To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 837
- compare with another revision
- download diff
- download tarball
- view history from revision 837
- Committer: Teddy Hogeborn
- Date: 2016-03-19 03:48:56 UTC
- Revision ID: teddy@recompile.se-20160319034856-d8rox0kdxekgr03g
Server: Make persistent state directory mode u=rwx,go=
The Makefile target "install-server" creates the server persistent
state directory /var/lib/mandos as mode u=rwx,go= (0700). Make this
also the case for the Debian package (unless overridden by
dpkg-statoverride).
* debian/mandos.postinst (configure): Fix state directory permissions,
but only if not listed by "dpkg-statoverride".
The Makefile target "install-server" creates the server persistent
state directory /var/lib/mandos as mode u=rwx,go= (0700). Make this
also the case for the Debian package (unless overridden by
dpkg-statoverride).
* debian/mandos.postinst (configure): Fix state directory permissions,
but only if not listed by "dpkg-statoverride".
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
39
39
except ImportError:
40
40
pass
41
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
42
try:
48
43
import SocketServer as socketserver
49
44
except ImportError:
50
45
import socketserver
51
46
import socket
47
import argparse
52
48
import datetime
53
49
import errno
54
50
try:
55
51
import ConfigParser as configparser
56
52
except ImportError:
57
53
import configparser
54
import sys
58
55
import re
56
import os
59
57
import signal
60
58
import subprocess
61
59
import atexit
62
60
import stat
61
import logging
63
62
import logging.handlers
64
63
import pwd
65
64
import contextlib
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import random
81
import shlex
82
79
83
80
import dbus
84
81
import dbus.service
85
import gi
86
82
from gi.repository import GLib
87
83
from dbus.mainloop.glib import DBusGMainLoop
88
84
import ctypes
90
86
import xml.dom.minidom
91
87
import inspect
92
88
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Add os.set_inheritable if it does not exist
114
try:
115
os.set_inheritable
116
except AttributeError:
117
def set_inheritable(fd, inheritable):
118
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
119
if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):
120
fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)
121
elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):
122
fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)
123
os.set_inheritable = set_inheritable
124
del set_inheritable
125
126
# Show warnings by default
127
if not sys.warnoptions:
128
import warnings
129
warnings.simplefilter("default")
130
131
# Try to find the value of SO_BINDTODEVICE:
132
try:
133
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
134
# newer, and it is also the most natural place for it:
89
try:
135
90
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
136
91
except AttributeError:
137
92
try:
138
# This is where SO_BINDTODEVICE was up to and including Python
139
# 2.6, and also 3.2:
140
93
from IN import SO_BINDTODEVICE
141
94
except ImportError:
142
# In Python 2.7 it seems to have been removed entirely.
143
# Try running the C preprocessor:
144
try:
145
cc = subprocess.Popen(["cc", "--language=c", "-E",
146
"/dev/stdin"],
147
stdin=subprocess.PIPE,
148
stdout=subprocess.PIPE)
149
stdout = cc.communicate(
150
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
151
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
152
except (OSError, ValueError, IndexError):
153
# No value found
154
SO_BINDTODEVICE = None
155
156
if sys.version_info < (3, 2):
157
configparser.Configparser = configparser.SafeConfigParser
158
159
version = "1.8.17"
95
SO_BINDTODEVICE = None
96
97
if sys.version_info.major == 2:
98
str = unicode
99
100
version = "1.7.6"
160
101
stored_state_file = "clients.pickle"
161
102
162
log = logging.getLogger(os.path.basename(sys.argv[0]))
163
logging.captureWarnings(True) # Show warnings via the logging system
103
logger = logging.getLogger()
164
104
syslogger = None
165
105
166
106
try:
167
107
if_nametoindex = ctypes.cdll.LoadLibrary(
168
108
ctypes.util.find_library("c")).if_nametoindex
169
109
except (OSError, AttributeError):
170
110
171
111
def if_nametoindex(interface):
172
112
"Get an interface index the hard way, i.e. using fcntl()"
173
113
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
196
136
197
137
def initlogger(debug, level=logging.WARNING):
198
138
"""init logger and add loglevel"""
199
139
200
140
global syslogger
201
141
syslogger = (logging.handlers.SysLogHandler(
202
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
203
address="/dev/log"))
142
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
143
address = "/dev/log"))
204
144
syslogger.setFormatter(logging.Formatter
205
("Mandos [%(process)d]: %(levelname)s:"
206
" %(message)s"))
207
log.addHandler(syslogger)
208
145
('Mandos [%(process)d]: %(levelname)s:'
146
' %(message)s'))
147
logger.addHandler(syslogger)
148
209
149
if debug:
210
150
console = logging.StreamHandler()
211
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
212
" [%(process)d]:"
213
" %(levelname)s:"
214
" %(message)s"))
215
log.addHandler(console)
216
log.setLevel(level)
151
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
152
' [%(process)d]:'
153
' %(levelname)s:'
154
' %(message)s'))
155
logger.addHandler(console)
156
logger.setLevel(level)
217
157
218
158
219
159
class PGPError(Exception):
221
161
pass
222
162
223
163
224
class PGPEngine:
164
class PGPEngine(object):
225
165
"""A simple class for OpenPGP symmetric encryption & decryption"""
226
166
227
167
def __init__(self):
228
168
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
229
169
self.gpg = "gpg"
231
171
output = subprocess.check_output(["gpgconf"])
232
172
for line in output.splitlines():
233
173
name, text, path = line.split(b":")
234
if name == b"gpg":
174
if name == "gpg":
235
175
self.gpg = path
236
176
break
237
177
except OSError as e:
238
178
if e.errno != errno.ENOENT:
239
179
raise
240
self.gnupgargs = ["--batch",
241
"--homedir", self.tempdir,
242
"--force-mdc",
243
"--quiet"]
244
# Only GPG version 1 has the --no-use-agent option.
245
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
246
self.gnupgargs.append("--no-use-agent")
247
180
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
182
'--force-mdc',
183
'--quiet',
184
'--no-use-agent']
185
248
186
def __enter__(self):
249
187
return self
250
188
251
189
def __exit__(self, exc_type, exc_value, traceback):
252
190
self._cleanup()
253
191
return False
254
192
255
193
def __del__(self):
256
194
self._cleanup()
257
195
258
196
def _cleanup(self):
259
197
if self.tempdir is not None:
260
198
# Delete contents of tempdir
261
199
for root, dirs, files in os.walk(self.tempdir,
262
topdown=False):
200
topdown = False):
263
201
for filename in files:
264
202
os.remove(os.path.join(root, filename))
265
203
for dirname in dirs:
267
205
# Remove tempdir
268
206
os.rmdir(self.tempdir)
269
207
self.tempdir = None
270
208
271
209
def password_encode(self, password):
272
210
# Passphrase can not be empty and can not contain newlines or
273
211
# NUL bytes. So we prefix it and hex encode it.
278
216
.replace(b"\n", b"\\n")
279
217
.replace(b"\0", b"\\x00"))
280
218
return encoded
281
219
282
220
def encrypt(self, data, password):
283
221
passphrase = self.password_encode(password)
284
222
with tempfile.NamedTemporaryFile(
285
223
dir=self.tempdir) as passfile:
286
224
passfile.write(passphrase)
287
225
passfile.flush()
288
proc = subprocess.Popen([self.gpg, "--symmetric",
289
"--passphrase-file",
226
proc = subprocess.Popen([self.gpg, '--symmetric',
227
'--passphrase-file',
290
228
passfile.name]
291
229
+ self.gnupgargs,
292
stdin=subprocess.PIPE,
293
stdout=subprocess.PIPE,
294
stderr=subprocess.PIPE)
295
ciphertext, err = proc.communicate(input=data)
230
stdin = subprocess.PIPE,
231
stdout = subprocess.PIPE,
232
stderr = subprocess.PIPE)
233
ciphertext, err = proc.communicate(input = data)
296
234
if proc.returncode != 0:
297
235
raise PGPError(err)
298
236
return ciphertext
299
237
300
238
def decrypt(self, data, password):
301
239
passphrase = self.password_encode(password)
302
240
with tempfile.NamedTemporaryFile(
303
dir=self.tempdir) as passfile:
241
dir = self.tempdir) as passfile:
304
242
passfile.write(passphrase)
305
243
passfile.flush()
306
proc = subprocess.Popen([self.gpg, "--decrypt",
307
"--passphrase-file",
244
proc = subprocess.Popen([self.gpg, '--decrypt',
245
'--passphrase-file',
308
246
passfile.name]
309
247
+ self.gnupgargs,
310
stdin=subprocess.PIPE,
311
stdout=subprocess.PIPE,
312
stderr=subprocess.PIPE)
313
decrypted_plaintext, err = proc.communicate(input=data)
248
stdin = subprocess.PIPE,
249
stdout = subprocess.PIPE,
250
stderr = subprocess.PIPE)
251
decrypted_plaintext, err = proc.communicate(input = data)
314
252
if proc.returncode != 0:
315
253
raise PGPError(err)
316
254
return decrypted_plaintext
317
255
318
319
256
# Pretend that we have an Avahi module
320
class avahi:
321
"""This isn't so much a class as it is a module-like namespace."""
322
IF_UNSPEC = -1 # avahi-common/address.h
323
PROTO_UNSPEC = -1 # avahi-common/address.h
324
PROTO_INET = 0 # avahi-common/address.h
325
PROTO_INET6 = 1 # avahi-common/address.h
257
class Avahi(object):
258
"""This isn't so much a class as it is a module-like namespace.
259
It is instantiated once, and simulates having an Avahi module."""
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
326
264
DBUS_NAME = "org.freedesktop.Avahi"
327
265
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
328
266
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
329
267
DBUS_PATH_SERVER = "/"
330
331
@staticmethod
332
def string_array_to_txt_array(t):
268
def string_array_to_txt_array(self, t):
333
269
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
334
270
for s in t), signature="ay")
335
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
336
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
337
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
338
SERVER_INVALID = 0 # avahi-common/defs.h
339
SERVER_REGISTERING = 1 # avahi-common/defs.h
340
SERVER_RUNNING = 2 # avahi-common/defs.h
341
SERVER_COLLISION = 3 # avahi-common/defs.h
342
SERVER_FAILURE = 4 # avahi-common/defs.h
343
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
279
avahi = Avahi()
344
280
345
281
class AvahiError(Exception):
346
282
def __init__(self, value, *args, **kwargs):
357
293
pass
358
294
359
295
360
class AvahiService:
296
class AvahiService(object):
361
297
"""An Avahi (Zeroconf) service.
362
298
363
299
Attributes:
364
300
interface: integer; avahi.IF_UNSPEC or an interface index.
365
301
Used to optionally bind to the specified interface.
366
name: string; Example: "Mandos"
367
type: string; Example: "_mandos._tcp".
302
name: string; Example: 'Mandos'
303
type: string; Example: '_mandos._tcp'.
368
304
See <https://www.iana.org/assignments/service-names-port-numbers>
369
305
port: integer; what port to announce
370
306
TXT: list of strings; TXT record for the service
377
313
server: D-Bus Server
378
314
bus: dbus.SystemBus()
379
315
"""
380
316
381
317
def __init__(self,
382
interface=avahi.IF_UNSPEC,
383
name=None,
384
servicetype=None,
385
port=None,
386
TXT=None,
387
domain="",
388
host="",
389
max_renames=32768,
390
protocol=avahi.PROTO_UNSPEC,
391
bus=None):
318
interface = avahi.IF_UNSPEC,
319
name = None,
320
servicetype = None,
321
port = None,
322
TXT = None,
323
domain = "",
324
host = "",
325
max_renames = 32768,
326
protocol = avahi.PROTO_UNSPEC,
327
bus = None):
392
328
self.interface = interface
393
329
self.name = name
394
330
self.type = servicetype
403
339
self.server = None
404
340
self.bus = bus
405
341
self.entry_group_state_changed_match = None
406
342
407
343
def rename(self, remove=True):
408
344
"""Derived from the Avahi example code"""
409
345
if self.rename_count >= self.max_renames:
410
log.critical("No suitable Zeroconf service name found"
411
" after %i retries, exiting.",
412
self.rename_count)
346
logger.critical("No suitable Zeroconf service name found"
347
" after %i retries, exiting.",
348
self.rename_count)
413
349
raise AvahiServiceError("Too many renames")
414
350
self.name = str(
415
351
self.server.GetAlternativeServiceName(self.name))
416
352
self.rename_count += 1
417
log.info("Changing Zeroconf service name to %r ...",
418
self.name)
353
logger.info("Changing Zeroconf service name to %r ...",
354
self.name)
419
355
if remove:
420
356
self.remove()
421
357
try:
423
359
except dbus.exceptions.DBusException as error:
424
360
if (error.get_dbus_name()
425
361
== "org.freedesktop.Avahi.CollisionError"):
426
log.info("Local Zeroconf service name collision.")
362
logger.info("Local Zeroconf service name collision.")
427
363
return self.rename(remove=False)
428
364
else:
429
log.critical("D-Bus Exception", exc_info=error)
365
logger.critical("D-Bus Exception", exc_info=error)
430
366
self.cleanup()
431
367
os._exit(1)
432
368
433
369
def remove(self):
434
370
"""Derived from the Avahi example code"""
435
371
if self.entry_group_state_changed_match is not None:
437
373
self.entry_group_state_changed_match = None
438
374
if self.group is not None:
439
375
self.group.Reset()
440
376
441
377
def add(self):
442
378
"""Derived from the Avahi example code"""
443
379
self.remove()
448
384
avahi.DBUS_INTERFACE_ENTRY_GROUP)
449
385
self.entry_group_state_changed_match = (
450
386
self.group.connect_to_signal(
451
"StateChanged", self.entry_group_state_changed))
452
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
453
self.name, self.type)
387
'StateChanged', self.entry_group_state_changed))
388
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
389
self.name, self.type)
454
390
self.group.AddService(
455
391
self.interface,
456
392
self.protocol,
460
396
dbus.UInt16(self.port),
461
397
avahi.string_array_to_txt_array(self.TXT))
462
398
self.group.Commit()
463
399
464
400
def entry_group_state_changed(self, state, error):
465
401
"""Derived from the Avahi example code"""
466
log.debug("Avahi entry group state change: %i", state)
467
402
logger.debug("Avahi entry group state change: %i", state)
403
468
404
if state == avahi.ENTRY_GROUP_ESTABLISHED:
469
log.debug("Zeroconf service established.")
405
logger.debug("Zeroconf service established.")
470
406
elif state == avahi.ENTRY_GROUP_COLLISION:
471
log.info("Zeroconf service name collision.")
407
logger.info("Zeroconf service name collision.")
472
408
self.rename()
473
409
elif state == avahi.ENTRY_GROUP_FAILURE:
474
log.critical("Avahi: Error in group state changed %s",
475
str(error))
410
logger.critical("Avahi: Error in group state changed %s",
411
str(error))
476
412
raise AvahiGroupError("State changed: {!s}".format(error))
477
413
478
414
def cleanup(self):
479
415
"""Derived from the Avahi example code"""
480
416
if self.group is not None:
485
421
pass
486
422
self.group = None
487
423
self.remove()
488
424
489
425
def server_state_changed(self, state, error=None):
490
426
"""Derived from the Avahi example code"""
491
log.debug("Avahi server state change: %i", state)
427
logger.debug("Avahi server state change: %i", state)
492
428
bad_states = {
493
429
avahi.SERVER_INVALID: "Zeroconf server invalid",
494
430
avahi.SERVER_REGISTERING: None,
498
434
if state in bad_states:
499
435
if bad_states[state] is not None:
500
436
if error is None:
501
log.error(bad_states[state])
437
logger.error(bad_states[state])
502
438
else:
503
log.error(bad_states[state] + ": %r", error)
439
logger.error(bad_states[state] + ": %r", error)
504
440
self.cleanup()
505
441
elif state == avahi.SERVER_RUNNING:
506
442
try:
508
444
except dbus.exceptions.DBusException as error:
509
445
if (error.get_dbus_name()
510
446
== "org.freedesktop.Avahi.CollisionError"):
511
log.info("Local Zeroconf service name collision.")
447
logger.info("Local Zeroconf service name"
448
" collision.")
512
449
return self.rename(remove=False)
513
450
else:
514
log.critical("D-Bus Exception", exc_info=error)
451
logger.critical("D-Bus Exception", exc_info=error)
515
452
self.cleanup()
516
453
os._exit(1)
517
454
else:
518
455
if error is None:
519
log.debug("Unknown state: %r", state)
456
logger.debug("Unknown state: %r", state)
520
457
else:
521
log.debug("Unknown state: %r: %r", state, error)
522
458
logger.debug("Unknown state: %r: %r", state, error)
459
523
460
def activate(self):
524
461
"""Derived from the Avahi example code"""
525
462
if self.server is None:
536
473
class AvahiServiceToSyslog(AvahiService):
537
474
def rename(self, *args, **kwargs):
538
475
"""Add the new name to the syslog messages"""
539
ret = super(AvahiServiceToSyslog, self).rename(*args,
540
**kwargs)
476
ret = AvahiService.rename(self, *args, **kwargs)
541
477
syslogger.setFormatter(logging.Formatter(
542
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
478
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
543
479
.format(self.name)))
544
480
return ret
545
481
546
547
482
# Pretend that we have a GnuTLS module
548
class gnutls:
549
"""This isn't so much a class as it is a module-like namespace."""
550
551
library = ctypes.util.find_library("gnutls")
552
if library is None:
553
library = ctypes.util.find_library("gnutls-deb0")
554
_library = ctypes.cdll.LoadLibrary(library)
555
del library
556
483
class GnuTLS(object):
484
"""This isn't so much a class as it is a module-like namespace.
485
It is instantiated once, and simulates having a GnuTLS module."""
486
487
_library = ctypes.cdll.LoadLibrary(
488
ctypes.util.find_library("gnutls"))
489
_need_version = b"3.3.0"
490
def __init__(self):
491
# Need to use class name "GnuTLS" here, since this method is
492
# called before the assignment to the "gnutls" global variable
493
# happens.
494
if GnuTLS.check_version(self._need_version) is None:
495
raise GnuTLS.Error("Needs GnuTLS {} or later"
496
.format(self._need_version))
497
557
498
# Unless otherwise indicated, the constants and types below are
558
499
# all from the gnutls/gnutls.h C header file.
559
500
560
501
# Constants
561
502
E_SUCCESS = 0
562
503
E_INTERRUPTED = -52
563
504
E_AGAIN = -28
564
505
CRT_OPENPGP = 2
565
CRT_RAWPK = 3
566
506
CLIENT = 2
567
507
SHUT_RDWR = 0
568
508
CRD_CERTIFICATE = 1
569
509
E_NO_CERTIFICATE_FOUND = -49
570
X509_FMT_DER = 0
571
NO_TICKETS = 1<<10
572
ENABLE_RAWPK = 1<<18
573
CTYPE_PEERS = 3
574
KEYID_USE_SHA256 = 1 # gnutls/x509.h
575
510
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
576
511
577
512
# Types
578
class _session_int(ctypes.Structure):
513
class session_int(ctypes.Structure):
579
514
_fields_ = []
580
session_t = ctypes.POINTER(_session_int)
581
515
session_t = ctypes.POINTER(session_int)
582
516
class certificate_credentials_st(ctypes.Structure):
583
517
_fields_ = []
584
518
certificate_credentials_t = ctypes.POINTER(
585
519
certificate_credentials_st)
586
520
certificate_type_t = ctypes.c_int
587
588
521
class datum_t(ctypes.Structure):
589
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
590
("size", ctypes.c_uint)]
591
592
class _openpgp_crt_int(ctypes.Structure):
522
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
523
('size', ctypes.c_uint)]
524
class openpgp_crt_int(ctypes.Structure):
593
525
_fields_ = []
594
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
595
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
526
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
596
528
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
597
529
credentials_type_t = ctypes.c_int
598
530
transport_ptr_t = ctypes.c_void_p
599
531
close_request_t = ctypes.c_int
600
532
601
533
# Exceptions
602
534
class Error(Exception):
603
def __init__(self, message=None, code=None, args=()):
535
# We need to use the class name "GnuTLS" here, since this
536
# exception might be raised from within GnuTLS.__init__,
537
# which is called before the assignment to the "gnutls"
538
# global variable has happened.
539
def __init__(self, message = None, code = None, args=()):
604
540
# Default usage is by a message string, but if a return
605
541
# code is passed, convert it to a string with
606
542
# gnutls.strerror()
607
543
self.code = code
608
544
if message is None and code is not None:
609
message = gnutls.strerror(code).decode(
610
"utf-8", errors="replace")
611
return super(gnutls.Error, self).__init__(
545
message = GnuTLS.strerror(code)
546
return super(GnuTLS.Error, self).__init__(
612
547
message, *args)
613
548
614
549
class CertificateSecurityError(Error):
615
550
pass
616
617
class PointerTo:
618
def __init__(self, cls):
619
self.cls = cls
620
621
def from_param(self, obj):
622
if not isinstance(obj, self.cls):
623
raise TypeError("Not of type {}: {!r}"
624
.format(self.cls.__name__, obj))
625
return ctypes.byref(obj.from_param(obj))
626
627
class CastToVoidPointer:
628
def __init__(self, cls):
629
self.cls = cls
630
631
def from_param(self, obj):
632
if not isinstance(obj, self.cls):
633
raise TypeError("Not of type {}: {!r}"
634
.format(self.cls.__name__, obj))
635
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
636
637
class With_from_param:
638
@classmethod
639
def from_param(cls, obj):
640
return obj._as_parameter_
641
551
642
552
# Classes
643
class Credentials(With_from_param):
553
class Credentials(object):
644
554
def __init__(self):
645
self._as_parameter_ = gnutls.certificate_credentials_t()
646
gnutls.certificate_allocate_credentials(self)
555
self._c_object = gnutls.certificate_credentials_t()
556
gnutls.certificate_allocate_credentials(
557
ctypes.byref(self._c_object))
647
558
self.type = gnutls.CRD_CERTIFICATE
648
559
649
560
def __del__(self):
650
gnutls.certificate_free_credentials(self)
651
652
class ClientSession(With_from_param):
653
def __init__(self, socket, credentials=None):
654
self._as_parameter_ = gnutls.session_t()
655
gnutls_flags = gnutls.CLIENT
656
if gnutls.check_version(b"3.5.6"):
657
gnutls_flags |= gnutls.NO_TICKETS
658
if gnutls.has_rawpk:
659
gnutls_flags |= gnutls.ENABLE_RAWPK
660
gnutls.init(self, gnutls_flags)
661
del gnutls_flags
662
gnutls.set_default_priority(self)
663
gnutls.transport_set_ptr(self, socket.fileno())
664
gnutls.handshake_set_private_extensions(self, True)
561
gnutls.certificate_free_credentials(self._c_object)
562
563
class ClientSession(object):
564
def __init__(self, socket, credentials = None):
565
self._c_object = gnutls.session_t()
566
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
567
gnutls.set_default_priority(self._c_object)
568
gnutls.transport_set_ptr(self._c_object, socket.fileno())
569
gnutls.handshake_set_private_extensions(self._c_object,
570
True)
665
571
self.socket = socket
666
572
if credentials is None:
667
573
credentials = gnutls.Credentials()
668
gnutls.credentials_set(self, credentials.type,
669
credentials)
574
gnutls.credentials_set(self._c_object, credentials.type,
575
ctypes.cast(credentials._c_object,
576
ctypes.c_void_p))
670
577
self.credentials = credentials
671
578
672
579
def __del__(self):
673
gnutls.deinit(self)
674
580
gnutls.deinit(self._c_object)
581
675
582
def handshake(self):
676
return gnutls.handshake(self)
677
583
return gnutls.handshake(self._c_object)
584
678
585
def send(self, data):
679
586
data = bytes(data)
680
587
data_len = len(data)
681
588
while data_len > 0:
682
data_len -= gnutls.record_send(self, data[-data_len:],
589
data_len -= gnutls.record_send(self._c_object,
590
data[-data_len:],
683
591
data_len)
684
592
685
593
def bye(self):
686
return gnutls.bye(self, gnutls.SHUT_RDWR)
687
594
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
595
688
596
# Error handling functions
689
597
def _error_code(result):
690
598
"""A function to raise exceptions on errors, suitable
691
for the "restype" attribute on ctypes functions"""
692
if result >= gnutls.E_SUCCESS:
599
for the 'restype' attribute on ctypes functions"""
600
if result >= 0:
693
601
return result
694
602
if result == gnutls.E_NO_CERTIFICATE_FOUND:
695
raise gnutls.CertificateSecurityError(code=result)
696
raise gnutls.Error(code=result)
697
698
def _retry_on_error(result, func, arguments,
699
_error_code=_error_code):
603
raise gnutls.CertificateSecurityError(code = result)
604
raise gnutls.Error(code = result)
605
606
def _retry_on_error(result, func, arguments):
700
607
"""A function to retry on some errors, suitable
701
for the "errcheck" attribute on ctypes functions"""
702
while result < gnutls.E_SUCCESS:
608
for the 'errcheck' attribute on ctypes functions"""
609
while result < 0:
703
610
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
704
611
return _error_code(result)
705
612
result = func(*arguments)
706
613
return result
707
614
708
615
# Unless otherwise indicated, the function declarations below are
709
616
# all from the gnutls/gnutls.h C header file.
710
617
711
618
# Functions
712
619
priority_set_direct = _library.gnutls_priority_set_direct
713
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
620
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
714
621
ctypes.POINTER(ctypes.c_char_p)]
715
622
priority_set_direct.restype = _error_code
716
623
717
624
init = _library.gnutls_init
718
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
625
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
719
626
init.restype = _error_code
720
627
721
628
set_default_priority = _library.gnutls_set_default_priority
722
set_default_priority.argtypes = [ClientSession]
629
set_default_priority.argtypes = [session_t]
723
630
set_default_priority.restype = _error_code
724
631
725
632
record_send = _library.gnutls_record_send
726
record_send.argtypes = [ClientSession, ctypes.c_void_p,
633
record_send.argtypes = [session_t, ctypes.c_void_p,
727
634
ctypes.c_size_t]
728
635
record_send.restype = ctypes.c_ssize_t
729
636
record_send.errcheck = _retry_on_error
730
637
731
638
certificate_allocate_credentials = (
732
639
_library.gnutls_certificate_allocate_credentials)
733
640
certificate_allocate_credentials.argtypes = [
734
PointerTo(Credentials)]
641
ctypes.POINTER(certificate_credentials_t)]
735
642
certificate_allocate_credentials.restype = _error_code
736
643
737
644
certificate_free_credentials = (
738
645
_library.gnutls_certificate_free_credentials)
739
certificate_free_credentials.argtypes = [Credentials]
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
740
647
certificate_free_credentials.restype = None
741
648
742
649
handshake_set_private_extensions = (
743
650
_library.gnutls_handshake_set_private_extensions)
744
handshake_set_private_extensions.argtypes = [ClientSession,
651
handshake_set_private_extensions.argtypes = [session_t,
745
652
ctypes.c_int]
746
653
handshake_set_private_extensions.restype = None
747
654
748
655
credentials_set = _library.gnutls_credentials_set
749
credentials_set.argtypes = [ClientSession, credentials_type_t,
750
CastToVoidPointer(Credentials)]
656
credentials_set.argtypes = [session_t, credentials_type_t,
657
ctypes.c_void_p]
751
658
credentials_set.restype = _error_code
752
659
753
660
strerror = _library.gnutls_strerror
754
661
strerror.argtypes = [ctypes.c_int]
755
662
strerror.restype = ctypes.c_char_p
756
663
757
664
certificate_type_get = _library.gnutls_certificate_type_get
758
certificate_type_get.argtypes = [ClientSession]
665
certificate_type_get.argtypes = [session_t]
759
666
certificate_type_get.restype = _error_code
760
667
761
668
certificate_get_peers = _library.gnutls_certificate_get_peers
762
certificate_get_peers.argtypes = [ClientSession,
669
certificate_get_peers.argtypes = [session_t,
763
670
ctypes.POINTER(ctypes.c_uint)]
764
671
certificate_get_peers.restype = ctypes.POINTER(datum_t)
765
672
766
673
global_set_log_level = _library.gnutls_global_set_log_level
767
674
global_set_log_level.argtypes = [ctypes.c_int]
768
675
global_set_log_level.restype = None
769
676
770
677
global_set_log_function = _library.gnutls_global_set_log_function
771
678
global_set_log_function.argtypes = [log_func]
772
679
global_set_log_function.restype = None
773
680
774
681
deinit = _library.gnutls_deinit
775
deinit.argtypes = [ClientSession]
682
deinit.argtypes = [session_t]
776
683
deinit.restype = None
777
684
778
685
handshake = _library.gnutls_handshake
779
handshake.argtypes = [ClientSession]
780
handshake.restype = ctypes.c_int
686
handshake.argtypes = [session_t]
687
handshake.restype = _error_code
781
688
handshake.errcheck = _retry_on_error
782
689
783
690
transport_set_ptr = _library.gnutls_transport_set_ptr
784
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
691
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
785
692
transport_set_ptr.restype = None
786
693
787
694
bye = _library.gnutls_bye
788
bye.argtypes = [ClientSession, close_request_t]
789
bye.restype = ctypes.c_int
695
bye.argtypes = [session_t, close_request_t]
696
bye.restype = _error_code
790
697
bye.errcheck = _retry_on_error
791
698
792
699
check_version = _library.gnutls_check_version
793
700
check_version.argtypes = [ctypes.c_char_p]
794
701
check_version.restype = ctypes.c_char_p
795
796
_need_version = b"3.3.0"
797
if check_version(_need_version) is None:
798
raise self.Error("Needs GnuTLS {} or later"
799
.format(_need_version))
800
801
_tls_rawpk_version = b"3.6.6"
802
has_rawpk = bool(check_version(_tls_rawpk_version))
803
804
if has_rawpk:
805
# Types
806
class pubkey_st(ctypes.Structure):
807
_fields = []
808
pubkey_t = ctypes.POINTER(pubkey_st)
809
810
x509_crt_fmt_t = ctypes.c_int
811
812
# All the function declarations below are from
813
# gnutls/abstract.h
814
pubkey_init = _library.gnutls_pubkey_init
815
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
816
pubkey_init.restype = _error_code
817
818
pubkey_import = _library.gnutls_pubkey_import
819
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
820
x509_crt_fmt_t]
821
pubkey_import.restype = _error_code
822
823
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
824
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
825
ctypes.POINTER(ctypes.c_ubyte),
826
ctypes.POINTER(ctypes.c_size_t)]
827
pubkey_get_key_id.restype = _error_code
828
829
pubkey_deinit = _library.gnutls_pubkey_deinit
830
pubkey_deinit.argtypes = [pubkey_t]
831
pubkey_deinit.restype = None
832
else:
833
# All the function declarations below are from
834
# gnutls/openpgp.h
835
836
openpgp_crt_init = _library.gnutls_openpgp_crt_init
837
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
838
openpgp_crt_init.restype = _error_code
839
840
openpgp_crt_import = _library.gnutls_openpgp_crt_import
841
openpgp_crt_import.argtypes = [openpgp_crt_t,
842
ctypes.POINTER(datum_t),
843
openpgp_crt_fmt_t]
844
openpgp_crt_import.restype = _error_code
845
846
openpgp_crt_verify_self = \
847
_library.gnutls_openpgp_crt_verify_self
848
openpgp_crt_verify_self.argtypes = [
849
openpgp_crt_t,
850
ctypes.c_uint,
851
ctypes.POINTER(ctypes.c_uint),
852
]
853
openpgp_crt_verify_self.restype = _error_code
854
855
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
856
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
857
openpgp_crt_deinit.restype = None
858
859
openpgp_crt_get_fingerprint = (
860
_library.gnutls_openpgp_crt_get_fingerprint)
861
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
862
ctypes.c_void_p,
863
ctypes.POINTER(
864
ctypes.c_size_t)]
865
openpgp_crt_get_fingerprint.restype = _error_code
866
867
if check_version(b"3.6.4"):
868
certificate_type_get2 = _library.gnutls_certificate_type_get2
869
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
870
certificate_type_get2.restype = _error_code
871
702
703
# All the function declarations below are from gnutls/openpgp.h
704
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
707
openpgp_crt_init.restype = _error_code
708
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
711
ctypes.POINTER(datum_t),
712
openpgp_crt_fmt_t]
713
openpgp_crt_import.restype = _error_code
714
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
717
ctypes.POINTER(ctypes.c_uint)]
718
openpgp_crt_verify_self.restype = _error_code
719
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
722
openpgp_crt_deinit.restype = None
723
724
openpgp_crt_get_fingerprint = (
725
_library.gnutls_openpgp_crt_get_fingerprint)
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
727
ctypes.c_void_p,
728
ctypes.POINTER(
729
ctypes.c_size_t)]
730
openpgp_crt_get_fingerprint.restype = _error_code
731
872
732
# Remove non-public functions
873
733
del _error_code, _retry_on_error
874
734
# Create the global "gnutls" object, simulating a module
735
gnutls = GnuTLS()
875
736
876
737
def call_pipe(connection, # : multiprocessing.Connection
877
738
func, *args, **kwargs):
878
739
"""This function is meant to be called by multiprocessing.Process
879
740
880
741
This function runs func(*args, **kwargs), and writes the resulting
881
742
return value on the provided multiprocessing.Connection.
882
743
"""
883
744
connection.send(func(*args, **kwargs))
884
745
connection.close()
885
746
886
887
class Client:
747
class Client(object):
888
748
"""A representation of a client host served by this server.
889
749
890
750
Attributes:
891
approved: bool(); None if not yet approved/disapproved
751
approved: bool(); 'None' if not yet approved/disapproved
892
752
approval_delay: datetime.timedelta(); Time to wait for approval
893
753
approval_duration: datetime.timedelta(); Duration of one approval
894
checker: multiprocessing.Process(); a running checker process used
895
to see if the client lives. None if no process is
896
running.
754
checker: subprocess.Popen(); a running checker process used
755
to see if the client lives.
756
'None' if no process is running.
897
757
checker_callback_tag: a GLib event source tag, or None
898
758
checker_command: string; External command which is run to check
899
759
if client lives. %() expansions are done at
907
767
disable_initiator_tag: a GLib event source tag, or None
908
768
enabled: bool()
909
769
fingerprint: string (40 or 32 hexadecimal digits); used to
910
uniquely identify an OpenPGP client
911
key_id: string (64 hexadecimal digits); used to uniquely identify
912
a client using raw public keys
770
uniquely identify the client
913
771
host: string; available for use by the checker command
914
772
interval: datetime.timedelta(); How often to start a new checker
915
773
last_approval_request: datetime.datetime(); (UTC) or None
931
789
disabled, or None
932
790
server_settings: The server_settings dict from main()
933
791
"""
934
792
935
793
runtime_expansions = ("approval_delay", "approval_duration",
936
"created", "enabled", "expires", "key_id",
794
"created", "enabled", "expires",
937
795
"fingerprint", "host", "interval",
938
796
"last_approval_request", "last_checked_ok",
939
797
"last_enabled", "name", "timeout")
948
806
"approved_by_default": "True",
949
807
"enabled": "True",
950
808
}
951
809
952
810
@staticmethod
953
811
def config_parser(config):
954
812
"""Construct a new dict of client settings of this form:
961
819
for client_name in config.sections():
962
820
section = dict(config.items(client_name))
963
821
client = settings[client_name] = {}
964
822
965
823
client["host"] = section["host"]
966
824
# Reformat values from string types to Python types
967
825
client["approved_by_default"] = config.getboolean(
968
826
client_name, "approved_by_default")
969
827
client["enabled"] = config.getboolean(client_name,
970
828
"enabled")
971
972
# Uppercase and remove spaces from key_id and fingerprint
973
# for later comparison purposes with return value from the
974
# key_id() and fingerprint() functions
975
client["key_id"] = (section.get("key_id", "").upper()
976
.replace(" ", ""))
977
client["fingerprint"] = (section.get("fingerprint",
978
"").upper()
829
830
# Uppercase and remove spaces from fingerprint for later
831
# comparison purposes with return value from the
832
# fingerprint() function
833
client["fingerprint"] = (section["fingerprint"].upper()
979
834
.replace(" ", ""))
980
if not (client["key_id"] or client["fingerprint"]):
981
log.error("Skipping client %s without key_id or"
982
" fingerprint", client_name)
983
del settings[client_name]
984
continue
985
835
if "secret" in section:
986
836
client["secret"] = codecs.decode(section["secret"]
987
837
.encode("utf-8"),
1006
856
client["last_approval_request"] = None
1007
857
client["last_checked_ok"] = None
1008
858
client["last_checker_status"] = -2
1009
859
1010
860
return settings
1011
1012
def __init__(self, settings, name=None, server_settings=None):
861
862
def __init__(self, settings, name = None, server_settings=None):
1013
863
self.name = name
1014
864
if server_settings is None:
1015
865
server_settings = {}
1017
867
# adding all client settings
1018
868
for setting, value in settings.items():
1019
869
setattr(self, setting, value)
1020
870
1021
871
if self.enabled:
1022
872
if not hasattr(self, "last_enabled"):
1023
873
self.last_enabled = datetime.datetime.utcnow()
1027
877
else:
1028
878
self.last_enabled = None
1029
879
self.expires = None
1030
1031
log.debug("Creating client %r", self.name)
1032
log.debug(" Key ID: %s", self.key_id)
1033
log.debug(" Fingerprint: %s", self.fingerprint)
880
881
logger.debug("Creating client %r", self.name)
882
logger.debug(" Fingerprint: %s", self.fingerprint)
1034
883
self.created = settings.get("created",
1035
884
datetime.datetime.utcnow())
1036
885
1037
886
# attributes specific for this server instance
1038
887
self.checker = None
1039
888
self.checker_initiator_tag = None
1048
897
for attr in self.__dict__.keys()
1049
898
if not attr.startswith("_")]
1050
899
self.client_structure.append("client_structure")
1051
900
1052
901
for name, t in inspect.getmembers(
1053
902
type(self), lambda obj: isinstance(obj, property)):
1054
903
if not name.startswith("_"):
1055
904
self.client_structure.append(name)
1056
905
1057
906
# Send notice to process children that client state has changed
1058
907
def send_changedstate(self):
1059
908
with self.changedstate:
1060
909
self.changedstate.notify_all()
1061
910
1062
911
def enable(self):
1063
912
"""Start this client's checker and timeout hooks"""
1064
913
if getattr(self, "enabled", False):
1065
914
# Already enabled
1066
915
return
916
self.expires = datetime.datetime.utcnow() + self.timeout
1067
917
self.enabled = True
1068
918
self.last_enabled = datetime.datetime.utcnow()
1069
919
self.init_checker()
1070
920
self.send_changedstate()
1071
921
1072
922
def disable(self, quiet=True):
1073
923
"""Disable this client."""
1074
924
if not getattr(self, "enabled", False):
1075
925
return False
1076
926
if not quiet:
1077
log.info("Disabling client %s", self.name)
927
logger.info("Disabling client %s", self.name)
1078
928
if getattr(self, "disable_initiator_tag", None) is not None:
1079
929
GLib.source_remove(self.disable_initiator_tag)
1080
930
self.disable_initiator_tag = None
1088
938
self.send_changedstate()
1089
939
# Do not run this again if called by a GLib.timeout_add
1090
940
return False
1091
941
1092
942
def __del__(self):
1093
943
self.disable()
1094
1095
def init_checker(self, randomize_start=False):
1096
# Schedule a new checker to be started a randomly selected
1097
# time (a fraction of 'interval') from now. This spreads out
1098
# the startup of checkers over time when the server is
1099
# started.
944
945
def init_checker(self):
946
# Schedule a new checker to be started an 'interval' from now,
947
# and every interval from then on.
1100
948
if self.checker_initiator_tag is not None:
1101
949
GLib.source_remove(self.checker_initiator_tag)
1102
interval_milliseconds = int(self.interval.total_seconds()
1103
* 1000)
1104
if randomize_start:
1105
delay_milliseconds = random.randrange(
1106
interval_milliseconds + 1)
1107
else:
1108
delay_milliseconds = interval_milliseconds
1109
950
self.checker_initiator_tag = GLib.timeout_add(
1110
delay_milliseconds, self.start_checker, randomize_start)
1111
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1112
# A checker might take up to an 'interval' of time, so we can
1113
# expire at the soonest one interval after a checker was
1114
# started. Since the initial checker is delayed, the expire
1115
# time might have to be extended.
1116
now = datetime.datetime.utcnow()
1117
self.expires = now + delay + self.interval
1118
# Schedule a disable() at expire time
951
int(self.interval.total_seconds() * 1000),
952
self.start_checker)
953
# Schedule a disable() when 'timeout' has passed
1119
954
if self.disable_initiator_tag is not None:
1120
955
GLib.source_remove(self.disable_initiator_tag)
1121
956
self.disable_initiator_tag = GLib.timeout_add(
1122
int((self.expires - now).total_seconds() * 1000),
1123
self.disable)
1124
957
int(self.timeout.total_seconds() * 1000), self.disable)
958
# Also start a new checker *right now*.
959
self.start_checker()
960
1125
961
def checker_callback(self, source, condition, connection,
1126
962
command):
1127
963
"""The checker has completed, so take appropriate actions."""
964
self.checker_callback_tag = None
965
self.checker = None
1128
966
# Read return code from connection (see call_pipe)
1129
967
returncode = connection.recv()
1130
968
connection.close()
1131
if self.checker is not None:
1132
self.checker.join()
1133
self.checker_callback_tag = None
1134
self.checker = None
1135
969
1136
970
if returncode >= 0:
1137
971
self.last_checker_status = returncode
1138
972
self.last_checker_signal = None
1139
973
if self.last_checker_status == 0:
1140
log.info("Checker for %(name)s succeeded", vars(self))
974
logger.info("Checker for %(name)s succeeded",
975
vars(self))
1141
976
self.checked_ok()
1142
977
else:
1143
log.info("Checker for %(name)s failed", vars(self))
978
logger.info("Checker for %(name)s failed", vars(self))
1144
979
else:
1145
980
self.last_checker_status = -1
1146
981
self.last_checker_signal = -returncode
1147
log.warning("Checker for %(name)s crashed?", vars(self))
982
logger.warning("Checker for %(name)s crashed?",
983
vars(self))
1148
984
return False
1149
985
1150
986
def checked_ok(self):
1151
987
"""Assert that the client has been seen, alive and well."""
1152
988
self.last_checked_ok = datetime.datetime.utcnow()
1153
989
self.last_checker_status = 0
1154
990
self.last_checker_signal = None
1155
991
self.bump_timeout()
1156
992
1157
993
def bump_timeout(self, timeout=None):
1158
994
"""Bump up the timeout for this client."""
1159
995
if timeout is None:
1165
1001
self.disable_initiator_tag = GLib.timeout_add(
1166
1002
int(timeout.total_seconds() * 1000), self.disable)
1167
1003
self.expires = datetime.datetime.utcnow() + timeout
1168
1004
1169
1005
def need_approval(self):
1170
1006
self.last_approval_request = datetime.datetime.utcnow()
1171
1172
def start_checker(self, start_was_randomized=False):
1007
1008
def start_checker(self):
1173
1009
"""Start a new checker subprocess if one is not running.
1174
1010
1175
1011
If a checker already exists, leave it running and do
1176
1012
nothing."""
1177
1013
# The reason for not killing a running checker is that if we
1182
1018
# checkers alone, the checker would have to take more time
1183
1019
# than 'timeout' for the client to be disabled, which is as it
1184
1020
# should be.
1185
1021
1186
1022
if self.checker is not None and not self.checker.is_alive():
1187
log.warning("Checker was not alive; joining")
1023
logger.warning("Checker was not alive; joining")
1188
1024
self.checker.join()
1189
1025
self.checker = None
1190
1026
# Start a new checker if needed
1191
1027
if self.checker is None:
1192
1028
# Escape attributes for the shell
1193
1029
escaped_attrs = {
1194
attr: shlex.quote(str(getattr(self, attr)))
1195
for attr in self.runtime_expansions}
1030
attr: re.escape(str(getattr(self, attr)))
1031
for attr in self.runtime_expansions }
1196
1032
try:
1197
1033
command = self.checker_command % escaped_attrs
1198
1034
except TypeError as error:
1199
log.error('Could not format string "%s"',
1200
self.checker_command, exc_info=error)
1035
logger.error('Could not format string "%s"',
1036
self.checker_command,
1037
exc_info=error)
1201
1038
return True # Try again later
1202
1039
self.current_checker_command = command
1203
log.info("Starting checker %r for %s", command, self.name)
1040
logger.info("Starting checker %r for %s", command,
1041
self.name)
1204
1042
# We don't need to redirect stdout and stderr, since
1205
1043
# in normal mode, that is already done by daemon(),
1206
1044
# and in debug mode we don't want to. (Stdin is
1208
1046
# The exception is when not debugging but nevertheless
1209
1047
# running in the foreground; use the previously
1210
1048
# created wnull.
1211
popen_args = {"close_fds": True,
1212
"shell": True,
1213
"cwd": "/"}
1049
popen_args = { "close_fds": True,
1050
"shell": True,
1051
"cwd": "/" }
1214
1052
if (not self.server_settings["debug"]
1215
1053
and self.server_settings["foreground"]):
1216
1054
popen_args.update({"stdout": wnull,
1217
"stderr": wnull})
1218
pipe = multiprocessing.Pipe(duplex=False)
1055
"stderr": wnull })
1056
pipe = multiprocessing.Pipe(duplex = False)
1219
1057
self.checker = multiprocessing.Process(
1220
target=call_pipe,
1221
args=(pipe[1], subprocess.call, command),
1222
kwargs=popen_args)
1058
target = call_pipe,
1059
args = (pipe[1], subprocess.call, command),
1060
kwargs = popen_args)
1223
1061
self.checker.start()
1224
1062
self.checker_callback_tag = GLib.io_add_watch(
1225
GLib.IOChannel.unix_new(pipe[0].fileno()),
1226
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1063
pipe[0].fileno(), GLib.IO_IN,
1227
1064
self.checker_callback, pipe[0], command)
1228
if start_was_randomized:
1229
# We were started after a random delay; Schedule a new
1230
# checker to be started an 'interval' from now, and every
1231
# interval from then on.
1232
now = datetime.datetime.utcnow()
1233
self.checker_initiator_tag = GLib.timeout_add(
1234
int(self.interval.total_seconds() * 1000),
1235
self.start_checker)
1236
self.expires = max(self.expires, now + self.interval)
1237
# Don't start a new checker again after same random delay
1238
return False
1239
1065
# Re-run this periodically if run by GLib.timeout_add
1240
1066
return True
1241
1067
1242
1068
def stop_checker(self):
1243
1069
"""Force the checker process, if any, to stop."""
1244
1070
if self.checker_callback_tag:
1246
1072
self.checker_callback_tag = None
1247
1073
if getattr(self, "checker", None) is None:
1248
1074
return
1249
log.debug("Stopping checker for %(name)s", vars(self))
1075
logger.debug("Stopping checker for %(name)s", vars(self))
1250
1076
self.checker.terminate()
1251
1077
self.checker = None
1252
1078
1257
1083
byte_arrays=False):
1258
1084
"""Decorators for marking methods of a DBusObjectWithProperties to
1259
1085
become properties on the D-Bus.
1260
1086
1261
1087
The decorated method will be called with no arguments by "Get"
1262
1088
and with one argument by "Set".
1263
1089
1264
1090
The parameters, where they are supported, are the same as
1265
1091
dbus.service.method, except there is only "signature", since the
1266
1092
type from Get() and the type sent to Set() is the same.
1270
1096
if byte_arrays and signature != "ay":
1271
1097
raise ValueError("Byte arrays not supported for non-'ay'"
1272
1098
" signature {!r}".format(signature))
1273
1099
1274
1100
def decorator(func):
1275
1101
func._dbus_is_property = True
1276
1102
func._dbus_interface = dbus_interface
1279
1105
func._dbus_name = func.__name__
1280
1106
if func._dbus_name.endswith("_dbus_property"):
1281
1107
func._dbus_name = func._dbus_name[:-14]
1282
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1108
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1283
1109
return func
1284
1110
1285
1111
return decorator
1286
1112
1287
1113
1288
1114
def dbus_interface_annotations(dbus_interface):
1289
1115
"""Decorator for marking functions returning interface annotations
1290
1116
1291
1117
Usage:
1292
1118
1293
1119
@dbus_interface_annotations("org.example.Interface")
1294
1120
def _foo(self): # Function name does not matter
1295
1121
return {"org.freedesktop.DBus.Deprecated": "true",
1296
1122
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1297
1123
"false"}
1298
1124
"""
1299
1125
1300
1126
def decorator(func):
1301
1127
func._dbus_is_interface = True
1302
1128
func._dbus_interface = dbus_interface
1303
1129
func._dbus_name = dbus_interface
1304
1130
return func
1305
1131
1306
1132
return decorator
1307
1133
1308
1134
1309
1135
def dbus_annotations(annotations):
1310
1136
"""Decorator to annotate D-Bus methods, signals or properties
1311
1137
Usage:
1312
1138
1313
1139
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1314
1140
"org.freedesktop.DBus.Property."
1315
1141
"EmitsChangedSignal": "false"})
1317
1143
access="r")
1318
1144
def Property_dbus_property(self):
1319
1145
return dbus.Boolean(False)
1320
1146
1321
1147
See also the DBusObjectWithAnnotations class.
1322
1148
"""
1323
1149
1324
1150
def decorator(func):
1325
1151
func._dbus_annotations = annotations
1326
1152
return func
1327
1153
1328
1154
return decorator
1329
1155
1330
1156
1348
1174
1349
1175
class DBusObjectWithAnnotations(dbus.service.Object):
1350
1176
"""A D-Bus object with annotations.
1351
1177
1352
1178
Classes inheriting from this can use the dbus_annotations
1353
1179
decorator to add annotations to methods or signals.
1354
1180
"""
1355
1181
1356
1182
@staticmethod
1357
1183
def _is_dbus_thing(thing):
1358
1184
"""Returns a function testing if an attribute is a D-Bus thing
1359
1185
1360
1186
If called like _is_dbus_thing("method") it returns a function
1361
1187
suitable for use as predicate to inspect.getmembers().
1362
1188
"""
1363
1189
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1364
1190
False)
1365
1191
1366
1192
def _get_all_dbus_things(self, thing):
1367
1193
"""Returns a generator of (name, attribute) pairs
1368
1194
"""
1371
1197
for cls in self.__class__.__mro__
1372
1198
for name, athing in
1373
1199
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1374
1200
1375
1201
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1376
out_signature="s",
1377
path_keyword="object_path",
1378
connection_keyword="connection")
1202
out_signature = "s",
1203
path_keyword = 'object_path',
1204
connection_keyword = 'connection')
1379
1205
def Introspect(self, object_path, connection):
1380
1206
"""Overloading of standard D-Bus method.
1381
1207
1382
1208
Inserts annotation tags on methods and signals.
1383
1209
"""
1384
1210
xmlstring = dbus.service.Object.Introspect(self, object_path,
1385
1211
connection)
1386
1212
try:
1387
1213
document = xml.dom.minidom.parseString(xmlstring)
1388
1214
1389
1215
for if_tag in document.getElementsByTagName("interface"):
1390
1216
# Add annotation tags
1391
1217
for typ in ("method", "signal"):
1418
1244
if_tag.appendChild(ann_tag)
1419
1245
# Fix argument name for the Introspect method itself
1420
1246
if (if_tag.getAttribute("name")
1421
== dbus.INTROSPECTABLE_IFACE):
1247
== dbus.INTROSPECTABLE_IFACE):
1422
1248
for cn in if_tag.getElementsByTagName("method"):
1423
1249
if cn.getAttribute("name") == "Introspect":
1424
1250
for arg in cn.getElementsByTagName("arg"):
1430
1256
document.unlink()
1431
1257
except (AttributeError, xml.dom.DOMException,
1432
1258
xml.parsers.expat.ExpatError) as error:
1433
log.error("Failed to override Introspection method",
1434
exc_info=error)
1259
logger.error("Failed to override Introspection method",
1260
exc_info=error)
1435
1261
return xmlstring
1436
1262
1437
1263
1438
1264
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1439
1265
"""A D-Bus object with properties.
1440
1266
1441
1267
Classes inheriting from this can use the dbus_service_property
1442
1268
decorator to expose methods as D-Bus properties. It exposes the
1443
1269
standard Get(), Set(), and GetAll() methods on the D-Bus.
1444
1270
"""
1445
1271
1446
1272
def _get_dbus_property(self, interface_name, property_name):
1447
1273
"""Returns a bound method if one exists which is a D-Bus
1448
1274
property with the specified name and interface.
1453
1279
if (value._dbus_name == property_name
1454
1280
and value._dbus_interface == interface_name):
1455
1281
return value.__get__(self)
1456
1282
1457
1283
# No such property
1458
1284
raise DBusPropertyNotFound("{}:{}.{}".format(
1459
1285
self.dbus_object_path, interface_name, property_name))
1460
1286
1461
1287
@classmethod
1462
1288
def _get_all_interface_names(cls):
1463
1289
"""Get a sequence of all interfaces supported by an object"""
1466
1292
for x in (inspect.getmro(cls))
1467
1293
for attr in dir(x))
1468
1294
if name is not None)
1469
1295
1470
1296
@dbus.service.method(dbus.PROPERTIES_IFACE,
1471
1297
in_signature="ss",
1472
1298
out_signature="v")
1480
1306
if not hasattr(value, "variant_level"):
1481
1307
return value
1482
1308
return type(value)(value, variant_level=value.variant_level+1)
1483
1309
1484
1310
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1485
1311
def Set(self, interface_name, property_name, value):
1486
1312
"""Standard D-Bus property Set() method, see D-Bus standard.
1495
1321
raise ValueError("Byte arrays not supported for non-"
1496
1322
"'ay' signature {!r}"
1497
1323
.format(prop._dbus_signature))
1498
value = dbus.ByteArray(bytes(value))
1324
value = dbus.ByteArray(b''.join(chr(byte)
1325
for byte in value))
1499
1326
prop(value)
1500
1327
1501
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
1502
1329
in_signature="s",
1503
1330
out_signature="a{sv}")
1504
1331
def GetAll(self, interface_name):
1505
1332
"""Standard D-Bus property GetAll() method, see D-Bus
1506
1333
standard.
1507
1334
1508
1335
Note: Will not include properties with access="write".
1509
1336
"""
1510
1337
properties = {}
1521
1348
properties[name] = value
1522
1349
continue
1523
1350
properties[name] = type(value)(
1524
value, variant_level=value.variant_level + 1)
1351
value, variant_level = value.variant_level + 1)
1525
1352
return dbus.Dictionary(properties, signature="sv")
1526
1353
1527
1354
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1528
1355
def PropertiesChanged(self, interface_name, changed_properties,
1529
1356
invalidated_properties):
1531
1358
standard.
1532
1359
"""
1533
1360
pass
1534
1361
1535
1362
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1536
1363
out_signature="s",
1537
path_keyword="object_path",
1538
connection_keyword="connection")
1364
path_keyword='object_path',
1365
connection_keyword='connection')
1539
1366
def Introspect(self, object_path, connection):
1540
1367
"""Overloading of standard D-Bus method.
1541
1368
1542
1369
Inserts property tags and interface annotation tags.
1543
1370
"""
1544
1371
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1546
1373
connection)
1547
1374
try:
1548
1375
document = xml.dom.minidom.parseString(xmlstring)
1549
1376
1550
1377
def make_tag(document, name, prop):
1551
1378
e = document.createElement("property")
1552
1379
e.setAttribute("name", name)
1553
1380
e.setAttribute("type", prop._dbus_signature)
1554
1381
e.setAttribute("access", prop._dbus_access)
1555
1382
return e
1556
1383
1557
1384
for if_tag in document.getElementsByTagName("interface"):
1558
1385
# Add property tags
1559
1386
for tag in (make_tag(document, name, prop)
1597
1424
document.unlink()
1598
1425
except (AttributeError, xml.dom.DOMException,
1599
1426
xml.parsers.expat.ExpatError) as error:
1600
log.error("Failed to override Introspection method",
1601
exc_info=error)
1427
logger.error("Failed to override Introspection method",
1428
exc_info=error)
1602
1429
return xmlstring
1603
1430
1604
1605
1431
try:
1606
1432
dbus.OBJECT_MANAGER_IFACE
1607
1433
except AttributeError:
1608
1434
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1609
1435
1610
1611
1436
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1612
1437
"""A D-Bus object with an ObjectManager.
1613
1438
1614
1439
Classes inheriting from this exposes the standard
1615
1440
GetManagedObjects call and the InterfacesAdded and
1616
1441
InterfacesRemoved signals on the standard
1617
1442
"org.freedesktop.DBus.ObjectManager" interface.
1618
1443
1619
1444
Note: No signals are sent automatically; they must be sent
1620
1445
manually.
1621
1446
"""
1622
1447
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1623
out_signature="a{oa{sa{sv}}}")
1448
out_signature = "a{oa{sa{sv}}}")
1624
1449
def GetManagedObjects(self):
1625
1450
"""This function must be overridden"""
1626
1451
raise NotImplementedError()
1627
1452
1628
1453
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1629
signature="oa{sa{sv}}")
1454
signature = "oa{sa{sv}}")
1630
1455
def InterfacesAdded(self, object_path, interfaces_and_properties):
1631
1456
pass
1632
1633
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1457
1458
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1634
1459
def InterfacesRemoved(self, object_path, interfaces):
1635
1460
pass
1636
1461
1637
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1638
out_signature="s",
1639
path_keyword="object_path",
1640
connection_keyword="connection")
1463
out_signature = "s",
1464
path_keyword = 'object_path',
1465
connection_keyword = 'connection')
1641
1466
def Introspect(self, object_path, connection):
1642
1467
"""Overloading of standard D-Bus method.
1643
1468
1644
1469
Override return argument name of GetManagedObjects to be
1645
1470
"objpath_interfaces_and_properties"
1646
1471
"""
1649
1474
connection)
1650
1475
try:
1651
1476
document = xml.dom.minidom.parseString(xmlstring)
1652
1477
1653
1478
for if_tag in document.getElementsByTagName("interface"):
1654
1479
# Fix argument name for the GetManagedObjects method
1655
1480
if (if_tag.getAttribute("name")
1656
== dbus.OBJECT_MANAGER_IFACE):
1481
== dbus.OBJECT_MANAGER_IFACE):
1657
1482
for cn in if_tag.getElementsByTagName("method"):
1658
1483
if (cn.getAttribute("name")
1659
1484
== "GetManagedObjects"):
1668
1493
document.unlink()
1669
1494
except (AttributeError, xml.dom.DOMException,
1670
1495
xml.parsers.expat.ExpatError) as error:
1671
log.error("Failed to override Introspection method",
1672
exc_info=error)
1496
logger.error("Failed to override Introspection method",
1497
exc_info = error)
1673
1498
return xmlstring
1674
1499
1675
1676
1500
def datetime_to_dbus(dt, variant_level=0):
1677
1501
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1678
1502
if dt is None:
1679
return dbus.String("", variant_level=variant_level)
1503
return dbus.String("", variant_level = variant_level)
1680
1504
return dbus.String(dt.isoformat(), variant_level=variant_level)
1681
1505
1682
1506
1685
1509
dbus.service.Object, it will add alternate D-Bus attributes with
1686
1510
interface names according to the "alt_interface_names" mapping.
1687
1511
Usage:
1688
1512
1689
1513
@alternate_dbus_interfaces({"org.example.Interface":
1690
1514
"net.example.AlternateInterface"})
1691
1515
class SampleDBusObject(dbus.service.Object):
1692
1516
@dbus.service.method("org.example.Interface")
1693
1517
def SampleDBusMethod():
1694
1518
pass
1695
1519
1696
1520
The above "SampleDBusMethod" on "SampleDBusObject" will be
1697
1521
reachable via two interfaces: "org.example.Interface" and
1698
1522
"net.example.AlternateInterface", the latter of which will have
1699
1523
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1700
1524
"true", unless "deprecate" is passed with a False value.
1701
1525
1702
1526
This works for methods and signals, and also for D-Bus properties
1703
1527
(from DBusObjectWithProperties) and interfaces (from the
1704
1528
dbus_interface_annotations decorator).
1705
1529
"""
1706
1530
1707
1531
def wrapper(cls):
1708
1532
for orig_interface_name, alt_interface_name in (
1709
1533
alt_interface_names.items()):
1749
1573
attribute._dbus_annotations)
1750
1574
except AttributeError:
1751
1575
pass
1752
1753
1576
# Define a creator of a function to call both the
1754
1577
# original and alternate functions, so both the
1755
1578
# original and alternate signals gets sent when
1758
1581
"""This function is a scope container to pass
1759
1582
func1 and func2 to the "call_both" function
1760
1583
outside of its arguments"""
1761
1584
1762
1585
@functools.wraps(func2)
1763
1586
def call_both(*args, **kwargs):
1764
1587
"""This function will emit two D-Bus
1765
1588
signals by calling func1 and func2"""
1766
1589
func1(*args, **kwargs)
1767
1590
func2(*args, **kwargs)
1768
# Make wrapper function look like a D-Bus
1769
# signal
1591
# Make wrapper function look like a D-Bus signal
1770
1592
for name, attr in inspect.getmembers(func2):
1771
1593
if name.startswith("_dbus_"):
1772
1594
setattr(call_both, name, attr)
1773
1595
1774
1596
return call_both
1775
1597
# Create the "call_both" function and add it to
1776
1598
# the class
1822
1644
(copy_function(attribute)))
1823
1645
if deprecate:
1824
1646
# Deprecate all alternate interfaces
1825
iname = "_AlternateDBusNames_interface_annotation{}"
1647
iname="_AlternateDBusNames_interface_annotation{}"
1826
1648
for interface_name in interface_names:
1827
1649
1828
1650
@dbus_interface_annotations(interface_name)
1829
1651
def func(self):
1830
return {"org.freedesktop.DBus.Deprecated":
1831
"true"}
1652
return { "org.freedesktop.DBus.Deprecated":
1653
"true" }
1832
1654
# Find an unused name
1833
1655
for aname in (iname.format(i)
1834
1656
for i in itertools.count()):
1845
1667
cls = type("{}Alternate".format(cls.__name__),
1846
1668
(cls, ), attr)
1847
1669
return cls
1848
1670
1849
1671
return wrapper
1850
1672
1851
1673
1853
1675
"se.bsnet.fukt.Mandos"})
1854
1676
class ClientDBus(Client, DBusObjectWithProperties):
1855
1677
"""A Client class using D-Bus
1856
1678
1857
1679
Attributes:
1858
1680
dbus_object_path: dbus.ObjectPath
1859
1681
bus: dbus.SystemBus()
1860
1682
"""
1861
1683
1862
1684
runtime_expansions = (Client.runtime_expansions
1863
1685
+ ("dbus_object_path", ))
1864
1686
1865
1687
_interface = "se.recompile.Mandos.Client"
1866
1688
1867
1689
# dbus.service.Object doesn't use super(), so we can't either.
1868
1869
def __init__(self, bus=None, *args, **kwargs):
1690
1691
def __init__(self, bus = None, *args, **kwargs):
1870
1692
self.bus = bus
1871
1693
Client.__init__(self, *args, **kwargs)
1872
1694
# Only now, when this client is initialized, can it show up on
1878
1700
"/clients/" + client_object_name)
1879
1701
DBusObjectWithProperties.__init__(self, self.bus,
1880
1702
self.dbus_object_path)
1881
1703
1882
1704
def notifychangeproperty(transform_func, dbus_name,
1883
1705
type_func=lambda x: x,
1884
1706
variant_level=1,
1886
1708
_interface=_interface):
1887
1709
""" Modify a variable so that it's a property which announces
1888
1710
its changes to DBus.
1889
1711
1890
1712
transform_fun: Function that takes a value and a variant_level
1891
1713
and transforms it to a D-Bus type.
1892
1714
dbus_name: D-Bus name of the variable
1895
1717
variant_level: D-Bus variant level. Default: 1
1896
1718
"""
1897
1719
attrname = "_{}".format(dbus_name)
1898
1720
1899
1721
def setter(self, value):
1900
1722
if hasattr(self, "dbus_object_path"):
1901
1723
if (not hasattr(self, attrname) or
1908
1730
else:
1909
1731
dbus_value = transform_func(
1910
1732
type_func(value),
1911
variant_level=variant_level)
1733
variant_level = variant_level)
1912
1734
self.PropertyChanged(dbus.String(dbus_name),
1913
1735
dbus_value)
1914
1736
self.PropertiesChanged(
1915
1737
_interface,
1916
dbus.Dictionary({dbus.String(dbus_name):
1917
dbus_value}),
1738
dbus.Dictionary({ dbus.String(dbus_name):
1739
dbus_value }),
1918
1740
dbus.Array())
1919
1741
setattr(self, attrname, value)
1920
1742
1921
1743
return property(lambda self: getattr(self, attrname), setter)
1922
1744
1923
1745
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1924
1746
approvals_pending = notifychangeproperty(dbus.Boolean,
1925
1747
"ApprovalPending",
1926
type_func=bool)
1748
type_func = bool)
1927
1749
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1928
1750
last_enabled = notifychangeproperty(datetime_to_dbus,
1929
1751
"LastEnabled")
1930
1752
checker = notifychangeproperty(
1931
1753
dbus.Boolean, "CheckerRunning",
1932
type_func=lambda checker: checker is not None)
1754
type_func = lambda checker: checker is not None)
1933
1755
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1934
1756
"LastCheckedOK")
1935
1757
last_checker_status = notifychangeproperty(dbus.Int16,
1940
1762
"ApprovedByDefault")
1941
1763
approval_delay = notifychangeproperty(
1942
1764
dbus.UInt64, "ApprovalDelay",
1943
type_func=lambda td: td.total_seconds() * 1000)
1765
type_func = lambda td: td.total_seconds() * 1000)
1944
1766
approval_duration = notifychangeproperty(
1945
1767
dbus.UInt64, "ApprovalDuration",
1946
type_func=lambda td: td.total_seconds() * 1000)
1768
type_func = lambda td: td.total_seconds() * 1000)
1947
1769
host = notifychangeproperty(dbus.String, "Host")
1948
1770
timeout = notifychangeproperty(
1949
1771
dbus.UInt64, "Timeout",
1950
type_func=lambda td: td.total_seconds() * 1000)
1772
type_func = lambda td: td.total_seconds() * 1000)
1951
1773
extended_timeout = notifychangeproperty(
1952
1774
dbus.UInt64, "ExtendedTimeout",
1953
type_func=lambda td: td.total_seconds() * 1000)
1775
type_func = lambda td: td.total_seconds() * 1000)
1954
1776
interval = notifychangeproperty(
1955
1777
dbus.UInt64, "Interval",
1956
type_func=lambda td: td.total_seconds() * 1000)
1778
type_func = lambda td: td.total_seconds() * 1000)
1957
1779
checker_command = notifychangeproperty(dbus.String, "Checker")
1958
1780
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1959
1781
invalidate_only=True)
1960
1782
1961
1783
del notifychangeproperty
1962
1784
1963
1785
def __del__(self, *args, **kwargs):
1964
1786
try:
1965
1787
self.remove_from_connection()
1968
1790
if hasattr(DBusObjectWithProperties, "__del__"):
1969
1791
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1970
1792
Client.__del__(self, *args, **kwargs)
1971
1793
1972
1794
def checker_callback(self, source, condition,
1973
1795
connection, command, *args, **kwargs):
1974
1796
ret = Client.checker_callback(self, source, condition,
1990
1812
| self.last_checker_signal),
1991
1813
dbus.String(command))
1992
1814
return ret
1993
1815
1994
1816
def start_checker(self, *args, **kwargs):
1995
1817
old_checker_pid = getattr(self.checker, "pid", None)
1996
1818
r = Client.start_checker(self, *args, **kwargs)
2000
1822
# Emit D-Bus signal
2001
1823
self.CheckerStarted(self.current_checker_command)
2002
1824
return r
2003
1825
2004
1826
def _reset_approved(self):
2005
1827
self.approved = None
2006
1828
return False
2007
1829
2008
1830
def approve(self, value=True):
2009
1831
self.approved = value
2010
1832
GLib.timeout_add(int(self.approval_duration.total_seconds()
2011
1833
* 1000), self._reset_approved)
2012
1834
self.send_changedstate()
2013
2014
# D-Bus methods, signals & properties
2015
2016
# Interfaces
2017
2018
# Signals
2019
1835
1836
## D-Bus methods, signals & properties
1837
1838
## Interfaces
1839
1840
## Signals
1841
2020
1842
# CheckerCompleted - signal
2021
1843
@dbus.service.signal(_interface, signature="nxs")
2022
1844
def CheckerCompleted(self, exitcode, waitstatus, command):
2023
1845
"D-Bus signal"
2024
1846
pass
2025
1847
2026
1848
# CheckerStarted - signal
2027
1849
@dbus.service.signal(_interface, signature="s")
2028
1850
def CheckerStarted(self, command):
2029
1851
"D-Bus signal"
2030
1852
pass
2031
1853
2032
1854
# PropertyChanged - signal
2033
1855
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2034
1856
@dbus.service.signal(_interface, signature="sv")
2035
1857
def PropertyChanged(self, property, value):
2036
1858
"D-Bus signal"
2037
1859
pass
2038
1860
2039
1861
# GotSecret - signal
2040
1862
@dbus.service.signal(_interface)
2041
1863
def GotSecret(self):
2044
1866
server to mandos-client
2045
1867
"""
2046
1868
pass
2047
1869
2048
1870
# Rejected - signal
2049
1871
@dbus.service.signal(_interface, signature="s")
2050
1872
def Rejected(self, reason):
2051
1873
"D-Bus signal"
2052
1874
pass
2053
1875
2054
1876
# NeedApproval - signal
2055
1877
@dbus.service.signal(_interface, signature="tb")
2056
1878
def NeedApproval(self, timeout, default):
2057
1879
"D-Bus signal"
2058
1880
return self.need_approval()
2059
2060
# Methods
2061
1881
1882
## Methods
1883
2062
1884
# Approve - method
2063
1885
@dbus.service.method(_interface, in_signature="b")
2064
1886
def Approve(self, value):
2065
1887
self.approve(value)
2066
1888
2067
1889
# CheckedOK - method
2068
1890
@dbus.service.method(_interface)
2069
1891
def CheckedOK(self):
2070
1892
self.checked_ok()
2071
1893
2072
1894
# Enable - method
2073
1895
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2074
1896
@dbus.service.method(_interface)
2075
1897
def Enable(self):
2076
1898
"D-Bus method"
2077
1899
self.enable()
2078
1900
2079
1901
# StartChecker - method
2080
1902
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2081
1903
@dbus.service.method(_interface)
2082
1904
def StartChecker(self):
2083
1905
"D-Bus method"
2084
1906
self.start_checker()
2085
1907
2086
1908
# Disable - method
2087
1909
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2088
1910
@dbus.service.method(_interface)
2089
1911
def Disable(self):
2090
1912
"D-Bus method"
2091
1913
self.disable()
2092
1914
2093
1915
# StopChecker - method
2094
1916
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2095
1917
@dbus.service.method(_interface)
2096
1918
def StopChecker(self):
2097
1919
self.stop_checker()
2098
2099
# Properties
2100
1920
1921
## Properties
1922
2101
1923
# ApprovalPending - property
2102
1924
@dbus_service_property(_interface, signature="b", access="read")
2103
1925
def ApprovalPending_dbus_property(self):
2104
1926
return dbus.Boolean(bool(self.approvals_pending))
2105
1927
2106
1928
# ApprovedByDefault - property
2107
1929
@dbus_service_property(_interface,
2108
1930
signature="b",
2111
1933
if value is None: # get
2112
1934
return dbus.Boolean(self.approved_by_default)
2113
1935
self.approved_by_default = bool(value)
2114
1936
2115
1937
# ApprovalDelay - property
2116
1938
@dbus_service_property(_interface,
2117
1939
signature="t",
2121
1943
return dbus.UInt64(self.approval_delay.total_seconds()
2122
1944
* 1000)
2123
1945
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2124
1946
2125
1947
# ApprovalDuration - property
2126
1948
@dbus_service_property(_interface,
2127
1949
signature="t",
2131
1953
return dbus.UInt64(self.approval_duration.total_seconds()
2132
1954
* 1000)
2133
1955
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2134
1956
2135
1957
# Name - property
2136
1958
@dbus_annotations(
2137
1959
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2138
1960
@dbus_service_property(_interface, signature="s", access="read")
2139
1961
def Name_dbus_property(self):
2140
1962
return dbus.String(self.name)
2141
2142
# KeyID - property
2143
@dbus_annotations(
2144
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2145
@dbus_service_property(_interface, signature="s", access="read")
2146
def KeyID_dbus_property(self):
2147
return dbus.String(self.key_id)
2148
1963
2149
1964
# Fingerprint - property
2150
1965
@dbus_annotations(
2151
1966
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2152
1967
@dbus_service_property(_interface, signature="s", access="read")
2153
1968
def Fingerprint_dbus_property(self):
2154
1969
return dbus.String(self.fingerprint)
2155
1970
2156
1971
# Host - property
2157
1972
@dbus_service_property(_interface,
2158
1973
signature="s",
2161
1976
if value is None: # get
2162
1977
return dbus.String(self.host)
2163
1978
self.host = str(value)
2164
1979
2165
1980
# Created - property
2166
1981
@dbus_annotations(
2167
1982
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2168
1983
@dbus_service_property(_interface, signature="s", access="read")
2169
1984
def Created_dbus_property(self):
2170
1985
return datetime_to_dbus(self.created)
2171
1986
2172
1987
# LastEnabled - property
2173
1988
@dbus_service_property(_interface, signature="s", access="read")
2174
1989
def LastEnabled_dbus_property(self):
2175
1990
return datetime_to_dbus(self.last_enabled)
2176
1991
2177
1992
# Enabled - property
2178
1993
@dbus_service_property(_interface,
2179
1994
signature="b",
2185
2000
self.enable()
2186
2001
else:
2187
2002
self.disable()
2188
2003
2189
2004
# LastCheckedOK - property
2190
2005
@dbus_service_property(_interface,
2191
2006
signature="s",
2195
2010
self.checked_ok()
2196
2011
return
2197
2012
return datetime_to_dbus(self.last_checked_ok)
2198
2013
2199
2014
# LastCheckerStatus - property
2200
2015
@dbus_service_property(_interface, signature="n", access="read")
2201
2016
def LastCheckerStatus_dbus_property(self):
2202
2017
return dbus.Int16(self.last_checker_status)
2203
2018
2204
2019
# Expires - property
2205
2020
@dbus_service_property(_interface, signature="s", access="read")
2206
2021
def Expires_dbus_property(self):
2207
2022
return datetime_to_dbus(self.expires)
2208
2023
2209
2024
# LastApprovalRequest - property
2210
2025
@dbus_service_property(_interface, signature="s", access="read")
2211
2026
def LastApprovalRequest_dbus_property(self):
2212
2027
return datetime_to_dbus(self.last_approval_request)
2213
2028
2214
2029
# Timeout - property
2215
2030
@dbus_service_property(_interface,
2216
2031
signature="t",
2235
2050
self.disable_initiator_tag = GLib.timeout_add(
2236
2051
int((self.expires - now).total_seconds() * 1000),
2237
2052
self.disable)
2238
2053
2239
2054
# ExtendedTimeout - property
2240
2055
@dbus_service_property(_interface,
2241
2056
signature="t",
2245
2060
return dbus.UInt64(self.extended_timeout.total_seconds()
2246
2061
* 1000)
2247
2062
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2248
2063
2249
2064
# Interval - property
2250
2065
@dbus_service_property(_interface,
2251
2066
signature="t",
2261
2076
GLib.source_remove(self.checker_initiator_tag)
2262
2077
self.checker_initiator_tag = GLib.timeout_add(
2263
2078
value, self.start_checker)
2264
self.start_checker() # Start one now, too
2265
2079
self.start_checker() # Start one now, too
2080
2266
2081
# Checker - property
2267
2082
@dbus_service_property(_interface,
2268
2083
signature="s",
2271
2086
if value is None: # get
2272
2087
return dbus.String(self.checker_command)
2273
2088
self.checker_command = str(value)
2274
2089
2275
2090
# CheckerRunning - property
2276
2091
@dbus_service_property(_interface,
2277
2092
signature="b",
2283
2098
self.start_checker()
2284
2099
else:
2285
2100
self.stop_checker()
2286
2101
2287
2102
# ObjectPath - property
2288
2103
@dbus_annotations(
2289
2104
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2290
2105
"org.freedesktop.DBus.Deprecated": "true"})
2291
2106
@dbus_service_property(_interface, signature="o", access="read")
2292
2107
def ObjectPath_dbus_property(self):
2293
return self.dbus_object_path # is already a dbus.ObjectPath
2294
2108
return self.dbus_object_path # is already a dbus.ObjectPath
2109
2295
2110
# Secret = property
2296
2111
@dbus_annotations(
2297
2112
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2302
2117
byte_arrays=True)
2303
2118
def Secret_dbus_property(self, value):
2304
2119
self.secret = bytes(value)
2305
2120
2306
2121
del _interface
2307
2122
2308
2123
2309
class ProxyClient:
2310
def __init__(self, child_pipe, key_id, fpr, address):
2124
class ProxyClient(object):
2125
def __init__(self, child_pipe, fpr, address):
2311
2126
self._pipe = child_pipe
2312
self._pipe.send(("init", key_id, fpr, address))
2127
self._pipe.send(('init', fpr, address))
2313
2128
if not self._pipe.recv():
2314
raise KeyError(key_id or fpr)
2315
2129
raise KeyError(fpr)
2130
2316
2131
def __getattribute__(self, name):
2317
if name == "_pipe":
2132
if name == '_pipe':
2318
2133
return super(ProxyClient, self).__getattribute__(name)
2319
self._pipe.send(("getattr", name))
2134
self._pipe.send(('getattr', name))
2320
2135
data = self._pipe.recv()
2321
if data[0] == "data":
2136
if data[0] == 'data':
2322
2137
return data[1]
2323
if data[0] == "function":
2324
2138
if data[0] == 'function':
2139
2325
2140
def func(*args, **kwargs):
2326
self._pipe.send(("funcall", name, args, kwargs))
2141
self._pipe.send(('funcall', name, args, kwargs))
2327
2142
return self._pipe.recv()[1]
2328
2143
2329
2144
return func
2330
2145
2331
2146
def __setattr__(self, name, value):
2332
if name == "_pipe":
2147
if name == '_pipe':
2333
2148
return super(ProxyClient, self).__setattr__(name, value)
2334
self._pipe.send(("setattr", name, value))
2149
self._pipe.send(('setattr', name, value))
2335
2150
2336
2151
2337
2152
class ClientHandler(socketserver.BaseRequestHandler, object):
2338
2153
"""A class to handle client connections.
2339
2154
2340
2155
Instantiated once for each connection to handle it.
2341
2156
Note: This will run in its own forked process."""
2342
2157
2343
2158
def handle(self):
2344
2159
with contextlib.closing(self.server.child_pipe) as child_pipe:
2345
log.info("TCP connection from: %s",
2346
str(self.client_address))
2347
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2348
2160
logger.info("TCP connection from: %s",
2161
str(self.client_address))
2162
logger.debug("Pipe FD: %d",
2163
self.server.child_pipe.fileno())
2164
2349
2165
session = gnutls.ClientSession(self.request)
2350
2351
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2352
# "+AES-256-CBC", "+SHA1",
2353
# "+COMP-NULL", "+CTYPE-OPENPGP",
2354
# "+DHE-DSS"))
2166
2167
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
# "+AES-256-CBC", "+SHA1",
2169
# "+COMP-NULL", "+CTYPE-OPENPGP",
2170
# "+DHE-DSS"))
2355
2171
# Use a fallback default, since this MUST be set.
2356
2172
priority = self.server.gnutls_priority
2357
2173
if priority is None:
2358
2174
priority = "NORMAL"
2359
gnutls.priority_set_direct(session,
2360
priority.encode("utf-8"), None)
2361
2175
gnutls.priority_set_direct(session._c_object, priority,
2176
None)
2177
2362
2178
# Start communication using the Mandos protocol
2363
2179
# Get protocol number
2364
2180
line = self.request.makefile().readline()
2365
log.debug("Protocol version: %r", line)
2181
logger.debug("Protocol version: %r", line)
2366
2182
try:
2367
2183
if int(line.strip().split()[0]) > 1:
2368
2184
raise RuntimeError(line)
2369
2185
except (ValueError, IndexError, RuntimeError) as error:
2370
log.error("Unknown protocol version: %s", error)
2186
logger.error("Unknown protocol version: %s", error)
2371
2187
return
2372
2188
2373
2189
# Start GnuTLS connection
2374
2190
try:
2375
2191
session.handshake()
2376
2192
except gnutls.Error as error:
2377
log.warning("Handshake failed: %s", error)
2193
logger.warning("Handshake failed: %s", error)
2378
2194
# Do not run session.bye() here: the session is not
2379
2195
# established. Just abandon the request.
2380
2196
return
2381
log.debug("Handshake succeeded")
2382
2197
logger.debug("Handshake succeeded")
2198
2383
2199
approval_required = False
2384
2200
try:
2385
if gnutls.has_rawpk:
2386
fpr = b""
2387
try:
2388
key_id = self.key_id(
2389
self.peer_certificate(session))
2390
except (TypeError, gnutls.Error) as error:
2391
log.warning("Bad certificate: %s", error)
2392
return
2393
log.debug("Key ID: %s",
2394
key_id.decode("utf-8",
2395
errors="replace"))
2396
2397
else:
2398
key_id = b""
2399
try:
2400
fpr = self.fingerprint(
2401
self.peer_certificate(session))
2402
except (TypeError, gnutls.Error) as error:
2403
log.warning("Bad certificate: %s", error)
2404
return
2405
log.debug("Fingerprint: %s", fpr)
2406
2407
try:
2408
client = ProxyClient(child_pipe, key_id, fpr,
2201
try:
2202
fpr = self.fingerprint(
2203
self.peer_certificate(session))
2204
except (TypeError, gnutls.Error) as error:
2205
logger.warning("Bad certificate: %s", error)
2206
return
2207
logger.debug("Fingerprint: %s", fpr)
2208
2209
try:
2210
client = ProxyClient(child_pipe, fpr,
2409
2211
self.client_address)
2410
2212
except KeyError:
2411
2213
return
2412
2214
2413
2215
if client.approval_delay:
2414
2216
delay = client.approval_delay
2415
2217
client.approvals_pending += 1
2416
2218
approval_required = True
2417
2219
2418
2220
while True:
2419
2221
if not client.enabled:
2420
log.info("Client %s is disabled", client.name)
2222
logger.info("Client %s is disabled",
2223
client.name)
2421
2224
if self.server.use_dbus:
2422
2225
# Emit D-Bus signal
2423
2226
client.Rejected("Disabled")
2424
2227
return
2425
2228
2426
2229
if client.approved or not client.approval_delay:
2427
# We are approved or approval is disabled
2230
#We are approved or approval is disabled
2428
2231
break
2429
2232
elif client.approved is None:
2430
log.info("Client %s needs approval",
2431
client.name)
2233
logger.info("Client %s needs approval",
2234
client.name)
2432
2235
if self.server.use_dbus:
2433
2236
# Emit D-Bus signal
2434
2237
client.NeedApproval(
2435
2238
client.approval_delay.total_seconds()
2436
2239
* 1000, client.approved_by_default)
2437
2240
else:
2438
log.warning("Client %s was not approved",
2439
client.name)
2241
logger.warning("Client %s was not approved",
2242
client.name)
2440
2243
if self.server.use_dbus:
2441
2244
# Emit D-Bus signal
2442
2245
client.Rejected("Denied")
2443
2246
return
2444
2445
# wait until timeout or approved
2247
2248
#wait until timeout or approved
2446
2249
time = datetime.datetime.now()
2447
2250
client.changedstate.acquire()
2448
2251
client.changedstate.wait(delay.total_seconds())
2450
2253
time2 = datetime.datetime.now()
2451
2254
if (time2 - time) >= delay:
2452
2255
if not client.approved_by_default:
2453
log.warning("Client %s timed out while"
2454
" waiting for approval",
2455
client.name)
2256
logger.warning("Client %s timed out while"
2257
" waiting for approval",
2258
client.name)
2456
2259
if self.server.use_dbus:
2457
2260
# Emit D-Bus signal
2458
2261
client.Rejected("Approval timed out")
2461
2264
break
2462
2265
else:
2463
2266
delay -= time2 - time
2464
2267
2465
2268
try:
2466
2269
session.send(client.secret)
2467
2270
except gnutls.Error as error:
2468
log.warning("gnutls send failed", exc_info=error)
2271
logger.warning("gnutls send failed",
2272
exc_info = error)
2469
2273
return
2470
2471
log.info("Sending secret to %s", client.name)
2274
2275
logger.info("Sending secret to %s", client.name)
2472
2276
# bump the timeout using extended_timeout
2473
2277
client.bump_timeout(client.extended_timeout)
2474
2278
if self.server.use_dbus:
2475
2279
# Emit D-Bus signal
2476
2280
client.GotSecret()
2477
2281
2478
2282
finally:
2479
2283
if approval_required:
2480
2284
client.approvals_pending -= 1
2481
2285
try:
2482
2286
session.bye()
2483
2287
except gnutls.Error as error:
2484
log.warning("GnuTLS bye failed", exc_info=error)
2485
2288
logger.warning("GnuTLS bye failed",
2289
exc_info=error)
2290
2486
2291
@staticmethod
2487
2292
def peer_certificate(session):
2488
"Return the peer's certificate as a bytestring"
2489
try:
2490
cert_type = gnutls.certificate_type_get2(
2491
session, gnutls.CTYPE_PEERS)
2492
except AttributeError:
2493
cert_type = gnutls.certificate_type_get(session)
2494
if gnutls.has_rawpk:
2495
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2496
else:
2497
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2498
# If not a valid certificate type...
2499
if cert_type not in valid_cert_types:
2500
log.info("Cert type %r not in %r", cert_type,
2501
valid_cert_types)
2293
"Return the peer's OpenPGP certificate as a bytestring"
2294
# If not an OpenPGP certificate...
2295
if (gnutls.certificate_type_get(session._c_object)
2296
!= gnutls.CRT_OPENPGP):
2502
2297
# ...return invalid data
2503
2298
return b""
2504
2299
list_size = ctypes.c_uint(1)
2505
2300
cert_list = (gnutls.certificate_get_peers
2506
(session, ctypes.byref(list_size)))
2301
(session._c_object, ctypes.byref(list_size)))
2507
2302
if not bool(cert_list) and list_size.value != 0:
2508
2303
raise gnutls.Error("error getting peer certificate")
2509
2304
if list_size.value == 0:
2510
2305
return None
2511
2306
cert = cert_list[0]
2512
2307
return ctypes.string_at(cert.data, cert.size)
2513
2514
@staticmethod
2515
def key_id(certificate):
2516
"Convert a certificate bytestring to a hexdigit key ID"
2517
# New GnuTLS "datum" with the public key
2518
datum = gnutls.datum_t(
2519
ctypes.cast(ctypes.c_char_p(certificate),
2520
ctypes.POINTER(ctypes.c_ubyte)),
2521
ctypes.c_uint(len(certificate)))
2522
# XXX all these need to be created in the gnutls "module"
2523
# New empty GnuTLS certificate
2524
pubkey = gnutls.pubkey_t()
2525
gnutls.pubkey_init(ctypes.byref(pubkey))
2526
# Import the raw public key into the certificate
2527
gnutls.pubkey_import(pubkey,
2528
ctypes.byref(datum),
2529
gnutls.X509_FMT_DER)
2530
# New buffer for the key ID
2531
buf = ctypes.create_string_buffer(32)
2532
buf_len = ctypes.c_size_t(len(buf))
2533
# Get the key ID from the raw public key into the buffer
2534
gnutls.pubkey_get_key_id(
2535
pubkey,
2536
gnutls.KEYID_USE_SHA256,
2537
ctypes.cast(ctypes.byref(buf),
2538
ctypes.POINTER(ctypes.c_ubyte)),
2539
ctypes.byref(buf_len))
2540
# Deinit the certificate
2541
gnutls.pubkey_deinit(pubkey)
2542
2543
# Convert the buffer to a Python bytestring
2544
key_id = ctypes.string_at(buf, buf_len.value)
2545
# Convert the bytestring to hexadecimal notation
2546
hex_key_id = binascii.hexlify(key_id).upper()
2547
return hex_key_id
2548
2308
2549
2309
@staticmethod
2550
2310
def fingerprint(openpgp):
2551
2311
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2566
2326
ctypes.byref(crtverify))
2567
2327
if crtverify.value != 0:
2568
2328
gnutls.openpgp_crt_deinit(crt)
2569
raise gnutls.CertificateSecurityError(code
2570
=crtverify.value)
2329
raise gnutls.CertificateSecurityError("Verify failed")
2571
2330
# New buffer for the fingerprint
2572
2331
buf = ctypes.create_string_buffer(20)
2573
2332
buf_len = ctypes.c_size_t()
2583
2342
return hex_fpr
2584
2343
2585
2344
2586
class MultiprocessingMixIn:
2345
class MultiprocessingMixIn(object):
2587
2346
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2588
2347
2589
2348
def sub_process_main(self, request, address):
2590
2349
try:
2591
2350
self.finish_request(request, address)
2592
2351
except Exception:
2593
2352
self.handle_error(request, address)
2594
2353
self.close_request(request)
2595
2354
2596
2355
def process_request(self, request, address):
2597
2356
"""Start a new process to process the request."""
2598
proc = multiprocessing.Process(target=self.sub_process_main,
2599
args=(request, address))
2357
proc = multiprocessing.Process(target = self.sub_process_main,
2358
args = (request, address))
2600
2359
proc.start()
2601
2360
return proc
2602
2361
2603
2362
2604
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2605
2364
""" adds a pipe to the MixIn """
2606
2365
2607
2366
def process_request(self, request, client_address):
2608
2367
"""Overrides and wraps the original process_request().
2609
2368
2610
2369
This function creates a new pipe in self.pipe
2611
2370
"""
2612
2371
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2613
2372
2614
2373
proc = MultiprocessingMixIn.process_request(self, request,
2615
2374
client_address)
2616
2375
self.child_pipe.close()
2617
2376
self.add_pipe(parent_pipe, proc)
2618
2377
2619
2378
def add_pipe(self, parent_pipe, proc):
2620
2379
"""Dummy function; override as necessary"""
2621
2380
raise NotImplementedError()
2622
2381
2623
2382
2624
2383
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2625
socketserver.TCPServer):
2626
"""IPv6-capable TCP server. Accepts None as address and/or port
2627
2384
socketserver.TCPServer, object):
2385
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2386
2628
2387
Attributes:
2629
2388
enabled: Boolean; whether this server is activated yet
2630
2389
interface: None or a network interface name (string)
2631
2390
use_ipv6: Boolean; to use IPv6 or not
2632
2391
"""
2633
2392
2634
2393
def __init__(self, server_address, RequestHandlerClass,
2635
2394
interface=None,
2636
2395
use_ipv6=True,
2646
2405
self.socketfd = socketfd
2647
2406
# Save the original socket.socket() function
2648
2407
self.socket_socket = socket.socket
2649
2650
2408
# To implement --socket, we monkey patch socket.socket.
2651
#
2409
#
2652
2410
# (When socketserver.TCPServer is a new-style class, we
2653
2411
# could make self.socket into a property instead of monkey
2654
2412
# patching socket.socket.)
2655
#
2413
#
2656
2414
# Create a one-time-only replacement for socket.socket()
2657
2415
@functools.wraps(socket.socket)
2658
2416
def socket_wrapper(*args, **kwargs):
2670
2428
# socket_wrapper(), if socketfd was set.
2671
2429
socketserver.TCPServer.__init__(self, server_address,
2672
2430
RequestHandlerClass)
2673
2431
2674
2432
def server_bind(self):
2675
2433
"""This overrides the normal server_bind() function
2676
2434
to bind to an interface if one was specified, and also NOT to
2677
2435
bind to an address or port if they were not specified."""
2678
global SO_BINDTODEVICE
2679
2436
if self.interface is not None:
2680
2437
if SO_BINDTODEVICE is None:
2681
# Fall back to a hard-coded value which seems to be
2682
# common enough.
2683
log.warning("SO_BINDTODEVICE not found, trying 25")
2684
SO_BINDTODEVICE = 25
2685
try:
2686
self.socket.setsockopt(
2687
socket.SOL_SOCKET, SO_BINDTODEVICE,
2688
(self.interface + "\0").encode("utf-8"))
2689
except socket.error as error:
2690
if error.errno == errno.EPERM:
2691
log.error("No permission to bind to interface %s",
2692
self.interface)
2693
elif error.errno == errno.ENOPROTOOPT:
2694
log.error("SO_BINDTODEVICE not available; cannot"
2695
" bind to interface %s", self.interface)
2696
elif error.errno == errno.ENODEV:
2697
log.error("Interface %s does not exist, cannot"
2698
" bind", self.interface)
2699
else:
2700
raise
2438
logger.error("SO_BINDTODEVICE does not exist;"
2439
" cannot bind to interface %s",
2440
self.interface)
2441
else:
2442
try:
2443
self.socket.setsockopt(
2444
socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
(self.interface + "\0").encode("utf-8"))
2446
except socket.error as error:
2447
if error.errno == errno.EPERM:
2448
logger.error("No permission to bind to"
2449
" interface %s", self.interface)
2450
elif error.errno == errno.ENOPROTOOPT:
2451
logger.error("SO_BINDTODEVICE not available;"
2452
" cannot bind to interface %s",
2453
self.interface)
2454
elif error.errno == errno.ENODEV:
2455
logger.error("Interface %s does not exist,"
2456
" cannot bind", self.interface)
2457
else:
2458
raise
2701
2459
# Only bind(2) the socket if we really need to.
2702
2460
if self.server_address[0] or self.server_address[1]:
2703
if self.server_address[1]:
2704
self.allow_reuse_address = True
2705
2461
if not self.server_address[0]:
2706
2462
if self.address_family == socket.AF_INET6:
2707
any_address = "::" # in6addr_any
2463
any_address = "::" # in6addr_any
2708
2464
else:
2709
any_address = "0.0.0.0" # INADDR_ANY
2465
any_address = "0.0.0.0" # INADDR_ANY
2710
2466
self.server_address = (any_address,
2711
2467
self.server_address[1])
2712
2468
elif not self.server_address[1]:
2722
2478
2723
2479
class MandosServer(IPv6_TCPServer):
2724
2480
"""Mandos server.
2725
2481
2726
2482
Attributes:
2727
2483
clients: set of Client objects
2728
2484
gnutls_priority GnuTLS priority string
2729
2485
use_dbus: Boolean; to emit D-Bus signals or not
2730
2486
2731
2487
Assumes a GLib.MainLoop event loop.
2732
2488
"""
2733
2489
2734
2490
def __init__(self, server_address, RequestHandlerClass,
2735
2491
interface=None,
2736
2492
use_ipv6=True,
2746
2502
self.gnutls_priority = gnutls_priority
2747
2503
IPv6_TCPServer.__init__(self, server_address,
2748
2504
RequestHandlerClass,
2749
interface=interface,
2750
use_ipv6=use_ipv6,
2751
socketfd=socketfd)
2752
2505
interface = interface,
2506
use_ipv6 = use_ipv6,
2507
socketfd = socketfd)
2508
2753
2509
def server_activate(self):
2754
2510
if self.enabled:
2755
2511
return socketserver.TCPServer.server_activate(self)
2756
2512
2757
2513
def enable(self):
2758
2514
self.enabled = True
2759
2515
2760
2516
def add_pipe(self, parent_pipe, proc):
2761
2517
# Call "handle_ipc" for both data and EOF events
2762
2518
GLib.io_add_watch(
2763
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2764
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2519
parent_pipe.fileno(),
2520
GLib.IO_IN | GLib.IO_HUP,
2765
2521
functools.partial(self.handle_ipc,
2766
parent_pipe=parent_pipe,
2767
proc=proc))
2768
2522
parent_pipe = parent_pipe,
2523
proc = proc))
2524
2769
2525
def handle_ipc(self, source, condition,
2770
2526
parent_pipe=None,
2771
proc=None,
2527
proc = None,
2772
2528
client_object=None):
2773
2529
# error, or the other end of multiprocessing.Pipe has closed
2774
2530
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2775
2531
# Wait for other process to exit
2776
2532
proc.join()
2777
2533
return False
2778
2534
2779
2535
# Read a request from the child
2780
2536
request = parent_pipe.recv()
2781
2537
command = request[0]
2782
2783
if command == "init":
2784
key_id = request[1].decode("ascii")
2785
fpr = request[2].decode("ascii")
2786
address = request[3]
2787
2538
2539
if command == 'init':
2540
fpr = request[1]
2541
address = request[2]
2542
2788
2543
for c in self.clients.values():
2789
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2790
"27AE41E4649B934CA495991B7852B855"):
2791
continue
2792
if key_id and c.key_id == key_id:
2793
client = c
2794
break
2795
if fpr and c.fingerprint == fpr:
2544
if c.fingerprint == fpr:
2796
2545
client = c
2797
2546
break
2798
2547
else:
2799
log.info("Client not found for key ID: %s, address:"
2800
" %s", key_id or fpr, address)
2548
logger.info("Client not found for fingerprint: %s, ad"
2549
"dress: %s", fpr, address)
2801
2550
if self.use_dbus:
2802
2551
# Emit D-Bus signal
2803
mandos_dbus_service.ClientNotFound(key_id or fpr,
2552
mandos_dbus_service.ClientNotFound(fpr,
2804
2553
address[0])
2805
2554
parent_pipe.send(False)
2806
2555
return False
2807
2556
2808
2557
GLib.io_add_watch(
2809
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2810
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2558
parent_pipe.fileno(),
2559
GLib.IO_IN | GLib.IO_HUP,
2811
2560
functools.partial(self.handle_ipc,
2812
parent_pipe=parent_pipe,
2813
proc=proc,
2814
client_object=client))
2561
parent_pipe = parent_pipe,
2562
proc = proc,
2563
client_object = client))
2815
2564
parent_pipe.send(True)
2816
2565
# remove the old hook in favor of the new above hook on
2817
2566
# same fileno
2818
2567
return False
2819
if command == "funcall":
2568
if command == 'funcall':
2820
2569
funcname = request[1]
2821
2570
args = request[2]
2822
2571
kwargs = request[3]
2823
2824
parent_pipe.send(("data", getattr(client_object,
2572
2573
parent_pipe.send(('data', getattr(client_object,
2825
2574
funcname)(*args,
2826
2575
**kwargs)))
2827
2828
if command == "getattr":
2576
2577
if command == 'getattr':
2829
2578
attrname = request[1]
2830
2579
if isinstance(client_object.__getattribute__(attrname),
2831
collections.abc.Callable):
2832
parent_pipe.send(("function", ))
2580
collections.Callable):
2581
parent_pipe.send(('function', ))
2833
2582
else:
2834
2583
parent_pipe.send((
2835
"data", client_object.__getattribute__(attrname)))
2836
2837
if command == "setattr":
2584
'data', client_object.__getattribute__(attrname)))
2585
2586
if command == 'setattr':
2838
2587
attrname = request[1]
2839
2588
value = request[2]
2840
2589
setattr(client_object, attrname, value)
2841
2590
2842
2591
return True
2843
2592
2844
2593
2845
2594
def rfc3339_duration_to_delta(duration):
2846
2595
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2847
2848
>>> timedelta = datetime.timedelta
2849
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2850
True
2851
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2852
True
2853
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2854
True
2855
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2856
True
2857
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2858
True
2859
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2860
True
2861
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2862
True
2863
>>> del timedelta
2596
2597
>>> rfc3339_duration_to_delta("P7D")
2598
datetime.timedelta(7)
2599
>>> rfc3339_duration_to_delta("PT60S")
2600
datetime.timedelta(0, 60)
2601
>>> rfc3339_duration_to_delta("PT60M")
2602
datetime.timedelta(0, 3600)
2603
>>> rfc3339_duration_to_delta("PT24H")
2604
datetime.timedelta(1)
2605
>>> rfc3339_duration_to_delta("P1W")
2606
datetime.timedelta(7)
2607
>>> rfc3339_duration_to_delta("PT5M30S")
2608
datetime.timedelta(0, 330)
2609
>>> rfc3339_duration_to_delta("P1DT3M20S")
2610
datetime.timedelta(1, 200)
2864
2611
"""
2865
2612
2866
2613
# Parsing an RFC 3339 duration with regular expressions is not
2867
2614
# possible - there would have to be multiple places for the same
2868
2615
# values, like seconds. The current code, while more esoteric, is
2869
2616
# cleaner without depending on a parsing library. If Python had a
2870
2617
# built-in library for parsing we would use it, but we'd like to
2871
2618
# avoid excessive use of external libraries.
2872
2619
2873
2620
# New type for defining tokens, syntax, and semantics all-in-one
2874
2621
Token = collections.namedtuple("Token", (
2875
2622
"regexp", # To match token; if "value" is not None, must have
2908
2655
frozenset((token_year, token_month,
2909
2656
token_day, token_time,
2910
2657
token_week)))
2911
# Define starting values:
2912
# Value so far
2913
value = datetime.timedelta()
2658
# Define starting values
2659
value = datetime.timedelta() # Value so far
2914
2660
found_token = None
2915
# Following valid tokens
2916
followers = frozenset((token_duration, ))
2917
# String left to parse
2918
s = duration
2661
followers = frozenset((token_duration, )) # Following valid tokens
2662
s = duration # String left to parse
2919
2663
# Loop until end token is found
2920
2664
while found_token is not token_end:
2921
2665
# Search for any currently valid tokens
2945
2689
2946
2690
def string_to_delta(interval):
2947
2691
"""Parse a string and return a datetime.timedelta
2948
2949
>>> string_to_delta("7d") == datetime.timedelta(7)
2950
True
2951
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2952
True
2953
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2954
True
2955
>>> string_to_delta("24h") == datetime.timedelta(1)
2956
True
2957
>>> string_to_delta("1w") == datetime.timedelta(7)
2958
True
2959
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2960
True
2692
2693
>>> string_to_delta('7d')
2694
datetime.timedelta(7)
2695
>>> string_to_delta('60s')
2696
datetime.timedelta(0, 60)
2697
>>> string_to_delta('60m')
2698
datetime.timedelta(0, 3600)
2699
>>> string_to_delta('24h')
2700
datetime.timedelta(1)
2701
>>> string_to_delta('1w')
2702
datetime.timedelta(7)
2703
>>> string_to_delta('5m 30s')
2704
datetime.timedelta(0, 330)
2961
2705
"""
2962
2706
2963
2707
try:
2964
2708
return rfc3339_duration_to_delta(interval)
2965
2709
except ValueError:
2966
2710
pass
2967
2711
2968
2712
timevalue = datetime.timedelta(0)
2969
2713
for s in interval.split():
2970
2714
try:
2988
2732
return timevalue
2989
2733
2990
2734
2991
def daemon(nochdir=False, noclose=False):
2735
def daemon(nochdir = False, noclose = False):
2992
2736
"""See daemon(3). Standard BSD Unix function.
2993
2737
2994
2738
This should really exist as os.daemon, but it doesn't (yet)."""
2995
2739
if os.fork():
2996
2740
sys.exit()
3014
2758
3015
2759
3016
2760
def main():
3017
2761
3018
2762
##################################################################
3019
2763
# Parsing of options, both command line and config file
3020
2764
3021
2765
parser = argparse.ArgumentParser()
3022
2766
parser.add_argument("-v", "--version", action="version",
3023
version="%(prog)s {}".format(version),
2767
version = "%(prog)s {}".format(version),
3024
2768
help="show version number and exit")
3025
2769
parser.add_argument("-i", "--interface", metavar="IF",
3026
2770
help="Bind to interface IF")
3062
2806
parser.add_argument("--no-zeroconf", action="store_false",
3063
2807
dest="zeroconf", help="Do not use Zeroconf",
3064
2808
default=None)
3065
2809
3066
2810
options = parser.parse_args()
3067
2811
2812
if options.check:
2813
import doctest
2814
fail_count, test_count = doctest.testmod()
2815
sys.exit(os.EX_OK if fail_count == 0 else 1)
2816
3068
2817
# Default values for config file for server-global settings
3069
if gnutls.has_rawpk:
3070
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3072
else:
3073
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3074
":+SIGN-DSA-SHA256")
3075
server_defaults = {"interface": "",
3076
"address": "",
3077
"port": "",
3078
"debug": "False",
3079
"priority": priority,
3080
"servicename": "Mandos",
3081
"use_dbus": "True",
3082
"use_ipv6": "True",
3083
"debuglevel": "",
3084
"restore": "True",
3085
"socket": "",
3086
"statedir": "/var/lib/mandos",
3087
"foreground": "False",
3088
"zeroconf": "True",
3089
}
3090
del priority
3091
2818
server_defaults = { "interface": "",
2819
"address": "",
2820
"port": "",
2821
"debug": "False",
2822
"priority":
2823
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2824
":+SIGN-DSA-SHA256",
2825
"servicename": "Mandos",
2826
"use_dbus": "True",
2827
"use_ipv6": "True",
2828
"debuglevel": "",
2829
"restore": "True",
2830
"socket": "",
2831
"statedir": "/var/lib/mandos",
2832
"foreground": "False",
2833
"zeroconf": "True",
2834
}
2835
3092
2836
# Parse config file for server-global settings
3093
server_config = configparser.ConfigParser(server_defaults)
2837
server_config = configparser.SafeConfigParser(server_defaults)
3094
2838
del server_defaults
3095
2839
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3096
# Convert the ConfigParser object to a dict
2840
# Convert the SafeConfigParser object to a dict
3097
2841
server_settings = server_config.defaults()
3098
2842
# Use the appropriate methods on the non-string config options
3099
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3100
"foreground", "zeroconf"):
2843
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3101
2844
server_settings[option] = server_config.getboolean("DEFAULT",
3102
2845
option)
3103
2846
if server_settings["port"]:
3109
2852
# Later, stdin will, and stdout and stderr might, be dup'ed
3110
2853
# over with an opened os.devnull. But we don't want this to
3111
2854
# happen with a supplied network socket.
3112
while 0 <= server_settings["socket"] <= 2:
2855
if 0 <= server_settings["socket"] <= 2:
3113
2856
server_settings["socket"] = os.dup(server_settings
3114
2857
["socket"])
3115
os.set_inheritable(server_settings["socket"], False)
3116
2858
del server_config
3117
2859
3118
2860
# Override the settings from the config file with command line
3119
2861
# options, if set.
3120
2862
for option in ("interface", "address", "port", "debug",
3138
2880
if server_settings["debug"]:
3139
2881
server_settings["foreground"] = True
3140
2882
# Now we have our good server settings in "server_settings"
3141
2883
3142
2884
##################################################################
3143
2885
3144
2886
if (not server_settings["zeroconf"]
3145
2887
and not (server_settings["port"]
3146
2888
or server_settings["socket"] != "")):
3147
2889
parser.error("Needs port or socket to work without Zeroconf")
3148
2890
3149
2891
# For convenience
3150
2892
debug = server_settings["debug"]
3151
2893
debuglevel = server_settings["debuglevel"]
3155
2897
stored_state_file)
3156
2898
foreground = server_settings["foreground"]
3157
2899
zeroconf = server_settings["zeroconf"]
3158
2900
3159
2901
if debug:
3160
2902
initlogger(debug, logging.DEBUG)
3161
2903
else:
3164
2906
else:
3165
2907
level = getattr(logging, debuglevel.upper())
3166
2908
initlogger(debug, level)
3167
2909
3168
2910
if server_settings["servicename"] != "Mandos":
3169
2911
syslogger.setFormatter(
3170
logging.Formatter("Mandos ({}) [%(process)d]:"
3171
" %(levelname)s: %(message)s".format(
2912
logging.Formatter('Mandos ({}) [%(process)d]:'
2913
' %(levelname)s: %(message)s'.format(
3172
2914
server_settings["servicename"])))
3173
2915
3174
2916
# Parse config file with clients
3175
client_config = configparser.ConfigParser(Client.client_defaults)
2917
client_config = configparser.SafeConfigParser(Client
2918
.client_defaults)
3176
2919
client_config.read(os.path.join(server_settings["configdir"],
3177
2920
"clients.conf"))
3178
2921
3179
2922
global mandos_dbus_service
3180
2923
mandos_dbus_service = None
3181
2924
3182
2925
socketfd = None
3183
2926
if server_settings["socket"] != "":
3184
2927
socketfd = server_settings["socket"]
3198
2941
try:
3199
2942
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3200
2943
except IOError as e:
3201
log.error("Could not open file %r", pidfilename,
3202
exc_info=e)
3203
2944
logger.error("Could not open file %r", pidfilename,
2945
exc_info=e)
2946
3204
2947
for name, group in (("_mandos", "_mandos"),
3205
2948
("mandos", "mandos"),
3206
2949
("nobody", "nogroup")):
3216
2959
try:
3217
2960
os.setgid(gid)
3218
2961
os.setuid(uid)
3219
log.debug("Did setuid/setgid to %s:%s", uid, gid)
2962
if debug:
2963
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2964
gid))
3220
2965
except OSError as error:
3221
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3222
os.strerror(error.errno))
2966
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2967
.format(uid, gid, os.strerror(error.errno)))
3223
2968
if error.errno != errno.EPERM:
3224
2969
raise
3225
2970
3226
2971
if debug:
3227
2972
# Enable all possible GnuTLS debugging
3228
2973
3229
2974
# "Use a log level over 10 to enable all debugging options."
3230
2975
# - GnuTLS manual
3231
2976
gnutls.global_set_log_level(11)
3232
2977
3233
2978
@gnutls.log_func
3234
2979
def debug_gnutls(level, string):
3235
log.debug("GnuTLS: %s",
3236
string[:-1].decode("utf-8", errors="replace"))
3237
2980
logger.debug("GnuTLS: %s", string[:-1])
2981
3238
2982
gnutls.global_set_log_function(debug_gnutls)
3239
2983
3240
2984
# Redirect stdin so all checkers get /dev/null
3241
2985
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3242
2986
os.dup2(null, sys.stdin.fileno())
3243
2987
if null > 2:
3244
2988
os.close(null)
3245
2989
3246
2990
# Need to fork before connecting to D-Bus
3247
2991
if not foreground:
3248
2992
# Close all input and output, do double fork, etc.
3249
2993
daemon()
3250
3251
if gi.version_info < (3, 10, 2):
3252
# multiprocessing will use threads, so before we use GLib we
3253
# need to inform GLib that threads will be used.
3254
GLib.threads_init()
3255
2994
2995
# multiprocessing will use threads, so before we use GLib we need
2996
# to inform GLib that threads will be used.
2997
GLib.threads_init()
2998
3256
2999
global main_loop
3257
3000
# From the Avahi example code
3258
3001
DBusGMainLoop(set_as_default=True)
3259
3002
main_loop = GLib.MainLoop()
3260
if use_dbus or zeroconf:
3261
bus = dbus.SystemBus()
3003
bus = dbus.SystemBus()
3262
3004
# End of Avahi example code
3263
3005
if use_dbus:
3264
3006
try:
3269
3011
"se.bsnet.fukt.Mandos", bus,
3270
3012
do_not_queue=True)
3271
3013
except dbus.exceptions.DBusException as e:
3272
log.error("Disabling D-Bus:", exc_info=e)
3014
logger.error("Disabling D-Bus:", exc_info=e)
3273
3015
use_dbus = False
3274
3016
server_settings["use_dbus"] = False
3275
3017
tcp_server.use_dbus = False
3276
3018
if zeroconf:
3277
3019
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3278
3020
service = AvahiServiceToSyslog(
3279
name=server_settings["servicename"],
3280
servicetype="_mandos._tcp",
3281
protocol=protocol,
3282
bus=bus)
3021
name = server_settings["servicename"],
3022
servicetype = "_mandos._tcp",
3023
protocol = protocol,
3024
bus = bus)
3283
3025
if server_settings["interface"]:
3284
3026
service.interface = if_nametoindex(
3285
3027
server_settings["interface"].encode("utf-8"))
3286
3028
3287
3029
global multiprocessing_manager
3288
3030
multiprocessing_manager = multiprocessing.Manager()
3289
3031
3290
3032
client_class = Client
3291
3033
if use_dbus:
3292
client_class = functools.partial(ClientDBus, bus=bus)
3293
3034
client_class = functools.partial(ClientDBus, bus = bus)
3035
3294
3036
client_settings = Client.config_parser(client_config)
3295
3037
old_client_settings = {}
3296
3038
clients_data = {}
3297
3039
3298
3040
# This is used to redirect stdout and stderr for checker processes
3299
3041
global wnull
3300
wnull = open(os.devnull, "w") # A writable /dev/null
3042
wnull = open(os.devnull, "w") # A writable /dev/null
3301
3043
# Only used if server is running in foreground but not in debug
3302
3044
# mode
3303
3045
if debug or not foreground:
3304
3046
wnull.close()
3305
3047
3306
3048
# Get client data and settings from last running state.
3307
3049
if server_settings["restore"]:
3308
3050
try:
3309
3051
with open(stored_state_path, "rb") as stored_state:
3310
if sys.version_info.major == 2:
3052
if sys.version_info.major == 2:
3311
3053
clients_data, old_client_settings = pickle.load(
3312
3054
stored_state)
3313
3055
else:
3314
3056
bytes_clients_data, bytes_old_client_settings = (
3315
pickle.load(stored_state, encoding="bytes"))
3316
# Fix bytes to strings
3317
# clients_data
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3059
## clients_data
3318
3060
# .keys()
3319
clients_data = {(key.decode("utf-8")
3320
if isinstance(key, bytes)
3321
else key): value
3322
for key, value in
3323
bytes_clients_data.items()}
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3063
else key): value
3064
for key, value in
3065
bytes_clients_data.items() }
3324
3066
del bytes_clients_data
3325
3067
for key in clients_data:
3326
value = {(k.decode("utf-8")
3327
if isinstance(k, bytes) else k): v
3328
for k, v in
3329
clients_data[key].items()}
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3070
for k, v in
3071
clients_data[key].items() }
3330
3072
clients_data[key] = value
3331
3073
# .client_structure
3332
3074
value["client_structure"] = [
3333
3075
(s.decode("utf-8")
3334
3076
if isinstance(s, bytes)
3335
3077
else s) for s in
3336
value["client_structure"]]
3337
# .name, .host, and .checker_command
3338
for k in ("name", "host", "checker_command"):
3078
value["client_structure"] ]
3079
# .name & .host
3080
for k in ("name", "host"):
3339
3081
if isinstance(value[k], bytes):
3340
3082
value[k] = value[k].decode("utf-8")
3341
if "key_id" not in value:
3342
value["key_id"] = ""
3343
elif "fingerprint" not in value:
3344
value["fingerprint"] = ""
3345
# old_client_settings
3083
## old_client_settings
3346
3084
# .keys()
3347
3085
old_client_settings = {
3348
3086
(key.decode("utf-8")
3349
3087
if isinstance(key, bytes)
3350
3088
else key): value
3351
3089
for key, value in
3352
bytes_old_client_settings.items()}
3090
bytes_old_client_settings.items() }
3353
3091
del bytes_old_client_settings
3354
# .host and .checker_command
3092
# .host
3355
3093
for value in old_client_settings.values():
3356
for attribute in ("host", "checker_command"):
3357
if isinstance(value[attribute], bytes):
3358
value[attribute] = (value[attribute]
3359
.decode("utf-8"))
3094
if isinstance(value["host"], bytes):
3095
value["host"] = (value["host"]
3096
.decode("utf-8"))
3360
3097
os.remove(stored_state_path)
3361
3098
except IOError as e:
3362
3099
if e.errno == errno.ENOENT:
3363
log.warning("Could not load persistent state:"
3364
" %s", os.strerror(e.errno))
3100
logger.warning("Could not load persistent state:"
3101
" {}".format(os.strerror(e.errno)))
3365
3102
else:
3366
log.critical("Could not load persistent state:",
3367
exc_info=e)
3103
logger.critical("Could not load persistent state:",
3104
exc_info=e)
3368
3105
raise
3369
3106
except EOFError as e:
3370
log.warning("Could not load persistent state: EOFError:",
3371
exc_info=e)
3372
3107
logger.warning("Could not load persistent state: "
3108
"EOFError:",
3109
exc_info=e)
3110
3373
3111
with PGPEngine() as pgp:
3374
3112
for client_name, client in clients_data.items():
3375
3113
# Skip removed clients
3376
3114
if client_name not in client_settings:
3377
3115
continue
3378
3116
3379
3117
# Decide which value to use after restoring saved state.
3380
3118
# We have three different values: Old config file,
3381
3119
# new config file, and saved state.
3392
3130
client[name] = value
3393
3131
except KeyError:
3394
3132
pass
3395
3133
3396
3134
# Clients who has passed its expire date can still be
3397
3135
# enabled if its last checker was successful. A Client
3398
3136
# whose checker succeeded before we stored its state is
3401
3139
if client["enabled"]:
3402
3140
if datetime.datetime.utcnow() >= client["expires"]:
3403
3141
if not client["last_checked_ok"]:
3404
log.warning("disabling client %s - Client"
3405
" never performed a successful"
3406
" checker", client_name)
3142
logger.warning(
3143
"disabling client {} - Client never "
3144
"performed a successful checker".format(
3145
client_name))
3407
3146
client["enabled"] = False
3408
3147
elif client["last_checker_status"] != 0:
3409
log.warning("disabling client %s - Client"
3410
" last checker failed with error"
3411
" code %s", client_name,
3412
client["last_checker_status"])
3148
logger.warning(
3149
"disabling client {} - Client last"
3150
" checker failed with error code"
3151
" {}".format(
3152
client_name,
3153
client["last_checker_status"]))
3413
3154
client["enabled"] = False
3414
3155
else:
3415
3156
client["expires"] = (
3416
3157
datetime.datetime.utcnow()
3417
3158
+ client["timeout"])
3418
log.debug("Last checker succeeded, keeping %s"
3419
" enabled", client_name)
3159
logger.debug("Last checker succeeded,"
3160
" keeping {} enabled".format(
3161
client_name))
3420
3162
try:
3421
3163
client["secret"] = pgp.decrypt(
3422
3164
client["encrypted_secret"],
3423
3165
client_settings[client_name]["secret"])
3424
3166
except PGPError:
3425
3167
# If decryption fails, we use secret from new settings
3426
log.debug("Failed to decrypt %s old secret",
3427
client_name)
3168
logger.debug("Failed to decrypt {} old secret".format(
3169
client_name))
3428
3170
client["secret"] = (client_settings[client_name]
3429
3171
["secret"])
3430
3172
3431
3173
# Add/remove clients based on new changes made to config
3432
3174
for client_name in (set(old_client_settings)
3433
3175
- set(client_settings)):
3435
3177
for client_name in (set(client_settings)
3436
3178
- set(old_client_settings)):
3437
3179
clients_data[client_name] = client_settings[client_name]
3438
3180
3439
3181
# Create all client objects
3440
3182
for client_name, client in clients_data.items():
3441
3183
tcp_server.clients[client_name] = client_class(
3442
name=client_name,
3443
settings=client,
3444
server_settings=server_settings)
3445
3184
name = client_name,
3185
settings = client,
3186
server_settings = server_settings)
3187
3446
3188
if not tcp_server.clients:
3447
log.warning("No clients defined")
3448
3189
logger.warning("No clients defined")
3190
3449
3191
if not foreground:
3450
3192
if pidfile is not None:
3451
3193
pid = os.getpid()
3453
3195
with pidfile:
3454
3196
print(pid, file=pidfile)
3455
3197
except IOError:
3456
log.error("Could not write to file %r with PID %d",
3457
pidfilename, pid)
3198
logger.error("Could not write to file %r with PID %d",
3199
pidfilename, pid)
3458
3200
del pidfile
3459
3201
del pidfilename
3460
3202
3461
3203
for termsig in (signal.SIGHUP, signal.SIGTERM):
3462
3204
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3463
3205
lambda: main_loop.quit() and False)
3464
3206
3465
3207
if use_dbus:
3466
3208
3467
3209
@alternate_dbus_interfaces(
3468
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3210
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3469
3211
class MandosDBusService(DBusObjectWithObjectManager):
3470
3212
"""A D-Bus proxy object"""
3471
3213
3472
3214
def __init__(self):
3473
3215
dbus.service.Object.__init__(self, bus, "/")
3474
3216
3475
3217
_interface = "se.recompile.Mandos"
3476
3218
3477
3219
@dbus.service.signal(_interface, signature="o")
3478
3220
def ClientAdded(self, objpath):
3479
3221
"D-Bus signal"
3480
3222
pass
3481
3223
3482
3224
@dbus.service.signal(_interface, signature="ss")
3483
def ClientNotFound(self, key_id, address):
3225
def ClientNotFound(self, fingerprint, address):
3484
3226
"D-Bus signal"
3485
3227
pass
3486
3228
3487
3229
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3488
3230
"true"})
3489
3231
@dbus.service.signal(_interface, signature="os")
3490
3232
def ClientRemoved(self, objpath, name):
3491
3233
"D-Bus signal"
3492
3234
pass
3493
3235
3494
3236
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3495
3237
"true"})
3496
3238
@dbus.service.method(_interface, out_signature="ao")
3498
3240
"D-Bus method"
3499
3241
return dbus.Array(c.dbus_object_path for c in
3500
3242
tcp_server.clients.values())
3501
3243
3502
3244
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3503
3245
"true"})
3504
3246
@dbus.service.method(_interface,
3506
3248
def GetAllClientsWithProperties(self):
3507
3249
"D-Bus method"
3508
3250
return dbus.Dictionary(
3509
{c.dbus_object_path: c.GetAll(
3251
{ c.dbus_object_path: c.GetAll(
3510
3252
"se.recompile.Mandos.Client")
3511
for c in tcp_server.clients.values()},
3253
for c in tcp_server.clients.values() },
3512
3254
signature="oa{sv}")
3513
3255
3514
3256
@dbus.service.method(_interface, in_signature="o")
3515
3257
def RemoveClient(self, object_path):
3516
3258
"D-Bus method"
3524
3266
self.client_removed_signal(c)
3525
3267
return
3526
3268
raise KeyError(object_path)
3527
3269
3528
3270
del _interface
3529
3271
3530
3272
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3531
out_signature="a{oa{sa{sv}}}")
3273
out_signature = "a{oa{sa{sv}}}")
3532
3274
def GetManagedObjects(self):
3533
3275
"""D-Bus method"""
3534
3276
return dbus.Dictionary(
3535
{client.dbus_object_path:
3536
dbus.Dictionary(
3537
{interface: client.GetAll(interface)
3538
for interface in
3539
client._get_all_interface_names()})
3540
for client in tcp_server.clients.values()})
3541
3277
{ client.dbus_object_path:
3278
dbus.Dictionary(
3279
{ interface: client.GetAll(interface)
3280
for interface in
3281
client._get_all_interface_names()})
3282
for client in tcp_server.clients.values()})
3283
3542
3284
def client_added_signal(self, client):
3543
3285
"""Send the new standard signal and the old signal"""
3544
3286
if use_dbus:
3546
3288
self.InterfacesAdded(
3547
3289
client.dbus_object_path,
3548
3290
dbus.Dictionary(
3549
{interface: client.GetAll(interface)
3550
for interface in
3551
client._get_all_interface_names()}))
3291
{ interface: client.GetAll(interface)
3292
for interface in
3293
client._get_all_interface_names()}))
3552
3294
# Old signal
3553
3295
self.ClientAdded(client.dbus_object_path)
3554
3296
3555
3297
def client_removed_signal(self, client):
3556
3298
"""Send the new standard signal and the old signal"""
3557
3299
if use_dbus:
3562
3304
# Old signal
3563
3305
self.ClientRemoved(client.dbus_object_path,
3564
3306
client.name)
3565
3307
3566
3308
mandos_dbus_service = MandosDBusService()
3567
3568
# Save modules to variables to exempt the modules from being
3569
# unloaded before the function registered with atexit() is run.
3570
mp = multiprocessing
3571
wn = wnull
3572
3309
3573
3310
def cleanup():
3574
3311
"Cleanup function; run on exit"
3575
3312
if zeroconf:
3576
3313
service.cleanup()
3577
3578
mp.active_children()
3579
wn.close()
3314
3315
multiprocessing.active_children()
3316
wnull.close()
3580
3317
if not (tcp_server.clients or client_settings):
3581
3318
return
3582
3319
3583
3320
# Store client before exiting. Secrets are encrypted with key
3584
3321
# based on what config file has. If config file is
3585
3322
# removed/edited, old secret will thus be unrecovable.
3590
3327
client.encrypted_secret = pgp.encrypt(client.secret,
3591
3328
key)
3592
3329
client_dict = {}
3593
3330
3594
3331
# A list of attributes that can not be pickled
3595
3332
# + secret.
3596
exclude = {"bus", "changedstate", "secret",
3597
"checker", "server_settings"}
3333
exclude = { "bus", "changedstate", "secret",
3334
"checker", "server_settings" }
3598
3335
for name, typ in inspect.getmembers(dbus.service
3599
3336
.Object):
3600
3337
exclude.add(name)
3601
3338
3602
3339
client_dict["encrypted_secret"] = (client
3603
3340
.encrypted_secret)
3604
3341
for attr in client.client_structure:
3605
3342
if attr not in exclude:
3606
3343
client_dict[attr] = getattr(client, attr)
3607
3344
3608
3345
clients[client.name] = client_dict
3609
3346
del client_settings[client.name]["secret"]
3610
3347
3611
3348
try:
3612
3349
with tempfile.NamedTemporaryFile(
3613
mode="wb",
3350
mode='wb',
3614
3351
suffix=".pickle",
3615
prefix="clients-",
3352
prefix='clients-',
3616
3353
dir=os.path.dirname(stored_state_path),
3617
3354
delete=False) as stored_state:
3618
3355
pickle.dump((clients, client_settings), stored_state,
3619
protocol=2)
3356
protocol = 2)
3620
3357
tempname = stored_state.name
3621
3358
os.rename(tempname, stored_state_path)
3622
3359
except (IOError, OSError) as e:
3626
3363
except NameError:
3627
3364
pass
3628
3365
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3629
log.warning("Could not save persistent state: %s",
3630
os.strerror(e.errno))
3366
logger.warning("Could not save persistent state: {}"
3367
.format(os.strerror(e.errno)))
3631
3368
else:
3632
log.warning("Could not save persistent state:",
3633
exc_info=e)
3369
logger.warning("Could not save persistent state:",
3370
exc_info=e)
3634
3371
raise
3635
3372
3636
3373
# Delete all clients, and settings from config
3637
3374
while tcp_server.clients:
3638
3375
name, client = tcp_server.clients.popitem()
3644
3381
if use_dbus:
3645
3382
mandos_dbus_service.client_removed_signal(client)
3646
3383
client_settings.clear()
3647
3384
3648
3385
atexit.register(cleanup)
3649
3386
3650
3387
for client in tcp_server.clients.values():
3651
3388
if use_dbus:
3652
3389
# Emit D-Bus signal for adding
3653
3390
mandos_dbus_service.client_added_signal(client)
3654
3391
# Need to initiate checking of clients
3655
3392
if client.enabled:
3656
client.init_checker(randomize_start=True)
3657
3393
client.init_checker()
3394
3658
3395
tcp_server.enable()
3659
3396
tcp_server.server_activate()
3660
3397
3661
3398
# Find out what port we got
3662
3399
if zeroconf:
3663
3400
service.port = tcp_server.socket.getsockname()[1]
3664
3401
if use_ipv6:
3665
log.info("Now listening on address %r, port %d, flowinfo %d,"
3666
" scope_id %d", *tcp_server.socket.getsockname())
3402
logger.info("Now listening on address %r, port %d,"
3403
" flowinfo %d, scope_id %d",
3404
*tcp_server.socket.getsockname())
3667
3405
else: # IPv4
3668
log.info("Now listening on address %r, port %d",
3669
*tcp_server.socket.getsockname())
3670
3671
# service.interface = tcp_server.socket.getsockname()[3]
3672
3406
logger.info("Now listening on address %r, port %d",
3407
*tcp_server.socket.getsockname())
3408
3409
#service.interface = tcp_server.socket.getsockname()[3]
3410
3673
3411
try:
3674
3412
if zeroconf:
3675
3413
# From the Avahi example code
3676
3414
try:
3677
3415
service.activate()
3678
3416
except dbus.exceptions.DBusException as error:
3679
log.critical("D-Bus Exception", exc_info=error)
3417
logger.critical("D-Bus Exception", exc_info=error)
3680
3418
cleanup()
3681
3419
sys.exit(1)
3682
3420
# End of Avahi example code
3683
3684
GLib.io_add_watch(
3685
GLib.IOChannel.unix_new(tcp_server.fileno()),
3686
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3687
lambda *args, **kwargs: (tcp_server.handle_request
3688
(*args[2:], **kwargs) or True))
3689
3690
log.debug("Starting main loop")
3421
3422
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3423
lambda *args, **kwargs:
3424
(tcp_server.handle_request
3425
(*args[2:], **kwargs) or True))
3426
3427
logger.debug("Starting main loop")
3691
3428
main_loop.run()
3692
3429
except AvahiError as error:
3693
log.critical("Avahi Error", exc_info=error)
3430
logger.critical("Avahi Error", exc_info=error)
3694
3431
cleanup()
3695
3432
sys.exit(1)
3696
3433
except KeyboardInterrupt:
3697
3434
if debug:
3698
3435
print("", file=sys.stderr)
3699
log.debug("Server received KeyboardInterrupt")
3700
log.debug("Server exiting")
3436
logger.debug("Server received KeyboardInterrupt")
3437
logger.debug("Server exiting")
3701
3438
# Must run before the D-Bus bus name gets deregistered
3702
3439
cleanup()
3703
3440
3704
3705
def parse_test_args():
3706
# type: () -> argparse.Namespace
3707
parser = argparse.ArgumentParser(add_help=False)
3708
parser.add_argument("--check", action="store_true")
3709
parser.add_argument("--prefix", )
3710
args, unknown_args = parser.parse_known_args()
3711
if args.check:
3712
# Remove test options from sys.argv
3713
sys.argv[1:] = unknown_args
3714
return args
3715
3716
# Add all tests from doctest strings
3717
def load_tests(loader, tests, none):
3718
import doctest
3719
tests.addTests(doctest.DocTestSuite())
3720
return tests
3721
3722
if __name__ == "__main__":
3723
options = parse_test_args()
3724
try:
3725
if options.check:
3726
extra_test_prefix = options.prefix
3727
if extra_test_prefix is not None:
3728
if not (unittest.main(argv=[""], exit=False)
3729
.result.wasSuccessful()):
3730
sys.exit(1)
3731
class ExtraTestLoader(unittest.TestLoader):
3732
testMethodPrefix = extra_test_prefix
3733
# Call using ./scriptname --test [--verbose]
3734
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3735
else:
3736
unittest.main(argv=[""])
3737
else:
3738
main()
3739
finally:
3740
logging.shutdown()
3741
3742
# Local Variables:
3743
# run-tests:
3744
# (lambda (&optional extra)
3745
# (if (not (funcall run-tests-in-test-buffer default-directory
3746
# extra))
3747
# (funcall show-test-buffer-in-test-window)
3748
# (funcall remove-test-window)
3749
# (if extra (message "Extra tests run successfully!"))))
3750
# run-tests-in-test-buffer:
3751
# (lambda (dir &optional extra)
3752
# (with-current-buffer (get-buffer-create "*Test*")
3753
# (setq buffer-read-only nil
3754
# default-directory dir)
3755
# (erase-buffer)
3756
# (compilation-mode))
3757
# (let ((process-result
3758
# (let ((inhibit-read-only t))
3759
# (process-file-shell-command
3760
# (funcall get-command-line extra) nil "*Test*"))))
3761
# (and (numberp process-result)
3762
# (= process-result 0))))
3763
# get-command-line:
3764
# (lambda (&optional extra)
3765
# (let ((quoted-script
3766
# (shell-quote-argument (funcall get-script-name))))
3767
# (format
3768
# (concat "%s --check" (if extra " --prefix=atest" ""))
3769
# quoted-script)))
3770
# get-script-name:
3771
# (lambda ()
3772
# (if (fboundp 'file-local-name)
3773
# (file-local-name (buffer-file-name))
3774
# (or (file-remote-p (buffer-file-name) 'localname)
3775
# (buffer-file-name))))
3776
# remove-test-window:
3777
# (lambda ()
3778
# (let ((test-window (get-buffer-window "*Test*")))
3779
# (if test-window (delete-window test-window))))
3780
# show-test-buffer-in-test-window:
3781
# (lambda ()
3782
# (when (not (get-buffer-window-list "*Test*"))
3783
# (setq next-error-last-buffer (get-buffer "*Test*"))
3784
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3785
# (display-buffer-overriding-action
3786
# `((display-buffer-in-side-window) (side . ,side)
3787
# (window-height . fit-window-to-buffer)
3788
# (window-width . fit-window-to-buffer))))
3789
# (display-buffer "*Test*"))))
3790
# eval:
3791
# (progn
3792
# (let* ((run-extra-tests (lambda () (interactive)
3793
# (funcall run-tests t)))
3794
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3795
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3796
# (setq minor-mode-overriding-map-alist
3797
# (cons `(run-tests . ,outer-keymap)
3798
# minor-mode-overriding-map-alist)))
3799
# (add-hook 'after-save-hook run-tests 90 t))
3800
# End:
3441
3442
if __name__ == '__main__':
3443
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0