To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 829
- compare with another revision
- download diff
- download tarball
- view history from revision 829
- Committer: Teddy Hogeborn
- Date: 2016-03-12 20:23:15 UTC
- Revision ID: teddy@recompile.se-20160312202315-hu7b87ivetlxqbw3
Server: Fix minor thing with Python 3 compatibility
Fix another small thing with unpickling string values.
* mandos (main): When restoring pickled client data, only decode byte
string for "host" key if it really is a byte string.
Fix another small thing with unpickling string values.
* mandos (main): When restoring pickled client data, only decode byte
string for "host" key if it really is a byte string.
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
39
39
except ImportError:
40
40
pass
41
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
42
try:
48
43
import SocketServer as socketserver
49
44
except ImportError:
50
45
import socketserver
51
46
import socket
47
import argparse
52
48
import datetime
53
49
import errno
54
50
try:
55
51
import ConfigParser as configparser
56
52
except ImportError:
57
53
import configparser
54
import sys
58
55
import re
56
import os
59
57
import signal
60
58
import subprocess
61
59
import atexit
62
60
import stat
61
import logging
63
62
import logging.handlers
64
63
import pwd
65
64
import contextlib
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import random
81
import shlex
82
79
83
80
import dbus
84
81
import dbus.service
85
import gi
86
from gi.repository import GLib
82
try:
83
from gi.repository import GObject
84
except ImportError:
85
import gobject as GObject
87
86
from dbus.mainloop.glib import DBusGMainLoop
88
87
import ctypes
89
88
import ctypes.util
90
89
import xml.dom.minidom
91
90
import inspect
92
91
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Add os.set_inheritable if it does not exist
114
try:
115
os.set_inheritable
116
except AttributeError:
117
def set_inheritable(fd, inheritable):
118
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
119
if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):
120
fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)
121
elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):
122
fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)
123
os.set_inheritable = set_inheritable
124
del set_inheritable
125
126
# Show warnings by default
127
if not sys.warnoptions:
128
import warnings
129
warnings.simplefilter("default")
130
131
# Try to find the value of SO_BINDTODEVICE:
132
try:
133
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
134
# newer, and it is also the most natural place for it:
92
try:
135
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
136
94
except AttributeError:
137
95
try:
138
# This is where SO_BINDTODEVICE was up to and including Python
139
# 2.6, and also 3.2:
140
96
from IN import SO_BINDTODEVICE
141
97
except ImportError:
142
# In Python 2.7 it seems to have been removed entirely.
143
# Try running the C preprocessor:
144
try:
145
cc = subprocess.Popen(["cc", "--language=c", "-E",
146
"/dev/stdin"],
147
stdin=subprocess.PIPE,
148
stdout=subprocess.PIPE)
149
stdout = cc.communicate(
150
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
151
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
152
except (OSError, ValueError, IndexError):
153
# No value found
154
SO_BINDTODEVICE = None
155
156
if sys.version_info < (3, 2):
157
configparser.Configparser = configparser.SafeConfigParser
158
159
version = "1.8.17"
98
SO_BINDTODEVICE = None
99
100
if sys.version_info.major == 2:
101
str = unicode
102
103
version = "1.7.5"
160
104
stored_state_file = "clients.pickle"
161
105
162
log = logging.getLogger(os.path.basename(sys.argv[0]))
163
logging.captureWarnings(True) # Show warnings via the logging system
106
logger = logging.getLogger()
164
107
syslogger = None
165
108
166
109
try:
167
110
if_nametoindex = ctypes.cdll.LoadLibrary(
168
111
ctypes.util.find_library("c")).if_nametoindex
169
112
except (OSError, AttributeError):
170
113
171
114
def if_nametoindex(interface):
172
115
"Get an interface index the hard way, i.e. using fcntl()"
173
116
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
196
139
197
140
def initlogger(debug, level=logging.WARNING):
198
141
"""init logger and add loglevel"""
199
142
200
143
global syslogger
201
144
syslogger = (logging.handlers.SysLogHandler(
202
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
203
address="/dev/log"))
145
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
146
address = "/dev/log"))
204
147
syslogger.setFormatter(logging.Formatter
205
("Mandos [%(process)d]: %(levelname)s:"
206
" %(message)s"))
207
log.addHandler(syslogger)
208
148
('Mandos [%(process)d]: %(levelname)s:'
149
' %(message)s'))
150
logger.addHandler(syslogger)
151
209
152
if debug:
210
153
console = logging.StreamHandler()
211
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
212
" [%(process)d]:"
213
" %(levelname)s:"
214
" %(message)s"))
215
log.addHandler(console)
216
log.setLevel(level)
154
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
155
' [%(process)d]:'
156
' %(levelname)s:'
157
' %(message)s'))
158
logger.addHandler(console)
159
logger.setLevel(level)
217
160
218
161
219
162
class PGPError(Exception):
221
164
pass
222
165
223
166
224
class PGPEngine:
167
class PGPEngine(object):
225
168
"""A simple class for OpenPGP symmetric encryption & decryption"""
226
169
227
170
def __init__(self):
228
171
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
229
172
self.gpg = "gpg"
231
174
output = subprocess.check_output(["gpgconf"])
232
175
for line in output.splitlines():
233
176
name, text, path = line.split(b":")
234
if name == b"gpg":
177
if name == "gpg":
235
178
self.gpg = path
236
179
break
237
180
except OSError as e:
238
181
if e.errno != errno.ENOENT:
239
182
raise
240
self.gnupgargs = ["--batch",
241
"--homedir", self.tempdir,
242
"--force-mdc",
243
"--quiet"]
244
# Only GPG version 1 has the --no-use-agent option.
245
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
246
self.gnupgargs.append("--no-use-agent")
247
183
self.gnupgargs = ['--batch',
184
'--homedir', self.tempdir,
185
'--force-mdc',
186
'--quiet',
187
'--no-use-agent']
188
248
189
def __enter__(self):
249
190
return self
250
191
251
192
def __exit__(self, exc_type, exc_value, traceback):
252
193
self._cleanup()
253
194
return False
254
195
255
196
def __del__(self):
256
197
self._cleanup()
257
198
258
199
def _cleanup(self):
259
200
if self.tempdir is not None:
260
201
# Delete contents of tempdir
261
202
for root, dirs, files in os.walk(self.tempdir,
262
topdown=False):
203
topdown = False):
263
204
for filename in files:
264
205
os.remove(os.path.join(root, filename))
265
206
for dirname in dirs:
267
208
# Remove tempdir
268
209
os.rmdir(self.tempdir)
269
210
self.tempdir = None
270
211
271
212
def password_encode(self, password):
272
213
# Passphrase can not be empty and can not contain newlines or
273
214
# NUL bytes. So we prefix it and hex encode it.
278
219
.replace(b"\n", b"\\n")
279
220
.replace(b"\0", b"\\x00"))
280
221
return encoded
281
222
282
223
def encrypt(self, data, password):
283
224
passphrase = self.password_encode(password)
284
225
with tempfile.NamedTemporaryFile(
285
226
dir=self.tempdir) as passfile:
286
227
passfile.write(passphrase)
287
228
passfile.flush()
288
proc = subprocess.Popen([self.gpg, "--symmetric",
289
"--passphrase-file",
229
proc = subprocess.Popen([self.gpg, '--symmetric',
230
'--passphrase-file',
290
231
passfile.name]
291
232
+ self.gnupgargs,
292
stdin=subprocess.PIPE,
293
stdout=subprocess.PIPE,
294
stderr=subprocess.PIPE)
295
ciphertext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
296
237
if proc.returncode != 0:
297
238
raise PGPError(err)
298
239
return ciphertext
299
240
300
241
def decrypt(self, data, password):
301
242
passphrase = self.password_encode(password)
302
243
with tempfile.NamedTemporaryFile(
303
dir=self.tempdir) as passfile:
244
dir = self.tempdir) as passfile:
304
245
passfile.write(passphrase)
305
246
passfile.flush()
306
proc = subprocess.Popen([self.gpg, "--decrypt",
307
"--passphrase-file",
247
proc = subprocess.Popen([self.gpg, '--decrypt',
248
'--passphrase-file',
308
249
passfile.name]
309
250
+ self.gnupgargs,
310
stdin=subprocess.PIPE,
311
stdout=subprocess.PIPE,
312
stderr=subprocess.PIPE)
313
decrypted_plaintext, err = proc.communicate(input=data)
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
314
255
if proc.returncode != 0:
315
256
raise PGPError(err)
316
257
return decrypted_plaintext
317
258
318
319
259
# Pretend that we have an Avahi module
320
class avahi:
321
"""This isn't so much a class as it is a module-like namespace."""
322
IF_UNSPEC = -1 # avahi-common/address.h
323
PROTO_UNSPEC = -1 # avahi-common/address.h
324
PROTO_INET = 0 # avahi-common/address.h
325
PROTO_INET6 = 1 # avahi-common/address.h
260
class Avahi(object):
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
326
267
DBUS_NAME = "org.freedesktop.Avahi"
327
268
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
328
269
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
329
270
DBUS_PATH_SERVER = "/"
330
331
@staticmethod
332
def string_array_to_txt_array(t):
271
def string_array_to_txt_array(self, t):
333
272
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
334
273
for s in t), signature="ay")
335
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
336
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
337
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
338
SERVER_INVALID = 0 # avahi-common/defs.h
339
SERVER_REGISTERING = 1 # avahi-common/defs.h
340
SERVER_RUNNING = 2 # avahi-common/defs.h
341
SERVER_COLLISION = 3 # avahi-common/defs.h
342
SERVER_FAILURE = 4 # avahi-common/defs.h
343
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
282
avahi = Avahi()
344
283
345
284
class AvahiError(Exception):
346
285
def __init__(self, value, *args, **kwargs):
357
296
pass
358
297
359
298
360
class AvahiService:
299
class AvahiService(object):
361
300
"""An Avahi (Zeroconf) service.
362
301
363
302
Attributes:
364
303
interface: integer; avahi.IF_UNSPEC or an interface index.
365
304
Used to optionally bind to the specified interface.
366
name: string; Example: "Mandos"
367
type: string; Example: "_mandos._tcp".
305
name: string; Example: 'Mandos'
306
type: string; Example: '_mandos._tcp'.
368
307
See <https://www.iana.org/assignments/service-names-port-numbers>
369
308
port: integer; what port to announce
370
309
TXT: list of strings; TXT record for the service
377
316
server: D-Bus Server
378
317
bus: dbus.SystemBus()
379
318
"""
380
319
381
320
def __init__(self,
382
interface=avahi.IF_UNSPEC,
383
name=None,
384
servicetype=None,
385
port=None,
386
TXT=None,
387
domain="",
388
host="",
389
max_renames=32768,
390
protocol=avahi.PROTO_UNSPEC,
391
bus=None):
321
interface = avahi.IF_UNSPEC,
322
name = None,
323
servicetype = None,
324
port = None,
325
TXT = None,
326
domain = "",
327
host = "",
328
max_renames = 32768,
329
protocol = avahi.PROTO_UNSPEC,
330
bus = None):
392
331
self.interface = interface
393
332
self.name = name
394
333
self.type = servicetype
403
342
self.server = None
404
343
self.bus = bus
405
344
self.entry_group_state_changed_match = None
406
345
407
346
def rename(self, remove=True):
408
347
"""Derived from the Avahi example code"""
409
348
if self.rename_count >= self.max_renames:
410
log.critical("No suitable Zeroconf service name found"
411
" after %i retries, exiting.",
412
self.rename_count)
349
logger.critical("No suitable Zeroconf service name found"
350
" after %i retries, exiting.",
351
self.rename_count)
413
352
raise AvahiServiceError("Too many renames")
414
353
self.name = str(
415
354
self.server.GetAlternativeServiceName(self.name))
416
355
self.rename_count += 1
417
log.info("Changing Zeroconf service name to %r ...",
418
self.name)
356
logger.info("Changing Zeroconf service name to %r ...",
357
self.name)
419
358
if remove:
420
359
self.remove()
421
360
try:
423
362
except dbus.exceptions.DBusException as error:
424
363
if (error.get_dbus_name()
425
364
== "org.freedesktop.Avahi.CollisionError"):
426
log.info("Local Zeroconf service name collision.")
365
logger.info("Local Zeroconf service name collision.")
427
366
return self.rename(remove=False)
428
367
else:
429
log.critical("D-Bus Exception", exc_info=error)
368
logger.critical("D-Bus Exception", exc_info=error)
430
369
self.cleanup()
431
370
os._exit(1)
432
371
433
372
def remove(self):
434
373
"""Derived from the Avahi example code"""
435
374
if self.entry_group_state_changed_match is not None:
437
376
self.entry_group_state_changed_match = None
438
377
if self.group is not None:
439
378
self.group.Reset()
440
379
441
380
def add(self):
442
381
"""Derived from the Avahi example code"""
443
382
self.remove()
448
387
avahi.DBUS_INTERFACE_ENTRY_GROUP)
449
388
self.entry_group_state_changed_match = (
450
389
self.group.connect_to_signal(
451
"StateChanged", self.entry_group_state_changed))
452
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
453
self.name, self.type)
390
'StateChanged', self.entry_group_state_changed))
391
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
392
self.name, self.type)
454
393
self.group.AddService(
455
394
self.interface,
456
395
self.protocol,
460
399
dbus.UInt16(self.port),
461
400
avahi.string_array_to_txt_array(self.TXT))
462
401
self.group.Commit()
463
402
464
403
def entry_group_state_changed(self, state, error):
465
404
"""Derived from the Avahi example code"""
466
log.debug("Avahi entry group state change: %i", state)
467
405
logger.debug("Avahi entry group state change: %i", state)
406
468
407
if state == avahi.ENTRY_GROUP_ESTABLISHED:
469
log.debug("Zeroconf service established.")
408
logger.debug("Zeroconf service established.")
470
409
elif state == avahi.ENTRY_GROUP_COLLISION:
471
log.info("Zeroconf service name collision.")
410
logger.info("Zeroconf service name collision.")
472
411
self.rename()
473
412
elif state == avahi.ENTRY_GROUP_FAILURE:
474
log.critical("Avahi: Error in group state changed %s",
475
str(error))
413
logger.critical("Avahi: Error in group state changed %s",
414
str(error))
476
415
raise AvahiGroupError("State changed: {!s}".format(error))
477
416
478
417
def cleanup(self):
479
418
"""Derived from the Avahi example code"""
480
419
if self.group is not None:
485
424
pass
486
425
self.group = None
487
426
self.remove()
488
427
489
428
def server_state_changed(self, state, error=None):
490
429
"""Derived from the Avahi example code"""
491
log.debug("Avahi server state change: %i", state)
430
logger.debug("Avahi server state change: %i", state)
492
431
bad_states = {
493
432
avahi.SERVER_INVALID: "Zeroconf server invalid",
494
433
avahi.SERVER_REGISTERING: None,
498
437
if state in bad_states:
499
438
if bad_states[state] is not None:
500
439
if error is None:
501
log.error(bad_states[state])
440
logger.error(bad_states[state])
502
441
else:
503
log.error(bad_states[state] + ": %r", error)
442
logger.error(bad_states[state] + ": %r", error)
504
443
self.cleanup()
505
444
elif state == avahi.SERVER_RUNNING:
506
445
try:
508
447
except dbus.exceptions.DBusException as error:
509
448
if (error.get_dbus_name()
510
449
== "org.freedesktop.Avahi.CollisionError"):
511
log.info("Local Zeroconf service name collision.")
450
logger.info("Local Zeroconf service name"
451
" collision.")
512
452
return self.rename(remove=False)
513
453
else:
514
log.critical("D-Bus Exception", exc_info=error)
454
logger.critical("D-Bus Exception", exc_info=error)
515
455
self.cleanup()
516
456
os._exit(1)
517
457
else:
518
458
if error is None:
519
log.debug("Unknown state: %r", state)
459
logger.debug("Unknown state: %r", state)
520
460
else:
521
log.debug("Unknown state: %r: %r", state, error)
522
461
logger.debug("Unknown state: %r: %r", state, error)
462
523
463
def activate(self):
524
464
"""Derived from the Avahi example code"""
525
465
if self.server is None:
536
476
class AvahiServiceToSyslog(AvahiService):
537
477
def rename(self, *args, **kwargs):
538
478
"""Add the new name to the syslog messages"""
539
ret = super(AvahiServiceToSyslog, self).rename(*args,
540
**kwargs)
479
ret = AvahiService.rename(self, *args, **kwargs)
541
480
syslogger.setFormatter(logging.Formatter(
542
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
543
482
.format(self.name)))
544
483
return ret
545
484
546
547
485
# Pretend that we have a GnuTLS module
548
class gnutls:
549
"""This isn't so much a class as it is a module-like namespace."""
550
551
library = ctypes.util.find_library("gnutls")
552
if library is None:
553
library = ctypes.util.find_library("gnutls-deb0")
554
_library = ctypes.cdll.LoadLibrary(library)
555
del library
556
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
489
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
493
def __init__(self):
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
496
# happens.
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
500
557
501
# Unless otherwise indicated, the constants and types below are
558
502
# all from the gnutls/gnutls.h C header file.
559
503
560
504
# Constants
561
505
E_SUCCESS = 0
562
506
E_INTERRUPTED = -52
563
507
E_AGAIN = -28
564
508
CRT_OPENPGP = 2
565
CRT_RAWPK = 3
566
509
CLIENT = 2
567
510
SHUT_RDWR = 0
568
511
CRD_CERTIFICATE = 1
569
512
E_NO_CERTIFICATE_FOUND = -49
570
X509_FMT_DER = 0
571
NO_TICKETS = 1<<10
572
ENABLE_RAWPK = 1<<18
573
CTYPE_PEERS = 3
574
KEYID_USE_SHA256 = 1 # gnutls/x509.h
575
513
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
576
514
577
515
# Types
578
class _session_int(ctypes.Structure):
516
class session_int(ctypes.Structure):
579
517
_fields_ = []
580
session_t = ctypes.POINTER(_session_int)
581
518
session_t = ctypes.POINTER(session_int)
582
519
class certificate_credentials_st(ctypes.Structure):
583
520
_fields_ = []
584
521
certificate_credentials_t = ctypes.POINTER(
585
522
certificate_credentials_st)
586
523
certificate_type_t = ctypes.c_int
587
588
524
class datum_t(ctypes.Structure):
589
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
590
("size", ctypes.c_uint)]
591
592
class _openpgp_crt_int(ctypes.Structure):
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
('size', ctypes.c_uint)]
527
class openpgp_crt_int(ctypes.Structure):
593
528
_fields_ = []
594
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
595
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
596
531
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
597
532
credentials_type_t = ctypes.c_int
598
533
transport_ptr_t = ctypes.c_void_p
599
534
close_request_t = ctypes.c_int
600
535
601
536
# Exceptions
602
537
class Error(Exception):
603
def __init__(self, message=None, code=None, args=()):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
604
543
# Default usage is by a message string, but if a return
605
544
# code is passed, convert it to a string with
606
545
# gnutls.strerror()
607
546
self.code = code
608
547
if message is None and code is not None:
609
message = gnutls.strerror(code).decode(
610
"utf-8", errors="replace")
611
return super(gnutls.Error, self).__init__(
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
612
550
message, *args)
613
551
614
552
class CertificateSecurityError(Error):
615
553
pass
616
617
class PointerTo:
618
def __init__(self, cls):
619
self.cls = cls
620
621
def from_param(self, obj):
622
if not isinstance(obj, self.cls):
623
raise TypeError("Not of type {}: {!r}"
624
.format(self.cls.__name__, obj))
625
return ctypes.byref(obj.from_param(obj))
626
627
class CastToVoidPointer:
628
def __init__(self, cls):
629
self.cls = cls
630
631
def from_param(self, obj):
632
if not isinstance(obj, self.cls):
633
raise TypeError("Not of type {}: {!r}"
634
.format(self.cls.__name__, obj))
635
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
636
637
class With_from_param:
638
@classmethod
639
def from_param(cls, obj):
640
return obj._as_parameter_
641
554
642
555
# Classes
643
class Credentials(With_from_param):
556
class Credentials(object):
644
557
def __init__(self):
645
self._as_parameter_ = gnutls.certificate_credentials_t()
646
gnutls.certificate_allocate_credentials(self)
558
self._c_object = gnutls.certificate_credentials_t()
559
gnutls.certificate_allocate_credentials(
560
ctypes.byref(self._c_object))
647
561
self.type = gnutls.CRD_CERTIFICATE
648
562
649
563
def __del__(self):
650
gnutls.certificate_free_credentials(self)
651
652
class ClientSession(With_from_param):
653
def __init__(self, socket, credentials=None):
654
self._as_parameter_ = gnutls.session_t()
655
gnutls_flags = gnutls.CLIENT
656
if gnutls.check_version(b"3.5.6"):
657
gnutls_flags |= gnutls.NO_TICKETS
658
if gnutls.has_rawpk:
659
gnutls_flags |= gnutls.ENABLE_RAWPK
660
gnutls.init(self, gnutls_flags)
661
del gnutls_flags
662
gnutls.set_default_priority(self)
663
gnutls.transport_set_ptr(self, socket.fileno())
664
gnutls.handshake_set_private_extensions(self, True)
564
gnutls.certificate_free_credentials(self._c_object)
565
566
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
568
self._c_object = gnutls.session_t()
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
570
gnutls.set_default_priority(self._c_object)
571
gnutls.transport_set_ptr(self._c_object, socket.fileno())
572
gnutls.handshake_set_private_extensions(self._c_object,
573
True)
665
574
self.socket = socket
666
575
if credentials is None:
667
576
credentials = gnutls.Credentials()
668
gnutls.credentials_set(self, credentials.type,
669
credentials)
577
gnutls.credentials_set(self._c_object, credentials.type,
578
ctypes.cast(credentials._c_object,
579
ctypes.c_void_p))
670
580
self.credentials = credentials
671
581
672
582
def __del__(self):
673
gnutls.deinit(self)
674
583
gnutls.deinit(self._c_object)
584
675
585
def handshake(self):
676
return gnutls.handshake(self)
677
586
return gnutls.handshake(self._c_object)
587
678
588
def send(self, data):
679
589
data = bytes(data)
680
590
data_len = len(data)
681
591
while data_len > 0:
682
data_len -= gnutls.record_send(self, data[-data_len:],
592
data_len -= gnutls.record_send(self._c_object,
593
data[-data_len:],
683
594
data_len)
684
595
685
596
def bye(self):
686
return gnutls.bye(self, gnutls.SHUT_RDWR)
687
597
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
598
688
599
# Error handling functions
689
600
def _error_code(result):
690
601
"""A function to raise exceptions on errors, suitable
691
for the "restype" attribute on ctypes functions"""
692
if result >= gnutls.E_SUCCESS:
602
for the 'restype' attribute on ctypes functions"""
603
if result >= 0:
693
604
return result
694
605
if result == gnutls.E_NO_CERTIFICATE_FOUND:
695
raise gnutls.CertificateSecurityError(code=result)
696
raise gnutls.Error(code=result)
697
698
def _retry_on_error(result, func, arguments,
699
_error_code=_error_code):
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
608
609
def _retry_on_error(result, func, arguments):
700
610
"""A function to retry on some errors, suitable
701
for the "errcheck" attribute on ctypes functions"""
702
while result < gnutls.E_SUCCESS:
611
for the 'errcheck' attribute on ctypes functions"""
612
while result < 0:
703
613
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
704
614
return _error_code(result)
705
615
result = func(*arguments)
706
616
return result
707
617
708
618
# Unless otherwise indicated, the function declarations below are
709
619
# all from the gnutls/gnutls.h C header file.
710
620
711
621
# Functions
712
622
priority_set_direct = _library.gnutls_priority_set_direct
713
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
714
624
ctypes.POINTER(ctypes.c_char_p)]
715
625
priority_set_direct.restype = _error_code
716
626
717
627
init = _library.gnutls_init
718
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
719
629
init.restype = _error_code
720
630
721
631
set_default_priority = _library.gnutls_set_default_priority
722
set_default_priority.argtypes = [ClientSession]
632
set_default_priority.argtypes = [session_t]
723
633
set_default_priority.restype = _error_code
724
634
725
635
record_send = _library.gnutls_record_send
726
record_send.argtypes = [ClientSession, ctypes.c_void_p,
636
record_send.argtypes = [session_t, ctypes.c_void_p,
727
637
ctypes.c_size_t]
728
638
record_send.restype = ctypes.c_ssize_t
729
639
record_send.errcheck = _retry_on_error
730
640
731
641
certificate_allocate_credentials = (
732
642
_library.gnutls_certificate_allocate_credentials)
733
643
certificate_allocate_credentials.argtypes = [
734
PointerTo(Credentials)]
644
ctypes.POINTER(certificate_credentials_t)]
735
645
certificate_allocate_credentials.restype = _error_code
736
646
737
647
certificate_free_credentials = (
738
648
_library.gnutls_certificate_free_credentials)
739
certificate_free_credentials.argtypes = [Credentials]
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
740
650
certificate_free_credentials.restype = None
741
651
742
652
handshake_set_private_extensions = (
743
653
_library.gnutls_handshake_set_private_extensions)
744
handshake_set_private_extensions.argtypes = [ClientSession,
654
handshake_set_private_extensions.argtypes = [session_t,
745
655
ctypes.c_int]
746
656
handshake_set_private_extensions.restype = None
747
657
748
658
credentials_set = _library.gnutls_credentials_set
749
credentials_set.argtypes = [ClientSession, credentials_type_t,
750
CastToVoidPointer(Credentials)]
659
credentials_set.argtypes = [session_t, credentials_type_t,
660
ctypes.c_void_p]
751
661
credentials_set.restype = _error_code
752
662
753
663
strerror = _library.gnutls_strerror
754
664
strerror.argtypes = [ctypes.c_int]
755
665
strerror.restype = ctypes.c_char_p
756
666
757
667
certificate_type_get = _library.gnutls_certificate_type_get
758
certificate_type_get.argtypes = [ClientSession]
668
certificate_type_get.argtypes = [session_t]
759
669
certificate_type_get.restype = _error_code
760
670
761
671
certificate_get_peers = _library.gnutls_certificate_get_peers
762
certificate_get_peers.argtypes = [ClientSession,
672
certificate_get_peers.argtypes = [session_t,
763
673
ctypes.POINTER(ctypes.c_uint)]
764
674
certificate_get_peers.restype = ctypes.POINTER(datum_t)
765
675
766
676
global_set_log_level = _library.gnutls_global_set_log_level
767
677
global_set_log_level.argtypes = [ctypes.c_int]
768
678
global_set_log_level.restype = None
769
679
770
680
global_set_log_function = _library.gnutls_global_set_log_function
771
681
global_set_log_function.argtypes = [log_func]
772
682
global_set_log_function.restype = None
773
683
774
684
deinit = _library.gnutls_deinit
775
deinit.argtypes = [ClientSession]
685
deinit.argtypes = [session_t]
776
686
deinit.restype = None
777
687
778
688
handshake = _library.gnutls_handshake
779
handshake.argtypes = [ClientSession]
780
handshake.restype = ctypes.c_int
689
handshake.argtypes = [session_t]
690
handshake.restype = _error_code
781
691
handshake.errcheck = _retry_on_error
782
692
783
693
transport_set_ptr = _library.gnutls_transport_set_ptr
784
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
785
695
transport_set_ptr.restype = None
786
696
787
697
bye = _library.gnutls_bye
788
bye.argtypes = [ClientSession, close_request_t]
789
bye.restype = ctypes.c_int
698
bye.argtypes = [session_t, close_request_t]
699
bye.restype = _error_code
790
700
bye.errcheck = _retry_on_error
791
701
792
702
check_version = _library.gnutls_check_version
793
703
check_version.argtypes = [ctypes.c_char_p]
794
704
check_version.restype = ctypes.c_char_p
795
796
_need_version = b"3.3.0"
797
if check_version(_need_version) is None:
798
raise self.Error("Needs GnuTLS {} or later"
799
.format(_need_version))
800
801
_tls_rawpk_version = b"3.6.6"
802
has_rawpk = bool(check_version(_tls_rawpk_version))
803
804
if has_rawpk:
805
# Types
806
class pubkey_st(ctypes.Structure):
807
_fields = []
808
pubkey_t = ctypes.POINTER(pubkey_st)
809
810
x509_crt_fmt_t = ctypes.c_int
811
812
# All the function declarations below are from
813
# gnutls/abstract.h
814
pubkey_init = _library.gnutls_pubkey_init
815
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
816
pubkey_init.restype = _error_code
817
818
pubkey_import = _library.gnutls_pubkey_import
819
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
820
x509_crt_fmt_t]
821
pubkey_import.restype = _error_code
822
823
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
824
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
825
ctypes.POINTER(ctypes.c_ubyte),
826
ctypes.POINTER(ctypes.c_size_t)]
827
pubkey_get_key_id.restype = _error_code
828
829
pubkey_deinit = _library.gnutls_pubkey_deinit
830
pubkey_deinit.argtypes = [pubkey_t]
831
pubkey_deinit.restype = None
832
else:
833
# All the function declarations below are from
834
# gnutls/openpgp.h
835
836
openpgp_crt_init = _library.gnutls_openpgp_crt_init
837
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
838
openpgp_crt_init.restype = _error_code
839
840
openpgp_crt_import = _library.gnutls_openpgp_crt_import
841
openpgp_crt_import.argtypes = [openpgp_crt_t,
842
ctypes.POINTER(datum_t),
843
openpgp_crt_fmt_t]
844
openpgp_crt_import.restype = _error_code
845
846
openpgp_crt_verify_self = \
847
_library.gnutls_openpgp_crt_verify_self
848
openpgp_crt_verify_self.argtypes = [
849
openpgp_crt_t,
850
ctypes.c_uint,
851
ctypes.POINTER(ctypes.c_uint),
852
]
853
openpgp_crt_verify_self.restype = _error_code
854
855
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
856
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
857
openpgp_crt_deinit.restype = None
858
859
openpgp_crt_get_fingerprint = (
860
_library.gnutls_openpgp_crt_get_fingerprint)
861
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
862
ctypes.c_void_p,
863
ctypes.POINTER(
864
ctypes.c_size_t)]
865
openpgp_crt_get_fingerprint.restype = _error_code
866
867
if check_version(b"3.6.4"):
868
certificate_type_get2 = _library.gnutls_certificate_type_get2
869
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
870
certificate_type_get2.restype = _error_code
871
705
706
# All the function declarations below are from gnutls/openpgp.h
707
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
711
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
715
openpgp_crt_fmt_t]
716
openpgp_crt_import.restype = _error_code
717
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
722
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
726
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
ctypes.c_void_p,
731
ctypes.POINTER(
732
ctypes.c_size_t)]
733
openpgp_crt_get_fingerprint.restype = _error_code
734
872
735
# Remove non-public functions
873
736
del _error_code, _retry_on_error
874
737
# Create the global "gnutls" object, simulating a module
738
gnutls = GnuTLS()
875
739
876
740
def call_pipe(connection, # : multiprocessing.Connection
877
741
func, *args, **kwargs):
878
742
"""This function is meant to be called by multiprocessing.Process
879
743
880
744
This function runs func(*args, **kwargs), and writes the resulting
881
745
return value on the provided multiprocessing.Connection.
882
746
"""
883
747
connection.send(func(*args, **kwargs))
884
748
connection.close()
885
749
886
887
class Client:
750
class Client(object):
888
751
"""A representation of a client host served by this server.
889
752
890
753
Attributes:
891
approved: bool(); None if not yet approved/disapproved
754
approved: bool(); 'None' if not yet approved/disapproved
892
755
approval_delay: datetime.timedelta(); Time to wait for approval
893
756
approval_duration: datetime.timedelta(); Duration of one approval
894
checker: multiprocessing.Process(); a running checker process used
895
to see if the client lives. None if no process is
896
running.
897
checker_callback_tag: a GLib event source tag, or None
757
checker: subprocess.Popen(); a running checker process used
758
to see if the client lives.
759
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
898
761
checker_command: string; External command which is run to check
899
762
if client lives. %() expansions are done at
900
763
runtime with vars(self) as dict, so that for
901
764
instance %(name)s can be used in the command.
902
checker_initiator_tag: a GLib event source tag, or None
765
checker_initiator_tag: a GObject event source tag, or None
903
766
created: datetime.datetime(); (UTC) object creation
904
767
client_structure: Object describing what attributes a client has
905
768
and is used for storing the client at exit
906
769
current_checker_command: string; current running checker_command
907
disable_initiator_tag: a GLib event source tag, or None
770
disable_initiator_tag: a GObject event source tag, or None
908
771
enabled: bool()
909
772
fingerprint: string (40 or 32 hexadecimal digits); used to
910
uniquely identify an OpenPGP client
911
key_id: string (64 hexadecimal digits); used to uniquely identify
912
a client using raw public keys
773
uniquely identify the client
913
774
host: string; available for use by the checker command
914
775
interval: datetime.timedelta(); How often to start a new checker
915
776
last_approval_request: datetime.datetime(); (UTC) or None
931
792
disabled, or None
932
793
server_settings: The server_settings dict from main()
933
794
"""
934
795
935
796
runtime_expansions = ("approval_delay", "approval_duration",
936
"created", "enabled", "expires", "key_id",
797
"created", "enabled", "expires",
937
798
"fingerprint", "host", "interval",
938
799
"last_approval_request", "last_checked_ok",
939
800
"last_enabled", "name", "timeout")
948
809
"approved_by_default": "True",
949
810
"enabled": "True",
950
811
}
951
812
952
813
@staticmethod
953
814
def config_parser(config):
954
815
"""Construct a new dict of client settings of this form:
961
822
for client_name in config.sections():
962
823
section = dict(config.items(client_name))
963
824
client = settings[client_name] = {}
964
825
965
826
client["host"] = section["host"]
966
827
# Reformat values from string types to Python types
967
828
client["approved_by_default"] = config.getboolean(
968
829
client_name, "approved_by_default")
969
830
client["enabled"] = config.getboolean(client_name,
970
831
"enabled")
971
972
# Uppercase and remove spaces from key_id and fingerprint
973
# for later comparison purposes with return value from the
974
# key_id() and fingerprint() functions
975
client["key_id"] = (section.get("key_id", "").upper()
976
.replace(" ", ""))
977
client["fingerprint"] = (section.get("fingerprint",
978
"").upper()
832
833
# Uppercase and remove spaces from fingerprint for later
834
# comparison purposes with return value from the
835
# fingerprint() function
836
client["fingerprint"] = (section["fingerprint"].upper()
979
837
.replace(" ", ""))
980
if not (client["key_id"] or client["fingerprint"]):
981
log.error("Skipping client %s without key_id or"
982
" fingerprint", client_name)
983
del settings[client_name]
984
continue
985
838
if "secret" in section:
986
839
client["secret"] = codecs.decode(section["secret"]
987
840
.encode("utf-8"),
1006
859
client["last_approval_request"] = None
1007
860
client["last_checked_ok"] = None
1008
861
client["last_checker_status"] = -2
1009
862
1010
863
return settings
1011
1012
def __init__(self, settings, name=None, server_settings=None):
864
865
def __init__(self, settings, name = None, server_settings=None):
1013
866
self.name = name
1014
867
if server_settings is None:
1015
868
server_settings = {}
1017
870
# adding all client settings
1018
871
for setting, value in settings.items():
1019
872
setattr(self, setting, value)
1020
873
1021
874
if self.enabled:
1022
875
if not hasattr(self, "last_enabled"):
1023
876
self.last_enabled = datetime.datetime.utcnow()
1027
880
else:
1028
881
self.last_enabled = None
1029
882
self.expires = None
1030
1031
log.debug("Creating client %r", self.name)
1032
log.debug(" Key ID: %s", self.key_id)
1033
log.debug(" Fingerprint: %s", self.fingerprint)
883
884
logger.debug("Creating client %r", self.name)
885
logger.debug(" Fingerprint: %s", self.fingerprint)
1034
886
self.created = settings.get("created",
1035
887
datetime.datetime.utcnow())
1036
888
1037
889
# attributes specific for this server instance
1038
890
self.checker = None
1039
891
self.checker_initiator_tag = None
1048
900
for attr in self.__dict__.keys()
1049
901
if not attr.startswith("_")]
1050
902
self.client_structure.append("client_structure")
1051
903
1052
904
for name, t in inspect.getmembers(
1053
905
type(self), lambda obj: isinstance(obj, property)):
1054
906
if not name.startswith("_"):
1055
907
self.client_structure.append(name)
1056
908
1057
909
# Send notice to process children that client state has changed
1058
910
def send_changedstate(self):
1059
911
with self.changedstate:
1060
912
self.changedstate.notify_all()
1061
913
1062
914
def enable(self):
1063
915
"""Start this client's checker and timeout hooks"""
1064
916
if getattr(self, "enabled", False):
1065
917
# Already enabled
1066
918
return
919
self.expires = datetime.datetime.utcnow() + self.timeout
1067
920
self.enabled = True
1068
921
self.last_enabled = datetime.datetime.utcnow()
1069
922
self.init_checker()
1070
923
self.send_changedstate()
1071
924
1072
925
def disable(self, quiet=True):
1073
926
"""Disable this client."""
1074
927
if not getattr(self, "enabled", False):
1075
928
return False
1076
929
if not quiet:
1077
log.info("Disabling client %s", self.name)
930
logger.info("Disabling client %s", self.name)
1078
931
if getattr(self, "disable_initiator_tag", None) is not None:
1079
GLib.source_remove(self.disable_initiator_tag)
932
GObject.source_remove(self.disable_initiator_tag)
1080
933
self.disable_initiator_tag = None
1081
934
self.expires = None
1082
935
if getattr(self, "checker_initiator_tag", None) is not None:
1083
GLib.source_remove(self.checker_initiator_tag)
936
GObject.source_remove(self.checker_initiator_tag)
1084
937
self.checker_initiator_tag = None
1085
938
self.stop_checker()
1086
939
self.enabled = False
1087
940
if not quiet:
1088
941
self.send_changedstate()
1089
# Do not run this again if called by a GLib.timeout_add
942
# Do not run this again if called by a GObject.timeout_add
1090
943
return False
1091
944
1092
945
def __del__(self):
1093
946
self.disable()
1094
1095
def init_checker(self, randomize_start=False):
1096
# Schedule a new checker to be started a randomly selected
1097
# time (a fraction of 'interval') from now. This spreads out
1098
# the startup of checkers over time when the server is
1099
# started.
947
948
def init_checker(self):
949
# Schedule a new checker to be started an 'interval' from now,
950
# and every interval from then on.
1100
951
if self.checker_initiator_tag is not None:
1101
GLib.source_remove(self.checker_initiator_tag)
1102
interval_milliseconds = int(self.interval.total_seconds()
1103
* 1000)
1104
if randomize_start:
1105
delay_milliseconds = random.randrange(
1106
interval_milliseconds + 1)
1107
else:
1108
delay_milliseconds = interval_milliseconds
1109
self.checker_initiator_tag = GLib.timeout_add(
1110
delay_milliseconds, self.start_checker, randomize_start)
1111
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1112
# A checker might take up to an 'interval' of time, so we can
1113
# expire at the soonest one interval after a checker was
1114
# started. Since the initial checker is delayed, the expire
1115
# time might have to be extended.
1116
now = datetime.datetime.utcnow()
1117
self.expires = now + delay + self.interval
1118
# Schedule a disable() at expire time
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
954
int(self.interval.total_seconds() * 1000),
955
self.start_checker)
956
# Schedule a disable() when 'timeout' has passed
1119
957
if self.disable_initiator_tag is not None:
1120
GLib.source_remove(self.disable_initiator_tag)
1121
self.disable_initiator_tag = GLib.timeout_add(
1122
int((self.expires - now).total_seconds() * 1000),
1123
self.disable)
1124
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
960
int(self.timeout.total_seconds() * 1000), self.disable)
961
# Also start a new checker *right now*.
962
self.start_checker()
963
1125
964
def checker_callback(self, source, condition, connection,
1126
965
command):
1127
966
"""The checker has completed, so take appropriate actions."""
967
self.checker_callback_tag = None
968
self.checker = None
1128
969
# Read return code from connection (see call_pipe)
1129
970
returncode = connection.recv()
1130
971
connection.close()
1131
if self.checker is not None:
1132
self.checker.join()
1133
self.checker_callback_tag = None
1134
self.checker = None
1135
972
1136
973
if returncode >= 0:
1137
974
self.last_checker_status = returncode
1138
975
self.last_checker_signal = None
1139
976
if self.last_checker_status == 0:
1140
log.info("Checker for %(name)s succeeded", vars(self))
977
logger.info("Checker for %(name)s succeeded",
978
vars(self))
1141
979
self.checked_ok()
1142
980
else:
1143
log.info("Checker for %(name)s failed", vars(self))
981
logger.info("Checker for %(name)s failed", vars(self))
1144
982
else:
1145
983
self.last_checker_status = -1
1146
984
self.last_checker_signal = -returncode
1147
log.warning("Checker for %(name)s crashed?", vars(self))
985
logger.warning("Checker for %(name)s crashed?",
986
vars(self))
1148
987
return False
1149
988
1150
989
def checked_ok(self):
1151
990
"""Assert that the client has been seen, alive and well."""
1152
991
self.last_checked_ok = datetime.datetime.utcnow()
1153
992
self.last_checker_status = 0
1154
993
self.last_checker_signal = None
1155
994
self.bump_timeout()
1156
995
1157
996
def bump_timeout(self, timeout=None):
1158
997
"""Bump up the timeout for this client."""
1159
998
if timeout is None:
1160
999
timeout = self.timeout
1161
1000
if self.disable_initiator_tag is not None:
1162
GLib.source_remove(self.disable_initiator_tag)
1001
GObject.source_remove(self.disable_initiator_tag)
1163
1002
self.disable_initiator_tag = None
1164
1003
if getattr(self, "enabled", False):
1165
self.disable_initiator_tag = GLib.timeout_add(
1004
self.disable_initiator_tag = GObject.timeout_add(
1166
1005
int(timeout.total_seconds() * 1000), self.disable)
1167
1006
self.expires = datetime.datetime.utcnow() + timeout
1168
1007
1169
1008
def need_approval(self):
1170
1009
self.last_approval_request = datetime.datetime.utcnow()
1171
1172
def start_checker(self, start_was_randomized=False):
1010
1011
def start_checker(self):
1173
1012
"""Start a new checker subprocess if one is not running.
1174
1013
1175
1014
If a checker already exists, leave it running and do
1176
1015
nothing."""
1177
1016
# The reason for not killing a running checker is that if we
1182
1021
# checkers alone, the checker would have to take more time
1183
1022
# than 'timeout' for the client to be disabled, which is as it
1184
1023
# should be.
1185
1024
1186
1025
if self.checker is not None and not self.checker.is_alive():
1187
log.warning("Checker was not alive; joining")
1026
logger.warning("Checker was not alive; joining")
1188
1027
self.checker.join()
1189
1028
self.checker = None
1190
1029
# Start a new checker if needed
1191
1030
if self.checker is None:
1192
1031
# Escape attributes for the shell
1193
1032
escaped_attrs = {
1194
attr: shlex.quote(str(getattr(self, attr)))
1195
for attr in self.runtime_expansions}
1033
attr: re.escape(str(getattr(self, attr)))
1034
for attr in self.runtime_expansions }
1196
1035
try:
1197
1036
command = self.checker_command % escaped_attrs
1198
1037
except TypeError as error:
1199
log.error('Could not format string "%s"',
1200
self.checker_command, exc_info=error)
1038
logger.error('Could not format string "%s"',
1039
self.checker_command,
1040
exc_info=error)
1201
1041
return True # Try again later
1202
1042
self.current_checker_command = command
1203
log.info("Starting checker %r for %s", command, self.name)
1043
logger.info("Starting checker %r for %s", command,
1044
self.name)
1204
1045
# We don't need to redirect stdout and stderr, since
1205
1046
# in normal mode, that is already done by daemon(),
1206
1047
# and in debug mode we don't want to. (Stdin is
1208
1049
# The exception is when not debugging but nevertheless
1209
1050
# running in the foreground; use the previously
1210
1051
# created wnull.
1211
popen_args = {"close_fds": True,
1212
"shell": True,
1213
"cwd": "/"}
1052
popen_args = { "close_fds": True,
1053
"shell": True,
1054
"cwd": "/" }
1214
1055
if (not self.server_settings["debug"]
1215
1056
and self.server_settings["foreground"]):
1216
1057
popen_args.update({"stdout": wnull,
1217
"stderr": wnull})
1218
pipe = multiprocessing.Pipe(duplex=False)
1058
"stderr": wnull })
1059
pipe = multiprocessing.Pipe(duplex = False)
1219
1060
self.checker = multiprocessing.Process(
1220
target=call_pipe,
1221
args=(pipe[1], subprocess.call, command),
1222
kwargs=popen_args)
1061
target = call_pipe,
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1223
1064
self.checker.start()
1224
self.checker_callback_tag = GLib.io_add_watch(
1225
GLib.IOChannel.unix_new(pipe[0].fileno()),
1226
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1227
1067
self.checker_callback, pipe[0], command)
1228
if start_was_randomized:
1229
# We were started after a random delay; Schedule a new
1230
# checker to be started an 'interval' from now, and every
1231
# interval from then on.
1232
now = datetime.datetime.utcnow()
1233
self.checker_initiator_tag = GLib.timeout_add(
1234
int(self.interval.total_seconds() * 1000),
1235
self.start_checker)
1236
self.expires = max(self.expires, now + self.interval)
1237
# Don't start a new checker again after same random delay
1238
return False
1239
# Re-run this periodically if run by GLib.timeout_add
1068
# Re-run this periodically if run by GObject.timeout_add
1240
1069
return True
1241
1070
1242
1071
def stop_checker(self):
1243
1072
"""Force the checker process, if any, to stop."""
1244
1073
if self.checker_callback_tag:
1245
GLib.source_remove(self.checker_callback_tag)
1074
GObject.source_remove(self.checker_callback_tag)
1246
1075
self.checker_callback_tag = None
1247
1076
if getattr(self, "checker", None) is None:
1248
1077
return
1249
log.debug("Stopping checker for %(name)s", vars(self))
1078
logger.debug("Stopping checker for %(name)s", vars(self))
1250
1079
self.checker.terminate()
1251
1080
self.checker = None
1252
1081
1257
1086
byte_arrays=False):
1258
1087
"""Decorators for marking methods of a DBusObjectWithProperties to
1259
1088
become properties on the D-Bus.
1260
1089
1261
1090
The decorated method will be called with no arguments by "Get"
1262
1091
and with one argument by "Set".
1263
1092
1264
1093
The parameters, where they are supported, are the same as
1265
1094
dbus.service.method, except there is only "signature", since the
1266
1095
type from Get() and the type sent to Set() is the same.
1270
1099
if byte_arrays and signature != "ay":
1271
1100
raise ValueError("Byte arrays not supported for non-'ay'"
1272
1101
" signature {!r}".format(signature))
1273
1102
1274
1103
def decorator(func):
1275
1104
func._dbus_is_property = True
1276
1105
func._dbus_interface = dbus_interface
1279
1108
func._dbus_name = func.__name__
1280
1109
if func._dbus_name.endswith("_dbus_property"):
1281
1110
func._dbus_name = func._dbus_name[:-14]
1282
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1111
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1283
1112
return func
1284
1113
1285
1114
return decorator
1286
1115
1287
1116
1288
1117
def dbus_interface_annotations(dbus_interface):
1289
1118
"""Decorator for marking functions returning interface annotations
1290
1119
1291
1120
Usage:
1292
1121
1293
1122
@dbus_interface_annotations("org.example.Interface")
1294
1123
def _foo(self): # Function name does not matter
1295
1124
return {"org.freedesktop.DBus.Deprecated": "true",
1296
1125
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1297
1126
"false"}
1298
1127
"""
1299
1128
1300
1129
def decorator(func):
1301
1130
func._dbus_is_interface = True
1302
1131
func._dbus_interface = dbus_interface
1303
1132
func._dbus_name = dbus_interface
1304
1133
return func
1305
1134
1306
1135
return decorator
1307
1136
1308
1137
1309
1138
def dbus_annotations(annotations):
1310
1139
"""Decorator to annotate D-Bus methods, signals or properties
1311
1140
Usage:
1312
1141
1313
1142
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1314
1143
"org.freedesktop.DBus.Property."
1315
1144
"EmitsChangedSignal": "false"})
1317
1146
access="r")
1318
1147
def Property_dbus_property(self):
1319
1148
return dbus.Boolean(False)
1320
1149
1321
1150
See also the DBusObjectWithAnnotations class.
1322
1151
"""
1323
1152
1324
1153
def decorator(func):
1325
1154
func._dbus_annotations = annotations
1326
1155
return func
1327
1156
1328
1157
return decorator
1329
1158
1330
1159
1348
1177
1349
1178
class DBusObjectWithAnnotations(dbus.service.Object):
1350
1179
"""A D-Bus object with annotations.
1351
1180
1352
1181
Classes inheriting from this can use the dbus_annotations
1353
1182
decorator to add annotations to methods or signals.
1354
1183
"""
1355
1184
1356
1185
@staticmethod
1357
1186
def _is_dbus_thing(thing):
1358
1187
"""Returns a function testing if an attribute is a D-Bus thing
1359
1188
1360
1189
If called like _is_dbus_thing("method") it returns a function
1361
1190
suitable for use as predicate to inspect.getmembers().
1362
1191
"""
1363
1192
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1364
1193
False)
1365
1194
1366
1195
def _get_all_dbus_things(self, thing):
1367
1196
"""Returns a generator of (name, attribute) pairs
1368
1197
"""
1371
1200
for cls in self.__class__.__mro__
1372
1201
for name, athing in
1373
1202
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1374
1203
1375
1204
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1376
out_signature="s",
1377
path_keyword="object_path",
1378
connection_keyword="connection")
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1379
1208
def Introspect(self, object_path, connection):
1380
1209
"""Overloading of standard D-Bus method.
1381
1210
1382
1211
Inserts annotation tags on methods and signals.
1383
1212
"""
1384
1213
xmlstring = dbus.service.Object.Introspect(self, object_path,
1385
1214
connection)
1386
1215
try:
1387
1216
document = xml.dom.minidom.parseString(xmlstring)
1388
1217
1389
1218
for if_tag in document.getElementsByTagName("interface"):
1390
1219
# Add annotation tags
1391
1220
for typ in ("method", "signal"):
1418
1247
if_tag.appendChild(ann_tag)
1419
1248
# Fix argument name for the Introspect method itself
1420
1249
if (if_tag.getAttribute("name")
1421
== dbus.INTROSPECTABLE_IFACE):
1250
== dbus.INTROSPECTABLE_IFACE):
1422
1251
for cn in if_tag.getElementsByTagName("method"):
1423
1252
if cn.getAttribute("name") == "Introspect":
1424
1253
for arg in cn.getElementsByTagName("arg"):
1430
1259
document.unlink()
1431
1260
except (AttributeError, xml.dom.DOMException,
1432
1261
xml.parsers.expat.ExpatError) as error:
1433
log.error("Failed to override Introspection method",
1434
exc_info=error)
1262
logger.error("Failed to override Introspection method",
1263
exc_info=error)
1435
1264
return xmlstring
1436
1265
1437
1266
1438
1267
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1439
1268
"""A D-Bus object with properties.
1440
1269
1441
1270
Classes inheriting from this can use the dbus_service_property
1442
1271
decorator to expose methods as D-Bus properties. It exposes the
1443
1272
standard Get(), Set(), and GetAll() methods on the D-Bus.
1444
1273
"""
1445
1274
1446
1275
def _get_dbus_property(self, interface_name, property_name):
1447
1276
"""Returns a bound method if one exists which is a D-Bus
1448
1277
property with the specified name and interface.
1453
1282
if (value._dbus_name == property_name
1454
1283
and value._dbus_interface == interface_name):
1455
1284
return value.__get__(self)
1456
1285
1457
1286
# No such property
1458
1287
raise DBusPropertyNotFound("{}:{}.{}".format(
1459
1288
self.dbus_object_path, interface_name, property_name))
1460
1289
1461
1290
@classmethod
1462
1291
def _get_all_interface_names(cls):
1463
1292
"""Get a sequence of all interfaces supported by an object"""
1466
1295
for x in (inspect.getmro(cls))
1467
1296
for attr in dir(x))
1468
1297
if name is not None)
1469
1298
1470
1299
@dbus.service.method(dbus.PROPERTIES_IFACE,
1471
1300
in_signature="ss",
1472
1301
out_signature="v")
1480
1309
if not hasattr(value, "variant_level"):
1481
1310
return value
1482
1311
return type(value)(value, variant_level=value.variant_level+1)
1483
1312
1484
1313
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1485
1314
def Set(self, interface_name, property_name, value):
1486
1315
"""Standard D-Bus property Set() method, see D-Bus standard.
1495
1324
raise ValueError("Byte arrays not supported for non-"
1496
1325
"'ay' signature {!r}"
1497
1326
.format(prop._dbus_signature))
1498
value = dbus.ByteArray(bytes(value))
1327
value = dbus.ByteArray(b''.join(chr(byte)
1328
for byte in value))
1499
1329
prop(value)
1500
1330
1501
1331
@dbus.service.method(dbus.PROPERTIES_IFACE,
1502
1332
in_signature="s",
1503
1333
out_signature="a{sv}")
1504
1334
def GetAll(self, interface_name):
1505
1335
"""Standard D-Bus property GetAll() method, see D-Bus
1506
1336
standard.
1507
1337
1508
1338
Note: Will not include properties with access="write".
1509
1339
"""
1510
1340
properties = {}
1521
1351
properties[name] = value
1522
1352
continue
1523
1353
properties[name] = type(value)(
1524
value, variant_level=value.variant_level + 1)
1354
value, variant_level = value.variant_level + 1)
1525
1355
return dbus.Dictionary(properties, signature="sv")
1526
1356
1527
1357
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1528
1358
def PropertiesChanged(self, interface_name, changed_properties,
1529
1359
invalidated_properties):
1531
1361
standard.
1532
1362
"""
1533
1363
pass
1534
1364
1535
1365
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1536
1366
out_signature="s",
1537
path_keyword="object_path",
1538
connection_keyword="connection")
1367
path_keyword='object_path',
1368
connection_keyword='connection')
1539
1369
def Introspect(self, object_path, connection):
1540
1370
"""Overloading of standard D-Bus method.
1541
1371
1542
1372
Inserts property tags and interface annotation tags.
1543
1373
"""
1544
1374
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1546
1376
connection)
1547
1377
try:
1548
1378
document = xml.dom.minidom.parseString(xmlstring)
1549
1379
1550
1380
def make_tag(document, name, prop):
1551
1381
e = document.createElement("property")
1552
1382
e.setAttribute("name", name)
1553
1383
e.setAttribute("type", prop._dbus_signature)
1554
1384
e.setAttribute("access", prop._dbus_access)
1555
1385
return e
1556
1386
1557
1387
for if_tag in document.getElementsByTagName("interface"):
1558
1388
# Add property tags
1559
1389
for tag in (make_tag(document, name, prop)
1597
1427
document.unlink()
1598
1428
except (AttributeError, xml.dom.DOMException,
1599
1429
xml.parsers.expat.ExpatError) as error:
1600
log.error("Failed to override Introspection method",
1601
exc_info=error)
1430
logger.error("Failed to override Introspection method",
1431
exc_info=error)
1602
1432
return xmlstring
1603
1433
1604
1605
1434
try:
1606
1435
dbus.OBJECT_MANAGER_IFACE
1607
1436
except AttributeError:
1608
1437
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1609
1438
1610
1611
1439
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1612
1440
"""A D-Bus object with an ObjectManager.
1613
1441
1614
1442
Classes inheriting from this exposes the standard
1615
1443
GetManagedObjects call and the InterfacesAdded and
1616
1444
InterfacesRemoved signals on the standard
1617
1445
"org.freedesktop.DBus.ObjectManager" interface.
1618
1446
1619
1447
Note: No signals are sent automatically; they must be sent
1620
1448
manually.
1621
1449
"""
1622
1450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1623
out_signature="a{oa{sa{sv}}}")
1451
out_signature = "a{oa{sa{sv}}}")
1624
1452
def GetManagedObjects(self):
1625
1453
"""This function must be overridden"""
1626
1454
raise NotImplementedError()
1627
1455
1628
1456
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1629
signature="oa{sa{sv}}")
1457
signature = "oa{sa{sv}}")
1630
1458
def InterfacesAdded(self, object_path, interfaces_and_properties):
1631
1459
pass
1632
1633
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1460
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1634
1462
def InterfacesRemoved(self, object_path, interfaces):
1635
1463
pass
1636
1464
1637
1465
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1638
out_signature="s",
1639
path_keyword="object_path",
1640
connection_keyword="connection")
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1641
1469
def Introspect(self, object_path, connection):
1642
1470
"""Overloading of standard D-Bus method.
1643
1471
1644
1472
Override return argument name of GetManagedObjects to be
1645
1473
"objpath_interfaces_and_properties"
1646
1474
"""
1649
1477
connection)
1650
1478
try:
1651
1479
document = xml.dom.minidom.parseString(xmlstring)
1652
1480
1653
1481
for if_tag in document.getElementsByTagName("interface"):
1654
1482
# Fix argument name for the GetManagedObjects method
1655
1483
if (if_tag.getAttribute("name")
1656
== dbus.OBJECT_MANAGER_IFACE):
1484
== dbus.OBJECT_MANAGER_IFACE):
1657
1485
for cn in if_tag.getElementsByTagName("method"):
1658
1486
if (cn.getAttribute("name")
1659
1487
== "GetManagedObjects"):
1668
1496
document.unlink()
1669
1497
except (AttributeError, xml.dom.DOMException,
1670
1498
xml.parsers.expat.ExpatError) as error:
1671
log.error("Failed to override Introspection method",
1672
exc_info=error)
1499
logger.error("Failed to override Introspection method",
1500
exc_info = error)
1673
1501
return xmlstring
1674
1502
1675
1676
1503
def datetime_to_dbus(dt, variant_level=0):
1677
1504
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1678
1505
if dt is None:
1679
return dbus.String("", variant_level=variant_level)
1506
return dbus.String("", variant_level = variant_level)
1680
1507
return dbus.String(dt.isoformat(), variant_level=variant_level)
1681
1508
1682
1509
1685
1512
dbus.service.Object, it will add alternate D-Bus attributes with
1686
1513
interface names according to the "alt_interface_names" mapping.
1687
1514
Usage:
1688
1515
1689
1516
@alternate_dbus_interfaces({"org.example.Interface":
1690
1517
"net.example.AlternateInterface"})
1691
1518
class SampleDBusObject(dbus.service.Object):
1692
1519
@dbus.service.method("org.example.Interface")
1693
1520
def SampleDBusMethod():
1694
1521
pass
1695
1522
1696
1523
The above "SampleDBusMethod" on "SampleDBusObject" will be
1697
1524
reachable via two interfaces: "org.example.Interface" and
1698
1525
"net.example.AlternateInterface", the latter of which will have
1699
1526
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1700
1527
"true", unless "deprecate" is passed with a False value.
1701
1528
1702
1529
This works for methods and signals, and also for D-Bus properties
1703
1530
(from DBusObjectWithProperties) and interfaces (from the
1704
1531
dbus_interface_annotations decorator).
1705
1532
"""
1706
1533
1707
1534
def wrapper(cls):
1708
1535
for orig_interface_name, alt_interface_name in (
1709
1536
alt_interface_names.items()):
1749
1576
attribute._dbus_annotations)
1750
1577
except AttributeError:
1751
1578
pass
1752
1753
1579
# Define a creator of a function to call both the
1754
1580
# original and alternate functions, so both the
1755
1581
# original and alternate signals gets sent when
1758
1584
"""This function is a scope container to pass
1759
1585
func1 and func2 to the "call_both" function
1760
1586
outside of its arguments"""
1761
1587
1762
1588
@functools.wraps(func2)
1763
1589
def call_both(*args, **kwargs):
1764
1590
"""This function will emit two D-Bus
1765
1591
signals by calling func1 and func2"""
1766
1592
func1(*args, **kwargs)
1767
1593
func2(*args, **kwargs)
1768
# Make wrapper function look like a D-Bus
1769
# signal
1594
# Make wrapper function look like a D-Bus signal
1770
1595
for name, attr in inspect.getmembers(func2):
1771
1596
if name.startswith("_dbus_"):
1772
1597
setattr(call_both, name, attr)
1773
1598
1774
1599
return call_both
1775
1600
# Create the "call_both" function and add it to
1776
1601
# the class
1822
1647
(copy_function(attribute)))
1823
1648
if deprecate:
1824
1649
# Deprecate all alternate interfaces
1825
iname = "_AlternateDBusNames_interface_annotation{}"
1650
iname="_AlternateDBusNames_interface_annotation{}"
1826
1651
for interface_name in interface_names:
1827
1652
1828
1653
@dbus_interface_annotations(interface_name)
1829
1654
def func(self):
1830
return {"org.freedesktop.DBus.Deprecated":
1831
"true"}
1655
return { "org.freedesktop.DBus.Deprecated":
1656
"true" }
1832
1657
# Find an unused name
1833
1658
for aname in (iname.format(i)
1834
1659
for i in itertools.count()):
1845
1670
cls = type("{}Alternate".format(cls.__name__),
1846
1671
(cls, ), attr)
1847
1672
return cls
1848
1673
1849
1674
return wrapper
1850
1675
1851
1676
1853
1678
"se.bsnet.fukt.Mandos"})
1854
1679
class ClientDBus(Client, DBusObjectWithProperties):
1855
1680
"""A Client class using D-Bus
1856
1681
1857
1682
Attributes:
1858
1683
dbus_object_path: dbus.ObjectPath
1859
1684
bus: dbus.SystemBus()
1860
1685
"""
1861
1686
1862
1687
runtime_expansions = (Client.runtime_expansions
1863
1688
+ ("dbus_object_path", ))
1864
1689
1865
1690
_interface = "se.recompile.Mandos.Client"
1866
1691
1867
1692
# dbus.service.Object doesn't use super(), so we can't either.
1868
1869
def __init__(self, bus=None, *args, **kwargs):
1693
1694
def __init__(self, bus = None, *args, **kwargs):
1870
1695
self.bus = bus
1871
1696
Client.__init__(self, *args, **kwargs)
1872
1697
# Only now, when this client is initialized, can it show up on
1878
1703
"/clients/" + client_object_name)
1879
1704
DBusObjectWithProperties.__init__(self, self.bus,
1880
1705
self.dbus_object_path)
1881
1706
1882
1707
def notifychangeproperty(transform_func, dbus_name,
1883
1708
type_func=lambda x: x,
1884
1709
variant_level=1,
1886
1711
_interface=_interface):
1887
1712
""" Modify a variable so that it's a property which announces
1888
1713
its changes to DBus.
1889
1714
1890
1715
transform_fun: Function that takes a value and a variant_level
1891
1716
and transforms it to a D-Bus type.
1892
1717
dbus_name: D-Bus name of the variable
1895
1720
variant_level: D-Bus variant level. Default: 1
1896
1721
"""
1897
1722
attrname = "_{}".format(dbus_name)
1898
1723
1899
1724
def setter(self, value):
1900
1725
if hasattr(self, "dbus_object_path"):
1901
1726
if (not hasattr(self, attrname) or
1908
1733
else:
1909
1734
dbus_value = transform_func(
1910
1735
type_func(value),
1911
variant_level=variant_level)
1736
variant_level = variant_level)
1912
1737
self.PropertyChanged(dbus.String(dbus_name),
1913
1738
dbus_value)
1914
1739
self.PropertiesChanged(
1915
1740
_interface,
1916
dbus.Dictionary({dbus.String(dbus_name):
1917
dbus_value}),
1741
dbus.Dictionary({ dbus.String(dbus_name):
1742
dbus_value }),
1918
1743
dbus.Array())
1919
1744
setattr(self, attrname, value)
1920
1745
1921
1746
return property(lambda self: getattr(self, attrname), setter)
1922
1747
1923
1748
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1924
1749
approvals_pending = notifychangeproperty(dbus.Boolean,
1925
1750
"ApprovalPending",
1926
type_func=bool)
1751
type_func = bool)
1927
1752
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1928
1753
last_enabled = notifychangeproperty(datetime_to_dbus,
1929
1754
"LastEnabled")
1930
1755
checker = notifychangeproperty(
1931
1756
dbus.Boolean, "CheckerRunning",
1932
type_func=lambda checker: checker is not None)
1757
type_func = lambda checker: checker is not None)
1933
1758
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1934
1759
"LastCheckedOK")
1935
1760
last_checker_status = notifychangeproperty(dbus.Int16,
1940
1765
"ApprovedByDefault")
1941
1766
approval_delay = notifychangeproperty(
1942
1767
dbus.UInt64, "ApprovalDelay",
1943
type_func=lambda td: td.total_seconds() * 1000)
1768
type_func = lambda td: td.total_seconds() * 1000)
1944
1769
approval_duration = notifychangeproperty(
1945
1770
dbus.UInt64, "ApprovalDuration",
1946
type_func=lambda td: td.total_seconds() * 1000)
1771
type_func = lambda td: td.total_seconds() * 1000)
1947
1772
host = notifychangeproperty(dbus.String, "Host")
1948
1773
timeout = notifychangeproperty(
1949
1774
dbus.UInt64, "Timeout",
1950
type_func=lambda td: td.total_seconds() * 1000)
1775
type_func = lambda td: td.total_seconds() * 1000)
1951
1776
extended_timeout = notifychangeproperty(
1952
1777
dbus.UInt64, "ExtendedTimeout",
1953
type_func=lambda td: td.total_seconds() * 1000)
1778
type_func = lambda td: td.total_seconds() * 1000)
1954
1779
interval = notifychangeproperty(
1955
1780
dbus.UInt64, "Interval",
1956
type_func=lambda td: td.total_seconds() * 1000)
1781
type_func = lambda td: td.total_seconds() * 1000)
1957
1782
checker_command = notifychangeproperty(dbus.String, "Checker")
1958
1783
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1959
1784
invalidate_only=True)
1960
1785
1961
1786
del notifychangeproperty
1962
1787
1963
1788
def __del__(self, *args, **kwargs):
1964
1789
try:
1965
1790
self.remove_from_connection()
1968
1793
if hasattr(DBusObjectWithProperties, "__del__"):
1969
1794
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1970
1795
Client.__del__(self, *args, **kwargs)
1971
1796
1972
1797
def checker_callback(self, source, condition,
1973
1798
connection, command, *args, **kwargs):
1974
1799
ret = Client.checker_callback(self, source, condition,
1990
1815
| self.last_checker_signal),
1991
1816
dbus.String(command))
1992
1817
return ret
1993
1818
1994
1819
def start_checker(self, *args, **kwargs):
1995
1820
old_checker_pid = getattr(self.checker, "pid", None)
1996
1821
r = Client.start_checker(self, *args, **kwargs)
2000
1825
# Emit D-Bus signal
2001
1826
self.CheckerStarted(self.current_checker_command)
2002
1827
return r
2003
1828
2004
1829
def _reset_approved(self):
2005
1830
self.approved = None
2006
1831
return False
2007
1832
2008
1833
def approve(self, value=True):
2009
1834
self.approved = value
2010
GLib.timeout_add(int(self.approval_duration.total_seconds()
2011
* 1000), self._reset_approved)
1835
GObject.timeout_add(int(self.approval_duration.total_seconds()
1836
* 1000), self._reset_approved)
2012
1837
self.send_changedstate()
2013
2014
# D-Bus methods, signals & properties
2015
2016
# Interfaces
2017
2018
# Signals
2019
1838
1839
## D-Bus methods, signals & properties
1840
1841
## Interfaces
1842
1843
## Signals
1844
2020
1845
# CheckerCompleted - signal
2021
1846
@dbus.service.signal(_interface, signature="nxs")
2022
1847
def CheckerCompleted(self, exitcode, waitstatus, command):
2023
1848
"D-Bus signal"
2024
1849
pass
2025
1850
2026
1851
# CheckerStarted - signal
2027
1852
@dbus.service.signal(_interface, signature="s")
2028
1853
def CheckerStarted(self, command):
2029
1854
"D-Bus signal"
2030
1855
pass
2031
1856
2032
1857
# PropertyChanged - signal
2033
1858
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2034
1859
@dbus.service.signal(_interface, signature="sv")
2035
1860
def PropertyChanged(self, property, value):
2036
1861
"D-Bus signal"
2037
1862
pass
2038
1863
2039
1864
# GotSecret - signal
2040
1865
@dbus.service.signal(_interface)
2041
1866
def GotSecret(self):
2044
1869
server to mandos-client
2045
1870
"""
2046
1871
pass
2047
1872
2048
1873
# Rejected - signal
2049
1874
@dbus.service.signal(_interface, signature="s")
2050
1875
def Rejected(self, reason):
2051
1876
"D-Bus signal"
2052
1877
pass
2053
1878
2054
1879
# NeedApproval - signal
2055
1880
@dbus.service.signal(_interface, signature="tb")
2056
1881
def NeedApproval(self, timeout, default):
2057
1882
"D-Bus signal"
2058
1883
return self.need_approval()
2059
2060
# Methods
2061
1884
1885
## Methods
1886
2062
1887
# Approve - method
2063
1888
@dbus.service.method(_interface, in_signature="b")
2064
1889
def Approve(self, value):
2065
1890
self.approve(value)
2066
1891
2067
1892
# CheckedOK - method
2068
1893
@dbus.service.method(_interface)
2069
1894
def CheckedOK(self):
2070
1895
self.checked_ok()
2071
1896
2072
1897
# Enable - method
2073
1898
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2074
1899
@dbus.service.method(_interface)
2075
1900
def Enable(self):
2076
1901
"D-Bus method"
2077
1902
self.enable()
2078
1903
2079
1904
# StartChecker - method
2080
1905
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2081
1906
@dbus.service.method(_interface)
2082
1907
def StartChecker(self):
2083
1908
"D-Bus method"
2084
1909
self.start_checker()
2085
1910
2086
1911
# Disable - method
2087
1912
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2088
1913
@dbus.service.method(_interface)
2089
1914
def Disable(self):
2090
1915
"D-Bus method"
2091
1916
self.disable()
2092
1917
2093
1918
# StopChecker - method
2094
1919
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2095
1920
@dbus.service.method(_interface)
2096
1921
def StopChecker(self):
2097
1922
self.stop_checker()
2098
2099
# Properties
2100
1923
1924
## Properties
1925
2101
1926
# ApprovalPending - property
2102
1927
@dbus_service_property(_interface, signature="b", access="read")
2103
1928
def ApprovalPending_dbus_property(self):
2104
1929
return dbus.Boolean(bool(self.approvals_pending))
2105
1930
2106
1931
# ApprovedByDefault - property
2107
1932
@dbus_service_property(_interface,
2108
1933
signature="b",
2111
1936
if value is None: # get
2112
1937
return dbus.Boolean(self.approved_by_default)
2113
1938
self.approved_by_default = bool(value)
2114
1939
2115
1940
# ApprovalDelay - property
2116
1941
@dbus_service_property(_interface,
2117
1942
signature="t",
2121
1946
return dbus.UInt64(self.approval_delay.total_seconds()
2122
1947
* 1000)
2123
1948
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2124
1949
2125
1950
# ApprovalDuration - property
2126
1951
@dbus_service_property(_interface,
2127
1952
signature="t",
2131
1956
return dbus.UInt64(self.approval_duration.total_seconds()
2132
1957
* 1000)
2133
1958
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2134
1959
2135
1960
# Name - property
2136
1961
@dbus_annotations(
2137
1962
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2138
1963
@dbus_service_property(_interface, signature="s", access="read")
2139
1964
def Name_dbus_property(self):
2140
1965
return dbus.String(self.name)
2141
2142
# KeyID - property
2143
@dbus_annotations(
2144
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2145
@dbus_service_property(_interface, signature="s", access="read")
2146
def KeyID_dbus_property(self):
2147
return dbus.String(self.key_id)
2148
1966
2149
1967
# Fingerprint - property
2150
1968
@dbus_annotations(
2151
1969
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2152
1970
@dbus_service_property(_interface, signature="s", access="read")
2153
1971
def Fingerprint_dbus_property(self):
2154
1972
return dbus.String(self.fingerprint)
2155
1973
2156
1974
# Host - property
2157
1975
@dbus_service_property(_interface,
2158
1976
signature="s",
2161
1979
if value is None: # get
2162
1980
return dbus.String(self.host)
2163
1981
self.host = str(value)
2164
1982
2165
1983
# Created - property
2166
1984
@dbus_annotations(
2167
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2168
1986
@dbus_service_property(_interface, signature="s", access="read")
2169
1987
def Created_dbus_property(self):
2170
1988
return datetime_to_dbus(self.created)
2171
1989
2172
1990
# LastEnabled - property
2173
1991
@dbus_service_property(_interface, signature="s", access="read")
2174
1992
def LastEnabled_dbus_property(self):
2175
1993
return datetime_to_dbus(self.last_enabled)
2176
1994
2177
1995
# Enabled - property
2178
1996
@dbus_service_property(_interface,
2179
1997
signature="b",
2185
2003
self.enable()
2186
2004
else:
2187
2005
self.disable()
2188
2006
2189
2007
# LastCheckedOK - property
2190
2008
@dbus_service_property(_interface,
2191
2009
signature="s",
2195
2013
self.checked_ok()
2196
2014
return
2197
2015
return datetime_to_dbus(self.last_checked_ok)
2198
2016
2199
2017
# LastCheckerStatus - property
2200
2018
@dbus_service_property(_interface, signature="n", access="read")
2201
2019
def LastCheckerStatus_dbus_property(self):
2202
2020
return dbus.Int16(self.last_checker_status)
2203
2021
2204
2022
# Expires - property
2205
2023
@dbus_service_property(_interface, signature="s", access="read")
2206
2024
def Expires_dbus_property(self):
2207
2025
return datetime_to_dbus(self.expires)
2208
2026
2209
2027
# LastApprovalRequest - property
2210
2028
@dbus_service_property(_interface, signature="s", access="read")
2211
2029
def LastApprovalRequest_dbus_property(self):
2212
2030
return datetime_to_dbus(self.last_approval_request)
2213
2031
2214
2032
# Timeout - property
2215
2033
@dbus_service_property(_interface,
2216
2034
signature="t",
2231
2049
if (getattr(self, "disable_initiator_tag", None)
2232
2050
is None):
2233
2051
return
2234
GLib.source_remove(self.disable_initiator_tag)
2235
self.disable_initiator_tag = GLib.timeout_add(
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2236
2054
int((self.expires - now).total_seconds() * 1000),
2237
2055
self.disable)
2238
2056
2239
2057
# ExtendedTimeout - property
2240
2058
@dbus_service_property(_interface,
2241
2059
signature="t",
2245
2063
return dbus.UInt64(self.extended_timeout.total_seconds()
2246
2064
* 1000)
2247
2065
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2248
2066
2249
2067
# Interval - property
2250
2068
@dbus_service_property(_interface,
2251
2069
signature="t",
2258
2076
return
2259
2077
if self.enabled:
2260
2078
# Reschedule checker run
2261
GLib.source_remove(self.checker_initiator_tag)
2262
self.checker_initiator_tag = GLib.timeout_add(
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2263
2081
value, self.start_checker)
2264
self.start_checker() # Start one now, too
2265
2082
self.start_checker() # Start one now, too
2083
2266
2084
# Checker - property
2267
2085
@dbus_service_property(_interface,
2268
2086
signature="s",
2271
2089
if value is None: # get
2272
2090
return dbus.String(self.checker_command)
2273
2091
self.checker_command = str(value)
2274
2092
2275
2093
# CheckerRunning - property
2276
2094
@dbus_service_property(_interface,
2277
2095
signature="b",
2283
2101
self.start_checker()
2284
2102
else:
2285
2103
self.stop_checker()
2286
2104
2287
2105
# ObjectPath - property
2288
2106
@dbus_annotations(
2289
2107
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2290
2108
"org.freedesktop.DBus.Deprecated": "true"})
2291
2109
@dbus_service_property(_interface, signature="o", access="read")
2292
2110
def ObjectPath_dbus_property(self):
2293
return self.dbus_object_path # is already a dbus.ObjectPath
2294
2111
return self.dbus_object_path # is already a dbus.ObjectPath
2112
2295
2113
# Secret = property
2296
2114
@dbus_annotations(
2297
2115
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2302
2120
byte_arrays=True)
2303
2121
def Secret_dbus_property(self, value):
2304
2122
self.secret = bytes(value)
2305
2123
2306
2124
del _interface
2307
2125
2308
2126
2309
class ProxyClient:
2310
def __init__(self, child_pipe, key_id, fpr, address):
2127
class ProxyClient(object):
2128
def __init__(self, child_pipe, fpr, address):
2311
2129
self._pipe = child_pipe
2312
self._pipe.send(("init", key_id, fpr, address))
2130
self._pipe.send(('init', fpr, address))
2313
2131
if not self._pipe.recv():
2314
raise KeyError(key_id or fpr)
2315
2132
raise KeyError(fpr)
2133
2316
2134
def __getattribute__(self, name):
2317
if name == "_pipe":
2135
if name == '_pipe':
2318
2136
return super(ProxyClient, self).__getattribute__(name)
2319
self._pipe.send(("getattr", name))
2137
self._pipe.send(('getattr', name))
2320
2138
data = self._pipe.recv()
2321
if data[0] == "data":
2139
if data[0] == 'data':
2322
2140
return data[1]
2323
if data[0] == "function":
2324
2141
if data[0] == 'function':
2142
2325
2143
def func(*args, **kwargs):
2326
self._pipe.send(("funcall", name, args, kwargs))
2144
self._pipe.send(('funcall', name, args, kwargs))
2327
2145
return self._pipe.recv()[1]
2328
2146
2329
2147
return func
2330
2148
2331
2149
def __setattr__(self, name, value):
2332
if name == "_pipe":
2150
if name == '_pipe':
2333
2151
return super(ProxyClient, self).__setattr__(name, value)
2334
self._pipe.send(("setattr", name, value))
2152
self._pipe.send(('setattr', name, value))
2335
2153
2336
2154
2337
2155
class ClientHandler(socketserver.BaseRequestHandler, object):
2338
2156
"""A class to handle client connections.
2339
2157
2340
2158
Instantiated once for each connection to handle it.
2341
2159
Note: This will run in its own forked process."""
2342
2160
2343
2161
def handle(self):
2344
2162
with contextlib.closing(self.server.child_pipe) as child_pipe:
2345
log.info("TCP connection from: %s",
2346
str(self.client_address))
2347
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2348
2163
logger.info("TCP connection from: %s",
2164
str(self.client_address))
2165
logger.debug("Pipe FD: %d",
2166
self.server.child_pipe.fileno())
2167
2349
2168
session = gnutls.ClientSession(self.request)
2350
2351
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2352
# "+AES-256-CBC", "+SHA1",
2353
# "+COMP-NULL", "+CTYPE-OPENPGP",
2354
# "+DHE-DSS"))
2169
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2173
# "+DHE-DSS"))
2355
2174
# Use a fallback default, since this MUST be set.
2356
2175
priority = self.server.gnutls_priority
2357
2176
if priority is None:
2358
2177
priority = "NORMAL"
2359
gnutls.priority_set_direct(session,
2360
priority.encode("utf-8"), None)
2361
2178
gnutls.priority_set_direct(session._c_object, priority,
2179
None)
2180
2362
2181
# Start communication using the Mandos protocol
2363
2182
# Get protocol number
2364
2183
line = self.request.makefile().readline()
2365
log.debug("Protocol version: %r", line)
2184
logger.debug("Protocol version: %r", line)
2366
2185
try:
2367
2186
if int(line.strip().split()[0]) > 1:
2368
2187
raise RuntimeError(line)
2369
2188
except (ValueError, IndexError, RuntimeError) as error:
2370
log.error("Unknown protocol version: %s", error)
2189
logger.error("Unknown protocol version: %s", error)
2371
2190
return
2372
2191
2373
2192
# Start GnuTLS connection
2374
2193
try:
2375
2194
session.handshake()
2376
2195
except gnutls.Error as error:
2377
log.warning("Handshake failed: %s", error)
2196
logger.warning("Handshake failed: %s", error)
2378
2197
# Do not run session.bye() here: the session is not
2379
2198
# established. Just abandon the request.
2380
2199
return
2381
log.debug("Handshake succeeded")
2382
2200
logger.debug("Handshake succeeded")
2201
2383
2202
approval_required = False
2384
2203
try:
2385
if gnutls.has_rawpk:
2386
fpr = b""
2387
try:
2388
key_id = self.key_id(
2389
self.peer_certificate(session))
2390
except (TypeError, gnutls.Error) as error:
2391
log.warning("Bad certificate: %s", error)
2392
return
2393
log.debug("Key ID: %s",
2394
key_id.decode("utf-8",
2395
errors="replace"))
2396
2397
else:
2398
key_id = b""
2399
try:
2400
fpr = self.fingerprint(
2401
self.peer_certificate(session))
2402
except (TypeError, gnutls.Error) as error:
2403
log.warning("Bad certificate: %s", error)
2404
return
2405
log.debug("Fingerprint: %s", fpr)
2406
2407
try:
2408
client = ProxyClient(child_pipe, key_id, fpr,
2204
try:
2205
fpr = self.fingerprint(
2206
self.peer_certificate(session))
2207
except (TypeError, gnutls.Error) as error:
2208
logger.warning("Bad certificate: %s", error)
2209
return
2210
logger.debug("Fingerprint: %s", fpr)
2211
2212
try:
2213
client = ProxyClient(child_pipe, fpr,
2409
2214
self.client_address)
2410
2215
except KeyError:
2411
2216
return
2412
2217
2413
2218
if client.approval_delay:
2414
2219
delay = client.approval_delay
2415
2220
client.approvals_pending += 1
2416
2221
approval_required = True
2417
2222
2418
2223
while True:
2419
2224
if not client.enabled:
2420
log.info("Client %s is disabled", client.name)
2225
logger.info("Client %s is disabled",
2226
client.name)
2421
2227
if self.server.use_dbus:
2422
2228
# Emit D-Bus signal
2423
2229
client.Rejected("Disabled")
2424
2230
return
2425
2231
2426
2232
if client.approved or not client.approval_delay:
2427
# We are approved or approval is disabled
2233
#We are approved or approval is disabled
2428
2234
break
2429
2235
elif client.approved is None:
2430
log.info("Client %s needs approval",
2431
client.name)
2236
logger.info("Client %s needs approval",
2237
client.name)
2432
2238
if self.server.use_dbus:
2433
2239
# Emit D-Bus signal
2434
2240
client.NeedApproval(
2435
2241
client.approval_delay.total_seconds()
2436
2242
* 1000, client.approved_by_default)
2437
2243
else:
2438
log.warning("Client %s was not approved",
2439
client.name)
2244
logger.warning("Client %s was not approved",
2245
client.name)
2440
2246
if self.server.use_dbus:
2441
2247
# Emit D-Bus signal
2442
2248
client.Rejected("Denied")
2443
2249
return
2444
2445
# wait until timeout or approved
2250
2251
#wait until timeout or approved
2446
2252
time = datetime.datetime.now()
2447
2253
client.changedstate.acquire()
2448
2254
client.changedstate.wait(delay.total_seconds())
2450
2256
time2 = datetime.datetime.now()
2451
2257
if (time2 - time) >= delay:
2452
2258
if not client.approved_by_default:
2453
log.warning("Client %s timed out while"
2454
" waiting for approval",
2455
client.name)
2259
logger.warning("Client %s timed out while"
2260
" waiting for approval",
2261
client.name)
2456
2262
if self.server.use_dbus:
2457
2263
# Emit D-Bus signal
2458
2264
client.Rejected("Approval timed out")
2461
2267
break
2462
2268
else:
2463
2269
delay -= time2 - time
2464
2270
2465
2271
try:
2466
2272
session.send(client.secret)
2467
2273
except gnutls.Error as error:
2468
log.warning("gnutls send failed", exc_info=error)
2274
logger.warning("gnutls send failed",
2275
exc_info = error)
2469
2276
return
2470
2471
log.info("Sending secret to %s", client.name)
2277
2278
logger.info("Sending secret to %s", client.name)
2472
2279
# bump the timeout using extended_timeout
2473
2280
client.bump_timeout(client.extended_timeout)
2474
2281
if self.server.use_dbus:
2475
2282
# Emit D-Bus signal
2476
2283
client.GotSecret()
2477
2284
2478
2285
finally:
2479
2286
if approval_required:
2480
2287
client.approvals_pending -= 1
2481
2288
try:
2482
2289
session.bye()
2483
2290
except gnutls.Error as error:
2484
log.warning("GnuTLS bye failed", exc_info=error)
2485
2291
logger.warning("GnuTLS bye failed",
2292
exc_info=error)
2293
2486
2294
@staticmethod
2487
2295
def peer_certificate(session):
2488
"Return the peer's certificate as a bytestring"
2489
try:
2490
cert_type = gnutls.certificate_type_get2(
2491
session, gnutls.CTYPE_PEERS)
2492
except AttributeError:
2493
cert_type = gnutls.certificate_type_get(session)
2494
if gnutls.has_rawpk:
2495
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2496
else:
2497
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2498
# If not a valid certificate type...
2499
if cert_type not in valid_cert_types:
2500
log.info("Cert type %r not in %r", cert_type,
2501
valid_cert_types)
2296
"Return the peer's OpenPGP certificate as a bytestring"
2297
# If not an OpenPGP certificate...
2298
if (gnutls.certificate_type_get(session._c_object)
2299
!= gnutls.CRT_OPENPGP):
2502
2300
# ...return invalid data
2503
2301
return b""
2504
2302
list_size = ctypes.c_uint(1)
2505
2303
cert_list = (gnutls.certificate_get_peers
2506
(session, ctypes.byref(list_size)))
2304
(session._c_object, ctypes.byref(list_size)))
2507
2305
if not bool(cert_list) and list_size.value != 0:
2508
2306
raise gnutls.Error("error getting peer certificate")
2509
2307
if list_size.value == 0:
2510
2308
return None
2511
2309
cert = cert_list[0]
2512
2310
return ctypes.string_at(cert.data, cert.size)
2513
2514
@staticmethod
2515
def key_id(certificate):
2516
"Convert a certificate bytestring to a hexdigit key ID"
2517
# New GnuTLS "datum" with the public key
2518
datum = gnutls.datum_t(
2519
ctypes.cast(ctypes.c_char_p(certificate),
2520
ctypes.POINTER(ctypes.c_ubyte)),
2521
ctypes.c_uint(len(certificate)))
2522
# XXX all these need to be created in the gnutls "module"
2523
# New empty GnuTLS certificate
2524
pubkey = gnutls.pubkey_t()
2525
gnutls.pubkey_init(ctypes.byref(pubkey))
2526
# Import the raw public key into the certificate
2527
gnutls.pubkey_import(pubkey,
2528
ctypes.byref(datum),
2529
gnutls.X509_FMT_DER)
2530
# New buffer for the key ID
2531
buf = ctypes.create_string_buffer(32)
2532
buf_len = ctypes.c_size_t(len(buf))
2533
# Get the key ID from the raw public key into the buffer
2534
gnutls.pubkey_get_key_id(
2535
pubkey,
2536
gnutls.KEYID_USE_SHA256,
2537
ctypes.cast(ctypes.byref(buf),
2538
ctypes.POINTER(ctypes.c_ubyte)),
2539
ctypes.byref(buf_len))
2540
# Deinit the certificate
2541
gnutls.pubkey_deinit(pubkey)
2542
2543
# Convert the buffer to a Python bytestring
2544
key_id = ctypes.string_at(buf, buf_len.value)
2545
# Convert the bytestring to hexadecimal notation
2546
hex_key_id = binascii.hexlify(key_id).upper()
2547
return hex_key_id
2548
2311
2549
2312
@staticmethod
2550
2313
def fingerprint(openpgp):
2551
2314
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2566
2329
ctypes.byref(crtverify))
2567
2330
if crtverify.value != 0:
2568
2331
gnutls.openpgp_crt_deinit(crt)
2569
raise gnutls.CertificateSecurityError(code
2570
=crtverify.value)
2332
raise gnutls.CertificateSecurityError("Verify failed")
2571
2333
# New buffer for the fingerprint
2572
2334
buf = ctypes.create_string_buffer(20)
2573
2335
buf_len = ctypes.c_size_t()
2583
2345
return hex_fpr
2584
2346
2585
2347
2586
class MultiprocessingMixIn:
2348
class MultiprocessingMixIn(object):
2587
2349
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2588
2350
2589
2351
def sub_process_main(self, request, address):
2590
2352
try:
2591
2353
self.finish_request(request, address)
2592
2354
except Exception:
2593
2355
self.handle_error(request, address)
2594
2356
self.close_request(request)
2595
2357
2596
2358
def process_request(self, request, address):
2597
2359
"""Start a new process to process the request."""
2598
proc = multiprocessing.Process(target=self.sub_process_main,
2599
args=(request, address))
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2600
2362
proc.start()
2601
2363
return proc
2602
2364
2603
2365
2604
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2605
2367
""" adds a pipe to the MixIn """
2606
2368
2607
2369
def process_request(self, request, client_address):
2608
2370
"""Overrides and wraps the original process_request().
2609
2371
2610
2372
This function creates a new pipe in self.pipe
2611
2373
"""
2612
2374
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2613
2375
2614
2376
proc = MultiprocessingMixIn.process_request(self, request,
2615
2377
client_address)
2616
2378
self.child_pipe.close()
2617
2379
self.add_pipe(parent_pipe, proc)
2618
2380
2619
2381
def add_pipe(self, parent_pipe, proc):
2620
2382
"""Dummy function; override as necessary"""
2621
2383
raise NotImplementedError()
2622
2384
2623
2385
2624
2386
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2625
socketserver.TCPServer):
2626
"""IPv6-capable TCP server. Accepts None as address and/or port
2627
2387
socketserver.TCPServer, object):
2388
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2389
2628
2390
Attributes:
2629
2391
enabled: Boolean; whether this server is activated yet
2630
2392
interface: None or a network interface name (string)
2631
2393
use_ipv6: Boolean; to use IPv6 or not
2632
2394
"""
2633
2395
2634
2396
def __init__(self, server_address, RequestHandlerClass,
2635
2397
interface=None,
2636
2398
use_ipv6=True,
2646
2408
self.socketfd = socketfd
2647
2409
# Save the original socket.socket() function
2648
2410
self.socket_socket = socket.socket
2649
2650
2411
# To implement --socket, we monkey patch socket.socket.
2651
#
2412
#
2652
2413
# (When socketserver.TCPServer is a new-style class, we
2653
2414
# could make self.socket into a property instead of monkey
2654
2415
# patching socket.socket.)
2655
#
2416
#
2656
2417
# Create a one-time-only replacement for socket.socket()
2657
2418
@functools.wraps(socket.socket)
2658
2419
def socket_wrapper(*args, **kwargs):
2670
2431
# socket_wrapper(), if socketfd was set.
2671
2432
socketserver.TCPServer.__init__(self, server_address,
2672
2433
RequestHandlerClass)
2673
2434
2674
2435
def server_bind(self):
2675
2436
"""This overrides the normal server_bind() function
2676
2437
to bind to an interface if one was specified, and also NOT to
2677
2438
bind to an address or port if they were not specified."""
2678
global SO_BINDTODEVICE
2679
2439
if self.interface is not None:
2680
2440
if SO_BINDTODEVICE is None:
2681
# Fall back to a hard-coded value which seems to be
2682
# common enough.
2683
log.warning("SO_BINDTODEVICE not found, trying 25")
2684
SO_BINDTODEVICE = 25
2685
try:
2686
self.socket.setsockopt(
2687
socket.SOL_SOCKET, SO_BINDTODEVICE,
2688
(self.interface + "\0").encode("utf-8"))
2689
except socket.error as error:
2690
if error.errno == errno.EPERM:
2691
log.error("No permission to bind to interface %s",
2692
self.interface)
2693
elif error.errno == errno.ENOPROTOOPT:
2694
log.error("SO_BINDTODEVICE not available; cannot"
2695
" bind to interface %s", self.interface)
2696
elif error.errno == errno.ENODEV:
2697
log.error("Interface %s does not exist, cannot"
2698
" bind", self.interface)
2699
else:
2700
raise
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2443
self.interface)
2444
else:
2445
try:
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2456
self.interface)
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2460
else:
2461
raise
2701
2462
# Only bind(2) the socket if we really need to.
2702
2463
if self.server_address[0] or self.server_address[1]:
2703
if self.server_address[1]:
2704
self.allow_reuse_address = True
2705
2464
if not self.server_address[0]:
2706
2465
if self.address_family == socket.AF_INET6:
2707
any_address = "::" # in6addr_any
2466
any_address = "::" # in6addr_any
2708
2467
else:
2709
any_address = "0.0.0.0" # INADDR_ANY
2468
any_address = "0.0.0.0" # INADDR_ANY
2710
2469
self.server_address = (any_address,
2711
2470
self.server_address[1])
2712
2471
elif not self.server_address[1]:
2722
2481
2723
2482
class MandosServer(IPv6_TCPServer):
2724
2483
"""Mandos server.
2725
2484
2726
2485
Attributes:
2727
2486
clients: set of Client objects
2728
2487
gnutls_priority GnuTLS priority string
2729
2488
use_dbus: Boolean; to emit D-Bus signals or not
2730
2731
Assumes a GLib.MainLoop event loop.
2489
2490
Assumes a GObject.MainLoop event loop.
2732
2491
"""
2733
2492
2734
2493
def __init__(self, server_address, RequestHandlerClass,
2735
2494
interface=None,
2736
2495
use_ipv6=True,
2746
2505
self.gnutls_priority = gnutls_priority
2747
2506
IPv6_TCPServer.__init__(self, server_address,
2748
2507
RequestHandlerClass,
2749
interface=interface,
2750
use_ipv6=use_ipv6,
2751
socketfd=socketfd)
2752
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2511
2753
2512
def server_activate(self):
2754
2513
if self.enabled:
2755
2514
return socketserver.TCPServer.server_activate(self)
2756
2515
2757
2516
def enable(self):
2758
2517
self.enabled = True
2759
2518
2760
2519
def add_pipe(self, parent_pipe, proc):
2761
2520
# Call "handle_ipc" for both data and EOF events
2762
GLib.io_add_watch(
2763
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2764
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2521
GObject.io_add_watch(
2522
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2765
2524
functools.partial(self.handle_ipc,
2766
parent_pipe=parent_pipe,
2767
proc=proc))
2768
2525
parent_pipe = parent_pipe,
2526
proc = proc))
2527
2769
2528
def handle_ipc(self, source, condition,
2770
2529
parent_pipe=None,
2771
proc=None,
2530
proc = None,
2772
2531
client_object=None):
2773
2532
# error, or the other end of multiprocessing.Pipe has closed
2774
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2775
2534
# Wait for other process to exit
2776
2535
proc.join()
2777
2536
return False
2778
2537
2779
2538
# Read a request from the child
2780
2539
request = parent_pipe.recv()
2781
2540
command = request[0]
2782
2783
if command == "init":
2784
key_id = request[1].decode("ascii")
2785
fpr = request[2].decode("ascii")
2786
address = request[3]
2787
2541
2542
if command == 'init':
2543
fpr = request[1]
2544
address = request[2]
2545
2788
2546
for c in self.clients.values():
2789
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2790
"27AE41E4649B934CA495991B7852B855"):
2791
continue
2792
if key_id and c.key_id == key_id:
2793
client = c
2794
break
2795
if fpr and c.fingerprint == fpr:
2547
if c.fingerprint == fpr:
2796
2548
client = c
2797
2549
break
2798
2550
else:
2799
log.info("Client not found for key ID: %s, address:"
2800
" %s", key_id or fpr, address)
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2801
2553
if self.use_dbus:
2802
2554
# Emit D-Bus signal
2803
mandos_dbus_service.ClientNotFound(key_id or fpr,
2555
mandos_dbus_service.ClientNotFound(fpr,
2804
2556
address[0])
2805
2557
parent_pipe.send(False)
2806
2558
return False
2807
2808
GLib.io_add_watch(
2809
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2810
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2559
2560
GObject.io_add_watch(
2561
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2811
2563
functools.partial(self.handle_ipc,
2812
parent_pipe=parent_pipe,
2813
proc=proc,
2814
client_object=client))
2564
parent_pipe = parent_pipe,
2565
proc = proc,
2566
client_object = client))
2815
2567
parent_pipe.send(True)
2816
2568
# remove the old hook in favor of the new above hook on
2817
2569
# same fileno
2818
2570
return False
2819
if command == "funcall":
2571
if command == 'funcall':
2820
2572
funcname = request[1]
2821
2573
args = request[2]
2822
2574
kwargs = request[3]
2823
2824
parent_pipe.send(("data", getattr(client_object,
2575
2576
parent_pipe.send(('data', getattr(client_object,
2825
2577
funcname)(*args,
2826
2578
**kwargs)))
2827
2828
if command == "getattr":
2579
2580
if command == 'getattr':
2829
2581
attrname = request[1]
2830
2582
if isinstance(client_object.__getattribute__(attrname),
2831
collections.abc.Callable):
2832
parent_pipe.send(("function", ))
2583
collections.Callable):
2584
parent_pipe.send(('function', ))
2833
2585
else:
2834
2586
parent_pipe.send((
2835
"data", client_object.__getattribute__(attrname)))
2836
2837
if command == "setattr":
2587
'data', client_object.__getattribute__(attrname)))
2588
2589
if command == 'setattr':
2838
2590
attrname = request[1]
2839
2591
value = request[2]
2840
2592
setattr(client_object, attrname, value)
2841
2593
2842
2594
return True
2843
2595
2844
2596
2845
2597
def rfc3339_duration_to_delta(duration):
2846
2598
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2847
2848
>>> timedelta = datetime.timedelta
2849
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2850
True
2851
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2852
True
2853
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2854
True
2855
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2856
True
2857
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2858
True
2859
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2860
True
2861
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2862
True
2863
>>> del timedelta
2599
2600
>>> rfc3339_duration_to_delta("P7D")
2601
datetime.timedelta(7)
2602
>>> rfc3339_duration_to_delta("PT60S")
2603
datetime.timedelta(0, 60)
2604
>>> rfc3339_duration_to_delta("PT60M")
2605
datetime.timedelta(0, 3600)
2606
>>> rfc3339_duration_to_delta("PT24H")
2607
datetime.timedelta(1)
2608
>>> rfc3339_duration_to_delta("P1W")
2609
datetime.timedelta(7)
2610
>>> rfc3339_duration_to_delta("PT5M30S")
2611
datetime.timedelta(0, 330)
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
datetime.timedelta(1, 200)
2864
2614
"""
2865
2615
2866
2616
# Parsing an RFC 3339 duration with regular expressions is not
2867
2617
# possible - there would have to be multiple places for the same
2868
2618
# values, like seconds. The current code, while more esoteric, is
2869
2619
# cleaner without depending on a parsing library. If Python had a
2870
2620
# built-in library for parsing we would use it, but we'd like to
2871
2621
# avoid excessive use of external libraries.
2872
2622
2873
2623
# New type for defining tokens, syntax, and semantics all-in-one
2874
2624
Token = collections.namedtuple("Token", (
2875
2625
"regexp", # To match token; if "value" is not None, must have
2908
2658
frozenset((token_year, token_month,
2909
2659
token_day, token_time,
2910
2660
token_week)))
2911
# Define starting values:
2912
# Value so far
2913
value = datetime.timedelta()
2661
# Define starting values
2662
value = datetime.timedelta() # Value so far
2914
2663
found_token = None
2915
# Following valid tokens
2916
followers = frozenset((token_duration, ))
2917
# String left to parse
2918
s = duration
2664
followers = frozenset((token_duration, )) # Following valid tokens
2665
s = duration # String left to parse
2919
2666
# Loop until end token is found
2920
2667
while found_token is not token_end:
2921
2668
# Search for any currently valid tokens
2945
2692
2946
2693
def string_to_delta(interval):
2947
2694
"""Parse a string and return a datetime.timedelta
2948
2949
>>> string_to_delta("7d") == datetime.timedelta(7)
2950
True
2951
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2952
True
2953
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2954
True
2955
>>> string_to_delta("24h") == datetime.timedelta(1)
2956
True
2957
>>> string_to_delta("1w") == datetime.timedelta(7)
2958
True
2959
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2960
True
2695
2696
>>> string_to_delta('7d')
2697
datetime.timedelta(7)
2698
>>> string_to_delta('60s')
2699
datetime.timedelta(0, 60)
2700
>>> string_to_delta('60m')
2701
datetime.timedelta(0, 3600)
2702
>>> string_to_delta('24h')
2703
datetime.timedelta(1)
2704
>>> string_to_delta('1w')
2705
datetime.timedelta(7)
2706
>>> string_to_delta('5m 30s')
2707
datetime.timedelta(0, 330)
2961
2708
"""
2962
2709
2963
2710
try:
2964
2711
return rfc3339_duration_to_delta(interval)
2965
2712
except ValueError:
2966
2713
pass
2967
2714
2968
2715
timevalue = datetime.timedelta(0)
2969
2716
for s in interval.split():
2970
2717
try:
2988
2735
return timevalue
2989
2736
2990
2737
2991
def daemon(nochdir=False, noclose=False):
2738
def daemon(nochdir = False, noclose = False):
2992
2739
"""See daemon(3). Standard BSD Unix function.
2993
2740
2994
2741
This should really exist as os.daemon, but it doesn't (yet)."""
2995
2742
if os.fork():
2996
2743
sys.exit()
3014
2761
3015
2762
3016
2763
def main():
3017
2764
3018
2765
##################################################################
3019
2766
# Parsing of options, both command line and config file
3020
2767
3021
2768
parser = argparse.ArgumentParser()
3022
2769
parser.add_argument("-v", "--version", action="version",
3023
version="%(prog)s {}".format(version),
2770
version = "%(prog)s {}".format(version),
3024
2771
help="show version number and exit")
3025
2772
parser.add_argument("-i", "--interface", metavar="IF",
3026
2773
help="Bind to interface IF")
3062
2809
parser.add_argument("--no-zeroconf", action="store_false",
3063
2810
dest="zeroconf", help="Do not use Zeroconf",
3064
2811
default=None)
3065
2812
3066
2813
options = parser.parse_args()
3067
2814
2815
if options.check:
2816
import doctest
2817
fail_count, test_count = doctest.testmod()
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2819
3068
2820
# Default values for config file for server-global settings
3069
if gnutls.has_rawpk:
3070
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3072
else:
3073
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3074
":+SIGN-DSA-SHA256")
3075
server_defaults = {"interface": "",
3076
"address": "",
3077
"port": "",
3078
"debug": "False",
3079
"priority": priority,
3080
"servicename": "Mandos",
3081
"use_dbus": "True",
3082
"use_ipv6": "True",
3083
"debuglevel": "",
3084
"restore": "True",
3085
"socket": "",
3086
"statedir": "/var/lib/mandos",
3087
"foreground": "False",
3088
"zeroconf": "True",
3089
}
3090
del priority
3091
2821
server_defaults = { "interface": "",
2822
"address": "",
2823
"port": "",
2824
"debug": "False",
2825
"priority":
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2829
"use_dbus": "True",
2830
"use_ipv6": "True",
2831
"debuglevel": "",
2832
"restore": "True",
2833
"socket": "",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2836
"zeroconf": "True",
2837
}
2838
3092
2839
# Parse config file for server-global settings
3093
server_config = configparser.ConfigParser(server_defaults)
2840
server_config = configparser.SafeConfigParser(server_defaults)
3094
2841
del server_defaults
3095
2842
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3096
# Convert the ConfigParser object to a dict
2843
# Convert the SafeConfigParser object to a dict
3097
2844
server_settings = server_config.defaults()
3098
2845
# Use the appropriate methods on the non-string config options
3099
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3100
"foreground", "zeroconf"):
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3101
2847
server_settings[option] = server_config.getboolean("DEFAULT",
3102
2848
option)
3103
2849
if server_settings["port"]:
3109
2855
# Later, stdin will, and stdout and stderr might, be dup'ed
3110
2856
# over with an opened os.devnull. But we don't want this to
3111
2857
# happen with a supplied network socket.
3112
while 0 <= server_settings["socket"] <= 2:
2858
if 0 <= server_settings["socket"] <= 2:
3113
2859
server_settings["socket"] = os.dup(server_settings
3114
2860
["socket"])
3115
os.set_inheritable(server_settings["socket"], False)
3116
2861
del server_config
3117
2862
3118
2863
# Override the settings from the config file with command line
3119
2864
# options, if set.
3120
2865
for option in ("interface", "address", "port", "debug",
3138
2883
if server_settings["debug"]:
3139
2884
server_settings["foreground"] = True
3140
2885
# Now we have our good server settings in "server_settings"
3141
2886
3142
2887
##################################################################
3143
2888
3144
2889
if (not server_settings["zeroconf"]
3145
2890
and not (server_settings["port"]
3146
2891
or server_settings["socket"] != "")):
3147
2892
parser.error("Needs port or socket to work without Zeroconf")
3148
2893
3149
2894
# For convenience
3150
2895
debug = server_settings["debug"]
3151
2896
debuglevel = server_settings["debuglevel"]
3155
2900
stored_state_file)
3156
2901
foreground = server_settings["foreground"]
3157
2902
zeroconf = server_settings["zeroconf"]
3158
2903
3159
2904
if debug:
3160
2905
initlogger(debug, logging.DEBUG)
3161
2906
else:
3164
2909
else:
3165
2910
level = getattr(logging, debuglevel.upper())
3166
2911
initlogger(debug, level)
3167
2912
3168
2913
if server_settings["servicename"] != "Mandos":
3169
2914
syslogger.setFormatter(
3170
logging.Formatter("Mandos ({}) [%(process)d]:"
3171
" %(levelname)s: %(message)s".format(
2915
logging.Formatter('Mandos ({}) [%(process)d]:'
2916
' %(levelname)s: %(message)s'.format(
3172
2917
server_settings["servicename"])))
3173
2918
3174
2919
# Parse config file with clients
3175
client_config = configparser.ConfigParser(Client.client_defaults)
2920
client_config = configparser.SafeConfigParser(Client
2921
.client_defaults)
3176
2922
client_config.read(os.path.join(server_settings["configdir"],
3177
2923
"clients.conf"))
3178
2924
3179
2925
global mandos_dbus_service
3180
2926
mandos_dbus_service = None
3181
2927
3182
2928
socketfd = None
3183
2929
if server_settings["socket"] != "":
3184
2930
socketfd = server_settings["socket"]
3198
2944
try:
3199
2945
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3200
2946
except IOError as e:
3201
log.error("Could not open file %r", pidfilename,
3202
exc_info=e)
3203
2947
logger.error("Could not open file %r", pidfilename,
2948
exc_info=e)
2949
3204
2950
for name, group in (("_mandos", "_mandos"),
3205
2951
("mandos", "mandos"),
3206
2952
("nobody", "nogroup")):
3216
2962
try:
3217
2963
os.setgid(gid)
3218
2964
os.setuid(uid)
3219
log.debug("Did setuid/setgid to %s:%s", uid, gid)
2965
if debug:
2966
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2967
gid))
3220
2968
except OSError as error:
3221
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3222
os.strerror(error.errno))
2969
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2970
.format(uid, gid, os.strerror(error.errno)))
3223
2971
if error.errno != errno.EPERM:
3224
2972
raise
3225
2973
3226
2974
if debug:
3227
2975
# Enable all possible GnuTLS debugging
3228
2976
3229
2977
# "Use a log level over 10 to enable all debugging options."
3230
2978
# - GnuTLS manual
3231
2979
gnutls.global_set_log_level(11)
3232
2980
3233
2981
@gnutls.log_func
3234
2982
def debug_gnutls(level, string):
3235
log.debug("GnuTLS: %s",
3236
string[:-1].decode("utf-8", errors="replace"))
3237
2983
logger.debug("GnuTLS: %s", string[:-1])
2984
3238
2985
gnutls.global_set_log_function(debug_gnutls)
3239
2986
3240
2987
# Redirect stdin so all checkers get /dev/null
3241
2988
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3242
2989
os.dup2(null, sys.stdin.fileno())
3243
2990
if null > 2:
3244
2991
os.close(null)
3245
2992
3246
2993
# Need to fork before connecting to D-Bus
3247
2994
if not foreground:
3248
2995
# Close all input and output, do double fork, etc.
3249
2996
daemon()
3250
3251
if gi.version_info < (3, 10, 2):
3252
# multiprocessing will use threads, so before we use GLib we
3253
# need to inform GLib that threads will be used.
3254
GLib.threads_init()
3255
2997
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
3001
3256
3002
global main_loop
3257
3003
# From the Avahi example code
3258
3004
DBusGMainLoop(set_as_default=True)
3259
main_loop = GLib.MainLoop()
3260
if use_dbus or zeroconf:
3261
bus = dbus.SystemBus()
3005
main_loop = GObject.MainLoop()
3006
bus = dbus.SystemBus()
3262
3007
# End of Avahi example code
3263
3008
if use_dbus:
3264
3009
try:
3269
3014
"se.bsnet.fukt.Mandos", bus,
3270
3015
do_not_queue=True)
3271
3016
except dbus.exceptions.DBusException as e:
3272
log.error("Disabling D-Bus:", exc_info=e)
3017
logger.error("Disabling D-Bus:", exc_info=e)
3273
3018
use_dbus = False
3274
3019
server_settings["use_dbus"] = False
3275
3020
tcp_server.use_dbus = False
3276
3021
if zeroconf:
3277
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3278
3023
service = AvahiServiceToSyslog(
3279
name=server_settings["servicename"],
3280
servicetype="_mandos._tcp",
3281
protocol=protocol,
3282
bus=bus)
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3027
bus = bus)
3283
3028
if server_settings["interface"]:
3284
3029
service.interface = if_nametoindex(
3285
3030
server_settings["interface"].encode("utf-8"))
3286
3031
3287
3032
global multiprocessing_manager
3288
3033
multiprocessing_manager = multiprocessing.Manager()
3289
3034
3290
3035
client_class = Client
3291
3036
if use_dbus:
3292
client_class = functools.partial(ClientDBus, bus=bus)
3293
3037
client_class = functools.partial(ClientDBus, bus = bus)
3038
3294
3039
client_settings = Client.config_parser(client_config)
3295
3040
old_client_settings = {}
3296
3041
clients_data = {}
3297
3042
3298
3043
# This is used to redirect stdout and stderr for checker processes
3299
3044
global wnull
3300
wnull = open(os.devnull, "w") # A writable /dev/null
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3301
3046
# Only used if server is running in foreground but not in debug
3302
3047
# mode
3303
3048
if debug or not foreground:
3304
3049
wnull.close()
3305
3050
3306
3051
# Get client data and settings from last running state.
3307
3052
if server_settings["restore"]:
3308
3053
try:
3309
3054
with open(stored_state_path, "rb") as stored_state:
3310
if sys.version_info.major == 2:
3055
if sys.version_info.major == 2:
3311
3056
clients_data, old_client_settings = pickle.load(
3312
3057
stored_state)
3313
3058
else:
3314
3059
bytes_clients_data, bytes_old_client_settings = (
3315
pickle.load(stored_state, encoding="bytes"))
3316
# Fix bytes to strings
3317
# clients_data
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3062
## clients_data
3318
3063
# .keys()
3319
clients_data = {(key.decode("utf-8")
3320
if isinstance(key, bytes)
3321
else key): value
3322
for key, value in
3323
bytes_clients_data.items()}
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3066
else key): value
3067
for key, value in
3068
bytes_clients_data.items() }
3324
3069
del bytes_clients_data
3325
3070
for key in clients_data:
3326
value = {(k.decode("utf-8")
3327
if isinstance(k, bytes) else k): v
3328
for k, v in
3329
clients_data[key].items()}
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3073
for k, v in
3074
clients_data[key].items() }
3330
3075
clients_data[key] = value
3331
3076
# .client_structure
3332
3077
value["client_structure"] = [
3333
3078
(s.decode("utf-8")
3334
3079
if isinstance(s, bytes)
3335
3080
else s) for s in
3336
value["client_structure"]]
3337
# .name, .host, and .checker_command
3338
for k in ("name", "host", "checker_command"):
3081
value["client_structure"] ]
3082
# .name & .host
3083
for k in ("name", "host"):
3339
3084
if isinstance(value[k], bytes):
3340
3085
value[k] = value[k].decode("utf-8")
3341
if "key_id" not in value:
3342
value["key_id"] = ""
3343
elif "fingerprint" not in value:
3344
value["fingerprint"] = ""
3345
# old_client_settings
3086
## old_client_settings
3346
3087
# .keys()
3347
3088
old_client_settings = {
3348
3089
(key.decode("utf-8")
3349
3090
if isinstance(key, bytes)
3350
3091
else key): value
3351
3092
for key, value in
3352
bytes_old_client_settings.items()}
3093
bytes_old_client_settings.items() }
3353
3094
del bytes_old_client_settings
3354
# .host and .checker_command
3095
# .host
3355
3096
for value in old_client_settings.values():
3356
for attribute in ("host", "checker_command"):
3357
if isinstance(value[attribute], bytes):
3358
value[attribute] = (value[attribute]
3359
.decode("utf-8"))
3097
if isinstance(value["host"], bytes):
3098
value["host"] = (value["host"]
3099
.decode("utf-8"))
3360
3100
os.remove(stored_state_path)
3361
3101
except IOError as e:
3362
3102
if e.errno == errno.ENOENT:
3363
log.warning("Could not load persistent state:"
3364
" %s", os.strerror(e.errno))
3103
logger.warning("Could not load persistent state:"
3104
" {}".format(os.strerror(e.errno)))
3365
3105
else:
3366
log.critical("Could not load persistent state:",
3367
exc_info=e)
3106
logger.critical("Could not load persistent state:",
3107
exc_info=e)
3368
3108
raise
3369
3109
except EOFError as e:
3370
log.warning("Could not load persistent state: EOFError:",
3371
exc_info=e)
3372
3110
logger.warning("Could not load persistent state: "
3111
"EOFError:",
3112
exc_info=e)
3113
3373
3114
with PGPEngine() as pgp:
3374
3115
for client_name, client in clients_data.items():
3375
3116
# Skip removed clients
3376
3117
if client_name not in client_settings:
3377
3118
continue
3378
3119
3379
3120
# Decide which value to use after restoring saved state.
3380
3121
# We have three different values: Old config file,
3381
3122
# new config file, and saved state.
3392
3133
client[name] = value
3393
3134
except KeyError:
3394
3135
pass
3395
3136
3396
3137
# Clients who has passed its expire date can still be
3397
3138
# enabled if its last checker was successful. A Client
3398
3139
# whose checker succeeded before we stored its state is
3401
3142
if client["enabled"]:
3402
3143
if datetime.datetime.utcnow() >= client["expires"]:
3403
3144
if not client["last_checked_ok"]:
3404
log.warning("disabling client %s - Client"
3405
" never performed a successful"
3406
" checker", client_name)
3145
logger.warning(
3146
"disabling client {} - Client never "
3147
"performed a successful checker".format(
3148
client_name))
3407
3149
client["enabled"] = False
3408
3150
elif client["last_checker_status"] != 0:
3409
log.warning("disabling client %s - Client"
3410
" last checker failed with error"
3411
" code %s", client_name,
3412
client["last_checker_status"])
3151
logger.warning(
3152
"disabling client {} - Client last"
3153
" checker failed with error code"
3154
" {}".format(
3155
client_name,
3156
client["last_checker_status"]))
3413
3157
client["enabled"] = False
3414
3158
else:
3415
3159
client["expires"] = (
3416
3160
datetime.datetime.utcnow()
3417
3161
+ client["timeout"])
3418
log.debug("Last checker succeeded, keeping %s"
3419
" enabled", client_name)
3162
logger.debug("Last checker succeeded,"
3163
" keeping {} enabled".format(
3164
client_name))
3420
3165
try:
3421
3166
client["secret"] = pgp.decrypt(
3422
3167
client["encrypted_secret"],
3423
3168
client_settings[client_name]["secret"])
3424
3169
except PGPError:
3425
3170
# If decryption fails, we use secret from new settings
3426
log.debug("Failed to decrypt %s old secret",
3427
client_name)
3171
logger.debug("Failed to decrypt {} old secret".format(
3172
client_name))
3428
3173
client["secret"] = (client_settings[client_name]
3429
3174
["secret"])
3430
3175
3431
3176
# Add/remove clients based on new changes made to config
3432
3177
for client_name in (set(old_client_settings)
3433
3178
- set(client_settings)):
3435
3180
for client_name in (set(client_settings)
3436
3181
- set(old_client_settings)):
3437
3182
clients_data[client_name] = client_settings[client_name]
3438
3183
3439
3184
# Create all client objects
3440
3185
for client_name, client in clients_data.items():
3441
3186
tcp_server.clients[client_name] = client_class(
3442
name=client_name,
3443
settings=client,
3444
server_settings=server_settings)
3445
3187
name = client_name,
3188
settings = client,
3189
server_settings = server_settings)
3190
3446
3191
if not tcp_server.clients:
3447
log.warning("No clients defined")
3448
3192
logger.warning("No clients defined")
3193
3449
3194
if not foreground:
3450
3195
if pidfile is not None:
3451
3196
pid = os.getpid()
3453
3198
with pidfile:
3454
3199
print(pid, file=pidfile)
3455
3200
except IOError:
3456
log.error("Could not write to file %r with PID %d",
3457
pidfilename, pid)
3201
logger.error("Could not write to file %r with PID %d",
3202
pidfilename, pid)
3458
3203
del pidfile
3459
3204
del pidfilename
3460
3461
for termsig in (signal.SIGHUP, signal.SIGTERM):
3462
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3463
lambda: main_loop.quit() and False)
3464
3205
3206
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3207
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3208
3465
3209
if use_dbus:
3466
3210
3467
3211
@alternate_dbus_interfaces(
3468
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3212
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3469
3213
class MandosDBusService(DBusObjectWithObjectManager):
3470
3214
"""A D-Bus proxy object"""
3471
3215
3472
3216
def __init__(self):
3473
3217
dbus.service.Object.__init__(self, bus, "/")
3474
3218
3475
3219
_interface = "se.recompile.Mandos"
3476
3220
3477
3221
@dbus.service.signal(_interface, signature="o")
3478
3222
def ClientAdded(self, objpath):
3479
3223
"D-Bus signal"
3480
3224
pass
3481
3225
3482
3226
@dbus.service.signal(_interface, signature="ss")
3483
def ClientNotFound(self, key_id, address):
3227
def ClientNotFound(self, fingerprint, address):
3484
3228
"D-Bus signal"
3485
3229
pass
3486
3230
3487
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3488
3232
"true"})
3489
3233
@dbus.service.signal(_interface, signature="os")
3490
3234
def ClientRemoved(self, objpath, name):
3491
3235
"D-Bus signal"
3492
3236
pass
3493
3237
3494
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3495
3239
"true"})
3496
3240
@dbus.service.method(_interface, out_signature="ao")
3498
3242
"D-Bus method"
3499
3243
return dbus.Array(c.dbus_object_path for c in
3500
3244
tcp_server.clients.values())
3501
3245
3502
3246
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3503
3247
"true"})
3504
3248
@dbus.service.method(_interface,
3506
3250
def GetAllClientsWithProperties(self):
3507
3251
"D-Bus method"
3508
3252
return dbus.Dictionary(
3509
{c.dbus_object_path: c.GetAll(
3253
{ c.dbus_object_path: c.GetAll(
3510
3254
"se.recompile.Mandos.Client")
3511
for c in tcp_server.clients.values()},
3255
for c in tcp_server.clients.values() },
3512
3256
signature="oa{sv}")
3513
3257
3514
3258
@dbus.service.method(_interface, in_signature="o")
3515
3259
def RemoveClient(self, object_path):
3516
3260
"D-Bus method"
3524
3268
self.client_removed_signal(c)
3525
3269
return
3526
3270
raise KeyError(object_path)
3527
3271
3528
3272
del _interface
3529
3273
3530
3274
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3531
out_signature="a{oa{sa{sv}}}")
3275
out_signature = "a{oa{sa{sv}}}")
3532
3276
def GetManagedObjects(self):
3533
3277
"""D-Bus method"""
3534
3278
return dbus.Dictionary(
3535
{client.dbus_object_path:
3536
dbus.Dictionary(
3537
{interface: client.GetAll(interface)
3538
for interface in
3539
client._get_all_interface_names()})
3540
for client in tcp_server.clients.values()})
3541
3279
{ client.dbus_object_path:
3280
dbus.Dictionary(
3281
{ interface: client.GetAll(interface)
3282
for interface in
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3285
3542
3286
def client_added_signal(self, client):
3543
3287
"""Send the new standard signal and the old signal"""
3544
3288
if use_dbus:
3546
3290
self.InterfacesAdded(
3547
3291
client.dbus_object_path,
3548
3292
dbus.Dictionary(
3549
{interface: client.GetAll(interface)
3550
for interface in
3551
client._get_all_interface_names()}))
3293
{ interface: client.GetAll(interface)
3294
for interface in
3295
client._get_all_interface_names()}))
3552
3296
# Old signal
3553
3297
self.ClientAdded(client.dbus_object_path)
3554
3298
3555
3299
def client_removed_signal(self, client):
3556
3300
"""Send the new standard signal and the old signal"""
3557
3301
if use_dbus:
3562
3306
# Old signal
3563
3307
self.ClientRemoved(client.dbus_object_path,
3564
3308
client.name)
3565
3309
3566
3310
mandos_dbus_service = MandosDBusService()
3567
3568
# Save modules to variables to exempt the modules from being
3569
# unloaded before the function registered with atexit() is run.
3570
mp = multiprocessing
3571
wn = wnull
3572
3311
3573
3312
def cleanup():
3574
3313
"Cleanup function; run on exit"
3575
3314
if zeroconf:
3576
3315
service.cleanup()
3577
3578
mp.active_children()
3579
wn.close()
3316
3317
multiprocessing.active_children()
3318
wnull.close()
3580
3319
if not (tcp_server.clients or client_settings):
3581
3320
return
3582
3321
3583
3322
# Store client before exiting. Secrets are encrypted with key
3584
3323
# based on what config file has. If config file is
3585
3324
# removed/edited, old secret will thus be unrecovable.
3590
3329
client.encrypted_secret = pgp.encrypt(client.secret,
3591
3330
key)
3592
3331
client_dict = {}
3593
3332
3594
3333
# A list of attributes that can not be pickled
3595
3334
# + secret.
3596
exclude = {"bus", "changedstate", "secret",
3597
"checker", "server_settings"}
3335
exclude = { "bus", "changedstate", "secret",
3336
"checker", "server_settings" }
3598
3337
for name, typ in inspect.getmembers(dbus.service
3599
3338
.Object):
3600
3339
exclude.add(name)
3601
3340
3602
3341
client_dict["encrypted_secret"] = (client
3603
3342
.encrypted_secret)
3604
3343
for attr in client.client_structure:
3605
3344
if attr not in exclude:
3606
3345
client_dict[attr] = getattr(client, attr)
3607
3346
3608
3347
clients[client.name] = client_dict
3609
3348
del client_settings[client.name]["secret"]
3610
3349
3611
3350
try:
3612
3351
with tempfile.NamedTemporaryFile(
3613
mode="wb",
3352
mode='wb',
3614
3353
suffix=".pickle",
3615
prefix="clients-",
3354
prefix='clients-',
3616
3355
dir=os.path.dirname(stored_state_path),
3617
3356
delete=False) as stored_state:
3618
3357
pickle.dump((clients, client_settings), stored_state,
3619
protocol=2)
3358
protocol = 2)
3620
3359
tempname = stored_state.name
3621
3360
os.rename(tempname, stored_state_path)
3622
3361
except (IOError, OSError) as e:
3626
3365
except NameError:
3627
3366
pass
3628
3367
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3629
log.warning("Could not save persistent state: %s",
3630
os.strerror(e.errno))
3368
logger.warning("Could not save persistent state: {}"
3369
.format(os.strerror(e.errno)))
3631
3370
else:
3632
log.warning("Could not save persistent state:",
3633
exc_info=e)
3371
logger.warning("Could not save persistent state:",
3372
exc_info=e)
3634
3373
raise
3635
3374
3636
3375
# Delete all clients, and settings from config
3637
3376
while tcp_server.clients:
3638
3377
name, client = tcp_server.clients.popitem()
3644
3383
if use_dbus:
3645
3384
mandos_dbus_service.client_removed_signal(client)
3646
3385
client_settings.clear()
3647
3386
3648
3387
atexit.register(cleanup)
3649
3388
3650
3389
for client in tcp_server.clients.values():
3651
3390
if use_dbus:
3652
3391
# Emit D-Bus signal for adding
3653
3392
mandos_dbus_service.client_added_signal(client)
3654
3393
# Need to initiate checking of clients
3655
3394
if client.enabled:
3656
client.init_checker(randomize_start=True)
3657
3395
client.init_checker()
3396
3658
3397
tcp_server.enable()
3659
3398
tcp_server.server_activate()
3660
3399
3661
3400
# Find out what port we got
3662
3401
if zeroconf:
3663
3402
service.port = tcp_server.socket.getsockname()[1]
3664
3403
if use_ipv6:
3665
log.info("Now listening on address %r, port %d, flowinfo %d,"
3666
" scope_id %d", *tcp_server.socket.getsockname())
3404
logger.info("Now listening on address %r, port %d,"
3405
" flowinfo %d, scope_id %d",
3406
*tcp_server.socket.getsockname())
3667
3407
else: # IPv4
3668
log.info("Now listening on address %r, port %d",
3669
*tcp_server.socket.getsockname())
3670
3671
# service.interface = tcp_server.socket.getsockname()[3]
3672
3408
logger.info("Now listening on address %r, port %d",
3409
*tcp_server.socket.getsockname())
3410
3411
#service.interface = tcp_server.socket.getsockname()[3]
3412
3673
3413
try:
3674
3414
if zeroconf:
3675
3415
# From the Avahi example code
3676
3416
try:
3677
3417
service.activate()
3678
3418
except dbus.exceptions.DBusException as error:
3679
log.critical("D-Bus Exception", exc_info=error)
3419
logger.critical("D-Bus Exception", exc_info=error)
3680
3420
cleanup()
3681
3421
sys.exit(1)
3682
3422
# End of Avahi example code
3683
3684
GLib.io_add_watch(
3685
GLib.IOChannel.unix_new(tcp_server.fileno()),
3686
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3687
lambda *args, **kwargs: (tcp_server.handle_request
3688
(*args[2:], **kwargs) or True))
3689
3690
log.debug("Starting main loop")
3423
3424
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3425
lambda *args, **kwargs:
3426
(tcp_server.handle_request
3427
(*args[2:], **kwargs) or True))
3428
3429
logger.debug("Starting main loop")
3691
3430
main_loop.run()
3692
3431
except AvahiError as error:
3693
log.critical("Avahi Error", exc_info=error)
3432
logger.critical("Avahi Error", exc_info=error)
3694
3433
cleanup()
3695
3434
sys.exit(1)
3696
3435
except KeyboardInterrupt:
3697
3436
if debug:
3698
3437
print("", file=sys.stderr)
3699
log.debug("Server received KeyboardInterrupt")
3700
log.debug("Server exiting")
3438
logger.debug("Server received KeyboardInterrupt")
3439
logger.debug("Server exiting")
3701
3440
# Must run before the D-Bus bus name gets deregistered
3702
3441
cleanup()
3703
3442
3704
3705
def parse_test_args():
3706
# type: () -> argparse.Namespace
3707
parser = argparse.ArgumentParser(add_help=False)
3708
parser.add_argument("--check", action="store_true")
3709
parser.add_argument("--prefix", )
3710
args, unknown_args = parser.parse_known_args()
3711
if args.check:
3712
# Remove test options from sys.argv
3713
sys.argv[1:] = unknown_args
3714
return args
3715
3716
# Add all tests from doctest strings
3717
def load_tests(loader, tests, none):
3718
import doctest
3719
tests.addTests(doctest.DocTestSuite())
3720
return tests
3721
3722
if __name__ == "__main__":
3723
options = parse_test_args()
3724
try:
3725
if options.check:
3726
extra_test_prefix = options.prefix
3727
if extra_test_prefix is not None:
3728
if not (unittest.main(argv=[""], exit=False)
3729
.result.wasSuccessful()):
3730
sys.exit(1)
3731
class ExtraTestLoader(unittest.TestLoader):
3732
testMethodPrefix = extra_test_prefix
3733
# Call using ./scriptname --test [--verbose]
3734
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3735
else:
3736
unittest.main(argv=[""])
3737
else:
3738
main()
3739
finally:
3740
logging.shutdown()
3741
3742
# Local Variables:
3743
# run-tests:
3744
# (lambda (&optional extra)
3745
# (if (not (funcall run-tests-in-test-buffer default-directory
3746
# extra))
3747
# (funcall show-test-buffer-in-test-window)
3748
# (funcall remove-test-window)
3749
# (if extra (message "Extra tests run successfully!"))))
3750
# run-tests-in-test-buffer:
3751
# (lambda (dir &optional extra)
3752
# (with-current-buffer (get-buffer-create "*Test*")
3753
# (setq buffer-read-only nil
3754
# default-directory dir)
3755
# (erase-buffer)
3756
# (compilation-mode))
3757
# (let ((process-result
3758
# (let ((inhibit-read-only t))
3759
# (process-file-shell-command
3760
# (funcall get-command-line extra) nil "*Test*"))))
3761
# (and (numberp process-result)
3762
# (= process-result 0))))
3763
# get-command-line:
3764
# (lambda (&optional extra)
3765
# (let ((quoted-script
3766
# (shell-quote-argument (funcall get-script-name))))
3767
# (format
3768
# (concat "%s --check" (if extra " --prefix=atest" ""))
3769
# quoted-script)))
3770
# get-script-name:
3771
# (lambda ()
3772
# (if (fboundp 'file-local-name)
3773
# (file-local-name (buffer-file-name))
3774
# (or (file-remote-p (buffer-file-name) 'localname)
3775
# (buffer-file-name))))
3776
# remove-test-window:
3777
# (lambda ()
3778
# (let ((test-window (get-buffer-window "*Test*")))
3779
# (if test-window (delete-window test-window))))
3780
# show-test-buffer-in-test-window:
3781
# (lambda ()
3782
# (when (not (get-buffer-window-list "*Test*"))
3783
# (setq next-error-last-buffer (get-buffer "*Test*"))
3784
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3785
# (display-buffer-overriding-action
3786
# `((display-buffer-in-side-window) (side . ,side)
3787
# (window-height . fit-window-to-buffer)
3788
# (window-width . fit-window-to-buffer))))
3789
# (display-buffer "*Test*"))))
3790
# eval:
3791
# (progn
3792
# (let* ((run-extra-tests (lambda () (interactive)
3793
# (funcall run-tests t)))
3794
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3795
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3796
# (setq minor-mode-overriding-map-alist
3797
# (cons `(run-tests . ,outer-keymap)
3798
# minor-mode-overriding-map-alist)))
3799
# (add-hook 'after-save-hook run-tests 90 t))
3800
# End:
3443
3444
if __name__ == '__main__':
3445
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0