To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 828
- compare with another revision
- download diff
- download tarball
- view history from revision 828
- Committer: Teddy Hogeborn
- Date: 2016-03-09 21:23:21 UTC
- Revision ID: teddy@recompile.se-20160309212321-2qlkzj9tecepc8xq
Server: Add Python 3 compatibility
Add Python 3 compatibility by not using the python-avahi module. Also
fix miscellaneous things which differs in Python 3. Especially hard
to fix is loading and saving clients data between Python 3 and 2,
since pickle formats have problems with strings.
* INSTALL: Remove python-avahi (and change python-gobject to
python-gi, which is preferred now).
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python-avahi".
* mandos: Wrap future_builtins import in try-except clause. Do not
import avahi module. Use codecs.decode(..., "base64) instead of
.decode("base64). Use .keys(), .values(), and .items() instead of
.iterkeys(), .itervalues(), and .iteritems().
(alternate_dbus_interfaces/wrapper): Python 3 still requires the
"black magic", but luckily it still works. The Python 3 type()
constructor requires first argument to be a string, not a byte
string.
(copy_function): New. Use throughout.
(Avahi, avahi): New class and global variable.
(GnuTLS._need_version): Changed to be a byte string.
(main): Decode byte strings loaded from pickle file.
(main/cleanup): Dump using pickle prototoc 2 which Python 2 can
read.
Add Python 3 compatibility by not using the python-avahi module. Also
fix miscellaneous things which differs in Python 3. Especially hard
to fix is loading and saving clients data between Python 3 and 2,
since pickle formats have problems with strings.
* INSTALL: Remove python-avahi (and change python-gobject to
python-gi, which is preferred now).
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python-avahi".
* mandos: Wrap future_builtins import in try-except clause. Do not
import avahi module. Use codecs.decode(..., "base64) instead of
.decode("base64). Use .keys(), .values(), and .items() instead of
.iterkeys(), .itervalues(), and .iteritems().
(alternate_dbus_interfaces/wrapper): Python 3 still requires the
"black magic", but luckily it still works. The Python 3 type()
constructor requires first argument to be a string, not a byte
string.
(copy_function): New. Use throughout.
(Avahi, avahi): New class and global variable.
(GnuTLS._need_version): Changed to be a byte string.
(main): Decode byte strings loaded from pickle file.
(main/cleanup): Dump using pickle prototoc 2 which Python 2 can
read.
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import unittest
81
79
82
80
import dbus
83
81
import dbus.service
84
import gi
85
from gi.repository import GLib
82
try:
83
from gi.repository import GObject
84
except ImportError:
85
import gobject as GObject
86
86
from dbus.mainloop.glib import DBusGMainLoop
87
87
import ctypes
88
88
import ctypes.util
89
89
import xml.dom.minidom
90
90
import inspect
91
91
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
95
# Show warnings by default
96
if not sys.warnoptions:
97
import warnings
98
warnings.simplefilter("default")
99
100
# Try to find the value of SO_BINDTODEVICE:
101
92
try:
102
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
103
# newer, and it is also the most natural place for it:
104
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
105
94
except AttributeError:
106
95
try:
107
# This is where SO_BINDTODEVICE was up to and including Python
108
# 2.6, and also 3.2:
109
96
from IN import SO_BINDTODEVICE
110
97
except ImportError:
111
# In Python 2.7 it seems to have been removed entirely.
112
# Try running the C preprocessor:
113
try:
114
cc = subprocess.Popen(["cc", "--language=c", "-E",
115
"/dev/stdin"],
116
stdin=subprocess.PIPE,
117
stdout=subprocess.PIPE)
118
stdout = cc.communicate(
119
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
120
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
121
except (OSError, ValueError, IndexError):
122
# No value found
123
SO_BINDTODEVICE = None
98
SO_BINDTODEVICE = None
124
99
125
100
if sys.version_info.major == 2:
126
101
str = unicode
127
102
128
if sys.version_info < (3, 2):
129
configparser.Configparser = configparser.SafeConfigParser
130
131
version = "1.8.9"
103
version = "1.7.5"
132
104
stored_state_file = "clients.pickle"
133
105
134
106
logger = logging.getLogger()
135
logging.captureWarnings(True) # Show warnings via the logging system
136
107
syslogger = None
137
108
138
109
try:
139
110
if_nametoindex = ctypes.cdll.LoadLibrary(
140
111
ctypes.util.find_library("c")).if_nametoindex
141
112
except (OSError, AttributeError):
142
113
143
114
def if_nametoindex(interface):
144
115
"Get an interface index the hard way, i.e. using fcntl()"
145
116
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
168
139
169
140
def initlogger(debug, level=logging.WARNING):
170
141
"""init logger and add loglevel"""
171
142
172
143
global syslogger
173
144
syslogger = (logging.handlers.SysLogHandler(
174
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
address="/dev/log"))
145
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
146
address = "/dev/log"))
176
147
syslogger.setFormatter(logging.Formatter
177
148
('Mandos [%(process)d]: %(levelname)s:'
178
149
' %(message)s'))
179
150
logger.addHandler(syslogger)
180
151
181
152
if debug:
182
153
console = logging.StreamHandler()
183
154
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
193
164
pass
194
165
195
166
196
class PGPEngine:
167
class PGPEngine(object):
197
168
"""A simple class for OpenPGP symmetric encryption & decryption"""
198
169
199
170
def __init__(self):
200
171
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
201
172
self.gpg = "gpg"
203
174
output = subprocess.check_output(["gpgconf"])
204
175
for line in output.splitlines():
205
176
name, text, path = line.split(b":")
206
if name == b"gpg":
177
if name == "gpg":
207
178
self.gpg = path
208
179
break
209
180
except OSError as e:
212
183
self.gnupgargs = ['--batch',
213
184
'--homedir', self.tempdir,
214
185
'--force-mdc',
215
'--quiet']
216
# Only GPG version 1 has the --no-use-agent option.
217
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
218
self.gnupgargs.append("--no-use-agent")
219
186
'--quiet',
187
'--no-use-agent']
188
220
189
def __enter__(self):
221
190
return self
222
191
223
192
def __exit__(self, exc_type, exc_value, traceback):
224
193
self._cleanup()
225
194
return False
226
195
227
196
def __del__(self):
228
197
self._cleanup()
229
198
230
199
def _cleanup(self):
231
200
if self.tempdir is not None:
232
201
# Delete contents of tempdir
233
202
for root, dirs, files in os.walk(self.tempdir,
234
topdown=False):
203
topdown = False):
235
204
for filename in files:
236
205
os.remove(os.path.join(root, filename))
237
206
for dirname in dirs:
239
208
# Remove tempdir
240
209
os.rmdir(self.tempdir)
241
210
self.tempdir = None
242
211
243
212
def password_encode(self, password):
244
213
# Passphrase can not be empty and can not contain newlines or
245
214
# NUL bytes. So we prefix it and hex encode it.
250
219
.replace(b"\n", b"\\n")
251
220
.replace(b"\0", b"\\x00"))
252
221
return encoded
253
222
254
223
def encrypt(self, data, password):
255
224
passphrase = self.password_encode(password)
256
225
with tempfile.NamedTemporaryFile(
261
230
'--passphrase-file',
262
231
passfile.name]
263
232
+ self.gnupgargs,
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
268
237
if proc.returncode != 0:
269
238
raise PGPError(err)
270
239
return ciphertext
271
240
272
241
def decrypt(self, data, password):
273
242
passphrase = self.password_encode(password)
274
243
with tempfile.NamedTemporaryFile(
275
dir=self.tempdir) as passfile:
244
dir = self.tempdir) as passfile:
276
245
passfile.write(passphrase)
277
246
passfile.flush()
278
247
proc = subprocess.Popen([self.gpg, '--decrypt',
279
248
'--passphrase-file',
280
249
passfile.name]
281
250
+ self.gnupgargs,
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
286
255
if proc.returncode != 0:
287
256
raise PGPError(err)
288
257
return decrypted_plaintext
289
258
290
291
259
# Pretend that we have an Avahi module
292
class avahi:
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
260
class Avahi(object):
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
298
267
DBUS_NAME = "org.freedesktop.Avahi"
299
268
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
269
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
270
DBUS_PATH_SERVER = "/"
302
303
@staticmethod
304
def string_array_to_txt_array(t):
271
def string_array_to_txt_array(self, t):
305
272
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
273
for s in t), signature="ay")
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
315
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
282
avahi = Avahi()
316
283
317
284
class AvahiError(Exception):
318
285
def __init__(self, value, *args, **kwargs):
329
296
pass
330
297
331
298
332
class AvahiService:
299
class AvahiService(object):
333
300
"""An Avahi (Zeroconf) service.
334
301
335
302
Attributes:
336
303
interface: integer; avahi.IF_UNSPEC or an interface index.
337
304
Used to optionally bind to the specified interface.
349
316
server: D-Bus Server
350
317
bus: dbus.SystemBus()
351
318
"""
352
319
353
320
def __init__(self,
354
interface=avahi.IF_UNSPEC,
355
name=None,
356
servicetype=None,
357
port=None,
358
TXT=None,
359
domain="",
360
host="",
361
max_renames=32768,
362
protocol=avahi.PROTO_UNSPEC,
363
bus=None):
321
interface = avahi.IF_UNSPEC,
322
name = None,
323
servicetype = None,
324
port = None,
325
TXT = None,
326
domain = "",
327
host = "",
328
max_renames = 32768,
329
protocol = avahi.PROTO_UNSPEC,
330
bus = None):
364
331
self.interface = interface
365
332
self.name = name
366
333
self.type = servicetype
375
342
self.server = None
376
343
self.bus = bus
377
344
self.entry_group_state_changed_match = None
378
345
379
346
def rename(self, remove=True):
380
347
"""Derived from the Avahi example code"""
381
348
if self.rename_count >= self.max_renames:
401
368
logger.critical("D-Bus Exception", exc_info=error)
402
369
self.cleanup()
403
370
os._exit(1)
404
371
405
372
def remove(self):
406
373
"""Derived from the Avahi example code"""
407
374
if self.entry_group_state_changed_match is not None:
409
376
self.entry_group_state_changed_match = None
410
377
if self.group is not None:
411
378
self.group.Reset()
412
379
413
380
def add(self):
414
381
"""Derived from the Avahi example code"""
415
382
self.remove()
432
399
dbus.UInt16(self.port),
433
400
avahi.string_array_to_txt_array(self.TXT))
434
401
self.group.Commit()
435
402
436
403
def entry_group_state_changed(self, state, error):
437
404
"""Derived from the Avahi example code"""
438
405
logger.debug("Avahi entry group state change: %i", state)
439
406
440
407
if state == avahi.ENTRY_GROUP_ESTABLISHED:
441
408
logger.debug("Zeroconf service established.")
442
409
elif state == avahi.ENTRY_GROUP_COLLISION:
446
413
logger.critical("Avahi: Error in group state changed %s",
447
414
str(error))
448
415
raise AvahiGroupError("State changed: {!s}".format(error))
449
416
450
417
def cleanup(self):
451
418
"""Derived from the Avahi example code"""
452
419
if self.group is not None:
457
424
pass
458
425
self.group = None
459
426
self.remove()
460
427
461
428
def server_state_changed(self, state, error=None):
462
429
"""Derived from the Avahi example code"""
463
430
logger.debug("Avahi server state change: %i", state)
492
459
logger.debug("Unknown state: %r", state)
493
460
else:
494
461
logger.debug("Unknown state: %r: %r", state, error)
495
462
496
463
def activate(self):
497
464
"""Derived from the Avahi example code"""
498
465
if self.server is None:
509
476
class AvahiServiceToSyslog(AvahiService):
510
477
def rename(self, *args, **kwargs):
511
478
"""Add the new name to the syslog messages"""
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
479
ret = AvahiService.rename(self, *args, **kwargs)
513
480
syslogger.setFormatter(logging.Formatter(
514
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
515
482
.format(self.name)))
516
483
return ret
517
484
518
519
485
# Pretend that we have a GnuTLS module
520
class gnutls:
521
"""This isn't so much a class as it is a module-like namespace."""
522
523
library = ctypes.util.find_library("gnutls")
524
if library is None:
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
527
del library
528
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
489
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
493
def __init__(self):
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
496
# happens.
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
500
529
501
# Unless otherwise indicated, the constants and types below are
530
502
# all from the gnutls/gnutls.h C header file.
531
503
532
504
# Constants
533
505
E_SUCCESS = 0
534
506
E_INTERRUPTED = -52
535
507
E_AGAIN = -28
536
508
CRT_OPENPGP = 2
537
CRT_RAWPK = 3
538
509
CLIENT = 2
539
510
SHUT_RDWR = 0
540
511
CRD_CERTIFICATE = 1
541
512
E_NO_CERTIFICATE_FOUND = -49
542
X509_FMT_DER = 0
543
NO_TICKETS = 1<<10
544
ENABLE_RAWPK = 1<<18
545
CTYPE_PEERS = 3
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
547
513
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
514
549
515
# Types
550
516
class session_int(ctypes.Structure):
551
517
_fields_ = []
552
518
session_t = ctypes.POINTER(session_int)
553
554
519
class certificate_credentials_st(ctypes.Structure):
555
520
_fields_ = []
556
521
certificate_credentials_t = ctypes.POINTER(
557
522
certificate_credentials_st)
558
523
certificate_type_t = ctypes.c_int
559
560
524
class datum_t(ctypes.Structure):
561
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
526
('size', ctypes.c_uint)]
563
564
527
class openpgp_crt_int(ctypes.Structure):
565
528
_fields_ = []
566
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
568
531
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
569
532
credentials_type_t = ctypes.c_int
570
533
transport_ptr_t = ctypes.c_void_p
571
534
close_request_t = ctypes.c_int
572
535
573
536
# Exceptions
574
537
class Error(Exception):
575
def __init__(self, message=None, code=None, args=()):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
576
543
# Default usage is by a message string, but if a return
577
544
# code is passed, convert it to a string with
578
545
# gnutls.strerror()
579
546
self.code = code
580
547
if message is None and code is not None:
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
583
550
message, *args)
584
551
585
552
class CertificateSecurityError(Error):
586
553
pass
587
554
588
555
# Classes
589
class Credentials:
556
class Credentials(object):
590
557
def __init__(self):
591
558
self._c_object = gnutls.certificate_credentials_t()
592
559
gnutls.certificate_allocate_credentials(
593
560
ctypes.byref(self._c_object))
594
561
self.type = gnutls.CRD_CERTIFICATE
595
562
596
563
def __del__(self):
597
564
gnutls.certificate_free_credentials(self._c_object)
598
599
class ClientSession:
600
def __init__(self, socket, credentials=None):
565
566
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
601
568
self._c_object = gnutls.session_t()
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
605
if gnutls.has_rawpk:
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
608
del gnutls_flags
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
609
570
gnutls.set_default_priority(self._c_object)
610
571
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
572
gnutls.handshake_set_private_extensions(self._c_object,
617
578
ctypes.cast(credentials._c_object,
618
579
ctypes.c_void_p))
619
580
self.credentials = credentials
620
581
621
582
def __del__(self):
622
583
gnutls.deinit(self._c_object)
623
584
624
585
def handshake(self):
625
586
return gnutls.handshake(self._c_object)
626
587
627
588
def send(self, data):
628
589
data = bytes(data)
629
590
data_len = len(data)
631
592
data_len -= gnutls.record_send(self._c_object,
632
593
data[-data_len:],
633
594
data_len)
634
595
635
596
def bye(self):
636
597
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
637
598
638
599
# Error handling functions
639
600
def _error_code(result):
640
601
"""A function to raise exceptions on errors, suitable
642
603
if result >= 0:
643
604
return result
644
605
if result == gnutls.E_NO_CERTIFICATE_FOUND:
645
raise gnutls.CertificateSecurityError(code=result)
646
raise gnutls.Error(code=result)
647
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
608
648
609
def _retry_on_error(result, func, arguments):
649
610
"""A function to retry on some errors, suitable
650
611
for the 'errcheck' attribute on ctypes functions"""
653
614
return _error_code(result)
654
615
result = func(*arguments)
655
616
return result
656
617
657
618
# Unless otherwise indicated, the function declarations below are
658
619
# all from the gnutls/gnutls.h C header file.
659
620
660
621
# Functions
661
622
priority_set_direct = _library.gnutls_priority_set_direct
662
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
663
624
ctypes.POINTER(ctypes.c_char_p)]
664
625
priority_set_direct.restype = _error_code
665
626
666
627
init = _library.gnutls_init
667
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
668
629
init.restype = _error_code
669
630
670
631
set_default_priority = _library.gnutls_set_default_priority
671
632
set_default_priority.argtypes = [session_t]
672
633
set_default_priority.restype = _error_code
673
634
674
635
record_send = _library.gnutls_record_send
675
636
record_send.argtypes = [session_t, ctypes.c_void_p,
676
637
ctypes.c_size_t]
677
638
record_send.restype = ctypes.c_ssize_t
678
639
record_send.errcheck = _retry_on_error
679
640
680
641
certificate_allocate_credentials = (
681
642
_library.gnutls_certificate_allocate_credentials)
682
643
certificate_allocate_credentials.argtypes = [
683
644
ctypes.POINTER(certificate_credentials_t)]
684
645
certificate_allocate_credentials.restype = _error_code
685
646
686
647
certificate_free_credentials = (
687
648
_library.gnutls_certificate_free_credentials)
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
690
650
certificate_free_credentials.restype = None
691
651
692
652
handshake_set_private_extensions = (
693
653
_library.gnutls_handshake_set_private_extensions)
694
654
handshake_set_private_extensions.argtypes = [session_t,
695
655
ctypes.c_int]
696
656
handshake_set_private_extensions.restype = None
697
657
698
658
credentials_set = _library.gnutls_credentials_set
699
659
credentials_set.argtypes = [session_t, credentials_type_t,
700
660
ctypes.c_void_p]
701
661
credentials_set.restype = _error_code
702
662
703
663
strerror = _library.gnutls_strerror
704
664
strerror.argtypes = [ctypes.c_int]
705
665
strerror.restype = ctypes.c_char_p
706
666
707
667
certificate_type_get = _library.gnutls_certificate_type_get
708
668
certificate_type_get.argtypes = [session_t]
709
669
certificate_type_get.restype = _error_code
710
670
711
671
certificate_get_peers = _library.gnutls_certificate_get_peers
712
672
certificate_get_peers.argtypes = [session_t,
713
673
ctypes.POINTER(ctypes.c_uint)]
714
674
certificate_get_peers.restype = ctypes.POINTER(datum_t)
715
675
716
676
global_set_log_level = _library.gnutls_global_set_log_level
717
677
global_set_log_level.argtypes = [ctypes.c_int]
718
678
global_set_log_level.restype = None
719
679
720
680
global_set_log_function = _library.gnutls_global_set_log_function
721
681
global_set_log_function.argtypes = [log_func]
722
682
global_set_log_function.restype = None
723
683
724
684
deinit = _library.gnutls_deinit
725
685
deinit.argtypes = [session_t]
726
686
deinit.restype = None
727
687
728
688
handshake = _library.gnutls_handshake
729
689
handshake.argtypes = [session_t]
730
690
handshake.restype = _error_code
731
691
handshake.errcheck = _retry_on_error
732
692
733
693
transport_set_ptr = _library.gnutls_transport_set_ptr
734
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
735
695
transport_set_ptr.restype = None
736
696
737
697
bye = _library.gnutls_bye
738
698
bye.argtypes = [session_t, close_request_t]
739
699
bye.restype = _error_code
740
700
bye.errcheck = _retry_on_error
741
701
742
702
check_version = _library.gnutls_check_version
743
703
check_version.argtypes = [ctypes.c_char_p]
744
704
check_version.restype = ctypes.c_char_p
745
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
750
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
753
754
if has_rawpk:
755
# Types
756
class pubkey_st(ctypes.Structure):
757
_fields = []
758
pubkey_t = ctypes.POINTER(pubkey_st)
759
760
x509_crt_fmt_t = ctypes.c_int
761
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
766
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
769
x509_crt_fmt_t]
770
pubkey_import.restype = _error_code
771
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
777
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
781
else:
782
# All the function declarations below are from gnutls/openpgp.h
783
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
787
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
791
openpgp_crt_fmt_t]
792
openpgp_crt_import.restype = _error_code
793
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
798
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
802
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
806
ctypes.c_void_p,
807
ctypes.POINTER(
808
ctypes.c_size_t)]
809
openpgp_crt_get_fingerprint.restype = _error_code
810
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
815
705
706
# All the function declarations below are from gnutls/openpgp.h
707
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
711
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
715
openpgp_crt_fmt_t]
716
openpgp_crt_import.restype = _error_code
717
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
722
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
726
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
ctypes.c_void_p,
731
ctypes.POINTER(
732
ctypes.c_size_t)]
733
openpgp_crt_get_fingerprint.restype = _error_code
734
816
735
# Remove non-public functions
817
736
del _error_code, _retry_on_error
818
737
# Create the global "gnutls" object, simulating a module
738
gnutls = GnuTLS()
819
739
820
740
def call_pipe(connection, # : multiprocessing.Connection
821
741
func, *args, **kwargs):
822
742
"""This function is meant to be called by multiprocessing.Process
823
743
824
744
This function runs func(*args, **kwargs), and writes the resulting
825
745
return value on the provided multiprocessing.Connection.
826
746
"""
827
747
connection.send(func(*args, **kwargs))
828
748
connection.close()
829
749
830
831
class Client:
750
class Client(object):
832
751
"""A representation of a client host served by this server.
833
752
834
753
Attributes:
835
754
approved: bool(); 'None' if not yet approved/disapproved
836
755
approval_delay: datetime.timedelta(); Time to wait for approval
837
756
approval_duration: datetime.timedelta(); Duration of one approval
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
840
running.
841
checker_callback_tag: a GLib event source tag, or None
757
checker: subprocess.Popen(); a running checker process used
758
to see if the client lives.
759
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
842
761
checker_command: string; External command which is run to check
843
762
if client lives. %() expansions are done at
844
763
runtime with vars(self) as dict, so that for
845
764
instance %(name)s can be used in the command.
846
checker_initiator_tag: a GLib event source tag, or None
765
checker_initiator_tag: a GObject event source tag, or None
847
766
created: datetime.datetime(); (UTC) object creation
848
767
client_structure: Object describing what attributes a client has
849
768
and is used for storing the client at exit
850
769
current_checker_command: string; current running checker_command
851
disable_initiator_tag: a GLib event source tag, or None
770
disable_initiator_tag: a GObject event source tag, or None
852
771
enabled: bool()
853
772
fingerprint: string (40 or 32 hexadecimal digits); used to
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
773
uniquely identify the client
857
774
host: string; available for use by the checker command
858
775
interval: datetime.timedelta(); How often to start a new checker
859
776
last_approval_request: datetime.datetime(); (UTC) or None
875
792
disabled, or None
876
793
server_settings: The server_settings dict from main()
877
794
"""
878
795
879
796
runtime_expansions = ("approval_delay", "approval_duration",
880
"created", "enabled", "expires", "key_id",
797
"created", "enabled", "expires",
881
798
"fingerprint", "host", "interval",
882
799
"last_approval_request", "last_checked_ok",
883
800
"last_enabled", "name", "timeout")
892
809
"approved_by_default": "True",
893
810
"enabled": "True",
894
811
}
895
812
896
813
@staticmethod
897
814
def config_parser(config):
898
815
"""Construct a new dict of client settings of this form:
905
822
for client_name in config.sections():
906
823
section = dict(config.items(client_name))
907
824
client = settings[client_name] = {}
908
825
909
826
client["host"] = section["host"]
910
827
# Reformat values from string types to Python types
911
828
client["approved_by_default"] = config.getboolean(
912
829
client_name, "approved_by_default")
913
830
client["enabled"] = config.getboolean(client_name,
914
831
"enabled")
915
916
# Uppercase and remove spaces from key_id and fingerprint
917
# for later comparison purposes with return value from the
918
# key_id() and fingerprint() functions
919
client["key_id"] = (section.get("key_id", "").upper()
920
.replace(" ", ""))
832
833
# Uppercase and remove spaces from fingerprint for later
834
# comparison purposes with return value from the
835
# fingerprint() function
921
836
client["fingerprint"] = (section["fingerprint"].upper()
922
837
.replace(" ", ""))
923
838
if "secret" in section:
944
859
client["last_approval_request"] = None
945
860
client["last_checked_ok"] = None
946
861
client["last_checker_status"] = -2
947
862
948
863
return settings
949
950
def __init__(self, settings, name=None, server_settings=None):
864
865
def __init__(self, settings, name = None, server_settings=None):
951
866
self.name = name
952
867
if server_settings is None:
953
868
server_settings = {}
955
870
# adding all client settings
956
871
for setting, value in settings.items():
957
872
setattr(self, setting, value)
958
873
959
874
if self.enabled:
960
875
if not hasattr(self, "last_enabled"):
961
876
self.last_enabled = datetime.datetime.utcnow()
965
880
else:
966
881
self.last_enabled = None
967
882
self.expires = None
968
883
969
884
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
885
logger.debug(" Fingerprint: %s", self.fingerprint)
972
886
self.created = settings.get("created",
973
887
datetime.datetime.utcnow())
974
888
975
889
# attributes specific for this server instance
976
890
self.checker = None
977
891
self.checker_initiator_tag = None
986
900
for attr in self.__dict__.keys()
987
901
if not attr.startswith("_")]
988
902
self.client_structure.append("client_structure")
989
903
990
904
for name, t in inspect.getmembers(
991
905
type(self), lambda obj: isinstance(obj, property)):
992
906
if not name.startswith("_"):
993
907
self.client_structure.append(name)
994
908
995
909
# Send notice to process children that client state has changed
996
910
def send_changedstate(self):
997
911
with self.changedstate:
998
912
self.changedstate.notify_all()
999
913
1000
914
def enable(self):
1001
915
"""Start this client's checker and timeout hooks"""
1002
916
if getattr(self, "enabled", False):
1007
921
self.last_enabled = datetime.datetime.utcnow()
1008
922
self.init_checker()
1009
923
self.send_changedstate()
1010
924
1011
925
def disable(self, quiet=True):
1012
926
"""Disable this client."""
1013
927
if not getattr(self, "enabled", False):
1015
929
if not quiet:
1016
930
logger.info("Disabling client %s", self.name)
1017
931
if getattr(self, "disable_initiator_tag", None) is not None:
1018
GLib.source_remove(self.disable_initiator_tag)
932
GObject.source_remove(self.disable_initiator_tag)
1019
933
self.disable_initiator_tag = None
1020
934
self.expires = None
1021
935
if getattr(self, "checker_initiator_tag", None) is not None:
1022
GLib.source_remove(self.checker_initiator_tag)
936
GObject.source_remove(self.checker_initiator_tag)
1023
937
self.checker_initiator_tag = None
1024
938
self.stop_checker()
1025
939
self.enabled = False
1026
940
if not quiet:
1027
941
self.send_changedstate()
1028
# Do not run this again if called by a GLib.timeout_add
942
# Do not run this again if called by a GObject.timeout_add
1029
943
return False
1030
944
1031
945
def __del__(self):
1032
946
self.disable()
1033
947
1034
948
def init_checker(self):
1035
949
# Schedule a new checker to be started an 'interval' from now,
1036
950
# and every interval from then on.
1037
951
if self.checker_initiator_tag is not None:
1038
GLib.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = GLib.timeout_add(
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
1040
954
int(self.interval.total_seconds() * 1000),
1041
955
self.start_checker)
1042
956
# Schedule a disable() when 'timeout' has passed
1043
957
if self.disable_initiator_tag is not None:
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1046
960
int(self.timeout.total_seconds() * 1000), self.disable)
1047
961
# Also start a new checker *right now*.
1048
962
self.start_checker()
1049
963
1050
964
def checker_callback(self, source, condition, connection,
1051
965
command):
1052
966
"""The checker has completed, so take appropriate actions."""
967
self.checker_callback_tag = None
968
self.checker = None
1053
969
# Read return code from connection (see call_pipe)
1054
970
returncode = connection.recv()
1055
971
connection.close()
1056
if self.checker is not None:
1057
self.checker.join()
1058
self.checker_callback_tag = None
1059
self.checker = None
1060
972
1061
973
if returncode >= 0:
1062
974
self.last_checker_status = returncode
1063
975
self.last_checker_signal = None
1073
985
logger.warning("Checker for %(name)s crashed?",
1074
986
vars(self))
1075
987
return False
1076
988
1077
989
def checked_ok(self):
1078
990
"""Assert that the client has been seen, alive and well."""
1079
991
self.last_checked_ok = datetime.datetime.utcnow()
1080
992
self.last_checker_status = 0
1081
993
self.last_checker_signal = None
1082
994
self.bump_timeout()
1083
995
1084
996
def bump_timeout(self, timeout=None):
1085
997
"""Bump up the timeout for this client."""
1086
998
if timeout is None:
1087
999
timeout = self.timeout
1088
1000
if self.disable_initiator_tag is not None:
1089
GLib.source_remove(self.disable_initiator_tag)
1001
GObject.source_remove(self.disable_initiator_tag)
1090
1002
self.disable_initiator_tag = None
1091
1003
if getattr(self, "enabled", False):
1092
self.disable_initiator_tag = GLib.timeout_add(
1004
self.disable_initiator_tag = GObject.timeout_add(
1093
1005
int(timeout.total_seconds() * 1000), self.disable)
1094
1006
self.expires = datetime.datetime.utcnow() + timeout
1095
1007
1096
1008
def need_approval(self):
1097
1009
self.last_approval_request = datetime.datetime.utcnow()
1098
1010
1099
1011
def start_checker(self):
1100
1012
"""Start a new checker subprocess if one is not running.
1101
1013
1102
1014
If a checker already exists, leave it running and do
1103
1015
nothing."""
1104
1016
# The reason for not killing a running checker is that if we
1109
1021
# checkers alone, the checker would have to take more time
1110
1022
# than 'timeout' for the client to be disabled, which is as it
1111
1023
# should be.
1112
1024
1113
1025
if self.checker is not None and not self.checker.is_alive():
1114
1026
logger.warning("Checker was not alive; joining")
1115
1027
self.checker.join()
1119
1031
# Escape attributes for the shell
1120
1032
escaped_attrs = {
1121
1033
attr: re.escape(str(getattr(self, attr)))
1122
for attr in self.runtime_expansions}
1034
for attr in self.runtime_expansions }
1123
1035
try:
1124
1036
command = self.checker_command % escaped_attrs
1125
1037
except TypeError as error:
1137
1049
# The exception is when not debugging but nevertheless
1138
1050
# running in the foreground; use the previously
1139
1051
# created wnull.
1140
popen_args = {"close_fds": True,
1141
"shell": True,
1142
"cwd": "/"}
1052
popen_args = { "close_fds": True,
1053
"shell": True,
1054
"cwd": "/" }
1143
1055
if (not self.server_settings["debug"]
1144
1056
and self.server_settings["foreground"]):
1145
1057
popen_args.update({"stdout": wnull,
1146
"stderr": wnull})
1147
pipe = multiprocessing.Pipe(duplex=False)
1058
"stderr": wnull })
1059
pipe = multiprocessing.Pipe(duplex = False)
1148
1060
self.checker = multiprocessing.Process(
1149
target=call_pipe,
1150
args=(pipe[1], subprocess.call, command),
1151
kwargs=popen_args)
1061
target = call_pipe,
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1152
1064
self.checker.start()
1153
self.checker_callback_tag = GLib.io_add_watch(
1154
GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1156
1067
self.checker_callback, pipe[0], command)
1157
# Re-run this periodically if run by GLib.timeout_add
1068
# Re-run this periodically if run by GObject.timeout_add
1158
1069
return True
1159
1070
1160
1071
def stop_checker(self):
1161
1072
"""Force the checker process, if any, to stop."""
1162
1073
if self.checker_callback_tag:
1163
GLib.source_remove(self.checker_callback_tag)
1074
GObject.source_remove(self.checker_callback_tag)
1164
1075
self.checker_callback_tag = None
1165
1076
if getattr(self, "checker", None) is None:
1166
1077
return
1175
1086
byte_arrays=False):
1176
1087
"""Decorators for marking methods of a DBusObjectWithProperties to
1177
1088
become properties on the D-Bus.
1178
1089
1179
1090
The decorated method will be called with no arguments by "Get"
1180
1091
and with one argument by "Set".
1181
1092
1182
1093
The parameters, where they are supported, are the same as
1183
1094
dbus.service.method, except there is only "signature", since the
1184
1095
type from Get() and the type sent to Set() is the same.
1188
1099
if byte_arrays and signature != "ay":
1189
1100
raise ValueError("Byte arrays not supported for non-'ay'"
1190
1101
" signature {!r}".format(signature))
1191
1102
1192
1103
def decorator(func):
1193
1104
func._dbus_is_property = True
1194
1105
func._dbus_interface = dbus_interface
1197
1108
func._dbus_name = func.__name__
1198
1109
if func._dbus_name.endswith("_dbus_property"):
1199
1110
func._dbus_name = func._dbus_name[:-14]
1200
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1111
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1201
1112
return func
1202
1113
1203
1114
return decorator
1204
1115
1205
1116
1206
1117
def dbus_interface_annotations(dbus_interface):
1207
1118
"""Decorator for marking functions returning interface annotations
1208
1119
1209
1120
Usage:
1210
1121
1211
1122
@dbus_interface_annotations("org.example.Interface")
1212
1123
def _foo(self): # Function name does not matter
1213
1124
return {"org.freedesktop.DBus.Deprecated": "true",
1214
1125
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1215
1126
"false"}
1216
1127
"""
1217
1128
1218
1129
def decorator(func):
1219
1130
func._dbus_is_interface = True
1220
1131
func._dbus_interface = dbus_interface
1221
1132
func._dbus_name = dbus_interface
1222
1133
return func
1223
1134
1224
1135
return decorator
1225
1136
1226
1137
1227
1138
def dbus_annotations(annotations):
1228
1139
"""Decorator to annotate D-Bus methods, signals or properties
1229
1140
Usage:
1230
1141
1231
1142
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1232
1143
"org.freedesktop.DBus.Property."
1233
1144
"EmitsChangedSignal": "false"})
1235
1146
access="r")
1236
1147
def Property_dbus_property(self):
1237
1148
return dbus.Boolean(False)
1238
1149
1239
1150
See also the DBusObjectWithAnnotations class.
1240
1151
"""
1241
1152
1242
1153
def decorator(func):
1243
1154
func._dbus_annotations = annotations
1244
1155
return func
1245
1156
1246
1157
return decorator
1247
1158
1248
1159
1266
1177
1267
1178
class DBusObjectWithAnnotations(dbus.service.Object):
1268
1179
"""A D-Bus object with annotations.
1269
1180
1270
1181
Classes inheriting from this can use the dbus_annotations
1271
1182
decorator to add annotations to methods or signals.
1272
1183
"""
1273
1184
1274
1185
@staticmethod
1275
1186
def _is_dbus_thing(thing):
1276
1187
"""Returns a function testing if an attribute is a D-Bus thing
1277
1188
1278
1189
If called like _is_dbus_thing("method") it returns a function
1279
1190
suitable for use as predicate to inspect.getmembers().
1280
1191
"""
1281
1192
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1282
1193
False)
1283
1194
1284
1195
def _get_all_dbus_things(self, thing):
1285
1196
"""Returns a generator of (name, attribute) pairs
1286
1197
"""
1289
1200
for cls in self.__class__.__mro__
1290
1201
for name, athing in
1291
1202
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1292
1203
1293
1204
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
out_signature="s",
1295
path_keyword='object_path',
1296
connection_keyword='connection')
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1297
1208
def Introspect(self, object_path, connection):
1298
1209
"""Overloading of standard D-Bus method.
1299
1210
1300
1211
Inserts annotation tags on methods and signals.
1301
1212
"""
1302
1213
xmlstring = dbus.service.Object.Introspect(self, object_path,
1303
1214
connection)
1304
1215
try:
1305
1216
document = xml.dom.minidom.parseString(xmlstring)
1306
1217
1307
1218
for if_tag in document.getElementsByTagName("interface"):
1308
1219
# Add annotation tags
1309
1220
for typ in ("method", "signal"):
1336
1247
if_tag.appendChild(ann_tag)
1337
1248
# Fix argument name for the Introspect method itself
1338
1249
if (if_tag.getAttribute("name")
1339
== dbus.INTROSPECTABLE_IFACE):
1250
== dbus.INTROSPECTABLE_IFACE):
1340
1251
for cn in if_tag.getElementsByTagName("method"):
1341
1252
if cn.getAttribute("name") == "Introspect":
1342
1253
for arg in cn.getElementsByTagName("arg"):
1355
1266
1356
1267
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1357
1268
"""A D-Bus object with properties.
1358
1269
1359
1270
Classes inheriting from this can use the dbus_service_property
1360
1271
decorator to expose methods as D-Bus properties. It exposes the
1361
1272
standard Get(), Set(), and GetAll() methods on the D-Bus.
1362
1273
"""
1363
1274
1364
1275
def _get_dbus_property(self, interface_name, property_name):
1365
1276
"""Returns a bound method if one exists which is a D-Bus
1366
1277
property with the specified name and interface.
1371
1282
if (value._dbus_name == property_name
1372
1283
and value._dbus_interface == interface_name):
1373
1284
return value.__get__(self)
1374
1285
1375
1286
# No such property
1376
1287
raise DBusPropertyNotFound("{}:{}.{}".format(
1377
1288
self.dbus_object_path, interface_name, property_name))
1378
1289
1379
1290
@classmethod
1380
1291
def _get_all_interface_names(cls):
1381
1292
"""Get a sequence of all interfaces supported by an object"""
1384
1295
for x in (inspect.getmro(cls))
1385
1296
for attr in dir(x))
1386
1297
if name is not None)
1387
1298
1388
1299
@dbus.service.method(dbus.PROPERTIES_IFACE,
1389
1300
in_signature="ss",
1390
1301
out_signature="v")
1398
1309
if not hasattr(value, "variant_level"):
1399
1310
return value
1400
1311
return type(value)(value, variant_level=value.variant_level+1)
1401
1312
1402
1313
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1403
1314
def Set(self, interface_name, property_name, value):
1404
1315
"""Standard D-Bus property Set() method, see D-Bus standard.
1416
1327
value = dbus.ByteArray(b''.join(chr(byte)
1417
1328
for byte in value))
1418
1329
prop(value)
1419
1330
1420
1331
@dbus.service.method(dbus.PROPERTIES_IFACE,
1421
1332
in_signature="s",
1422
1333
out_signature="a{sv}")
1423
1334
def GetAll(self, interface_name):
1424
1335
"""Standard D-Bus property GetAll() method, see D-Bus
1425
1336
standard.
1426
1337
1427
1338
Note: Will not include properties with access="write".
1428
1339
"""
1429
1340
properties = {}
1440
1351
properties[name] = value
1441
1352
continue
1442
1353
properties[name] = type(value)(
1443
value, variant_level=value.variant_level + 1)
1354
value, variant_level = value.variant_level + 1)
1444
1355
return dbus.Dictionary(properties, signature="sv")
1445
1356
1446
1357
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1447
1358
def PropertiesChanged(self, interface_name, changed_properties,
1448
1359
invalidated_properties):
1450
1361
standard.
1451
1362
"""
1452
1363
pass
1453
1364
1454
1365
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1455
1366
out_signature="s",
1456
1367
path_keyword='object_path',
1457
1368
connection_keyword='connection')
1458
1369
def Introspect(self, object_path, connection):
1459
1370
"""Overloading of standard D-Bus method.
1460
1371
1461
1372
Inserts property tags and interface annotation tags.
1462
1373
"""
1463
1374
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1465
1376
connection)
1466
1377
try:
1467
1378
document = xml.dom.minidom.parseString(xmlstring)
1468
1379
1469
1380
def make_tag(document, name, prop):
1470
1381
e = document.createElement("property")
1471
1382
e.setAttribute("name", name)
1472
1383
e.setAttribute("type", prop._dbus_signature)
1473
1384
e.setAttribute("access", prop._dbus_access)
1474
1385
return e
1475
1386
1476
1387
for if_tag in document.getElementsByTagName("interface"):
1477
1388
# Add property tags
1478
1389
for tag in (make_tag(document, name, prop)
1520
1431
exc_info=error)
1521
1432
return xmlstring
1522
1433
1523
1524
1434
try:
1525
1435
dbus.OBJECT_MANAGER_IFACE
1526
1436
except AttributeError:
1527
1437
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1528
1438
1529
1530
1439
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1531
1440
"""A D-Bus object with an ObjectManager.
1532
1441
1533
1442
Classes inheriting from this exposes the standard
1534
1443
GetManagedObjects call and the InterfacesAdded and
1535
1444
InterfacesRemoved signals on the standard
1536
1445
"org.freedesktop.DBus.ObjectManager" interface.
1537
1446
1538
1447
Note: No signals are sent automatically; they must be sent
1539
1448
manually.
1540
1449
"""
1541
1450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1542
out_signature="a{oa{sa{sv}}}")
1451
out_signature = "a{oa{sa{sv}}}")
1543
1452
def GetManagedObjects(self):
1544
1453
"""This function must be overridden"""
1545
1454
raise NotImplementedError()
1546
1455
1547
1456
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1548
signature="oa{sa{sv}}")
1457
signature = "oa{sa{sv}}")
1549
1458
def InterfacesAdded(self, object_path, interfaces_and_properties):
1550
1459
pass
1551
1552
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1460
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1553
1462
def InterfacesRemoved(self, object_path, interfaces):
1554
1463
pass
1555
1464
1556
1465
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1557
out_signature="s",
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1560
1469
def Introspect(self, object_path, connection):
1561
1470
"""Overloading of standard D-Bus method.
1562
1471
1563
1472
Override return argument name of GetManagedObjects to be
1564
1473
"objpath_interfaces_and_properties"
1565
1474
"""
1568
1477
connection)
1569
1478
try:
1570
1479
document = xml.dom.minidom.parseString(xmlstring)
1571
1480
1572
1481
for if_tag in document.getElementsByTagName("interface"):
1573
1482
# Fix argument name for the GetManagedObjects method
1574
1483
if (if_tag.getAttribute("name")
1575
== dbus.OBJECT_MANAGER_IFACE):
1484
== dbus.OBJECT_MANAGER_IFACE):
1576
1485
for cn in if_tag.getElementsByTagName("method"):
1577
1486
if (cn.getAttribute("name")
1578
1487
== "GetManagedObjects"):
1588
1497
except (AttributeError, xml.dom.DOMException,
1589
1498
xml.parsers.expat.ExpatError) as error:
1590
1499
logger.error("Failed to override Introspection method",
1591
exc_info=error)
1500
exc_info = error)
1592
1501
return xmlstring
1593
1502
1594
1595
1503
def datetime_to_dbus(dt, variant_level=0):
1596
1504
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1597
1505
if dt is None:
1598
return dbus.String("", variant_level=variant_level)
1506
return dbus.String("", variant_level = variant_level)
1599
1507
return dbus.String(dt.isoformat(), variant_level=variant_level)
1600
1508
1601
1509
1604
1512
dbus.service.Object, it will add alternate D-Bus attributes with
1605
1513
interface names according to the "alt_interface_names" mapping.
1606
1514
Usage:
1607
1515
1608
1516
@alternate_dbus_interfaces({"org.example.Interface":
1609
1517
"net.example.AlternateInterface"})
1610
1518
class SampleDBusObject(dbus.service.Object):
1611
1519
@dbus.service.method("org.example.Interface")
1612
1520
def SampleDBusMethod():
1613
1521
pass
1614
1522
1615
1523
The above "SampleDBusMethod" on "SampleDBusObject" will be
1616
1524
reachable via two interfaces: "org.example.Interface" and
1617
1525
"net.example.AlternateInterface", the latter of which will have
1618
1526
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1619
1527
"true", unless "deprecate" is passed with a False value.
1620
1528
1621
1529
This works for methods and signals, and also for D-Bus properties
1622
1530
(from DBusObjectWithProperties) and interfaces (from the
1623
1531
dbus_interface_annotations decorator).
1624
1532
"""
1625
1533
1626
1534
def wrapper(cls):
1627
1535
for orig_interface_name, alt_interface_name in (
1628
1536
alt_interface_names.items()):
1668
1576
attribute._dbus_annotations)
1669
1577
except AttributeError:
1670
1578
pass
1671
1672
1579
# Define a creator of a function to call both the
1673
1580
# original and alternate functions, so both the
1674
1581
# original and alternate signals gets sent when
1677
1584
"""This function is a scope container to pass
1678
1585
func1 and func2 to the "call_both" function
1679
1586
outside of its arguments"""
1680
1587
1681
1588
@functools.wraps(func2)
1682
1589
def call_both(*args, **kwargs):
1683
1590
"""This function will emit two D-Bus
1684
1591
signals by calling func1 and func2"""
1685
1592
func1(*args, **kwargs)
1686
1593
func2(*args, **kwargs)
1687
# Make wrapper function look like a D-Bus
1688
# signal
1594
# Make wrapper function look like a D-Bus signal
1689
1595
for name, attr in inspect.getmembers(func2):
1690
1596
if name.startswith("_dbus_"):
1691
1597
setattr(call_both, name, attr)
1692
1598
1693
1599
return call_both
1694
1600
# Create the "call_both" function and add it to
1695
1601
# the class
1741
1647
(copy_function(attribute)))
1742
1648
if deprecate:
1743
1649
# Deprecate all alternate interfaces
1744
iname = "_AlternateDBusNames_interface_annotation{}"
1650
iname="_AlternateDBusNames_interface_annotation{}"
1745
1651
for interface_name in interface_names:
1746
1652
1747
1653
@dbus_interface_annotations(interface_name)
1748
1654
def func(self):
1749
return {"org.freedesktop.DBus.Deprecated":
1750
"true"}
1655
return { "org.freedesktop.DBus.Deprecated":
1656
"true" }
1751
1657
# Find an unused name
1752
1658
for aname in (iname.format(i)
1753
1659
for i in itertools.count()):
1764
1670
cls = type("{}Alternate".format(cls.__name__),
1765
1671
(cls, ), attr)
1766
1672
return cls
1767
1673
1768
1674
return wrapper
1769
1675
1770
1676
1772
1678
"se.bsnet.fukt.Mandos"})
1773
1679
class ClientDBus(Client, DBusObjectWithProperties):
1774
1680
"""A Client class using D-Bus
1775
1681
1776
1682
Attributes:
1777
1683
dbus_object_path: dbus.ObjectPath
1778
1684
bus: dbus.SystemBus()
1779
1685
"""
1780
1686
1781
1687
runtime_expansions = (Client.runtime_expansions
1782
1688
+ ("dbus_object_path", ))
1783
1689
1784
1690
_interface = "se.recompile.Mandos.Client"
1785
1691
1786
1692
# dbus.service.Object doesn't use super(), so we can't either.
1787
1788
def __init__(self, bus=None, *args, **kwargs):
1693
1694
def __init__(self, bus = None, *args, **kwargs):
1789
1695
self.bus = bus
1790
1696
Client.__init__(self, *args, **kwargs)
1791
1697
# Only now, when this client is initialized, can it show up on
1797
1703
"/clients/" + client_object_name)
1798
1704
DBusObjectWithProperties.__init__(self, self.bus,
1799
1705
self.dbus_object_path)
1800
1706
1801
1707
def notifychangeproperty(transform_func, dbus_name,
1802
1708
type_func=lambda x: x,
1803
1709
variant_level=1,
1805
1711
_interface=_interface):
1806
1712
""" Modify a variable so that it's a property which announces
1807
1713
its changes to DBus.
1808
1714
1809
1715
transform_fun: Function that takes a value and a variant_level
1810
1716
and transforms it to a D-Bus type.
1811
1717
dbus_name: D-Bus name of the variable
1814
1720
variant_level: D-Bus variant level. Default: 1
1815
1721
"""
1816
1722
attrname = "_{}".format(dbus_name)
1817
1723
1818
1724
def setter(self, value):
1819
1725
if hasattr(self, "dbus_object_path"):
1820
1726
if (not hasattr(self, attrname) or
1827
1733
else:
1828
1734
dbus_value = transform_func(
1829
1735
type_func(value),
1830
variant_level=variant_level)
1736
variant_level = variant_level)
1831
1737
self.PropertyChanged(dbus.String(dbus_name),
1832
1738
dbus_value)
1833
1739
self.PropertiesChanged(
1834
1740
_interface,
1835
dbus.Dictionary({dbus.String(dbus_name):
1836
dbus_value}),
1741
dbus.Dictionary({ dbus.String(dbus_name):
1742
dbus_value }),
1837
1743
dbus.Array())
1838
1744
setattr(self, attrname, value)
1839
1745
1840
1746
return property(lambda self: getattr(self, attrname), setter)
1841
1747
1842
1748
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1843
1749
approvals_pending = notifychangeproperty(dbus.Boolean,
1844
1750
"ApprovalPending",
1845
type_func=bool)
1751
type_func = bool)
1846
1752
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1847
1753
last_enabled = notifychangeproperty(datetime_to_dbus,
1848
1754
"LastEnabled")
1849
1755
checker = notifychangeproperty(
1850
1756
dbus.Boolean, "CheckerRunning",
1851
type_func=lambda checker: checker is not None)
1757
type_func = lambda checker: checker is not None)
1852
1758
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1853
1759
"LastCheckedOK")
1854
1760
last_checker_status = notifychangeproperty(dbus.Int16,
1859
1765
"ApprovedByDefault")
1860
1766
approval_delay = notifychangeproperty(
1861
1767
dbus.UInt64, "ApprovalDelay",
1862
type_func=lambda td: td.total_seconds() * 1000)
1768
type_func = lambda td: td.total_seconds() * 1000)
1863
1769
approval_duration = notifychangeproperty(
1864
1770
dbus.UInt64, "ApprovalDuration",
1865
type_func=lambda td: td.total_seconds() * 1000)
1771
type_func = lambda td: td.total_seconds() * 1000)
1866
1772
host = notifychangeproperty(dbus.String, "Host")
1867
1773
timeout = notifychangeproperty(
1868
1774
dbus.UInt64, "Timeout",
1869
type_func=lambda td: td.total_seconds() * 1000)
1775
type_func = lambda td: td.total_seconds() * 1000)
1870
1776
extended_timeout = notifychangeproperty(
1871
1777
dbus.UInt64, "ExtendedTimeout",
1872
type_func=lambda td: td.total_seconds() * 1000)
1778
type_func = lambda td: td.total_seconds() * 1000)
1873
1779
interval = notifychangeproperty(
1874
1780
dbus.UInt64, "Interval",
1875
type_func=lambda td: td.total_seconds() * 1000)
1781
type_func = lambda td: td.total_seconds() * 1000)
1876
1782
checker_command = notifychangeproperty(dbus.String, "Checker")
1877
1783
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1878
1784
invalidate_only=True)
1879
1785
1880
1786
del notifychangeproperty
1881
1787
1882
1788
def __del__(self, *args, **kwargs):
1883
1789
try:
1884
1790
self.remove_from_connection()
1887
1793
if hasattr(DBusObjectWithProperties, "__del__"):
1888
1794
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1889
1795
Client.__del__(self, *args, **kwargs)
1890
1796
1891
1797
def checker_callback(self, source, condition,
1892
1798
connection, command, *args, **kwargs):
1893
1799
ret = Client.checker_callback(self, source, condition,
1909
1815
| self.last_checker_signal),
1910
1816
dbus.String(command))
1911
1817
return ret
1912
1818
1913
1819
def start_checker(self, *args, **kwargs):
1914
1820
old_checker_pid = getattr(self.checker, "pid", None)
1915
1821
r = Client.start_checker(self, *args, **kwargs)
1919
1825
# Emit D-Bus signal
1920
1826
self.CheckerStarted(self.current_checker_command)
1921
1827
return r
1922
1828
1923
1829
def _reset_approved(self):
1924
1830
self.approved = None
1925
1831
return False
1926
1832
1927
1833
def approve(self, value=True):
1928
1834
self.approved = value
1929
GLib.timeout_add(int(self.approval_duration.total_seconds()
1930
* 1000), self._reset_approved)
1835
GObject.timeout_add(int(self.approval_duration.total_seconds()
1836
* 1000), self._reset_approved)
1931
1837
self.send_changedstate()
1932
1933
# D-Bus methods, signals & properties
1934
1935
# Interfaces
1936
1937
# Signals
1938
1838
1839
## D-Bus methods, signals & properties
1840
1841
## Interfaces
1842
1843
## Signals
1844
1939
1845
# CheckerCompleted - signal
1940
1846
@dbus.service.signal(_interface, signature="nxs")
1941
1847
def CheckerCompleted(self, exitcode, waitstatus, command):
1942
1848
"D-Bus signal"
1943
1849
pass
1944
1850
1945
1851
# CheckerStarted - signal
1946
1852
@dbus.service.signal(_interface, signature="s")
1947
1853
def CheckerStarted(self, command):
1948
1854
"D-Bus signal"
1949
1855
pass
1950
1856
1951
1857
# PropertyChanged - signal
1952
1858
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1953
1859
@dbus.service.signal(_interface, signature="sv")
1954
1860
def PropertyChanged(self, property, value):
1955
1861
"D-Bus signal"
1956
1862
pass
1957
1863
1958
1864
# GotSecret - signal
1959
1865
@dbus.service.signal(_interface)
1960
1866
def GotSecret(self):
1963
1869
server to mandos-client
1964
1870
"""
1965
1871
pass
1966
1872
1967
1873
# Rejected - signal
1968
1874
@dbus.service.signal(_interface, signature="s")
1969
1875
def Rejected(self, reason):
1970
1876
"D-Bus signal"
1971
1877
pass
1972
1878
1973
1879
# NeedApproval - signal
1974
1880
@dbus.service.signal(_interface, signature="tb")
1975
1881
def NeedApproval(self, timeout, default):
1976
1882
"D-Bus signal"
1977
1883
return self.need_approval()
1978
1979
# Methods
1980
1884
1885
## Methods
1886
1981
1887
# Approve - method
1982
1888
@dbus.service.method(_interface, in_signature="b")
1983
1889
def Approve(self, value):
1984
1890
self.approve(value)
1985
1891
1986
1892
# CheckedOK - method
1987
1893
@dbus.service.method(_interface)
1988
1894
def CheckedOK(self):
1989
1895
self.checked_ok()
1990
1896
1991
1897
# Enable - method
1992
1898
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1993
1899
@dbus.service.method(_interface)
1994
1900
def Enable(self):
1995
1901
"D-Bus method"
1996
1902
self.enable()
1997
1903
1998
1904
# StartChecker - method
1999
1905
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2000
1906
@dbus.service.method(_interface)
2001
1907
def StartChecker(self):
2002
1908
"D-Bus method"
2003
1909
self.start_checker()
2004
1910
2005
1911
# Disable - method
2006
1912
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2007
1913
@dbus.service.method(_interface)
2008
1914
def Disable(self):
2009
1915
"D-Bus method"
2010
1916
self.disable()
2011
1917
2012
1918
# StopChecker - method
2013
1919
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2014
1920
@dbus.service.method(_interface)
2015
1921
def StopChecker(self):
2016
1922
self.stop_checker()
2017
2018
# Properties
2019
1923
1924
## Properties
1925
2020
1926
# ApprovalPending - property
2021
1927
@dbus_service_property(_interface, signature="b", access="read")
2022
1928
def ApprovalPending_dbus_property(self):
2023
1929
return dbus.Boolean(bool(self.approvals_pending))
2024
1930
2025
1931
# ApprovedByDefault - property
2026
1932
@dbus_service_property(_interface,
2027
1933
signature="b",
2030
1936
if value is None: # get
2031
1937
return dbus.Boolean(self.approved_by_default)
2032
1938
self.approved_by_default = bool(value)
2033
1939
2034
1940
# ApprovalDelay - property
2035
1941
@dbus_service_property(_interface,
2036
1942
signature="t",
2040
1946
return dbus.UInt64(self.approval_delay.total_seconds()
2041
1947
* 1000)
2042
1948
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2043
1949
2044
1950
# ApprovalDuration - property
2045
1951
@dbus_service_property(_interface,
2046
1952
signature="t",
2050
1956
return dbus.UInt64(self.approval_duration.total_seconds()
2051
1957
* 1000)
2052
1958
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2053
1959
2054
1960
# Name - property
2055
1961
@dbus_annotations(
2056
1962
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2057
1963
@dbus_service_property(_interface, signature="s", access="read")
2058
1964
def Name_dbus_property(self):
2059
1965
return dbus.String(self.name)
2060
2061
# KeyID - property
2062
@dbus_annotations(
2063
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2064
@dbus_service_property(_interface, signature="s", access="read")
2065
def KeyID_dbus_property(self):
2066
return dbus.String(self.key_id)
2067
1966
2068
1967
# Fingerprint - property
2069
1968
@dbus_annotations(
2070
1969
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2071
1970
@dbus_service_property(_interface, signature="s", access="read")
2072
1971
def Fingerprint_dbus_property(self):
2073
1972
return dbus.String(self.fingerprint)
2074
1973
2075
1974
# Host - property
2076
1975
@dbus_service_property(_interface,
2077
1976
signature="s",
2080
1979
if value is None: # get
2081
1980
return dbus.String(self.host)
2082
1981
self.host = str(value)
2083
1982
2084
1983
# Created - property
2085
1984
@dbus_annotations(
2086
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2087
1986
@dbus_service_property(_interface, signature="s", access="read")
2088
1987
def Created_dbus_property(self):
2089
1988
return datetime_to_dbus(self.created)
2090
1989
2091
1990
# LastEnabled - property
2092
1991
@dbus_service_property(_interface, signature="s", access="read")
2093
1992
def LastEnabled_dbus_property(self):
2094
1993
return datetime_to_dbus(self.last_enabled)
2095
1994
2096
1995
# Enabled - property
2097
1996
@dbus_service_property(_interface,
2098
1997
signature="b",
2104
2003
self.enable()
2105
2004
else:
2106
2005
self.disable()
2107
2006
2108
2007
# LastCheckedOK - property
2109
2008
@dbus_service_property(_interface,
2110
2009
signature="s",
2114
2013
self.checked_ok()
2115
2014
return
2116
2015
return datetime_to_dbus(self.last_checked_ok)
2117
2016
2118
2017
# LastCheckerStatus - property
2119
2018
@dbus_service_property(_interface, signature="n", access="read")
2120
2019
def LastCheckerStatus_dbus_property(self):
2121
2020
return dbus.Int16(self.last_checker_status)
2122
2021
2123
2022
# Expires - property
2124
2023
@dbus_service_property(_interface, signature="s", access="read")
2125
2024
def Expires_dbus_property(self):
2126
2025
return datetime_to_dbus(self.expires)
2127
2026
2128
2027
# LastApprovalRequest - property
2129
2028
@dbus_service_property(_interface, signature="s", access="read")
2130
2029
def LastApprovalRequest_dbus_property(self):
2131
2030
return datetime_to_dbus(self.last_approval_request)
2132
2031
2133
2032
# Timeout - property
2134
2033
@dbus_service_property(_interface,
2135
2034
signature="t",
2150
2049
if (getattr(self, "disable_initiator_tag", None)
2151
2050
is None):
2152
2051
return
2153
GLib.source_remove(self.disable_initiator_tag)
2154
self.disable_initiator_tag = GLib.timeout_add(
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2155
2054
int((self.expires - now).total_seconds() * 1000),
2156
2055
self.disable)
2157
2056
2158
2057
# ExtendedTimeout - property
2159
2058
@dbus_service_property(_interface,
2160
2059
signature="t",
2164
2063
return dbus.UInt64(self.extended_timeout.total_seconds()
2165
2064
* 1000)
2166
2065
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2167
2066
2168
2067
# Interval - property
2169
2068
@dbus_service_property(_interface,
2170
2069
signature="t",
2177
2076
return
2178
2077
if self.enabled:
2179
2078
# Reschedule checker run
2180
GLib.source_remove(self.checker_initiator_tag)
2181
self.checker_initiator_tag = GLib.timeout_add(
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2182
2081
value, self.start_checker)
2183
self.start_checker() # Start one now, too
2184
2082
self.start_checker() # Start one now, too
2083
2185
2084
# Checker - property
2186
2085
@dbus_service_property(_interface,
2187
2086
signature="s",
2190
2089
if value is None: # get
2191
2090
return dbus.String(self.checker_command)
2192
2091
self.checker_command = str(value)
2193
2092
2194
2093
# CheckerRunning - property
2195
2094
@dbus_service_property(_interface,
2196
2095
signature="b",
2202
2101
self.start_checker()
2203
2102
else:
2204
2103
self.stop_checker()
2205
2104
2206
2105
# ObjectPath - property
2207
2106
@dbus_annotations(
2208
2107
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2209
2108
"org.freedesktop.DBus.Deprecated": "true"})
2210
2109
@dbus_service_property(_interface, signature="o", access="read")
2211
2110
def ObjectPath_dbus_property(self):
2212
return self.dbus_object_path # is already a dbus.ObjectPath
2213
2111
return self.dbus_object_path # is already a dbus.ObjectPath
2112
2214
2113
# Secret = property
2215
2114
@dbus_annotations(
2216
2115
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2221
2120
byte_arrays=True)
2222
2121
def Secret_dbus_property(self, value):
2223
2122
self.secret = bytes(value)
2224
2123
2225
2124
del _interface
2226
2125
2227
2126
2228
class ProxyClient:
2229
def __init__(self, child_pipe, key_id, fpr, address):
2127
class ProxyClient(object):
2128
def __init__(self, child_pipe, fpr, address):
2230
2129
self._pipe = child_pipe
2231
self._pipe.send(('init', key_id, fpr, address))
2130
self._pipe.send(('init', fpr, address))
2232
2131
if not self._pipe.recv():
2233
raise KeyError(key_id or fpr)
2234
2132
raise KeyError(fpr)
2133
2235
2134
def __getattribute__(self, name):
2236
2135
if name == '_pipe':
2237
2136
return super(ProxyClient, self).__getattribute__(name)
2240
2139
if data[0] == 'data':
2241
2140
return data[1]
2242
2141
if data[0] == 'function':
2243
2142
2244
2143
def func(*args, **kwargs):
2245
2144
self._pipe.send(('funcall', name, args, kwargs))
2246
2145
return self._pipe.recv()[1]
2247
2146
2248
2147
return func
2249
2148
2250
2149
def __setattr__(self, name, value):
2251
2150
if name == '_pipe':
2252
2151
return super(ProxyClient, self).__setattr__(name, value)
2255
2154
2256
2155
class ClientHandler(socketserver.BaseRequestHandler, object):
2257
2156
"""A class to handle client connections.
2258
2157
2259
2158
Instantiated once for each connection to handle it.
2260
2159
Note: This will run in its own forked process."""
2261
2160
2262
2161
def handle(self):
2263
2162
with contextlib.closing(self.server.child_pipe) as child_pipe:
2264
2163
logger.info("TCP connection from: %s",
2265
2164
str(self.client_address))
2266
2165
logger.debug("Pipe FD: %d",
2267
2166
self.server.child_pipe.fileno())
2268
2167
2269
2168
session = gnutls.ClientSession(self.request)
2270
2271
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2272
# "+AES-256-CBC", "+SHA1",
2273
# "+COMP-NULL", "+CTYPE-OPENPGP",
2274
# "+DHE-DSS"))
2169
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2173
# "+DHE-DSS"))
2275
2174
# Use a fallback default, since this MUST be set.
2276
2175
priority = self.server.gnutls_priority
2277
2176
if priority is None:
2278
2177
priority = "NORMAL"
2279
gnutls.priority_set_direct(session._c_object,
2280
priority.encode("utf-8"),
2178
gnutls.priority_set_direct(session._c_object, priority,
2281
2179
None)
2282
2180
2283
2181
# Start communication using the Mandos protocol
2284
2182
# Get protocol number
2285
2183
line = self.request.makefile().readline()
2290
2188
except (ValueError, IndexError, RuntimeError) as error:
2291
2189
logger.error("Unknown protocol version: %s", error)
2292
2190
return
2293
2191
2294
2192
# Start GnuTLS connection
2295
2193
try:
2296
2194
session.handshake()
2300
2198
# established. Just abandon the request.
2301
2199
return
2302
2200
logger.debug("Handshake succeeded")
2303
2201
2304
2202
approval_required = False
2305
2203
try:
2306
if gnutls.has_rawpk:
2307
fpr = b""
2308
try:
2309
key_id = self.key_id(
2310
self.peer_certificate(session))
2311
except (TypeError, gnutls.Error) as error:
2312
logger.warning("Bad certificate: %s", error)
2313
return
2314
logger.debug("Key ID: %s", key_id)
2315
2316
else:
2317
key_id = b""
2318
try:
2319
fpr = self.fingerprint(
2320
self.peer_certificate(session))
2321
except (TypeError, gnutls.Error) as error:
2322
logger.warning("Bad certificate: %s", error)
2323
return
2324
logger.debug("Fingerprint: %s", fpr)
2325
2326
try:
2327
client = ProxyClient(child_pipe, key_id, fpr,
2204
try:
2205
fpr = self.fingerprint(
2206
self.peer_certificate(session))
2207
except (TypeError, gnutls.Error) as error:
2208
logger.warning("Bad certificate: %s", error)
2209
return
2210
logger.debug("Fingerprint: %s", fpr)
2211
2212
try:
2213
client = ProxyClient(child_pipe, fpr,
2328
2214
self.client_address)
2329
2215
except KeyError:
2330
2216
return
2331
2217
2332
2218
if client.approval_delay:
2333
2219
delay = client.approval_delay
2334
2220
client.approvals_pending += 1
2335
2221
approval_required = True
2336
2222
2337
2223
while True:
2338
2224
if not client.enabled:
2339
2225
logger.info("Client %s is disabled",
2342
2228
# Emit D-Bus signal
2343
2229
client.Rejected("Disabled")
2344
2230
return
2345
2231
2346
2232
if client.approved or not client.approval_delay:
2347
# We are approved or approval is disabled
2233
#We are approved or approval is disabled
2348
2234
break
2349
2235
elif client.approved is None:
2350
2236
logger.info("Client %s needs approval",
2361
2247
# Emit D-Bus signal
2362
2248
client.Rejected("Denied")
2363
2249
return
2364
2365
# wait until timeout or approved
2250
2251
#wait until timeout or approved
2366
2252
time = datetime.datetime.now()
2367
2253
client.changedstate.acquire()
2368
2254
client.changedstate.wait(delay.total_seconds())
2381
2267
break
2382
2268
else:
2383
2269
delay -= time2 - time
2384
2270
2385
2271
try:
2386
2272
session.send(client.secret)
2387
2273
except gnutls.Error as error:
2388
2274
logger.warning("gnutls send failed",
2389
exc_info=error)
2275
exc_info = error)
2390
2276
return
2391
2277
2392
2278
logger.info("Sending secret to %s", client.name)
2393
2279
# bump the timeout using extended_timeout
2394
2280
client.bump_timeout(client.extended_timeout)
2395
2281
if self.server.use_dbus:
2396
2282
# Emit D-Bus signal
2397
2283
client.GotSecret()
2398
2284
2399
2285
finally:
2400
2286
if approval_required:
2401
2287
client.approvals_pending -= 1
2404
2290
except gnutls.Error as error:
2405
2291
logger.warning("GnuTLS bye failed",
2406
2292
exc_info=error)
2407
2293
2408
2294
@staticmethod
2409
2295
def peer_certificate(session):
2410
"Return the peer's certificate as a bytestring"
2411
try:
2412
cert_type = gnutls.certificate_type_get2(session._c_object,
2413
gnutls.CTYPE_PEERS)
2414
except AttributeError:
2415
cert_type = gnutls.certificate_type_get(session._c_object)
2416
if gnutls.has_rawpk:
2417
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2418
else:
2419
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2420
# If not a valid certificate type...
2421
if cert_type not in valid_cert_types:
2422
logger.info("Cert type %r not in %r", cert_type,
2423
valid_cert_types)
2296
"Return the peer's OpenPGP certificate as a bytestring"
2297
# If not an OpenPGP certificate...
2298
if (gnutls.certificate_type_get(session._c_object)
2299
!= gnutls.CRT_OPENPGP):
2424
2300
# ...return invalid data
2425
2301
return b""
2426
2302
list_size = ctypes.c_uint(1)
2432
2308
return None
2433
2309
cert = cert_list[0]
2434
2310
return ctypes.string_at(cert.data, cert.size)
2435
2436
@staticmethod
2437
def key_id(certificate):
2438
"Convert a certificate bytestring to a hexdigit key ID"
2439
# New GnuTLS "datum" with the public key
2440
datum = gnutls.datum_t(
2441
ctypes.cast(ctypes.c_char_p(certificate),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.c_uint(len(certificate)))
2444
# XXX all these need to be created in the gnutls "module"
2445
# New empty GnuTLS certificate
2446
pubkey = gnutls.pubkey_t()
2447
gnutls.pubkey_init(ctypes.byref(pubkey))
2448
# Import the raw public key into the certificate
2449
gnutls.pubkey_import(pubkey,
2450
ctypes.byref(datum),
2451
gnutls.X509_FMT_DER)
2452
# New buffer for the key ID
2453
buf = ctypes.create_string_buffer(32)
2454
buf_len = ctypes.c_size_t(len(buf))
2455
# Get the key ID from the raw public key into the buffer
2456
gnutls.pubkey_get_key_id(pubkey,
2457
gnutls.KEYID_USE_SHA256,
2458
ctypes.cast(ctypes.byref(buf),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.byref(buf_len))
2461
# Deinit the certificate
2462
gnutls.pubkey_deinit(pubkey)
2463
2464
# Convert the buffer to a Python bytestring
2465
key_id = ctypes.string_at(buf, buf_len.value)
2466
# Convert the bytestring to hexadecimal notation
2467
hex_key_id = binascii.hexlify(key_id).upper()
2468
return hex_key_id
2469
2311
2470
2312
@staticmethod
2471
2313
def fingerprint(openpgp):
2472
2314
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2487
2329
ctypes.byref(crtverify))
2488
2330
if crtverify.value != 0:
2489
2331
gnutls.openpgp_crt_deinit(crt)
2490
raise gnutls.CertificateSecurityError(code
2491
=crtverify.value)
2332
raise gnutls.CertificateSecurityError("Verify failed")
2492
2333
# New buffer for the fingerprint
2493
2334
buf = ctypes.create_string_buffer(20)
2494
2335
buf_len = ctypes.c_size_t()
2504
2345
return hex_fpr
2505
2346
2506
2347
2507
class MultiprocessingMixIn:
2348
class MultiprocessingMixIn(object):
2508
2349
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2509
2350
2510
2351
def sub_process_main(self, request, address):
2511
2352
try:
2512
2353
self.finish_request(request, address)
2513
2354
except Exception:
2514
2355
self.handle_error(request, address)
2515
2356
self.close_request(request)
2516
2357
2517
2358
def process_request(self, request, address):
2518
2359
"""Start a new process to process the request."""
2519
proc = multiprocessing.Process(target=self.sub_process_main,
2520
args=(request, address))
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2521
2362
proc.start()
2522
2363
return proc
2523
2364
2524
2365
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2526
2367
""" adds a pipe to the MixIn """
2527
2368
2528
2369
def process_request(self, request, client_address):
2529
2370
"""Overrides and wraps the original process_request().
2530
2371
2531
2372
This function creates a new pipe in self.pipe
2532
2373
"""
2533
2374
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2534
2375
2535
2376
proc = MultiprocessingMixIn.process_request(self, request,
2536
2377
client_address)
2537
2378
self.child_pipe.close()
2538
2379
self.add_pipe(parent_pipe, proc)
2539
2380
2540
2381
def add_pipe(self, parent_pipe, proc):
2541
2382
"""Dummy function; override as necessary"""
2542
2383
raise NotImplementedError()
2543
2384
2544
2385
2545
2386
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2546
socketserver.TCPServer):
2387
socketserver.TCPServer, object):
2547
2388
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2548
2389
2549
2390
Attributes:
2550
2391
enabled: Boolean; whether this server is activated yet
2551
2392
interface: None or a network interface name (string)
2552
2393
use_ipv6: Boolean; to use IPv6 or not
2553
2394
"""
2554
2395
2555
2396
def __init__(self, server_address, RequestHandlerClass,
2556
2397
interface=None,
2557
2398
use_ipv6=True,
2567
2408
self.socketfd = socketfd
2568
2409
# Save the original socket.socket() function
2569
2410
self.socket_socket = socket.socket
2570
2571
2411
# To implement --socket, we monkey patch socket.socket.
2572
#
2412
#
2573
2413
# (When socketserver.TCPServer is a new-style class, we
2574
2414
# could make self.socket into a property instead of monkey
2575
2415
# patching socket.socket.)
2576
#
2416
#
2577
2417
# Create a one-time-only replacement for socket.socket()
2578
2418
@functools.wraps(socket.socket)
2579
2419
def socket_wrapper(*args, **kwargs):
2591
2431
# socket_wrapper(), if socketfd was set.
2592
2432
socketserver.TCPServer.__init__(self, server_address,
2593
2433
RequestHandlerClass)
2594
2434
2595
2435
def server_bind(self):
2596
2436
"""This overrides the normal server_bind() function
2597
2437
to bind to an interface if one was specified, and also NOT to
2598
2438
bind to an address or port if they were not specified."""
2599
global SO_BINDTODEVICE
2600
2439
if self.interface is not None:
2601
2440
if SO_BINDTODEVICE is None:
2602
# Fall back to a hard-coded value which seems to be
2603
# common enough.
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2605
SO_BINDTODEVICE = 25
2606
try:
2607
self.socket.setsockopt(
2608
socket.SOL_SOCKET, SO_BINDTODEVICE,
2609
(self.interface + "\0").encode("utf-8"))
2610
except socket.error as error:
2611
if error.errno == errno.EPERM:
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2614
elif error.errno == errno.ENOPROTOOPT:
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2617
self.interface)
2618
elif error.errno == errno.ENODEV:
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2621
else:
2622
raise
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2443
self.interface)
2444
else:
2445
try:
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2456
self.interface)
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2460
else:
2461
raise
2623
2462
# Only bind(2) the socket if we really need to.
2624
2463
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2627
2464
if not self.server_address[0]:
2628
2465
if self.address_family == socket.AF_INET6:
2629
any_address = "::" # in6addr_any
2466
any_address = "::" # in6addr_any
2630
2467
else:
2631
any_address = "0.0.0.0" # INADDR_ANY
2468
any_address = "0.0.0.0" # INADDR_ANY
2632
2469
self.server_address = (any_address,
2633
2470
self.server_address[1])
2634
2471
elif not self.server_address[1]:
2644
2481
2645
2482
class MandosServer(IPv6_TCPServer):
2646
2483
"""Mandos server.
2647
2484
2648
2485
Attributes:
2649
2486
clients: set of Client objects
2650
2487
gnutls_priority GnuTLS priority string
2651
2488
use_dbus: Boolean; to emit D-Bus signals or not
2652
2653
Assumes a GLib.MainLoop event loop.
2489
2490
Assumes a GObject.MainLoop event loop.
2654
2491
"""
2655
2492
2656
2493
def __init__(self, server_address, RequestHandlerClass,
2657
2494
interface=None,
2658
2495
use_ipv6=True,
2668
2505
self.gnutls_priority = gnutls_priority
2669
2506
IPv6_TCPServer.__init__(self, server_address,
2670
2507
RequestHandlerClass,
2671
interface=interface,
2672
use_ipv6=use_ipv6,
2673
socketfd=socketfd)
2674
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2511
2675
2512
def server_activate(self):
2676
2513
if self.enabled:
2677
2514
return socketserver.TCPServer.server_activate(self)
2678
2515
2679
2516
def enable(self):
2680
2517
self.enabled = True
2681
2518
2682
2519
def add_pipe(self, parent_pipe, proc):
2683
2520
# Call "handle_ipc" for both data and EOF events
2684
GLib.io_add_watch(
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2521
GObject.io_add_watch(
2522
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2687
2524
functools.partial(self.handle_ipc,
2688
parent_pipe=parent_pipe,
2689
proc=proc))
2690
2525
parent_pipe = parent_pipe,
2526
proc = proc))
2527
2691
2528
def handle_ipc(self, source, condition,
2692
2529
parent_pipe=None,
2693
proc=None,
2530
proc = None,
2694
2531
client_object=None):
2695
2532
# error, or the other end of multiprocessing.Pipe has closed
2696
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2697
2534
# Wait for other process to exit
2698
2535
proc.join()
2699
2536
return False
2700
2537
2701
2538
# Read a request from the child
2702
2539
request = parent_pipe.recv()
2703
2540
command = request[0]
2704
2541
2705
2542
if command == 'init':
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2709
2543
fpr = request[1]
2544
address = request[2]
2545
2710
2546
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2712
continue
2713
if key_id and c.key_id == key_id:
2714
client = c
2715
break
2716
if fpr and c.fingerprint == fpr:
2547
if c.fingerprint == fpr:
2717
2548
client = c
2718
2549
break
2719
2550
else:
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2722
2553
if self.use_dbus:
2723
2554
# Emit D-Bus signal
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2555
mandos_dbus_service.ClientNotFound(fpr,
2725
2556
address[0])
2726
2557
parent_pipe.send(False)
2727
2558
return False
2728
2729
GLib.io_add_watch(
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2559
2560
GObject.io_add_watch(
2561
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2732
2563
functools.partial(self.handle_ipc,
2733
parent_pipe=parent_pipe,
2734
proc=proc,
2735
client_object=client))
2564
parent_pipe = parent_pipe,
2565
proc = proc,
2566
client_object = client))
2736
2567
parent_pipe.send(True)
2737
2568
# remove the old hook in favor of the new above hook on
2738
2569
# same fileno
2741
2572
funcname = request[1]
2742
2573
args = request[2]
2743
2574
kwargs = request[3]
2744
2575
2745
2576
parent_pipe.send(('data', getattr(client_object,
2746
2577
funcname)(*args,
2747
2578
**kwargs)))
2748
2579
2749
2580
if command == 'getattr':
2750
2581
attrname = request[1]
2751
2582
if isinstance(client_object.__getattribute__(attrname),
2754
2585
else:
2755
2586
parent_pipe.send((
2756
2587
'data', client_object.__getattribute__(attrname)))
2757
2588
2758
2589
if command == 'setattr':
2759
2590
attrname = request[1]
2760
2591
value = request[2]
2761
2592
setattr(client_object, attrname, value)
2762
2593
2763
2594
return True
2764
2595
2765
2596
2766
2597
def rfc3339_duration_to_delta(duration):
2767
2598
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2768
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
True
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
True
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
True
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
True
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
True
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
True
2599
2600
>>> rfc3339_duration_to_delta("P7D")
2601
datetime.timedelta(7)
2602
>>> rfc3339_duration_to_delta("PT60S")
2603
datetime.timedelta(0, 60)
2604
>>> rfc3339_duration_to_delta("PT60M")
2605
datetime.timedelta(0, 3600)
2606
>>> rfc3339_duration_to_delta("PT24H")
2607
datetime.timedelta(1)
2608
>>> rfc3339_duration_to_delta("P1W")
2609
datetime.timedelta(7)
2610
>>> rfc3339_duration_to_delta("PT5M30S")
2611
datetime.timedelta(0, 330)
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
datetime.timedelta(1, 200)
2783
2614
"""
2784
2615
2785
2616
# Parsing an RFC 3339 duration with regular expressions is not
2786
2617
# possible - there would have to be multiple places for the same
2787
2618
# values, like seconds. The current code, while more esoteric, is
2788
2619
# cleaner without depending on a parsing library. If Python had a
2789
2620
# built-in library for parsing we would use it, but we'd like to
2790
2621
# avoid excessive use of external libraries.
2791
2622
2792
2623
# New type for defining tokens, syntax, and semantics all-in-one
2793
2624
Token = collections.namedtuple("Token", (
2794
2625
"regexp", # To match token; if "value" is not None, must have
2827
2658
frozenset((token_year, token_month,
2828
2659
token_day, token_time,
2829
2660
token_week)))
2830
# Define starting values:
2831
# Value so far
2832
value = datetime.timedelta()
2661
# Define starting values
2662
value = datetime.timedelta() # Value so far
2833
2663
found_token = None
2834
# Following valid tokens
2835
followers = frozenset((token_duration, ))
2836
# String left to parse
2837
s = duration
2664
followers = frozenset((token_duration, )) # Following valid tokens
2665
s = duration # String left to parse
2838
2666
# Loop until end token is found
2839
2667
while found_token is not token_end:
2840
2668
# Search for any currently valid tokens
2864
2692
2865
2693
def string_to_delta(interval):
2866
2694
"""Parse a string and return a datetime.timedelta
2867
2868
>>> string_to_delta('7d') == datetime.timedelta(7)
2869
True
2870
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
True
2872
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
True
2874
>>> string_to_delta('24h') == datetime.timedelta(1)
2875
True
2876
>>> string_to_delta('1w') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2879
True
2695
2696
>>> string_to_delta('7d')
2697
datetime.timedelta(7)
2698
>>> string_to_delta('60s')
2699
datetime.timedelta(0, 60)
2700
>>> string_to_delta('60m')
2701
datetime.timedelta(0, 3600)
2702
>>> string_to_delta('24h')
2703
datetime.timedelta(1)
2704
>>> string_to_delta('1w')
2705
datetime.timedelta(7)
2706
>>> string_to_delta('5m 30s')
2707
datetime.timedelta(0, 330)
2880
2708
"""
2881
2709
2882
2710
try:
2883
2711
return rfc3339_duration_to_delta(interval)
2884
2712
except ValueError:
2885
2713
pass
2886
2714
2887
2715
timevalue = datetime.timedelta(0)
2888
2716
for s in interval.split():
2889
2717
try:
2907
2735
return timevalue
2908
2736
2909
2737
2910
def daemon(nochdir=False, noclose=False):
2738
def daemon(nochdir = False, noclose = False):
2911
2739
"""See daemon(3). Standard BSD Unix function.
2912
2740
2913
2741
This should really exist as os.daemon, but it doesn't (yet)."""
2914
2742
if os.fork():
2915
2743
sys.exit()
2933
2761
2934
2762
2935
2763
def main():
2936
2764
2937
2765
##################################################################
2938
2766
# Parsing of options, both command line and config file
2939
2767
2940
2768
parser = argparse.ArgumentParser()
2941
2769
parser.add_argument("-v", "--version", action="version",
2942
version="%(prog)s {}".format(version),
2770
version = "%(prog)s {}".format(version),
2943
2771
help="show version number and exit")
2944
2772
parser.add_argument("-i", "--interface", metavar="IF",
2945
2773
help="Bind to interface IF")
2981
2809
parser.add_argument("--no-zeroconf", action="store_false",
2982
2810
dest="zeroconf", help="Do not use Zeroconf",
2983
2811
default=None)
2984
2812
2985
2813
options = parser.parse_args()
2986
2814
2815
if options.check:
2816
import doctest
2817
fail_count, test_count = doctest.testmod()
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2819
2987
2820
# Default values for config file for server-global settings
2988
if gnutls.has_rawpk:
2989
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2990
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2991
else:
2992
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2993
":+SIGN-DSA-SHA256")
2994
server_defaults = {"interface": "",
2995
"address": "",
2996
"port": "",
2997
"debug": "False",
2998
"priority": priority,
2999
"servicename": "Mandos",
3000
"use_dbus": "True",
3001
"use_ipv6": "True",
3002
"debuglevel": "",
3003
"restore": "True",
3004
"socket": "",
3005
"statedir": "/var/lib/mandos",
3006
"foreground": "False",
3007
"zeroconf": "True",
3008
}
3009
del priority
3010
2821
server_defaults = { "interface": "",
2822
"address": "",
2823
"port": "",
2824
"debug": "False",
2825
"priority":
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2829
"use_dbus": "True",
2830
"use_ipv6": "True",
2831
"debuglevel": "",
2832
"restore": "True",
2833
"socket": "",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2836
"zeroconf": "True",
2837
}
2838
3011
2839
# Parse config file for server-global settings
3012
server_config = configparser.ConfigParser(server_defaults)
2840
server_config = configparser.SafeConfigParser(server_defaults)
3013
2841
del server_defaults
3014
2842
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3015
# Convert the ConfigParser object to a dict
2843
# Convert the SafeConfigParser object to a dict
3016
2844
server_settings = server_config.defaults()
3017
2845
# Use the appropriate methods on the non-string config options
3018
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3019
"foreground", "zeroconf"):
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3020
2847
server_settings[option] = server_config.getboolean("DEFAULT",
3021
2848
option)
3022
2849
if server_settings["port"]:
3032
2859
server_settings["socket"] = os.dup(server_settings
3033
2860
["socket"])
3034
2861
del server_config
3035
2862
3036
2863
# Override the settings from the config file with command line
3037
2864
# options, if set.
3038
2865
for option in ("interface", "address", "port", "debug",
3056
2883
if server_settings["debug"]:
3057
2884
server_settings["foreground"] = True
3058
2885
# Now we have our good server settings in "server_settings"
3059
2886
3060
2887
##################################################################
3061
2888
3062
2889
if (not server_settings["zeroconf"]
3063
2890
and not (server_settings["port"]
3064
2891
or server_settings["socket"] != "")):
3065
2892
parser.error("Needs port or socket to work without Zeroconf")
3066
2893
3067
2894
# For convenience
3068
2895
debug = server_settings["debug"]
3069
2896
debuglevel = server_settings["debuglevel"]
3073
2900
stored_state_file)
3074
2901
foreground = server_settings["foreground"]
3075
2902
zeroconf = server_settings["zeroconf"]
3076
2903
3077
2904
if debug:
3078
2905
initlogger(debug, logging.DEBUG)
3079
2906
else:
3082
2909
else:
3083
2910
level = getattr(logging, debuglevel.upper())
3084
2911
initlogger(debug, level)
3085
2912
3086
2913
if server_settings["servicename"] != "Mandos":
3087
2914
syslogger.setFormatter(
3088
2915
logging.Formatter('Mandos ({}) [%(process)d]:'
3089
2916
' %(levelname)s: %(message)s'.format(
3090
2917
server_settings["servicename"])))
3091
2918
3092
2919
# Parse config file with clients
3093
client_config = configparser.ConfigParser(Client.client_defaults)
2920
client_config = configparser.SafeConfigParser(Client
2921
.client_defaults)
3094
2922
client_config.read(os.path.join(server_settings["configdir"],
3095
2923
"clients.conf"))
3096
2924
3097
2925
global mandos_dbus_service
3098
2926
mandos_dbus_service = None
3099
2927
3100
2928
socketfd = None
3101
2929
if server_settings["socket"] != "":
3102
2930
socketfd = server_settings["socket"]
3118
2946
except IOError as e:
3119
2947
logger.error("Could not open file %r", pidfilename,
3120
2948
exc_info=e)
3121
2949
3122
2950
for name, group in (("_mandos", "_mandos"),
3123
2951
("mandos", "mandos"),
3124
2952
("nobody", "nogroup")):
3142
2970
.format(uid, gid, os.strerror(error.errno)))
3143
2971
if error.errno != errno.EPERM:
3144
2972
raise
3145
2973
3146
2974
if debug:
3147
2975
# Enable all possible GnuTLS debugging
3148
2976
3149
2977
# "Use a log level over 10 to enable all debugging options."
3150
2978
# - GnuTLS manual
3151
2979
gnutls.global_set_log_level(11)
3152
2980
3153
2981
@gnutls.log_func
3154
2982
def debug_gnutls(level, string):
3155
2983
logger.debug("GnuTLS: %s", string[:-1])
3156
2984
3157
2985
gnutls.global_set_log_function(debug_gnutls)
3158
2986
3159
2987
# Redirect stdin so all checkers get /dev/null
3160
2988
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3161
2989
os.dup2(null, sys.stdin.fileno())
3162
2990
if null > 2:
3163
2991
os.close(null)
3164
2992
3165
2993
# Need to fork before connecting to D-Bus
3166
2994
if not foreground:
3167
2995
# Close all input and output, do double fork, etc.
3168
2996
daemon()
3169
3170
if gi.version_info < (3, 10, 2):
3171
# multiprocessing will use threads, so before we use GLib we
3172
# need to inform GLib that threads will be used.
3173
GLib.threads_init()
3174
2997
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
3001
3175
3002
global main_loop
3176
3003
# From the Avahi example code
3177
3004
DBusGMainLoop(set_as_default=True)
3178
main_loop = GLib.MainLoop()
3005
main_loop = GObject.MainLoop()
3179
3006
bus = dbus.SystemBus()
3180
3007
# End of Avahi example code
3181
3008
if use_dbus:
3194
3021
if zeroconf:
3195
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3196
3023
service = AvahiServiceToSyslog(
3197
name=server_settings["servicename"],
3198
servicetype="_mandos._tcp",
3199
protocol=protocol,
3200
bus=bus)
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3027
bus = bus)
3201
3028
if server_settings["interface"]:
3202
3029
service.interface = if_nametoindex(
3203
3030
server_settings["interface"].encode("utf-8"))
3204
3031
3205
3032
global multiprocessing_manager
3206
3033
multiprocessing_manager = multiprocessing.Manager()
3207
3034
3208
3035
client_class = Client
3209
3036
if use_dbus:
3210
client_class = functools.partial(ClientDBus, bus=bus)
3211
3037
client_class = functools.partial(ClientDBus, bus = bus)
3038
3212
3039
client_settings = Client.config_parser(client_config)
3213
3040
old_client_settings = {}
3214
3041
clients_data = {}
3215
3042
3216
3043
# This is used to redirect stdout and stderr for checker processes
3217
3044
global wnull
3218
wnull = open(os.devnull, "w") # A writable /dev/null
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3219
3046
# Only used if server is running in foreground but not in debug
3220
3047
# mode
3221
3048
if debug or not foreground:
3222
3049
wnull.close()
3223
3050
3224
3051
# Get client data and settings from last running state.
3225
3052
if server_settings["restore"]:
3226
3053
try:
3227
3054
with open(stored_state_path, "rb") as stored_state:
3228
if sys.version_info.major == 2:
3055
if sys.version_info.major == 2:
3229
3056
clients_data, old_client_settings = pickle.load(
3230
3057
stored_state)
3231
3058
else:
3232
3059
bytes_clients_data, bytes_old_client_settings = (
3233
pickle.load(stored_state, encoding="bytes"))
3234
# Fix bytes to strings
3235
# clients_data
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3062
## clients_data
3236
3063
# .keys()
3237
clients_data = {(key.decode("utf-8")
3238
if isinstance(key, bytes)
3239
else key): value
3240
for key, value in
3241
bytes_clients_data.items()}
3242
del bytes_clients_data
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3066
else key): value
3067
for key, value in
3068
bytes_clients_data.items() }
3243
3069
for key in clients_data:
3244
value = {(k.decode("utf-8")
3245
if isinstance(k, bytes) else k): v
3246
for k, v in
3247
clients_data[key].items()}
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3248
3074
clients_data[key] = value
3249
3075
# .client_structure
3250
3076
value["client_structure"] = [
3251
3077
(s.decode("utf-8")
3252
3078
if isinstance(s, bytes)
3253
3079
else s) for s in
3254
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3080
value["client_structure"] ]
3081
# .name & .host
3082
for k in ("name", "host"):
3257
3083
if isinstance(value[k], bytes):
3258
3084
value[k] = value[k].decode("utf-8")
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
# old_client_settings
3264
# .keys()
3085
## old_client_settings
3086
# .keys
3265
3087
old_client_settings = {
3266
3088
(key.decode("utf-8")
3267
3089
if isinstance(key, bytes)
3268
3090
else key): value
3269
3091
for key, value in
3270
bytes_old_client_settings.items()}
3271
del bytes_old_client_settings
3272
# .host and .checker_command
3092
bytes_old_client_settings.items() }
3093
# .host
3273
3094
for value in old_client_settings.values():
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3277
.decode("utf-8"))
3095
value["host"] = value["host"].decode("utf-8")
3278
3096
os.remove(stored_state_path)
3279
3097
except IOError as e:
3280
3098
if e.errno == errno.ENOENT:
3288
3106
logger.warning("Could not load persistent state: "
3289
3107
"EOFError:",
3290
3108
exc_info=e)
3291
3109
3292
3110
with PGPEngine() as pgp:
3293
3111
for client_name, client in clients_data.items():
3294
3112
# Skip removed clients
3295
3113
if client_name not in client_settings:
3296
3114
continue
3297
3115
3298
3116
# Decide which value to use after restoring saved state.
3299
3117
# We have three different values: Old config file,
3300
3118
# new config file, and saved state.
3311
3129
client[name] = value
3312
3130
except KeyError:
3313
3131
pass
3314
3132
3315
3133
# Clients who has passed its expire date can still be
3316
3134
# enabled if its last checker was successful. A Client
3317
3135
# whose checker succeeded before we stored its state is
3350
3168
client_name))
3351
3169
client["secret"] = (client_settings[client_name]
3352
3170
["secret"])
3353
3171
3354
3172
# Add/remove clients based on new changes made to config
3355
3173
for client_name in (set(old_client_settings)
3356
3174
- set(client_settings)):
3358
3176
for client_name in (set(client_settings)
3359
3177
- set(old_client_settings)):
3360
3178
clients_data[client_name] = client_settings[client_name]
3361
3179
3362
3180
# Create all client objects
3363
3181
for client_name, client in clients_data.items():
3364
3182
tcp_server.clients[client_name] = client_class(
3365
name=client_name,
3366
settings=client,
3367
server_settings=server_settings)
3368
3183
name = client_name,
3184
settings = client,
3185
server_settings = server_settings)
3186
3369
3187
if not tcp_server.clients:
3370
3188
logger.warning("No clients defined")
3371
3189
3372
3190
if not foreground:
3373
3191
if pidfile is not None:
3374
3192
pid = os.getpid()
3380
3198
pidfilename, pid)
3381
3199
del pidfile
3382
3200
del pidfilename
3383
3384
for termsig in (signal.SIGHUP, signal.SIGTERM):
3385
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3386
lambda: main_loop.quit() and False)
3387
3201
3202
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3203
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3204
3388
3205
if use_dbus:
3389
3206
3390
3207
@alternate_dbus_interfaces(
3391
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3208
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3392
3209
class MandosDBusService(DBusObjectWithObjectManager):
3393
3210
"""A D-Bus proxy object"""
3394
3211
3395
3212
def __init__(self):
3396
3213
dbus.service.Object.__init__(self, bus, "/")
3397
3214
3398
3215
_interface = "se.recompile.Mandos"
3399
3216
3400
3217
@dbus.service.signal(_interface, signature="o")
3401
3218
def ClientAdded(self, objpath):
3402
3219
"D-Bus signal"
3403
3220
pass
3404
3221
3405
3222
@dbus.service.signal(_interface, signature="ss")
3406
def ClientNotFound(self, key_id, address):
3223
def ClientNotFound(self, fingerprint, address):
3407
3224
"D-Bus signal"
3408
3225
pass
3409
3226
3410
3227
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3411
3228
"true"})
3412
3229
@dbus.service.signal(_interface, signature="os")
3413
3230
def ClientRemoved(self, objpath, name):
3414
3231
"D-Bus signal"
3415
3232
pass
3416
3233
3417
3234
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3418
3235
"true"})
3419
3236
@dbus.service.method(_interface, out_signature="ao")
3421
3238
"D-Bus method"
3422
3239
return dbus.Array(c.dbus_object_path for c in
3423
3240
tcp_server.clients.values())
3424
3241
3425
3242
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3426
3243
"true"})
3427
3244
@dbus.service.method(_interface,
3429
3246
def GetAllClientsWithProperties(self):
3430
3247
"D-Bus method"
3431
3248
return dbus.Dictionary(
3432
{c.dbus_object_path: c.GetAll(
3249
{ c.dbus_object_path: c.GetAll(
3433
3250
"se.recompile.Mandos.Client")
3434
for c in tcp_server.clients.values()},
3251
for c in tcp_server.clients.values() },
3435
3252
signature="oa{sv}")
3436
3253
3437
3254
@dbus.service.method(_interface, in_signature="o")
3438
3255
def RemoveClient(self, object_path):
3439
3256
"D-Bus method"
3447
3264
self.client_removed_signal(c)
3448
3265
return
3449
3266
raise KeyError(object_path)
3450
3267
3451
3268
del _interface
3452
3269
3453
3270
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3454
out_signature="a{oa{sa{sv}}}")
3271
out_signature = "a{oa{sa{sv}}}")
3455
3272
def GetManagedObjects(self):
3456
3273
"""D-Bus method"""
3457
3274
return dbus.Dictionary(
3458
{client.dbus_object_path:
3459
dbus.Dictionary(
3460
{interface: client.GetAll(interface)
3461
for interface in
3462
client._get_all_interface_names()})
3463
for client in tcp_server.clients.values()})
3464
3275
{ client.dbus_object_path:
3276
dbus.Dictionary(
3277
{ interface: client.GetAll(interface)
3278
for interface in
3279
client._get_all_interface_names()})
3280
for client in tcp_server.clients.values()})
3281
3465
3282
def client_added_signal(self, client):
3466
3283
"""Send the new standard signal and the old signal"""
3467
3284
if use_dbus:
3469
3286
self.InterfacesAdded(
3470
3287
client.dbus_object_path,
3471
3288
dbus.Dictionary(
3472
{interface: client.GetAll(interface)
3473
for interface in
3474
client._get_all_interface_names()}))
3289
{ interface: client.GetAll(interface)
3290
for interface in
3291
client._get_all_interface_names()}))
3475
3292
# Old signal
3476
3293
self.ClientAdded(client.dbus_object_path)
3477
3294
3478
3295
def client_removed_signal(self, client):
3479
3296
"""Send the new standard signal and the old signal"""
3480
3297
if use_dbus:
3485
3302
# Old signal
3486
3303
self.ClientRemoved(client.dbus_object_path,
3487
3304
client.name)
3488
3305
3489
3306
mandos_dbus_service = MandosDBusService()
3490
3491
# Save modules to variables to exempt the modules from being
3492
# unloaded before the function registered with atexit() is run.
3493
mp = multiprocessing
3494
wn = wnull
3495
3307
3496
3308
def cleanup():
3497
3309
"Cleanup function; run on exit"
3498
3310
if zeroconf:
3499
3311
service.cleanup()
3500
3501
mp.active_children()
3502
wn.close()
3312
3313
multiprocessing.active_children()
3314
wnull.close()
3503
3315
if not (tcp_server.clients or client_settings):
3504
3316
return
3505
3317
3506
3318
# Store client before exiting. Secrets are encrypted with key
3507
3319
# based on what config file has. If config file is
3508
3320
# removed/edited, old secret will thus be unrecovable.
3513
3325
client.encrypted_secret = pgp.encrypt(client.secret,
3514
3326
key)
3515
3327
client_dict = {}
3516
3328
3517
3329
# A list of attributes that can not be pickled
3518
3330
# + secret.
3519
exclude = {"bus", "changedstate", "secret",
3520
"checker", "server_settings"}
3331
exclude = { "bus", "changedstate", "secret",
3332
"checker", "server_settings" }
3521
3333
for name, typ in inspect.getmembers(dbus.service
3522
3334
.Object):
3523
3335
exclude.add(name)
3524
3336
3525
3337
client_dict["encrypted_secret"] = (client
3526
3338
.encrypted_secret)
3527
3339
for attr in client.client_structure:
3528
3340
if attr not in exclude:
3529
3341
client_dict[attr] = getattr(client, attr)
3530
3342
3531
3343
clients[client.name] = client_dict
3532
3344
del client_settings[client.name]["secret"]
3533
3345
3534
3346
try:
3535
3347
with tempfile.NamedTemporaryFile(
3536
3348
mode='wb',
3539
3351
dir=os.path.dirname(stored_state_path),
3540
3352
delete=False) as stored_state:
3541
3353
pickle.dump((clients, client_settings), stored_state,
3542
protocol=2)
3354
protocol = 2)
3543
3355
tempname = stored_state.name
3544
3356
os.rename(tempname, stored_state_path)
3545
3357
except (IOError, OSError) as e:
3555
3367
logger.warning("Could not save persistent state:",
3556
3368
exc_info=e)
3557
3369
raise
3558
3370
3559
3371
# Delete all clients, and settings from config
3560
3372
while tcp_server.clients:
3561
3373
name, client = tcp_server.clients.popitem()
3567
3379
if use_dbus:
3568
3380
mandos_dbus_service.client_removed_signal(client)
3569
3381
client_settings.clear()
3570
3382
3571
3383
atexit.register(cleanup)
3572
3384
3573
3385
for client in tcp_server.clients.values():
3574
3386
if use_dbus:
3575
3387
# Emit D-Bus signal for adding
3577
3389
# Need to initiate checking of clients
3578
3390
if client.enabled:
3579
3391
client.init_checker()
3580
3392
3581
3393
tcp_server.enable()
3582
3394
tcp_server.server_activate()
3583
3395
3584
3396
# Find out what port we got
3585
3397
if zeroconf:
3586
3398
service.port = tcp_server.socket.getsockname()[1]
3591
3403
else: # IPv4
3592
3404
logger.info("Now listening on address %r, port %d",
3593
3405
*tcp_server.socket.getsockname())
3594
3595
# service.interface = tcp_server.socket.getsockname()[3]
3596
3406
3407
#service.interface = tcp_server.socket.getsockname()[3]
3408
3597
3409
try:
3598
3410
if zeroconf:
3599
3411
# From the Avahi example code
3604
3416
cleanup()
3605
3417
sys.exit(1)
3606
3418
# End of Avahi example code
3607
3608
GLib.io_add_watch(
3609
GLib.IOChannel.unix_new(tcp_server.fileno()),
3610
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3611
lambda *args, **kwargs: (tcp_server.handle_request
3612
(*args[2:], **kwargs) or True))
3613
3419
3420
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3421
lambda *args, **kwargs:
3422
(tcp_server.handle_request
3423
(*args[2:], **kwargs) or True))
3424
3614
3425
logger.debug("Starting main loop")
3615
3426
main_loop.run()
3616
3427
except AvahiError as error:
3625
3436
# Must run before the D-Bus bus name gets deregistered
3626
3437
cleanup()
3627
3438
3628
3629
def should_only_run_tests():
3630
parser = argparse.ArgumentParser(add_help=False)
3631
parser.add_argument("--check", action='store_true')
3632
args, unknown_args = parser.parse_known_args()
3633
run_tests = args.check
3634
if run_tests:
3635
# Remove --check argument from sys.argv
3636
sys.argv[1:] = unknown_args
3637
return run_tests
3638
3639
# Add all tests from doctest strings
3640
def load_tests(loader, tests, none):
3641
import doctest
3642
tests.addTests(doctest.DocTestSuite())
3643
return tests
3644
3439
3645
3440
if __name__ == '__main__':
3646
try:
3647
if should_only_run_tests():
3648
# Call using ./mandos --check [--verbose]
3649
unittest.main()
3650
else:
3651
main()
3652
finally:
3653
logging.shutdown()
3441
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0