943
794
client["fingerprint"] = (section["fingerprint"].upper()
944
795
.replace(" ", ""))
945
796
if "secret" in section:
946
client["secret"] = codecs.decode(section["secret"]
947
.encode("utf-8"),
948
"base64")
797
client["secret"] = section["secret"].decode("base64")
949
798
elif "secfile" in section:
950
799
with open(os.path.expanduser(os.path.expandvars
951
800
(section["secfile"])),
966
815
client["last_approval_request"] = None
967
816
client["last_checked_ok"] = None
968
817
client["last_checker_status"] = -2
969
818
970
819
return settings
971
972
def __init__(self, settings, name=None, server_settings=None):
820
821
def __init__(self, settings, name = None, server_settings=None):
973
822
self.name = name
974
823
if server_settings is None:
975
824
server_settings = {}
977
826
# adding all client settings
978
827
for setting, value in settings.items():
979
828
setattr(self, setting, value)
980
829
981
830
if self.enabled:
982
831
if not hasattr(self, "last_enabled"):
983
832
self.last_enabled = datetime.datetime.utcnow()
987
836
else:
988
837
self.last_enabled = None
989
838
self.expires = None
990
839
991
840
logger.debug("Creating client %r", self.name)
992
logger.debug(" Key ID: %s", self.key_id)
993
841
logger.debug(" Fingerprint: %s", self.fingerprint)
994
842
self.created = settings.get("created",
995
843
datetime.datetime.utcnow())
996
844
997
845
# attributes specific for this server instance
998
846
self.checker = None
999
847
self.checker_initiator_tag = None
1005
853
self.changedstate = multiprocessing_manager.Condition(
1006
854
multiprocessing_manager.Lock())
1007
855
self.client_structure = [attr
1008
for attr in self.__dict__.keys()
856
for attr in self.__dict__.iterkeys()
1009
857
if not attr.startswith("_")]
1010
858
self.client_structure.append("client_structure")
1011
859
1012
860
for name, t in inspect.getmembers(
1013
861
type(self), lambda obj: isinstance(obj, property)):
1014
862
if not name.startswith("_"):
1015
863
self.client_structure.append(name)
1016
864
1017
865
# Send notice to process children that client state has changed
1018
866
def send_changedstate(self):
1019
867
with self.changedstate:
1020
868
self.changedstate.notify_all()
1021
869
1022
870
def enable(self):
1023
871
"""Start this client's checker and timeout hooks"""
1024
872
if getattr(self, "enabled", False):
1029
877
self.last_enabled = datetime.datetime.utcnow()
1030
878
self.init_checker()
1031
879
self.send_changedstate()
1032
880
1033
881
def disable(self, quiet=True):
1034
882
"""Disable this client."""
1035
883
if not getattr(self, "enabled", False):
1037
885
if not quiet:
1038
886
logger.info("Disabling client %s", self.name)
1039
887
if getattr(self, "disable_initiator_tag", None) is not None:
1040
GLib.source_remove(self.disable_initiator_tag)
888
GObject.source_remove(self.disable_initiator_tag)
1041
889
self.disable_initiator_tag = None
1042
890
self.expires = None
1043
891
if getattr(self, "checker_initiator_tag", None) is not None:
1044
GLib.source_remove(self.checker_initiator_tag)
892
GObject.source_remove(self.checker_initiator_tag)
1045
893
self.checker_initiator_tag = None
1046
894
self.stop_checker()
1047
895
self.enabled = False
1048
896
if not quiet:
1049
897
self.send_changedstate()
1050
# Do not run this again if called by a GLib.timeout_add
898
# Do not run this again if called by a GObject.timeout_add
1051
899
return False
1052
900
1053
901
def __del__(self):
1054
902
self.disable()
1055
903
1056
904
def init_checker(self):
1057
905
# Schedule a new checker to be started an 'interval' from now,
1058
906
# and every interval from then on.
1059
907
if self.checker_initiator_tag is not None:
1060
GLib.source_remove(self.checker_initiator_tag)
1061
self.checker_initiator_tag = GLib.timeout_add(
1062
random.randrange(int(self.interval.total_seconds() * 1000
1063
+ 1)),
908
GObject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = GObject.timeout_add(
910
int(self.interval.total_seconds() * 1000),
1064
911
self.start_checker)
1065
912
# Schedule a disable() when 'timeout' has passed
1066
913
if self.disable_initiator_tag is not None:
1067
GLib.source_remove(self.disable_initiator_tag)
1068
self.disable_initiator_tag = GLib.timeout_add(
914
GObject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = GObject.timeout_add(
1069
916
int(self.timeout.total_seconds() * 1000), self.disable)
1070
917
# Also start a new checker *right now*.
1071
918
self.start_checker()
1072
919
1073
920
def checker_callback(self, source, condition, connection,
1074
921
command):
1075
922
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
924
self.checker = None
1076
925
# Read return code from connection (see call_pipe)
1077
926
returncode = connection.recv()
1078
927
connection.close()
1079
if self.checker is not None:
1080
self.checker.join()
1081
self.checker_callback_tag = None
1082
self.checker = None
1083
928
1084
929
if returncode >= 0:
1085
930
self.last_checker_status = returncode
1086
931
self.last_checker_signal = None
1096
941
logger.warning("Checker for %(name)s crashed?",
1097
942
vars(self))
1098
943
return False
1099
944
1100
945
def checked_ok(self):
1101
946
"""Assert that the client has been seen, alive and well."""
1102
947
self.last_checked_ok = datetime.datetime.utcnow()
1103
948
self.last_checker_status = 0
1104
949
self.last_checker_signal = None
1105
950
self.bump_timeout()
1106
951
1107
952
def bump_timeout(self, timeout=None):
1108
953
"""Bump up the timeout for this client."""
1109
954
if timeout is None:
1110
955
timeout = self.timeout
1111
956
if self.disable_initiator_tag is not None:
1112
GLib.source_remove(self.disable_initiator_tag)
957
GObject.source_remove(self.disable_initiator_tag)
1113
958
self.disable_initiator_tag = None
1114
959
if getattr(self, "enabled", False):
1115
self.disable_initiator_tag = GLib.timeout_add(
960
self.disable_initiator_tag = GObject.timeout_add(
1116
961
int(timeout.total_seconds() * 1000), self.disable)
1117
962
self.expires = datetime.datetime.utcnow() + timeout
1118
963
1119
964
def need_approval(self):
1120
965
self.last_approval_request = datetime.datetime.utcnow()
1121
966
1122
967
def start_checker(self):
1123
968
"""Start a new checker subprocess if one is not running.
1124
969
1125
970
If a checker already exists, leave it running and do
1126
971
nothing."""
1127
972
# The reason for not killing a running checker is that if we
1132
977
# checkers alone, the checker would have to take more time
1133
978
# than 'timeout' for the client to be disabled, which is as it
1134
979
# should be.
1135
980
1136
981
if self.checker is not None and not self.checker.is_alive():
1137
982
logger.warning("Checker was not alive; joining")
1138
983
self.checker.join()
1141
986
if self.checker is None:
1142
987
# Escape attributes for the shell
1143
988
escaped_attrs = {
1144
attr: shlex.quote(str(getattr(self, attr)))
1145
for attr in self.runtime_expansions}
989
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
1146
991
try:
1147
992
command = self.checker_command % escaped_attrs
1148
993
except TypeError as error:
1160
1005
# The exception is when not debugging but nevertheless
1161
1006
# running in the foreground; use the previously
1162
1007
# created wnull.
1163
popen_args = {"close_fds": True,
1164
"shell": True,
1165
"cwd": "/"}
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1166
1011
if (not self.server_settings["debug"]
1167
1012
and self.server_settings["foreground"]):
1168
1013
popen_args.update({"stdout": wnull,
1169
"stderr": wnull})
1170
pipe = multiprocessing.Pipe(duplex=False)
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1171
1016
self.checker = multiprocessing.Process(
1172
target=call_pipe,
1173
args=(pipe[1], subprocess.call, command),
1174
kwargs=popen_args)
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1175
1020
self.checker.start()
1176
self.checker_callback_tag = GLib.io_add_watch(
1177
GLib.IOChannel.unix_new(pipe[0].fileno()),
1178
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1021
self.checker_callback_tag = GObject.io_add_watch(
1022
pipe[0].fileno(), GObject.IO_IN,
1179
1023
self.checker_callback, pipe[0], command)
1180
# Re-run this periodically if run by GLib.timeout_add
1024
# Re-run this periodically if run by GObject.timeout_add
1181
1025
return True
1182
1026
1183
1027
def stop_checker(self):
1184
1028
"""Force the checker process, if any, to stop."""
1185
1029
if self.checker_callback_tag:
1186
GLib.source_remove(self.checker_callback_tag)
1030
GObject.source_remove(self.checker_callback_tag)
1187
1031
self.checker_callback_tag = None
1188
1032
if getattr(self, "checker", None) is None:
1189
1033
return
1198
1042
byte_arrays=False):
1199
1043
"""Decorators for marking methods of a DBusObjectWithProperties to
1200
1044
become properties on the D-Bus.
1201
1045
1202
1046
The decorated method will be called with no arguments by "Get"
1203
1047
and with one argument by "Set".
1204
1048
1205
1049
The parameters, where they are supported, are the same as
1206
1050
dbus.service.method, except there is only "signature", since the
1207
1051
type from Get() and the type sent to Set() is the same.
1211
1055
if byte_arrays and signature != "ay":
1212
1056
raise ValueError("Byte arrays not supported for non-'ay'"
1213
1057
" signature {!r}".format(signature))
1214
1058
1215
1059
def decorator(func):
1216
1060
func._dbus_is_property = True
1217
1061
func._dbus_interface = dbus_interface
1220
1064
func._dbus_name = func.__name__
1221
1065
if func._dbus_name.endswith("_dbus_property"):
1222
1066
func._dbus_name = func._dbus_name[:-14]
1223
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1224
1068
return func
1225
1069
1226
1070
return decorator
1227
1071
1228
1072
1229
1073
def dbus_interface_annotations(dbus_interface):
1230
1074
"""Decorator for marking functions returning interface annotations
1231
1075
1232
1076
Usage:
1233
1077
1234
1078
@dbus_interface_annotations("org.example.Interface")
1235
1079
def _foo(self): # Function name does not matter
1236
1080
return {"org.freedesktop.DBus.Deprecated": "true",
1237
1081
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1238
1082
"false"}
1239
1083
"""
1240
1084
1241
1085
def decorator(func):
1242
1086
func._dbus_is_interface = True
1243
1087
func._dbus_interface = dbus_interface
1244
1088
func._dbus_name = dbus_interface
1245
1089
return func
1246
1090
1247
1091
return decorator
1248
1092
1249
1093
1250
1094
def dbus_annotations(annotations):
1251
1095
"""Decorator to annotate D-Bus methods, signals or properties
1252
1096
Usage:
1253
1097
1254
1098
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1255
1099
"org.freedesktop.DBus.Property."
1256
1100
"EmitsChangedSignal": "false"})
1258
1102
access="r")
1259
1103
def Property_dbus_property(self):
1260
1104
return dbus.Boolean(False)
1261
1105
1262
1106
See also the DBusObjectWithAnnotations class.
1263
1107
"""
1264
1108
1265
1109
def decorator(func):
1266
1110
func._dbus_annotations = annotations
1267
1111
return func
1268
1112
1269
1113
return decorator
1270
1114
1271
1115
1289
1133
1290
1134
class DBusObjectWithAnnotations(dbus.service.Object):
1291
1135
"""A D-Bus object with annotations.
1292
1136
1293
1137
Classes inheriting from this can use the dbus_annotations
1294
1138
decorator to add annotations to methods or signals.
1295
1139
"""
1296
1140
1297
1141
@staticmethod
1298
1142
def _is_dbus_thing(thing):
1299
1143
"""Returns a function testing if an attribute is a D-Bus thing
1300
1144
1301
1145
If called like _is_dbus_thing("method") it returns a function
1302
1146
suitable for use as predicate to inspect.getmembers().
1303
1147
"""
1304
1148
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1305
1149
False)
1306
1150
1307
1151
def _get_all_dbus_things(self, thing):
1308
1152
"""Returns a generator of (name, attribute) pairs
1309
1153
"""
1312
1156
for cls in self.__class__.__mro__
1313
1157
for name, athing in
1314
1158
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1315
1159
1316
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1317
out_signature="s",
1318
path_keyword='object_path',
1319
connection_keyword='connection')
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1320
1164
def Introspect(self, object_path, connection):
1321
1165
"""Overloading of standard D-Bus method.
1322
1166
1323
1167
Inserts annotation tags on methods and signals.
1324
1168
"""
1325
1169
xmlstring = dbus.service.Object.Introspect(self, object_path,
1326
1170
connection)
1327
1171
try:
1328
1172
document = xml.dom.minidom.parseString(xmlstring)
1329
1173
1330
1174
for if_tag in document.getElementsByTagName("interface"):
1331
1175
# Add annotation tags
1332
1176
for typ in ("method", "signal"):
1359
1203
if_tag.appendChild(ann_tag)
1360
1204
# Fix argument name for the Introspect method itself
1361
1205
if (if_tag.getAttribute("name")
1362
== dbus.INTROSPECTABLE_IFACE):
1206
== dbus.INTROSPECTABLE_IFACE):
1363
1207
for cn in if_tag.getElementsByTagName("method"):
1364
1208
if cn.getAttribute("name") == "Introspect":
1365
1209
for arg in cn.getElementsByTagName("arg"):
1378
1222
1379
1223
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1380
1224
"""A D-Bus object with properties.
1381
1225
1382
1226
Classes inheriting from this can use the dbus_service_property
1383
1227
decorator to expose methods as D-Bus properties. It exposes the
1384
1228
standard Get(), Set(), and GetAll() methods on the D-Bus.
1385
1229
"""
1386
1230
1387
1231
def _get_dbus_property(self, interface_name, property_name):
1388
1232
"""Returns a bound method if one exists which is a D-Bus
1389
1233
property with the specified name and interface.
1394
1238
if (value._dbus_name == property_name
1395
1239
and value._dbus_interface == interface_name):
1396
1240
return value.__get__(self)
1397
1241
1398
1242
# No such property
1399
1243
raise DBusPropertyNotFound("{}:{}.{}".format(
1400
1244
self.dbus_object_path, interface_name, property_name))
1401
1245
1402
1246
@classmethod
1403
1247
def _get_all_interface_names(cls):
1404
1248
"""Get a sequence of all interfaces supported by an object"""
1407
1251
for x in (inspect.getmro(cls))
1408
1252
for attr in dir(x))
1409
1253
if name is not None)
1410
1254
1411
1255
@dbus.service.method(dbus.PROPERTIES_IFACE,
1412
1256
in_signature="ss",
1413
1257
out_signature="v")
1421
1265
if not hasattr(value, "variant_level"):
1422
1266
return value
1423
1267
return type(value)(value, variant_level=value.variant_level+1)
1424
1268
1425
1269
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1426
1270
def Set(self, interface_name, property_name, value):
1427
1271
"""Standard D-Bus property Set() method, see D-Bus standard.
1436
1280
raise ValueError("Byte arrays not supported for non-"
1437
1281
"'ay' signature {!r}"
1438
1282
.format(prop._dbus_signature))
1439
value = dbus.ByteArray(bytes(value))
1283
value = dbus.ByteArray(b''.join(chr(byte)
1284
for byte in value))
1440
1285
prop(value)
1441
1286
1442
1287
@dbus.service.method(dbus.PROPERTIES_IFACE,
1443
1288
in_signature="s",
1444
1289
out_signature="a{sv}")
1445
1290
def GetAll(self, interface_name):
1446
1291
"""Standard D-Bus property GetAll() method, see D-Bus
1447
1292
standard.
1448
1293
1449
1294
Note: Will not include properties with access="write".
1450
1295
"""
1451
1296
properties = {}
1462
1307
properties[name] = value
1463
1308
continue
1464
1309
properties[name] = type(value)(
1465
value, variant_level=value.variant_level + 1)
1310
value, variant_level = value.variant_level + 1)
1466
1311
return dbus.Dictionary(properties, signature="sv")
1467
1312
1468
1313
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1469
1314
def PropertiesChanged(self, interface_name, changed_properties,
1470
1315
invalidated_properties):
1472
1317
standard.
1473
1318
"""
1474
1319
pass
1475
1320
1476
1321
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1477
1322
out_signature="s",
1478
1323
path_keyword='object_path',
1479
1324
connection_keyword='connection')
1480
1325
def Introspect(self, object_path, connection):
1481
1326
"""Overloading of standard D-Bus method.
1482
1327
1483
1328
Inserts property tags and interface annotation tags.
1484
1329
"""
1485
1330
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1487
1332
connection)
1488
1333
try:
1489
1334
document = xml.dom.minidom.parseString(xmlstring)
1490
1335
1491
1336
def make_tag(document, name, prop):
1492
1337
e = document.createElement("property")
1493
1338
e.setAttribute("name", name)
1494
1339
e.setAttribute("type", prop._dbus_signature)
1495
1340
e.setAttribute("access", prop._dbus_access)
1496
1341
return e
1497
1342
1498
1343
for if_tag in document.getElementsByTagName("interface"):
1499
1344
# Add property tags
1500
1345
for tag in (make_tag(document, name, prop)
1542
1387
exc_info=error)
1543
1388
return xmlstring
1544
1389
1545
1546
1390
try:
1547
1391
dbus.OBJECT_MANAGER_IFACE
1548
1392
except AttributeError:
1549
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1550
1394
1551
1552
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1553
1396
"""A D-Bus object with an ObjectManager.
1554
1397
1555
1398
Classes inheriting from this exposes the standard
1556
1399
GetManagedObjects call and the InterfacesAdded and
1557
1400
InterfacesRemoved signals on the standard
1558
1401
"org.freedesktop.DBus.ObjectManager" interface.
1559
1402
1560
1403
Note: No signals are sent automatically; they must be sent
1561
1404
manually.
1562
1405
"""
1563
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1564
out_signature="a{oa{sa{sv}}}")
1407
out_signature = "a{oa{sa{sv}}}")
1565
1408
def GetManagedObjects(self):
1566
1409
"""This function must be overridden"""
1567
1410
raise NotImplementedError()
1568
1411
1569
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1570
signature="oa{sa{sv}}")
1413
signature = "oa{sa{sv}}")
1571
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1572
1415
pass
1573
1574
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1575
1418
def InterfacesRemoved(self, object_path, interfaces):
1576
1419
pass
1577
1420
1578
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1579
out_signature="s",
1580
path_keyword='object_path',
1581
connection_keyword='connection')
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1582
1425
def Introspect(self, object_path, connection):
1583
1426
"""Overloading of standard D-Bus method.
1584
1427
1585
1428
Override return argument name of GetManagedObjects to be
1586
1429
"objpath_interfaces_and_properties"
1587
1430
"""
1590
1433
connection)
1591
1434
try:
1592
1435
document = xml.dom.minidom.parseString(xmlstring)
1593
1436
1594
1437
for if_tag in document.getElementsByTagName("interface"):
1595
1438
# Fix argument name for the GetManagedObjects method
1596
1439
if (if_tag.getAttribute("name")
1597
== dbus.OBJECT_MANAGER_IFACE):
1440
== dbus.OBJECT_MANAGER_IFACE):
1598
1441
for cn in if_tag.getElementsByTagName("method"):
1599
1442
if (cn.getAttribute("name")
1600
1443
== "GetManagedObjects"):
1610
1453
except (AttributeError, xml.dom.DOMException,
1611
1454
xml.parsers.expat.ExpatError) as error:
1612
1455
logger.error("Failed to override Introspection method",
1613
exc_info=error)
1456
exc_info = error)
1614
1457
return xmlstring
1615
1458
1616
1617
1459
def datetime_to_dbus(dt, variant_level=0):
1618
1460
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1619
1461
if dt is None:
1620
return dbus.String("", variant_level=variant_level)
1462
return dbus.String("", variant_level = variant_level)
1621
1463
return dbus.String(dt.isoformat(), variant_level=variant_level)
1622
1464
1623
1465
1626
1468
dbus.service.Object, it will add alternate D-Bus attributes with
1627
1469
interface names according to the "alt_interface_names" mapping.
1628
1470
Usage:
1629
1471
1630
1472
@alternate_dbus_interfaces({"org.example.Interface":
1631
1473
"net.example.AlternateInterface"})
1632
1474
class SampleDBusObject(dbus.service.Object):
1633
1475
@dbus.service.method("org.example.Interface")
1634
1476
def SampleDBusMethod():
1635
1477
pass
1636
1478
1637
1479
The above "SampleDBusMethod" on "SampleDBusObject" will be
1638
1480
reachable via two interfaces: "org.example.Interface" and
1639
1481
"net.example.AlternateInterface", the latter of which will have
1640
1482
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1641
1483
"true", unless "deprecate" is passed with a False value.
1642
1484
1643
1485
This works for methods and signals, and also for D-Bus properties
1644
1486
(from DBusObjectWithProperties) and interfaces (from the
1645
1487
dbus_interface_annotations decorator).
1646
1488
"""
1647
1489
1648
1490
def wrapper(cls):
1649
1491
for orig_interface_name, alt_interface_name in (
1650
1492
alt_interface_names.items()):
1665
1507
interface_names.add(alt_interface)
1666
1508
# Is this a D-Bus signal?
1667
1509
if getattr(attribute, "_dbus_is_signal", False):
1668
# Extract the original non-method undecorated
1669
# function by black magic
1670
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1671
1513
nonmethod_func = (dict(
1672
1514
zip(attribute.func_code.co_freevars,
1673
1515
attribute.__closure__))
1674
1516
["func"].cell_contents)
1675
1517
else:
1676
nonmethod_func = (dict(
1677
zip(attribute.__code__.co_freevars,
1678
attribute.__closure__))
1679
["func"].cell_contents)
1518
nonmethod_func = attribute
1680
1519
# Create a new, but exactly alike, function
1681
1520
# object, and decorate it to be a new D-Bus signal
1682
1521
# with the alternate D-Bus interface name
1683
new_function = copy_function(nonmethod_func)
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1684
1536
new_function = (dbus.service.signal(
1685
1537
alt_interface,
1686
1538
attribute._dbus_signature)(new_function))
1690
1542
attribute._dbus_annotations)
1691
1543
except AttributeError:
1692
1544
pass
1693
1694
1545
# Define a creator of a function to call both the
1695
1546
# original and alternate functions, so both the
1696
1547
# original and alternate signals gets sent when
1699
1550
"""This function is a scope container to pass
1700
1551
func1 and func2 to the "call_both" function
1701
1552
outside of its arguments"""
1702
1553
1703
1554
@functools.wraps(func2)
1704
1555
def call_both(*args, **kwargs):
1705
1556
"""This function will emit two D-Bus
1706
1557
signals by calling func1 and func2"""
1707
1558
func1(*args, **kwargs)
1708
1559
func2(*args, **kwargs)
1709
# Make wrapper function look like a D-Bus
1710
# signal
1560
# Make wrapper function look like a D-Bus signal
1711
1561
for name, attr in inspect.getmembers(func2):
1712
1562
if name.startswith("_dbus_"):
1713
1563
setattr(call_both, name, attr)
1714
1564
1715
1565
return call_both
1716
1566
# Create the "call_both" function and add it to
1717
1567
# the class
1727
1577
alt_interface,
1728
1578
attribute._dbus_in_signature,
1729
1579
attribute._dbus_out_signature)
1730
(copy_function(attribute)))
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1731
1585
# Copy annotations, if any
1732
1586
try:
1733
1587
attr[attrname]._dbus_annotations = dict(
1745
1599
attribute._dbus_access,
1746
1600
attribute._dbus_get_args_options
1747
1601
["byte_arrays"])
1748
(copy_function(attribute)))
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1749
1608
# Copy annotations, if any
1750
1609
try:
1751
1610
attr[attrname]._dbus_annotations = dict(
1760
1619
# to the class.
1761
1620
attr[attrname] = (
1762
1621
dbus_interface_annotations(alt_interface)
1763
(copy_function(attribute)))
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1764
1627
if deprecate:
1765
1628
# Deprecate all alternate interfaces
1766
iname = "_AlternateDBusNames_interface_annotation{}"
1629
iname="_AlternateDBusNames_interface_annotation{}"
1767
1630
for interface_name in interface_names:
1768
1631
1769
1632
@dbus_interface_annotations(interface_name)
1770
1633
def func(self):
1771
return {"org.freedesktop.DBus.Deprecated":
1772
"true"}
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1773
1636
# Find an unused name
1774
1637
for aname in (iname.format(i)
1775
1638
for i in itertools.count()):
1779
1642
if interface_names:
1780
1643
# Replace the class with a new subclass of it with
1781
1644
# methods, signals, etc. as created above.
1782
if sys.version_info.major == 2:
1783
cls = type(b"{}Alternate".format(cls.__name__),
1784
(cls, ), attr)
1785
else:
1786
cls = type("{}Alternate".format(cls.__name__),
1787
(cls, ), attr)
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1788
1647
return cls
1789
1648
1790
1649
return wrapper
1791
1650
1792
1651
1794
1653
"se.bsnet.fukt.Mandos"})
1795
1654
class ClientDBus(Client, DBusObjectWithProperties):
1796
1655
"""A Client class using D-Bus
1797
1656
1798
1657
Attributes:
1799
1658
dbus_object_path: dbus.ObjectPath
1800
1659
bus: dbus.SystemBus()
1801
1660
"""
1802
1661
1803
1662
runtime_expansions = (Client.runtime_expansions
1804
1663
+ ("dbus_object_path", ))
1805
1664
1806
1665
_interface = "se.recompile.Mandos.Client"
1807
1666
1808
1667
# dbus.service.Object doesn't use super(), so we can't either.
1809
1810
def __init__(self, bus=None, *args, **kwargs):
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1811
1670
self.bus = bus
1812
1671
Client.__init__(self, *args, **kwargs)
1813
1672
# Only now, when this client is initialized, can it show up on
1819
1678
"/clients/" + client_object_name)
1820
1679
DBusObjectWithProperties.__init__(self, self.bus,
1821
1680
self.dbus_object_path)
1822
1681
1823
1682
def notifychangeproperty(transform_func, dbus_name,
1824
1683
type_func=lambda x: x,
1825
1684
variant_level=1,
1827
1686
_interface=_interface):
1828
1687
""" Modify a variable so that it's a property which announces
1829
1688
its changes to DBus.
1830
1689
1831
1690
transform_fun: Function that takes a value and a variant_level
1832
1691
and transforms it to a D-Bus type.
1833
1692
dbus_name: D-Bus name of the variable
1836
1695
variant_level: D-Bus variant level. Default: 1
1837
1696
"""
1838
1697
attrname = "_{}".format(dbus_name)
1839
1698
1840
1699
def setter(self, value):
1841
1700
if hasattr(self, "dbus_object_path"):
1842
1701
if (not hasattr(self, attrname) or
1849
1708
else:
1850
1709
dbus_value = transform_func(
1851
1710
type_func(value),
1852
variant_level=variant_level)
1711
variant_level = variant_level)
1853
1712
self.PropertyChanged(dbus.String(dbus_name),
1854
1713
dbus_value)
1855
1714
self.PropertiesChanged(
1856
1715
_interface,
1857
dbus.Dictionary({dbus.String(dbus_name):
1858
dbus_value}),
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1859
1718
dbus.Array())
1860
1719
setattr(self, attrname, value)
1861
1720
1862
1721
return property(lambda self: getattr(self, attrname), setter)
1863
1722
1864
1723
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1865
1724
approvals_pending = notifychangeproperty(dbus.Boolean,
1866
1725
"ApprovalPending",
1867
type_func=bool)
1726
type_func = bool)
1868
1727
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1869
1728
last_enabled = notifychangeproperty(datetime_to_dbus,
1870
1729
"LastEnabled")
1871
1730
checker = notifychangeproperty(
1872
1731
dbus.Boolean, "CheckerRunning",
1873
type_func=lambda checker: checker is not None)
1732
type_func = lambda checker: checker is not None)
1874
1733
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1875
1734
"LastCheckedOK")
1876
1735
last_checker_status = notifychangeproperty(dbus.Int16,
1881
1740
"ApprovedByDefault")
1882
1741
approval_delay = notifychangeproperty(
1883
1742
dbus.UInt64, "ApprovalDelay",
1884
type_func=lambda td: td.total_seconds() * 1000)
1743
type_func = lambda td: td.total_seconds() * 1000)
1885
1744
approval_duration = notifychangeproperty(
1886
1745
dbus.UInt64, "ApprovalDuration",
1887
type_func=lambda td: td.total_seconds() * 1000)
1746
type_func = lambda td: td.total_seconds() * 1000)
1888
1747
host = notifychangeproperty(dbus.String, "Host")
1889
1748
timeout = notifychangeproperty(
1890
1749
dbus.UInt64, "Timeout",
1891
type_func=lambda td: td.total_seconds() * 1000)
1750
type_func = lambda td: td.total_seconds() * 1000)
1892
1751
extended_timeout = notifychangeproperty(
1893
1752
dbus.UInt64, "ExtendedTimeout",
1894
type_func=lambda td: td.total_seconds() * 1000)
1753
type_func = lambda td: td.total_seconds() * 1000)
1895
1754
interval = notifychangeproperty(
1896
1755
dbus.UInt64, "Interval",
1897
type_func=lambda td: td.total_seconds() * 1000)
1756
type_func = lambda td: td.total_seconds() * 1000)
1898
1757
checker_command = notifychangeproperty(dbus.String, "Checker")
1899
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1900
1759
invalidate_only=True)
1901
1760
1902
1761
del notifychangeproperty
1903
1762
1904
1763
def __del__(self, *args, **kwargs):
1905
1764
try:
1906
1765
self.remove_from_connection()
1909
1768
if hasattr(DBusObjectWithProperties, "__del__"):
1910
1769
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1911
1770
Client.__del__(self, *args, **kwargs)
1912
1771
1913
1772
def checker_callback(self, source, condition,
1914
1773
connection, command, *args, **kwargs):
1915
1774
ret = Client.checker_callback(self, source, condition,
1931
1790
| self.last_checker_signal),
1932
1791
dbus.String(command))
1933
1792
return ret
1934
1793
1935
1794
def start_checker(self, *args, **kwargs):
1936
1795
old_checker_pid = getattr(self.checker, "pid", None)
1937
1796
r = Client.start_checker(self, *args, **kwargs)
1941
1800
# Emit D-Bus signal
1942
1801
self.CheckerStarted(self.current_checker_command)
1943
1802
return r
1944
1803
1945
1804
def _reset_approved(self):
1946
1805
self.approved = None
1947
1806
return False
1948
1807
1949
1808
def approve(self, value=True):
1950
1809
self.approved = value
1951
GLib.timeout_add(int(self.approval_duration.total_seconds()
1952
* 1000), self._reset_approved)
1810
GObject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1953
1812
self.send_changedstate()
1954
1955
# D-Bus methods, signals & properties
1956
1957
# Interfaces
1958
1959
# Signals
1960
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1961
1820
# CheckerCompleted - signal
1962
1821
@dbus.service.signal(_interface, signature="nxs")
1963
1822
def CheckerCompleted(self, exitcode, waitstatus, command):
1964
1823
"D-Bus signal"
1965
1824
pass
1966
1825
1967
1826
# CheckerStarted - signal
1968
1827
@dbus.service.signal(_interface, signature="s")
1969
1828
def CheckerStarted(self, command):
1970
1829
"D-Bus signal"
1971
1830
pass
1972
1831
1973
1832
# PropertyChanged - signal
1974
1833
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1975
1834
@dbus.service.signal(_interface, signature="sv")
1976
1835
def PropertyChanged(self, property, value):
1977
1836
"D-Bus signal"
1978
1837
pass
1979
1838
1980
1839
# GotSecret - signal
1981
1840
@dbus.service.signal(_interface)
1982
1841
def GotSecret(self):
1985
1844
server to mandos-client
1986
1845
"""
1987
1846
pass
1988
1847
1989
1848
# Rejected - signal
1990
1849
@dbus.service.signal(_interface, signature="s")
1991
1850
def Rejected(self, reason):
1992
1851
"D-Bus signal"
1993
1852
pass
1994
1853
1995
1854
# NeedApproval - signal
1996
1855
@dbus.service.signal(_interface, signature="tb")
1997
1856
def NeedApproval(self, timeout, default):
1998
1857
"D-Bus signal"
1999
1858
return self.need_approval()
2000
2001
# Methods
2002
1859
1860
## Methods
1861
2003
1862
# Approve - method
2004
1863
@dbus.service.method(_interface, in_signature="b")
2005
1864
def Approve(self, value):
2006
1865
self.approve(value)
2007
1866
2008
1867
# CheckedOK - method
2009
1868
@dbus.service.method(_interface)
2010
1869
def CheckedOK(self):
2011
1870
self.checked_ok()
2012
1871
2013
1872
# Enable - method
2014
1873
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2015
1874
@dbus.service.method(_interface)
2016
1875
def Enable(self):
2017
1876
"D-Bus method"
2018
1877
self.enable()
2019
1878
2020
1879
# StartChecker - method
2021
1880
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2022
1881
@dbus.service.method(_interface)
2023
1882
def StartChecker(self):
2024
1883
"D-Bus method"
2025
1884
self.start_checker()
2026
1885
2027
1886
# Disable - method
2028
1887
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2029
1888
@dbus.service.method(_interface)
2030
1889
def Disable(self):
2031
1890
"D-Bus method"
2032
1891
self.disable()
2033
1892
2034
1893
# StopChecker - method
2035
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2036
1895
@dbus.service.method(_interface)
2037
1896
def StopChecker(self):
2038
1897
self.stop_checker()
2039
2040
# Properties
2041
1898
1899
## Properties
1900
2042
1901
# ApprovalPending - property
2043
1902
@dbus_service_property(_interface, signature="b", access="read")
2044
1903
def ApprovalPending_dbus_property(self):
2045
1904
return dbus.Boolean(bool(self.approvals_pending))
2046
1905
2047
1906
# ApprovedByDefault - property
2048
1907
@dbus_service_property(_interface,
2049
1908
signature="b",
2052
1911
if value is None: # get
2053
1912
return dbus.Boolean(self.approved_by_default)
2054
1913
self.approved_by_default = bool(value)
2055
1914
2056
1915
# ApprovalDelay - property
2057
1916
@dbus_service_property(_interface,
2058
1917
signature="t",
2062
1921
return dbus.UInt64(self.approval_delay.total_seconds()
2063
1922
* 1000)
2064
1923
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2065
1924
2066
1925
# ApprovalDuration - property
2067
1926
@dbus_service_property(_interface,
2068
1927
signature="t",
2072
1931
return dbus.UInt64(self.approval_duration.total_seconds()
2073
1932
* 1000)
2074
1933
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2075
1934
2076
1935
# Name - property
2077
1936
@dbus_annotations(
2078
1937
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2079
1938
@dbus_service_property(_interface, signature="s", access="read")
2080
1939
def Name_dbus_property(self):
2081
1940
return dbus.String(self.name)
2082
2083
# KeyID - property
2084
@dbus_annotations(
2085
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2086
@dbus_service_property(_interface, signature="s", access="read")
2087
def KeyID_dbus_property(self):
2088
return dbus.String(self.key_id)
2089
1941
2090
1942
# Fingerprint - property
2091
1943
@dbus_annotations(
2092
1944
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2093
1945
@dbus_service_property(_interface, signature="s", access="read")
2094
1946
def Fingerprint_dbus_property(self):
2095
1947
return dbus.String(self.fingerprint)
2096
1948
2097
1949
# Host - property
2098
1950
@dbus_service_property(_interface,
2099
1951
signature="s",
2102
1954
if value is None: # get
2103
1955
return dbus.String(self.host)
2104
1956
self.host = str(value)
2105
1957
2106
1958
# Created - property
2107
1959
@dbus_annotations(
2108
1960
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2109
1961
@dbus_service_property(_interface, signature="s", access="read")
2110
1962
def Created_dbus_property(self):
2111
1963
return datetime_to_dbus(self.created)
2112
1964
2113
1965
# LastEnabled - property
2114
1966
@dbus_service_property(_interface, signature="s", access="read")
2115
1967
def LastEnabled_dbus_property(self):
2116
1968
return datetime_to_dbus(self.last_enabled)
2117
1969
2118
1970
# Enabled - property
2119
1971
@dbus_service_property(_interface,
2120
1972
signature="b",
2126
1978
self.enable()
2127
1979
else:
2128
1980
self.disable()
2129
1981
2130
1982
# LastCheckedOK - property
2131
1983
@dbus_service_property(_interface,
2132
1984
signature="s",
2136
1988
self.checked_ok()
2137
1989
return
2138
1990
return datetime_to_dbus(self.last_checked_ok)
2139
1991
2140
1992
# LastCheckerStatus - property
2141
1993
@dbus_service_property(_interface, signature="n", access="read")
2142
1994
def LastCheckerStatus_dbus_property(self):
2143
1995
return dbus.Int16(self.last_checker_status)
2144
1996
2145
1997
# Expires - property
2146
1998
@dbus_service_property(_interface, signature="s", access="read")
2147
1999
def Expires_dbus_property(self):
2148
2000
return datetime_to_dbus(self.expires)
2149
2001
2150
2002
# LastApprovalRequest - property
2151
2003
@dbus_service_property(_interface, signature="s", access="read")
2152
2004
def LastApprovalRequest_dbus_property(self):
2153
2005
return datetime_to_dbus(self.last_approval_request)
2154
2006
2155
2007
# Timeout - property
2156
2008
@dbus_service_property(_interface,
2157
2009
signature="t",
2172
2024
if (getattr(self, "disable_initiator_tag", None)
2173
2025
is None):
2174
2026
return
2175
GLib.source_remove(self.disable_initiator_tag)
2176
self.disable_initiator_tag = GLib.timeout_add(
2027
GObject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = GObject.timeout_add(
2177
2029
int((self.expires - now).total_seconds() * 1000),
2178
2030
self.disable)
2179
2031
2180
2032
# ExtendedTimeout - property
2181
2033
@dbus_service_property(_interface,
2182
2034
signature="t",
2186
2038
return dbus.UInt64(self.extended_timeout.total_seconds()
2187
2039
* 1000)
2188
2040
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2189
2041
2190
2042
# Interval - property
2191
2043
@dbus_service_property(_interface,
2192
2044
signature="t",
2199
2051
return
2200
2052
if self.enabled:
2201
2053
# Reschedule checker run
2202
GLib.source_remove(self.checker_initiator_tag)
2203
self.checker_initiator_tag = GLib.timeout_add(
2054
GObject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = GObject.timeout_add(
2204
2056
value, self.start_checker)
2205
self.start_checker() # Start one now, too
2206
2057
self.start_checker() # Start one now, too
2058
2207
2059
# Checker - property
2208
2060
@dbus_service_property(_interface,
2209
2061
signature="s",
2212
2064
if value is None: # get
2213
2065
return dbus.String(self.checker_command)
2214
2066
self.checker_command = str(value)
2215
2067
2216
2068
# CheckerRunning - property
2217
2069
@dbus_service_property(_interface,
2218
2070
signature="b",
2224
2076
self.start_checker()
2225
2077
else:
2226
2078
self.stop_checker()
2227
2079
2228
2080
# ObjectPath - property
2229
2081
@dbus_annotations(
2230
2082
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2231
2083
"org.freedesktop.DBus.Deprecated": "true"})
2232
2084
@dbus_service_property(_interface, signature="o", access="read")
2233
2085
def ObjectPath_dbus_property(self):
2234
return self.dbus_object_path # is already a dbus.ObjectPath
2235
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2236
2088
# Secret = property
2237
2089
@dbus_annotations(
2238
2090
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2243
2095
byte_arrays=True)
2244
2096
def Secret_dbus_property(self, value):
2245
2097
self.secret = bytes(value)
2246
2098
2247
2099
del _interface
2248
2100
2249
2101
2250
class ProxyClient:
2251
def __init__(self, child_pipe, key_id, fpr, address):
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2252
2104
self._pipe = child_pipe
2253
self._pipe.send(('init', key_id, fpr, address))
2105
self._pipe.send(('init', fpr, address))
2254
2106
if not self._pipe.recv():
2255
raise KeyError(key_id or fpr)
2256
2107
raise KeyError(fpr)
2108
2257
2109
def __getattribute__(self, name):
2258
2110
if name == '_pipe':
2259
2111
return super(ProxyClient, self).__getattribute__(name)
2262
2114
if data[0] == 'data':
2263
2115
return data[1]
2264
2116
if data[0] == 'function':
2265
2117
2266
2118
def func(*args, **kwargs):
2267
2119
self._pipe.send(('funcall', name, args, kwargs))
2268
2120
return self._pipe.recv()[1]
2269
2121
2270
2122
return func
2271
2123
2272
2124
def __setattr__(self, name, value):
2273
2125
if name == '_pipe':
2274
2126
return super(ProxyClient, self).__setattr__(name, value)
2277
2129
2278
2130
class ClientHandler(socketserver.BaseRequestHandler, object):
2279
2131
"""A class to handle client connections.
2280
2132
2281
2133
Instantiated once for each connection to handle it.
2282
2134
Note: This will run in its own forked process."""
2283
2135
2284
2136
def handle(self):
2285
2137
with contextlib.closing(self.server.child_pipe) as child_pipe:
2286
2138
logger.info("TCP connection from: %s",
2287
2139
str(self.client_address))
2288
2140
logger.debug("Pipe FD: %d",
2289
2141
self.server.child_pipe.fileno())
2290
2142
2291
2143
session = gnutls.ClientSession(self.request)
2292
2293
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2294
# "+AES-256-CBC", "+SHA1",
2295
# "+COMP-NULL", "+CTYPE-OPENPGP",
2296
# "+DHE-DSS"))
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2297
2149
# Use a fallback default, since this MUST be set.
2298
2150
priority = self.server.gnutls_priority
2299
2151
if priority is None:
2300
2152
priority = "NORMAL"
2301
gnutls.priority_set_direct(session._c_object,
2302
priority.encode("utf-8"),
2153
gnutls.priority_set_direct(session._c_object, priority,
2303
2154
None)
2304
2155
2305
2156
# Start communication using the Mandos protocol
2306
2157
# Get protocol number
2307
2158
line = self.request.makefile().readline()
2312
2163
except (ValueError, IndexError, RuntimeError) as error:
2313
2164
logger.error("Unknown protocol version: %s", error)
2314
2165
return
2315
2166
2316
2167
# Start GnuTLS connection
2317
2168
try:
2318
2169
session.handshake()
2322
2173
# established. Just abandon the request.
2323
2174
return
2324
2175
logger.debug("Handshake succeeded")
2325
2176
2326
2177
approval_required = False
2327
2178
try:
2328
if gnutls.has_rawpk:
2329
fpr = b""
2330
try:
2331
key_id = self.key_id(
2332
self.peer_certificate(session))
2333
except (TypeError, gnutls.Error) as error:
2334
logger.warning("Bad certificate: %s", error)
2335
return
2336
logger.debug("Key ID: %s", key_id)
2337
2338
else:
2339
key_id = b""
2340
try:
2341
fpr = self.fingerprint(
2342
self.peer_certificate(session))
2343
except (TypeError, gnutls.Error) as error:
2344
logger.warning("Bad certificate: %s", error)
2345
return
2346
logger.debug("Fingerprint: %s", fpr)
2347
2348
try:
2349
client = ProxyClient(child_pipe, key_id, fpr,
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2350
2189
self.client_address)
2351
2190
except KeyError:
2352
2191
return
2353
2192
2354
2193
if client.approval_delay:
2355
2194
delay = client.approval_delay
2356
2195
client.approvals_pending += 1
2357
2196
approval_required = True
2358
2197
2359
2198
while True:
2360
2199
if not client.enabled:
2361
2200
logger.info("Client %s is disabled",
2364
2203
# Emit D-Bus signal
2365
2204
client.Rejected("Disabled")
2366
2205
return
2367
2206
2368
2207
if client.approved or not client.approval_delay:
2369
# We are approved or approval is disabled
2208
#We are approved or approval is disabled
2370
2209
break
2371
2210
elif client.approved is None:
2372
2211
logger.info("Client %s needs approval",
2383
2222
# Emit D-Bus signal
2384
2223
client.Rejected("Denied")
2385
2224
return
2386
2387
# wait until timeout or approved
2225
2226
#wait until timeout or approved
2388
2227
time = datetime.datetime.now()
2389
2228
client.changedstate.acquire()
2390
2229
client.changedstate.wait(delay.total_seconds())
2403
2242
break
2404
2243
else:
2405
2244
delay -= time2 - time
2406
2245
2407
2246
try:
2408
2247
session.send(client.secret)
2409
2248
except gnutls.Error as error:
2410
2249
logger.warning("gnutls send failed",
2411
exc_info=error)
2250
exc_info = error)
2412
2251
return
2413
2252
2414
2253
logger.info("Sending secret to %s", client.name)
2415
2254
# bump the timeout using extended_timeout
2416
2255
client.bump_timeout(client.extended_timeout)
2417
2256
if self.server.use_dbus:
2418
2257
# Emit D-Bus signal
2419
2258
client.GotSecret()
2420
2259
2421
2260
finally:
2422
2261
if approval_required:
2423
2262
client.approvals_pending -= 1
2426
2265
except gnutls.Error as error:
2427
2266
logger.warning("GnuTLS bye failed",
2428
2267
exc_info=error)
2429
2268
2430
2269
@staticmethod
2431
2270
def peer_certificate(session):
2432
"Return the peer's certificate as a bytestring"
2433
try:
2434
cert_type = gnutls.certificate_type_get2(session._c_object,
2435
gnutls.CTYPE_PEERS)
2436
except AttributeError:
2437
cert_type = gnutls.certificate_type_get(session._c_object)
2438
if gnutls.has_rawpk:
2439
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
else:
2441
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2442
# If not a valid certificate type...
2443
if cert_type not in valid_cert_types:
2444
logger.info("Cert type %r not in %r", cert_type,
2445
valid_cert_types)
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2446
2275
# ...return invalid data
2447
2276
return b""
2448
2277
list_size = ctypes.c_uint(1)
2454
2283
return None
2455
2284
cert = cert_list[0]
2456
2285
return ctypes.string_at(cert.data, cert.size)
2457
2458
@staticmethod
2459
def key_id(certificate):
2460
"Convert a certificate bytestring to a hexdigit key ID"
2461
# New GnuTLS "datum" with the public key
2462
datum = gnutls.datum_t(
2463
ctypes.cast(ctypes.c_char_p(certificate),
2464
ctypes.POINTER(ctypes.c_ubyte)),
2465
ctypes.c_uint(len(certificate)))
2466
# XXX all these need to be created in the gnutls "module"
2467
# New empty GnuTLS certificate
2468
pubkey = gnutls.pubkey_t()
2469
gnutls.pubkey_init(ctypes.byref(pubkey))
2470
# Import the raw public key into the certificate
2471
gnutls.pubkey_import(pubkey,
2472
ctypes.byref(datum),
2473
gnutls.X509_FMT_DER)
2474
# New buffer for the key ID
2475
buf = ctypes.create_string_buffer(32)
2476
buf_len = ctypes.c_size_t(len(buf))
2477
# Get the key ID from the raw public key into the buffer
2478
gnutls.pubkey_get_key_id(
2479
pubkey,
2480
gnutls.KEYID_USE_SHA256,
2481
ctypes.cast(ctypes.byref(buf),
2482
ctypes.POINTER(ctypes.c_ubyte)),
2483
ctypes.byref(buf_len))
2484
# Deinit the certificate
2485
gnutls.pubkey_deinit(pubkey)
2486
2487
# Convert the buffer to a Python bytestring
2488
key_id = ctypes.string_at(buf, buf_len.value)
2489
# Convert the bytestring to hexadecimal notation
2490
hex_key_id = binascii.hexlify(key_id).upper()
2491
return hex_key_id
2492
2286
2493
2287
@staticmethod
2494
2288
def fingerprint(openpgp):
2495
2289
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2510
2304
ctypes.byref(crtverify))
2511
2305
if crtverify.value != 0:
2512
2306
gnutls.openpgp_crt_deinit(crt)
2513
raise gnutls.CertificateSecurityError(code
2514
=crtverify.value)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2515
2308
# New buffer for the fingerprint
2516
2309
buf = ctypes.create_string_buffer(20)
2517
2310
buf_len = ctypes.c_size_t()
2527
2320
return hex_fpr
2528
2321
2529
2322
2530
class MultiprocessingMixIn:
2323
class MultiprocessingMixIn(object):
2531
2324
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2532
2325
2533
2326
def sub_process_main(self, request, address):
2534
2327
try:
2535
2328
self.finish_request(request, address)
2536
2329
except Exception:
2537
2330
self.handle_error(request, address)
2538
2331
self.close_request(request)
2539
2332
2540
2333
def process_request(self, request, address):
2541
2334
"""Start a new process to process the request."""
2542
proc = multiprocessing.Process(target=self.sub_process_main,
2543
args=(request, address))
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2544
2337
proc.start()
2545
2338
return proc
2546
2339
2547
2340
2548
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2549
2342
""" adds a pipe to the MixIn """
2550
2343
2551
2344
def process_request(self, request, client_address):
2552
2345
"""Overrides and wraps the original process_request().
2553
2346
2554
2347
This function creates a new pipe in self.pipe
2555
2348
"""
2556
2349
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2557
2350
2558
2351
proc = MultiprocessingMixIn.process_request(self, request,
2559
2352
client_address)
2560
2353
self.child_pipe.close()
2561
2354
self.add_pipe(parent_pipe, proc)
2562
2355
2563
2356
def add_pipe(self, parent_pipe, proc):
2564
2357
"""Dummy function; override as necessary"""
2565
2358
raise NotImplementedError()
2566
2359
2567
2360
2568
2361
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2569
socketserver.TCPServer):
2362
socketserver.TCPServer, object):
2570
2363
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2571
2364
2572
2365
Attributes:
2573
2366
enabled: Boolean; whether this server is activated yet
2574
2367
interface: None or a network interface name (string)
2575
2368
use_ipv6: Boolean; to use IPv6 or not
2576
2369
"""
2577
2370
2578
2371
def __init__(self, server_address, RequestHandlerClass,
2579
2372
interface=None,
2580
2373
use_ipv6=True,
2590
2383
self.socketfd = socketfd
2591
2384
# Save the original socket.socket() function
2592
2385
self.socket_socket = socket.socket
2593
2594
2386
# To implement --socket, we monkey patch socket.socket.
2595
#
2387
#
2596
2388
# (When socketserver.TCPServer is a new-style class, we
2597
2389
# could make self.socket into a property instead of monkey
2598
2390
# patching socket.socket.)
2599
#
2391
#
2600
2392
# Create a one-time-only replacement for socket.socket()
2601
2393
@functools.wraps(socket.socket)
2602
2394
def socket_wrapper(*args, **kwargs):
2614
2406
# socket_wrapper(), if socketfd was set.
2615
2407
socketserver.TCPServer.__init__(self, server_address,
2616
2408
RequestHandlerClass)
2617
2409
2618
2410
def server_bind(self):
2619
2411
"""This overrides the normal server_bind() function
2620
2412
to bind to an interface if one was specified, and also NOT to
2621
2413
bind to an address or port if they were not specified."""
2622
global SO_BINDTODEVICE
2623
2414
if self.interface is not None:
2624
2415
if SO_BINDTODEVICE is None:
2625
# Fall back to a hard-coded value which seems to be
2626
# common enough.
2627
logger.warning("SO_BINDTODEVICE not found, trying 25")
2628
SO_BINDTODEVICE = 25
2629
try:
2630
self.socket.setsockopt(
2631
socket.SOL_SOCKET, SO_BINDTODEVICE,
2632
(self.interface + "\0").encode("utf-8"))
2633
except socket.error as error:
2634
if error.errno == errno.EPERM:
2635
logger.error("No permission to bind to"
2636
" interface %s", self.interface)
2637
elif error.errno == errno.ENOPROTOOPT:
2638
logger.error("SO_BINDTODEVICE not available;"
2639
" cannot bind to interface %s",
2640
self.interface)
2641
elif error.errno == errno.ENODEV:
2642
logger.error("Interface %s does not exist,"
2643
" cannot bind", self.interface)
2644
else:
2645
raise
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2646
2437
# Only bind(2) the socket if we really need to.
2647
2438
if self.server_address[0] or self.server_address[1]:
2648
if self.server_address[1]:
2649
self.allow_reuse_address = True
2650
2439
if not self.server_address[0]:
2651
2440
if self.address_family == socket.AF_INET6:
2652
any_address = "::" # in6addr_any
2441
any_address = "::" # in6addr_any
2653
2442
else:
2654
any_address = "0.0.0.0" # INADDR_ANY
2443
any_address = "0.0.0.0" # INADDR_ANY
2655
2444
self.server_address = (any_address,
2656
2445
self.server_address[1])
2657
2446
elif not self.server_address[1]:
2667
2456
2668
2457
class MandosServer(IPv6_TCPServer):
2669
2458
"""Mandos server.
2670
2459
2671
2460
Attributes:
2672
2461
clients: set of Client objects
2673
2462
gnutls_priority GnuTLS priority string
2674
2463
use_dbus: Boolean; to emit D-Bus signals or not
2675
2676
Assumes a GLib.MainLoop event loop.
2464
2465
Assumes a GObject.MainLoop event loop.
2677
2466
"""
2678
2467
2679
2468
def __init__(self, server_address, RequestHandlerClass,
2680
2469
interface=None,
2681
2470
use_ipv6=True,
2691
2480
self.gnutls_priority = gnutls_priority
2692
2481
IPv6_TCPServer.__init__(self, server_address,
2693
2482
RequestHandlerClass,
2694
interface=interface,
2695
use_ipv6=use_ipv6,
2696
socketfd=socketfd)
2697
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2698
2487
def server_activate(self):
2699
2488
if self.enabled:
2700
2489
return socketserver.TCPServer.server_activate(self)
2701
2490
2702
2491
def enable(self):
2703
2492
self.enabled = True
2704
2493
2705
2494
def add_pipe(self, parent_pipe, proc):
2706
2495
# Call "handle_ipc" for both data and EOF events
2707
GLib.io_add_watch(
2708
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2709
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2496
GObject.io_add_watch(
2497
parent_pipe.fileno(),
2498
GObject.IO_IN | GObject.IO_HUP,
2710
2499
functools.partial(self.handle_ipc,
2711
parent_pipe=parent_pipe,
2712
proc=proc))
2713
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2714
2503
def handle_ipc(self, source, condition,
2715
2504
parent_pipe=None,
2716
proc=None,
2505
proc = None,
2717
2506
client_object=None):
2718
2507
# error, or the other end of multiprocessing.Pipe has closed
2719
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2508
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2720
2509
# Wait for other process to exit
2721
2510
proc.join()
2722
2511
return False
2723
2512
2724
2513
# Read a request from the child
2725
2514
request = parent_pipe.recv()
2726
2515
command = request[0]
2727
2516
2728
2517
if command == 'init':
2729
key_id = request[1].decode("ascii")
2730
fpr = request[2].decode("ascii")
2731
address = request[3]
2732
2733
for c in self.clients.values():
2734
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2735
"27AE41E4649B934CA495991B7852B855"):
2736
continue
2737
if key_id and c.key_id == key_id:
2738
client = c
2739
break
2740
if fpr and c.fingerprint == fpr:
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2741
2523
client = c
2742
2524
break
2743
2525
else:
2744
logger.info("Client not found for key ID: %s, address"
2745
": %s", key_id or fpr, address)
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2746
2528
if self.use_dbus:
2747
2529
# Emit D-Bus signal
2748
mandos_dbus_service.ClientNotFound(key_id or fpr,
2530
mandos_dbus_service.ClientNotFound(fpr,
2749
2531
address[0])
2750
2532
parent_pipe.send(False)
2751
2533
return False
2752
2753
GLib.io_add_watch(
2754
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2755
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2534
2535
GObject.io_add_watch(
2536
parent_pipe.fileno(),
2537
GObject.IO_IN | GObject.IO_HUP,
2756
2538
functools.partial(self.handle_ipc,
2757
parent_pipe=parent_pipe,
2758
proc=proc,
2759
client_object=client))
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2760
2542
parent_pipe.send(True)
2761
2543
# remove the old hook in favor of the new above hook on
2762
2544
# same fileno
2765
2547
funcname = request[1]
2766
2548
args = request[2]
2767
2549
kwargs = request[3]
2768
2550
2769
2551
parent_pipe.send(('data', getattr(client_object,
2770
2552
funcname)(*args,
2771
2553
**kwargs)))
2772
2554
2773
2555
if command == 'getattr':
2774
2556
attrname = request[1]
2775
2557
if isinstance(client_object.__getattribute__(attrname),
2776
collections.abc.Callable):
2558
collections.Callable):
2777
2559
parent_pipe.send(('function', ))
2778
2560
else:
2779
2561
parent_pipe.send((
2780
2562
'data', client_object.__getattribute__(attrname)))
2781
2563
2782
2564
if command == 'setattr':
2783
2565
attrname = request[1]
2784
2566
value = request[2]
2785
2567
setattr(client_object, attrname, value)
2786
2568
2787
2569
return True
2788
2570
2789
2571
2790
2572
def rfc3339_duration_to_delta(duration):
2791
2573
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2792
2793
>>> timedelta = datetime.timedelta
2794
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2795
True
2796
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2797
True
2798
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2799
True
2800
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2801
True
2802
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2803
True
2804
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2805
True
2806
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2807
True
2808
>>> del timedelta
2574
2575
>>> rfc3339_duration_to_delta("P7D")
2576
datetime.timedelta(7)
2577
>>> rfc3339_duration_to_delta("PT60S")
2578
datetime.timedelta(0, 60)
2579
>>> rfc3339_duration_to_delta("PT60M")
2580
datetime.timedelta(0, 3600)
2581
>>> rfc3339_duration_to_delta("PT24H")
2582
datetime.timedelta(1)
2583
>>> rfc3339_duration_to_delta("P1W")
2584
datetime.timedelta(7)
2585
>>> rfc3339_duration_to_delta("PT5M30S")
2586
datetime.timedelta(0, 330)
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
datetime.timedelta(1, 200)
2809
2589
"""
2810
2590
2811
2591
# Parsing an RFC 3339 duration with regular expressions is not
2812
2592
# possible - there would have to be multiple places for the same
2813
2593
# values, like seconds. The current code, while more esoteric, is
2814
2594
# cleaner without depending on a parsing library. If Python had a
2815
2595
# built-in library for parsing we would use it, but we'd like to
2816
2596
# avoid excessive use of external libraries.
2817
2597
2818
2598
# New type for defining tokens, syntax, and semantics all-in-one
2819
2599
Token = collections.namedtuple("Token", (
2820
2600
"regexp", # To match token; if "value" is not None, must have
2853
2633
frozenset((token_year, token_month,
2854
2634
token_day, token_time,
2855
2635
token_week)))
2856
# Define starting values:
2857
# Value so far
2858
value = datetime.timedelta()
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2859
2638
found_token = None
2860
# Following valid tokens
2861
followers = frozenset((token_duration, ))
2862
# String left to parse
2863
s = duration
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2864
2641
# Loop until end token is found
2865
2642
while found_token is not token_end:
2866
2643
# Search for any currently valid tokens
2890
2667
2891
2668
def string_to_delta(interval):
2892
2669
"""Parse a string and return a datetime.timedelta
2893
2894
>>> string_to_delta('7d') == datetime.timedelta(7)
2895
True
2896
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
True
2898
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
True
2900
>>> string_to_delta('24h') == datetime.timedelta(1)
2901
True
2902
>>> string_to_delta('1w') == datetime.timedelta(7)
2903
True
2904
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2905
True
2670
2671
>>> string_to_delta('7d')
2672
datetime.timedelta(7)
2673
>>> string_to_delta('60s')
2674
datetime.timedelta(0, 60)
2675
>>> string_to_delta('60m')
2676
datetime.timedelta(0, 3600)
2677
>>> string_to_delta('24h')
2678
datetime.timedelta(1)
2679
>>> string_to_delta('1w')
2680
datetime.timedelta(7)
2681
>>> string_to_delta('5m 30s')
2682
datetime.timedelta(0, 330)
2906
2683
"""
2907
2684
2908
2685
try:
2909
2686
return rfc3339_duration_to_delta(interval)
2910
2687
except ValueError:
2911
2688
pass
2912
2689
2913
2690
timevalue = datetime.timedelta(0)
2914
2691
for s in interval.split():
2915
2692
try:
2933
2710
return timevalue
2934
2711
2935
2712
2936
def daemon(nochdir=False, noclose=False):
2713
def daemon(nochdir = False, noclose = False):
2937
2714
"""See daemon(3). Standard BSD Unix function.
2938
2715
2939
2716
This should really exist as os.daemon, but it doesn't (yet)."""
2940
2717
if os.fork():
2941
2718
sys.exit()
2959
2736
2960
2737
2961
2738
def main():
2962
2739
2963
2740
##################################################################
2964
2741
# Parsing of options, both command line and config file
2965
2742
2966
2743
parser = argparse.ArgumentParser()
2967
2744
parser.add_argument("-v", "--version", action="version",
2968
version="%(prog)s {}".format(version),
2745
version = "%(prog)s {}".format(version),
2969
2746
help="show version number and exit")
2970
2747
parser.add_argument("-i", "--interface", metavar="IF",
2971
2748
help="Bind to interface IF")
3007
2784
parser.add_argument("--no-zeroconf", action="store_false",
3008
2785
dest="zeroconf", help="Do not use Zeroconf",
3009
2786
default=None)
3010
2787
3011
2788
options = parser.parse_args()
3012
2789
2790
if options.check:
2791
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
3013
2795
# Default values for config file for server-global settings
3014
if gnutls.has_rawpk:
3015
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3016
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3017
else:
3018
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3019
":+SIGN-DSA-SHA256")
3020
server_defaults = {"interface": "",
3021
"address": "",
3022
"port": "",
3023
"debug": "False",
3024
"priority": priority,
3025
"servicename": "Mandos",
3026
"use_dbus": "True",
3027
"use_ipv6": "True",
3028
"debuglevel": "",
3029
"restore": "True",
3030
"socket": "",
3031
"statedir": "/var/lib/mandos",
3032
"foreground": "False",
3033
"zeroconf": "True",
3034
}
3035
del priority
3036
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
3037
2814
# Parse config file for server-global settings
3038
server_config = configparser.ConfigParser(server_defaults)
2815
server_config = configparser.SafeConfigParser(server_defaults)
3039
2816
del server_defaults
3040
2817
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3041
# Convert the ConfigParser object to a dict
2818
# Convert the SafeConfigParser object to a dict
3042
2819
server_settings = server_config.defaults()
3043
2820
# Use the appropriate methods on the non-string config options
3044
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3045
"foreground", "zeroconf"):
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3046
2822
server_settings[option] = server_config.getboolean("DEFAULT",
3047
2823
option)
3048
2824
if server_settings["port"]:
3058
2834
server_settings["socket"] = os.dup(server_settings
3059
2835
["socket"])
3060
2836
del server_config
3061
2837
3062
2838
# Override the settings from the config file with command line
3063
2839
# options, if set.
3064
2840
for option in ("interface", "address", "port", "debug",
3082
2858
if server_settings["debug"]:
3083
2859
server_settings["foreground"] = True
3084
2860
# Now we have our good server settings in "server_settings"
3085
2861
3086
2862
##################################################################
3087
2863
3088
2864
if (not server_settings["zeroconf"]
3089
2865
and not (server_settings["port"]
3090
2866
or server_settings["socket"] != "")):
3091
2867
parser.error("Needs port or socket to work without Zeroconf")
3092
2868
3093
2869
# For convenience
3094
2870
debug = server_settings["debug"]
3095
2871
debuglevel = server_settings["debuglevel"]
3099
2875
stored_state_file)
3100
2876
foreground = server_settings["foreground"]
3101
2877
zeroconf = server_settings["zeroconf"]
3102
2878
3103
2879
if debug:
3104
2880
initlogger(debug, logging.DEBUG)
3105
2881
else:
3108
2884
else:
3109
2885
level = getattr(logging, debuglevel.upper())
3110
2886
initlogger(debug, level)
3111
2887
3112
2888
if server_settings["servicename"] != "Mandos":
3113
2889
syslogger.setFormatter(
3114
2890
logging.Formatter('Mandos ({}) [%(process)d]:'
3115
2891
' %(levelname)s: %(message)s'.format(
3116
2892
server_settings["servicename"])))
3117
2893
3118
2894
# Parse config file with clients
3119
client_config = configparser.ConfigParser(Client.client_defaults)
2895
client_config = configparser.SafeConfigParser(Client
2896
.client_defaults)
3120
2897
client_config.read(os.path.join(server_settings["configdir"],
3121
2898
"clients.conf"))
3122
2899
3123
2900
global mandos_dbus_service
3124
2901
mandos_dbus_service = None
3125
2902
3126
2903
socketfd = None
3127
2904
if server_settings["socket"] != "":
3128
2905
socketfd = server_settings["socket"]
3144
2921
except IOError as e:
3145
2922
logger.error("Could not open file %r", pidfilename,
3146
2923
exc_info=e)
3147
2924
3148
2925
for name, group in (("_mandos", "_mandos"),
3149
2926
("mandos", "mandos"),
3150
2927
("nobody", "nogroup")):
3168
2945
.format(uid, gid, os.strerror(error.errno)))
3169
2946
if error.errno != errno.EPERM:
3170
2947
raise
3171
2948
3172
2949
if debug:
3173
2950
# Enable all possible GnuTLS debugging
3174
2951
3175
2952
# "Use a log level over 10 to enable all debugging options."
3176
2953
# - GnuTLS manual
3177
2954
gnutls.global_set_log_level(11)
3178
2955
3179
2956
@gnutls.log_func
3180
2957
def debug_gnutls(level, string):
3181
2958
logger.debug("GnuTLS: %s", string[:-1])
3182
2959
3183
2960
gnutls.global_set_log_function(debug_gnutls)
3184
2961
3185
2962
# Redirect stdin so all checkers get /dev/null
3186
2963
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3187
2964
os.dup2(null, sys.stdin.fileno())
3188
2965
if null > 2:
3189
2966
os.close(null)
3190
2967
3191
2968
# Need to fork before connecting to D-Bus
3192
2969
if not foreground:
3193
2970
# Close all input and output, do double fork, etc.
3194
2971
daemon()
3195
3196
if gi.version_info < (3, 10, 2):
3197
# multiprocessing will use threads, so before we use GLib we
3198
# need to inform GLib that threads will be used.
3199
GLib.threads_init()
3200
2972
2973
# multiprocessing will use threads, so before we use GObject we
2974
# need to inform GObject that threads will be used.
2975
GObject.threads_init()
2976
3201
2977
global main_loop
3202
2978
# From the Avahi example code
3203
2979
DBusGMainLoop(set_as_default=True)
3204
main_loop = GLib.MainLoop()
2980
main_loop = GObject.MainLoop()
3205
2981
bus = dbus.SystemBus()
3206
2982
# End of Avahi example code
3207
2983
if use_dbus:
3220
2996
if zeroconf:
3221
2997
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3222
2998
service = AvahiServiceToSyslog(
3223
name=server_settings["servicename"],
3224
servicetype="_mandos._tcp",
3225
protocol=protocol,
3226
bus=bus)
2999
name = server_settings["servicename"],
3000
servicetype = "_mandos._tcp",
3001
protocol = protocol,
3002
bus = bus)
3227
3003
if server_settings["interface"]:
3228
3004
service.interface = if_nametoindex(
3229
3005
server_settings["interface"].encode("utf-8"))
3230
3006
3231
3007
global multiprocessing_manager
3232
3008
multiprocessing_manager = multiprocessing.Manager()
3233
3009
3234
3010
client_class = Client
3235
3011
if use_dbus:
3236
client_class = functools.partial(ClientDBus, bus=bus)
3237
3012
client_class = functools.partial(ClientDBus, bus = bus)
3013
3238
3014
client_settings = Client.config_parser(client_config)
3239
3015
old_client_settings = {}
3240
3016
clients_data = {}
3241
3017
3242
3018
# This is used to redirect stdout and stderr for checker processes
3243
3019
global wnull
3244
wnull = open(os.devnull, "w") # A writable /dev/null
3020
wnull = open(os.devnull, "w") # A writable /dev/null
3245
3021
# Only used if server is running in foreground but not in debug
3246
3022
# mode
3247
3023
if debug or not foreground:
3248
3024
wnull.close()
3249
3025
3250
3026
# Get client data and settings from last running state.
3251
3027
if server_settings["restore"]:
3252
3028
try:
3253
3029
with open(stored_state_path, "rb") as stored_state:
3254
if sys.version_info.major == 2:
3255
clients_data, old_client_settings = pickle.load(
3256
stored_state)
3257
else:
3258
bytes_clients_data, bytes_old_client_settings = (
3259
pickle.load(stored_state, encoding="bytes"))
3260
# Fix bytes to strings
3261
# clients_data
3262
# .keys()
3263
clients_data = {(key.decode("utf-8")
3264
if isinstance(key, bytes)
3265
else key): value
3266
for key, value in
3267
bytes_clients_data.items()}
3268
del bytes_clients_data
3269
for key in clients_data:
3270
value = {(k.decode("utf-8")
3271
if isinstance(k, bytes) else k): v
3272
for k, v in
3273
clients_data[key].items()}
3274
clients_data[key] = value
3275
# .client_structure
3276
value["client_structure"] = [
3277
(s.decode("utf-8")
3278
if isinstance(s, bytes)
3279
else s) for s in
3280
value["client_structure"]]
3281
# .name, .host, and .checker_command
3282
for k in ("name", "host", "checker_command"):
3283
if isinstance(value[k], bytes):
3284
value[k] = value[k].decode("utf-8")
3285
if "key_id" not in value:
3286
value["key_id"] = ""
3287
elif "fingerprint" not in value:
3288
value["fingerprint"] = ""
3289
# old_client_settings
3290
# .keys()
3291
old_client_settings = {
3292
(key.decode("utf-8")
3293
if isinstance(key, bytes)
3294
else key): value
3295
for key, value in
3296
bytes_old_client_settings.items()}
3297
del bytes_old_client_settings
3298
# .host and .checker_command
3299
for value in old_client_settings.values():
3300
for attribute in ("host", "checker_command"):
3301
if isinstance(value[attribute], bytes):
3302
value[attribute] = (value[attribute]
3303
.decode("utf-8"))
3030
clients_data, old_client_settings = pickle.load(
3031
stored_state)
3304
3032
os.remove(stored_state_path)
3305
3033
except IOError as e:
3306
3034
if e.errno == errno.ENOENT:
3314
3042
logger.warning("Could not load persistent state: "
3315
3043
"EOFError:",
3316
3044
exc_info=e)
3317
3045
3318
3046
with PGPEngine() as pgp:
3319
3047
for client_name, client in clients_data.items():
3320
3048
# Skip removed clients
3321
3049
if client_name not in client_settings:
3322
3050
continue
3323
3051
3324
3052
# Decide which value to use after restoring saved state.
3325
3053
# We have three different values: Old config file,
3326
3054
# new config file, and saved state.
3337
3065
client[name] = value
3338
3066
except KeyError:
3339
3067
pass
3340
3068
3341
3069
# Clients who has passed its expire date can still be
3342
3070
# enabled if its last checker was successful. A Client
3343
3071
# whose checker succeeded before we stored its state is
3376
3104
client_name))
3377
3105
client["secret"] = (client_settings[client_name]
3378
3106
["secret"])
3379
3107
3380
3108
# Add/remove clients based on new changes made to config
3381
3109
for client_name in (set(old_client_settings)
3382
3110
- set(client_settings)):
3384
3112
for client_name in (set(client_settings)
3385
3113
- set(old_client_settings)):
3386
3114
clients_data[client_name] = client_settings[client_name]
3387
3115
3388
3116
# Create all client objects
3389
3117
for client_name, client in clients_data.items():
3390
3118
tcp_server.clients[client_name] = client_class(
3391
name=client_name,
3392
settings=client,
3393
server_settings=server_settings)
3394
3119
name = client_name,
3120
settings = client,
3121
server_settings = server_settings)
3122
3395
3123
if not tcp_server.clients:
3396
3124
logger.warning("No clients defined")
3397
3125
3398
3126
if not foreground:
3399
3127
if pidfile is not None:
3400
3128
pid = os.getpid()
3406
3134
pidfilename, pid)
3407
3135
del pidfile
3408
3136
del pidfilename
3409
3410
for termsig in (signal.SIGHUP, signal.SIGTERM):
3411
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3412
lambda: main_loop.quit() and False)
3413
3137
3138
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3139
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3140
3414
3141
if use_dbus:
3415
3142
3416
3143
@alternate_dbus_interfaces(
3417
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3144
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3418
3145
class MandosDBusService(DBusObjectWithObjectManager):
3419
3146
"""A D-Bus proxy object"""
3420
3147
3421
3148
def __init__(self):
3422
3149
dbus.service.Object.__init__(self, bus, "/")
3423
3150
3424
3151
_interface = "se.recompile.Mandos"
3425
3152
3426
3153
@dbus.service.signal(_interface, signature="o")
3427
3154
def ClientAdded(self, objpath):
3428
3155
"D-Bus signal"
3429
3156
pass
3430
3157
3431
3158
@dbus.service.signal(_interface, signature="ss")
3432
def ClientNotFound(self, key_id, address):
3159
def ClientNotFound(self, fingerprint, address):
3433
3160
"D-Bus signal"
3434
3161
pass
3435
3162
3436
3163
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3437
3164
"true"})
3438
3165
@dbus.service.signal(_interface, signature="os")
3439
3166
def ClientRemoved(self, objpath, name):
3440
3167
"D-Bus signal"
3441
3168
pass
3442
3169
3443
3170
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3444
3171
"true"})
3445
3172
@dbus.service.method(_interface, out_signature="ao")
3446
3173
def GetAllClients(self):
3447
3174
"D-Bus method"
3448
3175
return dbus.Array(c.dbus_object_path for c in
3449
tcp_server.clients.values())
3450
3176
tcp_server.clients.itervalues())
3177
3451
3178
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3452
3179
"true"})
3453
3180
@dbus.service.method(_interface,
3455
3182
def GetAllClientsWithProperties(self):
3456
3183
"D-Bus method"
3457
3184
return dbus.Dictionary(
3458
{c.dbus_object_path: c.GetAll(
3185
{ c.dbus_object_path: c.GetAll(
3459
3186
"se.recompile.Mandos.Client")
3460
for c in tcp_server.clients.values()},
3187
for c in tcp_server.clients.itervalues() },
3461
3188
signature="oa{sv}")
3462
3189
3463
3190
@dbus.service.method(_interface, in_signature="o")
3464
3191
def RemoveClient(self, object_path):
3465
3192
"D-Bus method"
3466
for c in tcp_server.clients.values():
3193
for c in tcp_server.clients.itervalues():
3467
3194
if c.dbus_object_path == object_path:
3468
3195
del tcp_server.clients[c.name]
3469
3196
c.remove_from_connection()
3473
3200
self.client_removed_signal(c)
3474
3201
return
3475
3202
raise KeyError(object_path)
3476
3203
3477
3204
del _interface
3478
3205
3479
3206
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3480
out_signature="a{oa{sa{sv}}}")
3207
out_signature = "a{oa{sa{sv}}}")
3481
3208
def GetManagedObjects(self):
3482
3209
"""D-Bus method"""
3483
3210
return dbus.Dictionary(
3484
{client.dbus_object_path:
3485
dbus.Dictionary(
3486
{interface: client.GetAll(interface)
3487
for interface in
3488
client._get_all_interface_names()})
3489
for client in tcp_server.clients.values()})
3490
3211
{ client.dbus_object_path:
3212
dbus.Dictionary(
3213
{ interface: client.GetAll(interface)
3214
for interface in
3215
client._get_all_interface_names()})
3216
for client in tcp_server.clients.values()})
3217
3491
3218
def client_added_signal(self, client):
3492
3219
"""Send the new standard signal and the old signal"""
3493
3220
if use_dbus:
3495
3222
self.InterfacesAdded(
3496
3223
client.dbus_object_path,
3497
3224
dbus.Dictionary(
3498
{interface: client.GetAll(interface)
3499
for interface in
3500
client._get_all_interface_names()}))
3225
{ interface: client.GetAll(interface)
3226
for interface in
3227
client._get_all_interface_names()}))
3501
3228
# Old signal
3502
3229
self.ClientAdded(client.dbus_object_path)
3503
3230
3504
3231
def client_removed_signal(self, client):
3505
3232
"""Send the new standard signal and the old signal"""
3506
3233
if use_dbus:
3511
3238
# Old signal
3512
3239
self.ClientRemoved(client.dbus_object_path,
3513
3240
client.name)
3514
3241
3515
3242
mandos_dbus_service = MandosDBusService()
3516
3517
# Save modules to variables to exempt the modules from being
3518
# unloaded before the function registered with atexit() is run.
3519
mp = multiprocessing
3520
wn = wnull
3521
3243
3522
3244
def cleanup():
3523
3245
"Cleanup function; run on exit"
3524
3246
if zeroconf:
3525
3247
service.cleanup()
3526
3527
mp.active_children()
3528
wn.close()
3248
3249
multiprocessing.active_children()
3250
wnull.close()
3529
3251
if not (tcp_server.clients or client_settings):
3530
3252
return
3531
3253
3532
3254
# Store client before exiting. Secrets are encrypted with key
3533
3255
# based on what config file has. If config file is
3534
3256
# removed/edited, old secret will thus be unrecovable.
3535
3257
clients = {}
3536
3258
with PGPEngine() as pgp:
3537
for client in tcp_server.clients.values():
3259
for client in tcp_server.clients.itervalues():
3538
3260
key = client_settings[client.name]["secret"]
3539
3261
client.encrypted_secret = pgp.encrypt(client.secret,
3540
3262
key)
3541
3263
client_dict = {}
3542
3264
3543
3265
# A list of attributes that can not be pickled
3544
3266
# + secret.
3545
exclude = {"bus", "changedstate", "secret",
3546
"checker", "server_settings"}
3267
exclude = { "bus", "changedstate", "secret",
3268
"checker", "server_settings" }
3547
3269
for name, typ in inspect.getmembers(dbus.service
3548
3270
.Object):
3549
3271
exclude.add(name)
3550
3272
3551
3273
client_dict["encrypted_secret"] = (client
3552
3274
.encrypted_secret)
3553
3275
for attr in client.client_structure:
3554
3276
if attr not in exclude:
3555
3277
client_dict[attr] = getattr(client, attr)
3556
3278
3557
3279
clients[client.name] = client_dict
3558
3280
del client_settings[client.name]["secret"]
3559
3281
3560
3282
try:
3561
3283
with tempfile.NamedTemporaryFile(
3562
3284
mode='wb',
3564
3286
prefix='clients-',
3565
3287
dir=os.path.dirname(stored_state_path),
3566
3288
delete=False) as stored_state:
3567
pickle.dump((clients, client_settings), stored_state,
3568
protocol=2)
3289
pickle.dump((clients, client_settings), stored_state)
3569
3290
tempname = stored_state.name
3570
3291
os.rename(tempname, stored_state_path)
3571
3292
except (IOError, OSError) as e:
3581
3302
logger.warning("Could not save persistent state:",
3582
3303
exc_info=e)
3583
3304
raise
3584
3305
3585
3306
# Delete all clients, and settings from config
3586
3307
while tcp_server.clients:
3587
3308
name, client = tcp_server.clients.popitem()
3593
3314
if use_dbus:
3594
3315
mandos_dbus_service.client_removed_signal(client)
3595
3316
client_settings.clear()
3596
3317
3597
3318
atexit.register(cleanup)
3598
3599
for client in tcp_server.clients.values():
3319
3320
for client in tcp_server.clients.itervalues():
3600
3321
if use_dbus:
3601
3322
# Emit D-Bus signal for adding
3602
3323
mandos_dbus_service.client_added_signal(client)
3603
3324
# Need to initiate checking of clients
3604
3325
if client.enabled:
3605
3326
client.init_checker()
3606
3327
3607
3328
tcp_server.enable()
3608
3329
tcp_server.server_activate()
3609
3330
3610
3331
# Find out what port we got
3611
3332
if zeroconf:
3612
3333
service.port = tcp_server.socket.getsockname()[1]
3617
3338
else: # IPv4
3618
3339
logger.info("Now listening on address %r, port %d",
3619
3340
*tcp_server.socket.getsockname())
3620
3621
# service.interface = tcp_server.socket.getsockname()[3]
3622
3341
3342
#service.interface = tcp_server.socket.getsockname()[3]
3343
3623
3344
try:
3624
3345
if zeroconf:
3625
3346
# From the Avahi example code
3630
3351
cleanup()
3631
3352
sys.exit(1)
3632
3353
# End of Avahi example code
3633
3634
GLib.io_add_watch(
3635
GLib.IOChannel.unix_new(tcp_server.fileno()),
3636
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3637
lambda *args, **kwargs: (tcp_server.handle_request
3638
(*args[2:], **kwargs) or True))
3639
3354
3355
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3356
lambda *args, **kwargs:
3357
(tcp_server.handle_request
3358
(*args[2:], **kwargs) or True))
3359
3640
3360
logger.debug("Starting main loop")
3641
3361
main_loop.run()
3642
3362
except AvahiError as error:
3651
3371
# Must run before the D-Bus bus name gets deregistered
3652
3372
cleanup()
3653
3373
3654
3655
def should_only_run_tests():
3656
parser = argparse.ArgumentParser(add_help=False)
3657
parser.add_argument("--check", action='store_true')
3658
args, unknown_args = parser.parse_known_args()
3659
run_tests = args.check
3660
if run_tests:
3661
# Remove --check argument from sys.argv
3662
sys.argv[1:] = unknown_args
3663
return run_tests
3664
3665
# Add all tests from doctest strings
3666
def load_tests(loader, tests, none):
3667
import doctest
3668
tests.addTests(doctest.DocTestSuite())
3669
return tests
3670
3374
3671
3375
if __name__ == '__main__':
3672
try:
3673
if should_only_run_tests():
3674
# Call using ./mandos --check [--verbose]
3675
unittest.main()
3676
else:
3677
main()
3678
finally:
3679
logging.shutdown()
3376
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0