To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 856
- compare with another revision
- download diff
- download tarball
- view history from revision 856
- Committer: Teddy Hogeborn
- Date: 2016-06-22 04:42:23 UTC
- Revision ID: teddy@recompile.se-20160622044223-ew442xmt3c3bg76n
Client: Do not install intro(8mandos) manual page
When installing client, do not include the intro(8mandos) manual page
to avoid a conflict with the files from a server install.
* Makefile (install-client-nokey): Do not install intro.8mandos.
When installing client, do not include the intro(8mandos) manual page
to avoid a conflict with the files from a server install.
* Makefile (install-client-nokey): Do not install intro.8mandos.
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
39
39
except ImportError:
40
40
pass
41
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
42
try:
48
43
import SocketServer as socketserver
49
44
except ImportError:
50
45
import socketserver
51
46
import socket
47
import argparse
52
48
import datetime
53
49
import errno
54
50
try:
55
51
import ConfigParser as configparser
56
52
except ImportError:
57
53
import configparser
54
import sys
58
55
import re
56
import os
59
57
import signal
60
58
import subprocess
61
59
import atexit
62
60
import stat
61
import logging
63
62
import logging.handlers
64
63
import pwd
65
64
import contextlib
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import random
81
import shlex
82
79
83
80
import dbus
84
81
import dbus.service
85
import gi
86
82
from gi.repository import GLib
87
83
from dbus.mainloop.glib import DBusGMainLoop
88
84
import ctypes
90
86
import xml.dom.minidom
91
87
import inspect
92
88
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Add os.set_inheritable if it does not exist
114
try:
115
os.set_inheritable
116
except AttributeError:
117
def set_inheritable(fd, inheritable):
118
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
119
if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):
120
fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)
121
elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):
122
fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)
123
os.set_inheritable = set_inheritable
124
del set_inheritable
125
126
# Show warnings by default
127
if not sys.warnoptions:
128
import warnings
129
warnings.simplefilter("default")
130
131
89
# Try to find the value of SO_BINDTODEVICE:
132
90
try:
133
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
153
111
# No value found
154
112
SO_BINDTODEVICE = None
155
113
156
if sys.version_info < (3, 2):
157
configparser.Configparser = configparser.SafeConfigParser
114
if sys.version_info.major == 2:
115
str = unicode
158
116
159
version = "1.8.17"
117
version = "1.7.8"
160
118
stored_state_file = "clients.pickle"
161
119
162
log = logging.getLogger(os.path.basename(sys.argv[0]))
163
logging.captureWarnings(True) # Show warnings via the logging system
120
logger = logging.getLogger()
164
121
syslogger = None
165
122
166
123
try:
167
124
if_nametoindex = ctypes.cdll.LoadLibrary(
168
125
ctypes.util.find_library("c")).if_nametoindex
169
126
except (OSError, AttributeError):
170
127
171
128
def if_nametoindex(interface):
172
129
"Get an interface index the hard way, i.e. using fcntl()"
173
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
196
153
197
154
def initlogger(debug, level=logging.WARNING):
198
155
"""init logger and add loglevel"""
199
156
200
157
global syslogger
201
158
syslogger = (logging.handlers.SysLogHandler(
202
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
203
address="/dev/log"))
159
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
160
address = "/dev/log"))
204
161
syslogger.setFormatter(logging.Formatter
205
("Mandos [%(process)d]: %(levelname)s:"
206
" %(message)s"))
207
log.addHandler(syslogger)
208
162
('Mandos [%(process)d]: %(levelname)s:'
163
' %(message)s'))
164
logger.addHandler(syslogger)
165
209
166
if debug:
210
167
console = logging.StreamHandler()
211
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
212
" [%(process)d]:"
213
" %(levelname)s:"
214
" %(message)s"))
215
log.addHandler(console)
216
log.setLevel(level)
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
169
' [%(process)d]:'
170
' %(levelname)s:'
171
' %(message)s'))
172
logger.addHandler(console)
173
logger.setLevel(level)
217
174
218
175
219
176
class PGPError(Exception):
221
178
pass
222
179
223
180
224
class PGPEngine:
181
class PGPEngine(object):
225
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
226
183
227
184
def __init__(self):
228
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
229
186
self.gpg = "gpg"
231
188
output = subprocess.check_output(["gpgconf"])
232
189
for line in output.splitlines():
233
190
name, text, path = line.split(b":")
234
if name == b"gpg":
191
if name == "gpg":
235
192
self.gpg = path
236
193
break
237
194
except OSError as e:
238
195
if e.errno != errno.ENOENT:
239
196
raise
240
self.gnupgargs = ["--batch",
241
"--homedir", self.tempdir,
242
"--force-mdc",
243
"--quiet"]
197
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
199
'--force-mdc',
200
'--quiet']
244
201
# Only GPG version 1 has the --no-use-agent option.
245
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
246
203
self.gnupgargs.append("--no-use-agent")
247
204
248
205
def __enter__(self):
249
206
return self
250
207
251
208
def __exit__(self, exc_type, exc_value, traceback):
252
209
self._cleanup()
253
210
return False
254
211
255
212
def __del__(self):
256
213
self._cleanup()
257
214
258
215
def _cleanup(self):
259
216
if self.tempdir is not None:
260
217
# Delete contents of tempdir
261
218
for root, dirs, files in os.walk(self.tempdir,
262
topdown=False):
219
topdown = False):
263
220
for filename in files:
264
221
os.remove(os.path.join(root, filename))
265
222
for dirname in dirs:
267
224
# Remove tempdir
268
225
os.rmdir(self.tempdir)
269
226
self.tempdir = None
270
227
271
228
def password_encode(self, password):
272
229
# Passphrase can not be empty and can not contain newlines or
273
230
# NUL bytes. So we prefix it and hex encode it.
278
235
.replace(b"\n", b"\\n")
279
236
.replace(b"\0", b"\\x00"))
280
237
return encoded
281
238
282
239
def encrypt(self, data, password):
283
240
passphrase = self.password_encode(password)
284
241
with tempfile.NamedTemporaryFile(
285
242
dir=self.tempdir) as passfile:
286
243
passfile.write(passphrase)
287
244
passfile.flush()
288
proc = subprocess.Popen([self.gpg, "--symmetric",
289
"--passphrase-file",
245
proc = subprocess.Popen([self.gpg, '--symmetric',
246
'--passphrase-file',
290
247
passfile.name]
291
248
+ self.gnupgargs,
292
stdin=subprocess.PIPE,
293
stdout=subprocess.PIPE,
294
stderr=subprocess.PIPE)
295
ciphertext, err = proc.communicate(input=data)
249
stdin = subprocess.PIPE,
250
stdout = subprocess.PIPE,
251
stderr = subprocess.PIPE)
252
ciphertext, err = proc.communicate(input = data)
296
253
if proc.returncode != 0:
297
254
raise PGPError(err)
298
255
return ciphertext
299
256
300
257
def decrypt(self, data, password):
301
258
passphrase = self.password_encode(password)
302
259
with tempfile.NamedTemporaryFile(
303
dir=self.tempdir) as passfile:
260
dir = self.tempdir) as passfile:
304
261
passfile.write(passphrase)
305
262
passfile.flush()
306
proc = subprocess.Popen([self.gpg, "--decrypt",
307
"--passphrase-file",
263
proc = subprocess.Popen([self.gpg, '--decrypt',
264
'--passphrase-file',
308
265
passfile.name]
309
266
+ self.gnupgargs,
310
stdin=subprocess.PIPE,
311
stdout=subprocess.PIPE,
312
stderr=subprocess.PIPE)
313
decrypted_plaintext, err = proc.communicate(input=data)
267
stdin = subprocess.PIPE,
268
stdout = subprocess.PIPE,
269
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
314
271
if proc.returncode != 0:
315
272
raise PGPError(err)
316
273
return decrypted_plaintext
317
274
318
319
275
# Pretend that we have an Avahi module
320
class avahi:
321
"""This isn't so much a class as it is a module-like namespace."""
322
IF_UNSPEC = -1 # avahi-common/address.h
323
PROTO_UNSPEC = -1 # avahi-common/address.h
324
PROTO_INET = 0 # avahi-common/address.h
325
PROTO_INET6 = 1 # avahi-common/address.h
276
class Avahi(object):
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
326
283
DBUS_NAME = "org.freedesktop.Avahi"
327
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
328
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
329
286
DBUS_PATH_SERVER = "/"
330
331
@staticmethod
332
def string_array_to_txt_array(t):
287
def string_array_to_txt_array(self, t):
333
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
334
289
for s in t), signature="ay")
335
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
336
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
337
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
338
SERVER_INVALID = 0 # avahi-common/defs.h
339
SERVER_REGISTERING = 1 # avahi-common/defs.h
340
SERVER_RUNNING = 2 # avahi-common/defs.h
341
SERVER_COLLISION = 3 # avahi-common/defs.h
342
SERVER_FAILURE = 4 # avahi-common/defs.h
343
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
298
avahi = Avahi()
344
299
345
300
class AvahiError(Exception):
346
301
def __init__(self, value, *args, **kwargs):
357
312
pass
358
313
359
314
360
class AvahiService:
315
class AvahiService(object):
361
316
"""An Avahi (Zeroconf) service.
362
317
363
318
Attributes:
364
319
interface: integer; avahi.IF_UNSPEC or an interface index.
365
320
Used to optionally bind to the specified interface.
366
name: string; Example: "Mandos"
367
type: string; Example: "_mandos._tcp".
321
name: string; Example: 'Mandos'
322
type: string; Example: '_mandos._tcp'.
368
323
See <https://www.iana.org/assignments/service-names-port-numbers>
369
324
port: integer; what port to announce
370
325
TXT: list of strings; TXT record for the service
377
332
server: D-Bus Server
378
333
bus: dbus.SystemBus()
379
334
"""
380
335
381
336
def __init__(self,
382
interface=avahi.IF_UNSPEC,
383
name=None,
384
servicetype=None,
385
port=None,
386
TXT=None,
387
domain="",
388
host="",
389
max_renames=32768,
390
protocol=avahi.PROTO_UNSPEC,
391
bus=None):
337
interface = avahi.IF_UNSPEC,
338
name = None,
339
servicetype = None,
340
port = None,
341
TXT = None,
342
domain = "",
343
host = "",
344
max_renames = 32768,
345
protocol = avahi.PROTO_UNSPEC,
346
bus = None):
392
347
self.interface = interface
393
348
self.name = name
394
349
self.type = servicetype
403
358
self.server = None
404
359
self.bus = bus
405
360
self.entry_group_state_changed_match = None
406
361
407
362
def rename(self, remove=True):
408
363
"""Derived from the Avahi example code"""
409
364
if self.rename_count >= self.max_renames:
410
log.critical("No suitable Zeroconf service name found"
411
" after %i retries, exiting.",
412
self.rename_count)
365
logger.critical("No suitable Zeroconf service name found"
366
" after %i retries, exiting.",
367
self.rename_count)
413
368
raise AvahiServiceError("Too many renames")
414
369
self.name = str(
415
370
self.server.GetAlternativeServiceName(self.name))
416
371
self.rename_count += 1
417
log.info("Changing Zeroconf service name to %r ...",
418
self.name)
372
logger.info("Changing Zeroconf service name to %r ...",
373
self.name)
419
374
if remove:
420
375
self.remove()
421
376
try:
423
378
except dbus.exceptions.DBusException as error:
424
379
if (error.get_dbus_name()
425
380
== "org.freedesktop.Avahi.CollisionError"):
426
log.info("Local Zeroconf service name collision.")
381
logger.info("Local Zeroconf service name collision.")
427
382
return self.rename(remove=False)
428
383
else:
429
log.critical("D-Bus Exception", exc_info=error)
384
logger.critical("D-Bus Exception", exc_info=error)
430
385
self.cleanup()
431
386
os._exit(1)
432
387
433
388
def remove(self):
434
389
"""Derived from the Avahi example code"""
435
390
if self.entry_group_state_changed_match is not None:
437
392
self.entry_group_state_changed_match = None
438
393
if self.group is not None:
439
394
self.group.Reset()
440
395
441
396
def add(self):
442
397
"""Derived from the Avahi example code"""
443
398
self.remove()
448
403
avahi.DBUS_INTERFACE_ENTRY_GROUP)
449
404
self.entry_group_state_changed_match = (
450
405
self.group.connect_to_signal(
451
"StateChanged", self.entry_group_state_changed))
452
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
453
self.name, self.type)
406
'StateChanged', self.entry_group_state_changed))
407
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
408
self.name, self.type)
454
409
self.group.AddService(
455
410
self.interface,
456
411
self.protocol,
460
415
dbus.UInt16(self.port),
461
416
avahi.string_array_to_txt_array(self.TXT))
462
417
self.group.Commit()
463
418
464
419
def entry_group_state_changed(self, state, error):
465
420
"""Derived from the Avahi example code"""
466
log.debug("Avahi entry group state change: %i", state)
467
421
logger.debug("Avahi entry group state change: %i", state)
422
468
423
if state == avahi.ENTRY_GROUP_ESTABLISHED:
469
log.debug("Zeroconf service established.")
424
logger.debug("Zeroconf service established.")
470
425
elif state == avahi.ENTRY_GROUP_COLLISION:
471
log.info("Zeroconf service name collision.")
426
logger.info("Zeroconf service name collision.")
472
427
self.rename()
473
428
elif state == avahi.ENTRY_GROUP_FAILURE:
474
log.critical("Avahi: Error in group state changed %s",
475
str(error))
429
logger.critical("Avahi: Error in group state changed %s",
430
str(error))
476
431
raise AvahiGroupError("State changed: {!s}".format(error))
477
432
478
433
def cleanup(self):
479
434
"""Derived from the Avahi example code"""
480
435
if self.group is not None:
485
440
pass
486
441
self.group = None
487
442
self.remove()
488
443
489
444
def server_state_changed(self, state, error=None):
490
445
"""Derived from the Avahi example code"""
491
log.debug("Avahi server state change: %i", state)
446
logger.debug("Avahi server state change: %i", state)
492
447
bad_states = {
493
448
avahi.SERVER_INVALID: "Zeroconf server invalid",
494
449
avahi.SERVER_REGISTERING: None,
498
453
if state in bad_states:
499
454
if bad_states[state] is not None:
500
455
if error is None:
501
log.error(bad_states[state])
456
logger.error(bad_states[state])
502
457
else:
503
log.error(bad_states[state] + ": %r", error)
458
logger.error(bad_states[state] + ": %r", error)
504
459
self.cleanup()
505
460
elif state == avahi.SERVER_RUNNING:
506
461
try:
508
463
except dbus.exceptions.DBusException as error:
509
464
if (error.get_dbus_name()
510
465
== "org.freedesktop.Avahi.CollisionError"):
511
log.info("Local Zeroconf service name collision.")
466
logger.info("Local Zeroconf service name"
467
" collision.")
512
468
return self.rename(remove=False)
513
469
else:
514
log.critical("D-Bus Exception", exc_info=error)
470
logger.critical("D-Bus Exception", exc_info=error)
515
471
self.cleanup()
516
472
os._exit(1)
517
473
else:
518
474
if error is None:
519
log.debug("Unknown state: %r", state)
475
logger.debug("Unknown state: %r", state)
520
476
else:
521
log.debug("Unknown state: %r: %r", state, error)
522
477
logger.debug("Unknown state: %r: %r", state, error)
478
523
479
def activate(self):
524
480
"""Derived from the Avahi example code"""
525
481
if self.server is None:
536
492
class AvahiServiceToSyslog(AvahiService):
537
493
def rename(self, *args, **kwargs):
538
494
"""Add the new name to the syslog messages"""
539
ret = super(AvahiServiceToSyslog, self).rename(*args,
540
**kwargs)
495
ret = AvahiService.rename(self, *args, **kwargs)
541
496
syslogger.setFormatter(logging.Formatter(
542
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
497
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
543
498
.format(self.name)))
544
499
return ret
545
500
546
547
501
# Pretend that we have a GnuTLS module
548
class gnutls:
549
"""This isn't so much a class as it is a module-like namespace."""
550
551
library = ctypes.util.find_library("gnutls")
552
if library is None:
553
library = ctypes.util.find_library("gnutls-deb0")
554
_library = ctypes.cdll.LoadLibrary(library)
555
del library
556
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
505
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
509
def __init__(self):
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
512
# happens.
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
516
557
517
# Unless otherwise indicated, the constants and types below are
558
518
# all from the gnutls/gnutls.h C header file.
559
519
560
520
# Constants
561
521
E_SUCCESS = 0
562
522
E_INTERRUPTED = -52
563
523
E_AGAIN = -28
564
524
CRT_OPENPGP = 2
565
CRT_RAWPK = 3
566
525
CLIENT = 2
567
526
SHUT_RDWR = 0
568
527
CRD_CERTIFICATE = 1
569
528
E_NO_CERTIFICATE_FOUND = -49
570
X509_FMT_DER = 0
571
NO_TICKETS = 1<<10
572
ENABLE_RAWPK = 1<<18
573
CTYPE_PEERS = 3
574
KEYID_USE_SHA256 = 1 # gnutls/x509.h
575
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
576
530
577
531
# Types
578
class _session_int(ctypes.Structure):
532
class session_int(ctypes.Structure):
579
533
_fields_ = []
580
session_t = ctypes.POINTER(_session_int)
581
534
session_t = ctypes.POINTER(session_int)
582
535
class certificate_credentials_st(ctypes.Structure):
583
536
_fields_ = []
584
537
certificate_credentials_t = ctypes.POINTER(
585
538
certificate_credentials_st)
586
539
certificate_type_t = ctypes.c_int
587
588
540
class datum_t(ctypes.Structure):
589
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
590
("size", ctypes.c_uint)]
591
592
class _openpgp_crt_int(ctypes.Structure):
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
('size', ctypes.c_uint)]
543
class openpgp_crt_int(ctypes.Structure):
593
544
_fields_ = []
594
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
595
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
596
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
597
548
credentials_type_t = ctypes.c_int
598
549
transport_ptr_t = ctypes.c_void_p
599
550
close_request_t = ctypes.c_int
600
551
601
552
# Exceptions
602
553
class Error(Exception):
603
def __init__(self, message=None, code=None, args=()):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
604
559
# Default usage is by a message string, but if a return
605
560
# code is passed, convert it to a string with
606
561
# gnutls.strerror()
607
562
self.code = code
608
563
if message is None and code is not None:
609
message = gnutls.strerror(code).decode(
610
"utf-8", errors="replace")
611
return super(gnutls.Error, self).__init__(
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
612
566
message, *args)
613
567
614
568
class CertificateSecurityError(Error):
615
569
pass
616
617
class PointerTo:
618
def __init__(self, cls):
619
self.cls = cls
620
621
def from_param(self, obj):
622
if not isinstance(obj, self.cls):
623
raise TypeError("Not of type {}: {!r}"
624
.format(self.cls.__name__, obj))
625
return ctypes.byref(obj.from_param(obj))
626
627
class CastToVoidPointer:
628
def __init__(self, cls):
629
self.cls = cls
630
631
def from_param(self, obj):
632
if not isinstance(obj, self.cls):
633
raise TypeError("Not of type {}: {!r}"
634
.format(self.cls.__name__, obj))
635
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
636
637
class With_from_param:
638
@classmethod
639
def from_param(cls, obj):
640
return obj._as_parameter_
641
570
642
571
# Classes
643
class Credentials(With_from_param):
572
class Credentials(object):
644
573
def __init__(self):
645
self._as_parameter_ = gnutls.certificate_credentials_t()
646
gnutls.certificate_allocate_credentials(self)
574
self._c_object = gnutls.certificate_credentials_t()
575
gnutls.certificate_allocate_credentials(
576
ctypes.byref(self._c_object))
647
577
self.type = gnutls.CRD_CERTIFICATE
648
578
649
579
def __del__(self):
650
gnutls.certificate_free_credentials(self)
651
652
class ClientSession(With_from_param):
653
def __init__(self, socket, credentials=None):
654
self._as_parameter_ = gnutls.session_t()
655
gnutls_flags = gnutls.CLIENT
656
if gnutls.check_version(b"3.5.6"):
657
gnutls_flags |= gnutls.NO_TICKETS
658
if gnutls.has_rawpk:
659
gnutls_flags |= gnutls.ENABLE_RAWPK
660
gnutls.init(self, gnutls_flags)
661
del gnutls_flags
662
gnutls.set_default_priority(self)
663
gnutls.transport_set_ptr(self, socket.fileno())
664
gnutls.handshake_set_private_extensions(self, True)
580
gnutls.certificate_free_credentials(self._c_object)
581
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
584
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
586
gnutls.set_default_priority(self._c_object)
587
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
gnutls.handshake_set_private_extensions(self._c_object,
589
True)
665
590
self.socket = socket
666
591
if credentials is None:
667
592
credentials = gnutls.Credentials()
668
gnutls.credentials_set(self, credentials.type,
669
credentials)
593
gnutls.credentials_set(self._c_object, credentials.type,
594
ctypes.cast(credentials._c_object,
595
ctypes.c_void_p))
670
596
self.credentials = credentials
671
597
672
598
def __del__(self):
673
gnutls.deinit(self)
674
599
gnutls.deinit(self._c_object)
600
675
601
def handshake(self):
676
return gnutls.handshake(self)
677
602
return gnutls.handshake(self._c_object)
603
678
604
def send(self, data):
679
605
data = bytes(data)
680
606
data_len = len(data)
681
607
while data_len > 0:
682
data_len -= gnutls.record_send(self, data[-data_len:],
608
data_len -= gnutls.record_send(self._c_object,
609
data[-data_len:],
683
610
data_len)
684
611
685
612
def bye(self):
686
return gnutls.bye(self, gnutls.SHUT_RDWR)
687
613
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
614
688
615
# Error handling functions
689
616
def _error_code(result):
690
617
"""A function to raise exceptions on errors, suitable
691
for the "restype" attribute on ctypes functions"""
692
if result >= gnutls.E_SUCCESS:
618
for the 'restype' attribute on ctypes functions"""
619
if result >= 0:
693
620
return result
694
621
if result == gnutls.E_NO_CERTIFICATE_FOUND:
695
raise gnutls.CertificateSecurityError(code=result)
696
raise gnutls.Error(code=result)
697
698
def _retry_on_error(result, func, arguments,
699
_error_code=_error_code):
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
624
625
def _retry_on_error(result, func, arguments):
700
626
"""A function to retry on some errors, suitable
701
for the "errcheck" attribute on ctypes functions"""
702
while result < gnutls.E_SUCCESS:
627
for the 'errcheck' attribute on ctypes functions"""
628
while result < 0:
703
629
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
704
630
return _error_code(result)
705
631
result = func(*arguments)
706
632
return result
707
633
708
634
# Unless otherwise indicated, the function declarations below are
709
635
# all from the gnutls/gnutls.h C header file.
710
636
711
637
# Functions
712
638
priority_set_direct = _library.gnutls_priority_set_direct
713
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
714
640
ctypes.POINTER(ctypes.c_char_p)]
715
641
priority_set_direct.restype = _error_code
716
642
717
643
init = _library.gnutls_init
718
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
719
645
init.restype = _error_code
720
646
721
647
set_default_priority = _library.gnutls_set_default_priority
722
set_default_priority.argtypes = [ClientSession]
648
set_default_priority.argtypes = [session_t]
723
649
set_default_priority.restype = _error_code
724
650
725
651
record_send = _library.gnutls_record_send
726
record_send.argtypes = [ClientSession, ctypes.c_void_p,
652
record_send.argtypes = [session_t, ctypes.c_void_p,
727
653
ctypes.c_size_t]
728
654
record_send.restype = ctypes.c_ssize_t
729
655
record_send.errcheck = _retry_on_error
730
656
731
657
certificate_allocate_credentials = (
732
658
_library.gnutls_certificate_allocate_credentials)
733
659
certificate_allocate_credentials.argtypes = [
734
PointerTo(Credentials)]
660
ctypes.POINTER(certificate_credentials_t)]
735
661
certificate_allocate_credentials.restype = _error_code
736
662
737
663
certificate_free_credentials = (
738
664
_library.gnutls_certificate_free_credentials)
739
certificate_free_credentials.argtypes = [Credentials]
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
740
666
certificate_free_credentials.restype = None
741
667
742
668
handshake_set_private_extensions = (
743
669
_library.gnutls_handshake_set_private_extensions)
744
handshake_set_private_extensions.argtypes = [ClientSession,
670
handshake_set_private_extensions.argtypes = [session_t,
745
671
ctypes.c_int]
746
672
handshake_set_private_extensions.restype = None
747
673
748
674
credentials_set = _library.gnutls_credentials_set
749
credentials_set.argtypes = [ClientSession, credentials_type_t,
750
CastToVoidPointer(Credentials)]
675
credentials_set.argtypes = [session_t, credentials_type_t,
676
ctypes.c_void_p]
751
677
credentials_set.restype = _error_code
752
678
753
679
strerror = _library.gnutls_strerror
754
680
strerror.argtypes = [ctypes.c_int]
755
681
strerror.restype = ctypes.c_char_p
756
682
757
683
certificate_type_get = _library.gnutls_certificate_type_get
758
certificate_type_get.argtypes = [ClientSession]
684
certificate_type_get.argtypes = [session_t]
759
685
certificate_type_get.restype = _error_code
760
686
761
687
certificate_get_peers = _library.gnutls_certificate_get_peers
762
certificate_get_peers.argtypes = [ClientSession,
688
certificate_get_peers.argtypes = [session_t,
763
689
ctypes.POINTER(ctypes.c_uint)]
764
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
765
691
766
692
global_set_log_level = _library.gnutls_global_set_log_level
767
693
global_set_log_level.argtypes = [ctypes.c_int]
768
694
global_set_log_level.restype = None
769
695
770
696
global_set_log_function = _library.gnutls_global_set_log_function
771
697
global_set_log_function.argtypes = [log_func]
772
698
global_set_log_function.restype = None
773
699
774
700
deinit = _library.gnutls_deinit
775
deinit.argtypes = [ClientSession]
701
deinit.argtypes = [session_t]
776
702
deinit.restype = None
777
703
778
704
handshake = _library.gnutls_handshake
779
handshake.argtypes = [ClientSession]
780
handshake.restype = ctypes.c_int
705
handshake.argtypes = [session_t]
706
handshake.restype = _error_code
781
707
handshake.errcheck = _retry_on_error
782
708
783
709
transport_set_ptr = _library.gnutls_transport_set_ptr
784
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
785
711
transport_set_ptr.restype = None
786
712
787
713
bye = _library.gnutls_bye
788
bye.argtypes = [ClientSession, close_request_t]
789
bye.restype = ctypes.c_int
714
bye.argtypes = [session_t, close_request_t]
715
bye.restype = _error_code
790
716
bye.errcheck = _retry_on_error
791
717
792
718
check_version = _library.gnutls_check_version
793
719
check_version.argtypes = [ctypes.c_char_p]
794
720
check_version.restype = ctypes.c_char_p
795
796
_need_version = b"3.3.0"
797
if check_version(_need_version) is None:
798
raise self.Error("Needs GnuTLS {} or later"
799
.format(_need_version))
800
801
_tls_rawpk_version = b"3.6.6"
802
has_rawpk = bool(check_version(_tls_rawpk_version))
803
804
if has_rawpk:
805
# Types
806
class pubkey_st(ctypes.Structure):
807
_fields = []
808
pubkey_t = ctypes.POINTER(pubkey_st)
809
810
x509_crt_fmt_t = ctypes.c_int
811
812
# All the function declarations below are from
813
# gnutls/abstract.h
814
pubkey_init = _library.gnutls_pubkey_init
815
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
816
pubkey_init.restype = _error_code
817
818
pubkey_import = _library.gnutls_pubkey_import
819
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
820
x509_crt_fmt_t]
821
pubkey_import.restype = _error_code
822
823
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
824
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
825
ctypes.POINTER(ctypes.c_ubyte),
826
ctypes.POINTER(ctypes.c_size_t)]
827
pubkey_get_key_id.restype = _error_code
828
829
pubkey_deinit = _library.gnutls_pubkey_deinit
830
pubkey_deinit.argtypes = [pubkey_t]
831
pubkey_deinit.restype = None
832
else:
833
# All the function declarations below are from
834
# gnutls/openpgp.h
835
836
openpgp_crt_init = _library.gnutls_openpgp_crt_init
837
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
838
openpgp_crt_init.restype = _error_code
839
840
openpgp_crt_import = _library.gnutls_openpgp_crt_import
841
openpgp_crt_import.argtypes = [openpgp_crt_t,
842
ctypes.POINTER(datum_t),
843
openpgp_crt_fmt_t]
844
openpgp_crt_import.restype = _error_code
845
846
openpgp_crt_verify_self = \
847
_library.gnutls_openpgp_crt_verify_self
848
openpgp_crt_verify_self.argtypes = [
849
openpgp_crt_t,
850
ctypes.c_uint,
851
ctypes.POINTER(ctypes.c_uint),
852
]
853
openpgp_crt_verify_self.restype = _error_code
854
855
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
856
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
857
openpgp_crt_deinit.restype = None
858
859
openpgp_crt_get_fingerprint = (
860
_library.gnutls_openpgp_crt_get_fingerprint)
861
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
862
ctypes.c_void_p,
863
ctypes.POINTER(
864
ctypes.c_size_t)]
865
openpgp_crt_get_fingerprint.restype = _error_code
866
867
if check_version(b"3.6.4"):
868
certificate_type_get2 = _library.gnutls_certificate_type_get2
869
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
870
certificate_type_get2.restype = _error_code
871
721
722
# All the function declarations below are from gnutls/openpgp.h
723
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
727
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
731
openpgp_crt_fmt_t]
732
openpgp_crt_import.restype = _error_code
733
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
738
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
742
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
746
ctypes.c_void_p,
747
ctypes.POINTER(
748
ctypes.c_size_t)]
749
openpgp_crt_get_fingerprint.restype = _error_code
750
872
751
# Remove non-public functions
873
752
del _error_code, _retry_on_error
874
753
# Create the global "gnutls" object, simulating a module
754
gnutls = GnuTLS()
875
755
876
756
def call_pipe(connection, # : multiprocessing.Connection
877
757
func, *args, **kwargs):
878
758
"""This function is meant to be called by multiprocessing.Process
879
759
880
760
This function runs func(*args, **kwargs), and writes the resulting
881
761
return value on the provided multiprocessing.Connection.
882
762
"""
883
763
connection.send(func(*args, **kwargs))
884
764
connection.close()
885
765
886
887
class Client:
766
class Client(object):
888
767
"""A representation of a client host served by this server.
889
768
890
769
Attributes:
891
approved: bool(); None if not yet approved/disapproved
770
approved: bool(); 'None' if not yet approved/disapproved
892
771
approval_delay: datetime.timedelta(); Time to wait for approval
893
772
approval_duration: datetime.timedelta(); Duration of one approval
894
checker: multiprocessing.Process(); a running checker process used
895
to see if the client lives. None if no process is
896
running.
773
checker: subprocess.Popen(); a running checker process used
774
to see if the client lives.
775
'None' if no process is running.
897
776
checker_callback_tag: a GLib event source tag, or None
898
777
checker_command: string; External command which is run to check
899
778
if client lives. %() expansions are done at
907
786
disable_initiator_tag: a GLib event source tag, or None
908
787
enabled: bool()
909
788
fingerprint: string (40 or 32 hexadecimal digits); used to
910
uniquely identify an OpenPGP client
911
key_id: string (64 hexadecimal digits); used to uniquely identify
912
a client using raw public keys
789
uniquely identify the client
913
790
host: string; available for use by the checker command
914
791
interval: datetime.timedelta(); How often to start a new checker
915
792
last_approval_request: datetime.datetime(); (UTC) or None
931
808
disabled, or None
932
809
server_settings: The server_settings dict from main()
933
810
"""
934
811
935
812
runtime_expansions = ("approval_delay", "approval_duration",
936
"created", "enabled", "expires", "key_id",
813
"created", "enabled", "expires",
937
814
"fingerprint", "host", "interval",
938
815
"last_approval_request", "last_checked_ok",
939
816
"last_enabled", "name", "timeout")
948
825
"approved_by_default": "True",
949
826
"enabled": "True",
950
827
}
951
828
952
829
@staticmethod
953
830
def config_parser(config):
954
831
"""Construct a new dict of client settings of this form:
961
838
for client_name in config.sections():
962
839
section = dict(config.items(client_name))
963
840
client = settings[client_name] = {}
964
841
965
842
client["host"] = section["host"]
966
843
# Reformat values from string types to Python types
967
844
client["approved_by_default"] = config.getboolean(
968
845
client_name, "approved_by_default")
969
846
client["enabled"] = config.getboolean(client_name,
970
847
"enabled")
971
972
# Uppercase and remove spaces from key_id and fingerprint
973
# for later comparison purposes with return value from the
974
# key_id() and fingerprint() functions
975
client["key_id"] = (section.get("key_id", "").upper()
976
.replace(" ", ""))
977
client["fingerprint"] = (section.get("fingerprint",
978
"").upper()
848
849
# Uppercase and remove spaces from fingerprint for later
850
# comparison purposes with return value from the
851
# fingerprint() function
852
client["fingerprint"] = (section["fingerprint"].upper()
979
853
.replace(" ", ""))
980
if not (client["key_id"] or client["fingerprint"]):
981
log.error("Skipping client %s without key_id or"
982
" fingerprint", client_name)
983
del settings[client_name]
984
continue
985
854
if "secret" in section:
986
855
client["secret"] = codecs.decode(section["secret"]
987
856
.encode("utf-8"),
1006
875
client["last_approval_request"] = None
1007
876
client["last_checked_ok"] = None
1008
877
client["last_checker_status"] = -2
1009
878
1010
879
return settings
1011
1012
def __init__(self, settings, name=None, server_settings=None):
880
881
def __init__(self, settings, name = None, server_settings=None):
1013
882
self.name = name
1014
883
if server_settings is None:
1015
884
server_settings = {}
1017
886
# adding all client settings
1018
887
for setting, value in settings.items():
1019
888
setattr(self, setting, value)
1020
889
1021
890
if self.enabled:
1022
891
if not hasattr(self, "last_enabled"):
1023
892
self.last_enabled = datetime.datetime.utcnow()
1027
896
else:
1028
897
self.last_enabled = None
1029
898
self.expires = None
1030
1031
log.debug("Creating client %r", self.name)
1032
log.debug(" Key ID: %s", self.key_id)
1033
log.debug(" Fingerprint: %s", self.fingerprint)
899
900
logger.debug("Creating client %r", self.name)
901
logger.debug(" Fingerprint: %s", self.fingerprint)
1034
902
self.created = settings.get("created",
1035
903
datetime.datetime.utcnow())
1036
904
1037
905
# attributes specific for this server instance
1038
906
self.checker = None
1039
907
self.checker_initiator_tag = None
1048
916
for attr in self.__dict__.keys()
1049
917
if not attr.startswith("_")]
1050
918
self.client_structure.append("client_structure")
1051
919
1052
920
for name, t in inspect.getmembers(
1053
921
type(self), lambda obj: isinstance(obj, property)):
1054
922
if not name.startswith("_"):
1055
923
self.client_structure.append(name)
1056
924
1057
925
# Send notice to process children that client state has changed
1058
926
def send_changedstate(self):
1059
927
with self.changedstate:
1060
928
self.changedstate.notify_all()
1061
929
1062
930
def enable(self):
1063
931
"""Start this client's checker and timeout hooks"""
1064
932
if getattr(self, "enabled", False):
1065
933
# Already enabled
1066
934
return
935
self.expires = datetime.datetime.utcnow() + self.timeout
1067
936
self.enabled = True
1068
937
self.last_enabled = datetime.datetime.utcnow()
1069
938
self.init_checker()
1070
939
self.send_changedstate()
1071
940
1072
941
def disable(self, quiet=True):
1073
942
"""Disable this client."""
1074
943
if not getattr(self, "enabled", False):
1075
944
return False
1076
945
if not quiet:
1077
log.info("Disabling client %s", self.name)
946
logger.info("Disabling client %s", self.name)
1078
947
if getattr(self, "disable_initiator_tag", None) is not None:
1079
948
GLib.source_remove(self.disable_initiator_tag)
1080
949
self.disable_initiator_tag = None
1088
957
self.send_changedstate()
1089
958
# Do not run this again if called by a GLib.timeout_add
1090
959
return False
1091
960
1092
961
def __del__(self):
1093
962
self.disable()
1094
1095
def init_checker(self, randomize_start=False):
1096
# Schedule a new checker to be started a randomly selected
1097
# time (a fraction of 'interval') from now. This spreads out
1098
# the startup of checkers over time when the server is
1099
# started.
963
964
def init_checker(self):
965
# Schedule a new checker to be started an 'interval' from now,
966
# and every interval from then on.
1100
967
if self.checker_initiator_tag is not None:
1101
968
GLib.source_remove(self.checker_initiator_tag)
1102
interval_milliseconds = int(self.interval.total_seconds()
1103
* 1000)
1104
if randomize_start:
1105
delay_milliseconds = random.randrange(
1106
interval_milliseconds + 1)
1107
else:
1108
delay_milliseconds = interval_milliseconds
1109
969
self.checker_initiator_tag = GLib.timeout_add(
1110
delay_milliseconds, self.start_checker, randomize_start)
1111
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1112
# A checker might take up to an 'interval' of time, so we can
1113
# expire at the soonest one interval after a checker was
1114
# started. Since the initial checker is delayed, the expire
1115
# time might have to be extended.
1116
now = datetime.datetime.utcnow()
1117
self.expires = now + delay + self.interval
1118
# Schedule a disable() at expire time
970
int(self.interval.total_seconds() * 1000),
971
self.start_checker)
972
# Schedule a disable() when 'timeout' has passed
1119
973
if self.disable_initiator_tag is not None:
1120
974
GLib.source_remove(self.disable_initiator_tag)
1121
975
self.disable_initiator_tag = GLib.timeout_add(
1122
int((self.expires - now).total_seconds() * 1000),
1123
self.disable)
1124
976
int(self.timeout.total_seconds() * 1000), self.disable)
977
# Also start a new checker *right now*.
978
self.start_checker()
979
1125
980
def checker_callback(self, source, condition, connection,
1126
981
command):
1127
982
"""The checker has completed, so take appropriate actions."""
983
self.checker_callback_tag = None
984
self.checker = None
1128
985
# Read return code from connection (see call_pipe)
1129
986
returncode = connection.recv()
1130
987
connection.close()
1131
if self.checker is not None:
1132
self.checker.join()
1133
self.checker_callback_tag = None
1134
self.checker = None
1135
988
1136
989
if returncode >= 0:
1137
990
self.last_checker_status = returncode
1138
991
self.last_checker_signal = None
1139
992
if self.last_checker_status == 0:
1140
log.info("Checker for %(name)s succeeded", vars(self))
993
logger.info("Checker for %(name)s succeeded",
994
vars(self))
1141
995
self.checked_ok()
1142
996
else:
1143
log.info("Checker for %(name)s failed", vars(self))
997
logger.info("Checker for %(name)s failed", vars(self))
1144
998
else:
1145
999
self.last_checker_status = -1
1146
1000
self.last_checker_signal = -returncode
1147
log.warning("Checker for %(name)s crashed?", vars(self))
1001
logger.warning("Checker for %(name)s crashed?",
1002
vars(self))
1148
1003
return False
1149
1004
1150
1005
def checked_ok(self):
1151
1006
"""Assert that the client has been seen, alive and well."""
1152
1007
self.last_checked_ok = datetime.datetime.utcnow()
1153
1008
self.last_checker_status = 0
1154
1009
self.last_checker_signal = None
1155
1010
self.bump_timeout()
1156
1011
1157
1012
def bump_timeout(self, timeout=None):
1158
1013
"""Bump up the timeout for this client."""
1159
1014
if timeout is None:
1165
1020
self.disable_initiator_tag = GLib.timeout_add(
1166
1021
int(timeout.total_seconds() * 1000), self.disable)
1167
1022
self.expires = datetime.datetime.utcnow() + timeout
1168
1023
1169
1024
def need_approval(self):
1170
1025
self.last_approval_request = datetime.datetime.utcnow()
1171
1172
def start_checker(self, start_was_randomized=False):
1026
1027
def start_checker(self):
1173
1028
"""Start a new checker subprocess if one is not running.
1174
1029
1175
1030
If a checker already exists, leave it running and do
1176
1031
nothing."""
1177
1032
# The reason for not killing a running checker is that if we
1182
1037
# checkers alone, the checker would have to take more time
1183
1038
# than 'timeout' for the client to be disabled, which is as it
1184
1039
# should be.
1185
1040
1186
1041
if self.checker is not None and not self.checker.is_alive():
1187
log.warning("Checker was not alive; joining")
1042
logger.warning("Checker was not alive; joining")
1188
1043
self.checker.join()
1189
1044
self.checker = None
1190
1045
# Start a new checker if needed
1191
1046
if self.checker is None:
1192
1047
# Escape attributes for the shell
1193
1048
escaped_attrs = {
1194
attr: shlex.quote(str(getattr(self, attr)))
1195
for attr in self.runtime_expansions}
1049
attr: re.escape(str(getattr(self, attr)))
1050
for attr in self.runtime_expansions }
1196
1051
try:
1197
1052
command = self.checker_command % escaped_attrs
1198
1053
except TypeError as error:
1199
log.error('Could not format string "%s"',
1200
self.checker_command, exc_info=error)
1054
logger.error('Could not format string "%s"',
1055
self.checker_command,
1056
exc_info=error)
1201
1057
return True # Try again later
1202
1058
self.current_checker_command = command
1203
log.info("Starting checker %r for %s", command, self.name)
1059
logger.info("Starting checker %r for %s", command,
1060
self.name)
1204
1061
# We don't need to redirect stdout and stderr, since
1205
1062
# in normal mode, that is already done by daemon(),
1206
1063
# and in debug mode we don't want to. (Stdin is
1208
1065
# The exception is when not debugging but nevertheless
1209
1066
# running in the foreground; use the previously
1210
1067
# created wnull.
1211
popen_args = {"close_fds": True,
1212
"shell": True,
1213
"cwd": "/"}
1068
popen_args = { "close_fds": True,
1069
"shell": True,
1070
"cwd": "/" }
1214
1071
if (not self.server_settings["debug"]
1215
1072
and self.server_settings["foreground"]):
1216
1073
popen_args.update({"stdout": wnull,
1217
"stderr": wnull})
1218
pipe = multiprocessing.Pipe(duplex=False)
1074
"stderr": wnull })
1075
pipe = multiprocessing.Pipe(duplex = False)
1219
1076
self.checker = multiprocessing.Process(
1220
target=call_pipe,
1221
args=(pipe[1], subprocess.call, command),
1222
kwargs=popen_args)
1077
target = call_pipe,
1078
args = (pipe[1], subprocess.call, command),
1079
kwargs = popen_args)
1223
1080
self.checker.start()
1224
1081
self.checker_callback_tag = GLib.io_add_watch(
1225
GLib.IOChannel.unix_new(pipe[0].fileno()),
1226
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1082
pipe[0].fileno(), GLib.IO_IN,
1227
1083
self.checker_callback, pipe[0], command)
1228
if start_was_randomized:
1229
# We were started after a random delay; Schedule a new
1230
# checker to be started an 'interval' from now, and every
1231
# interval from then on.
1232
now = datetime.datetime.utcnow()
1233
self.checker_initiator_tag = GLib.timeout_add(
1234
int(self.interval.total_seconds() * 1000),
1235
self.start_checker)
1236
self.expires = max(self.expires, now + self.interval)
1237
# Don't start a new checker again after same random delay
1238
return False
1239
1084
# Re-run this periodically if run by GLib.timeout_add
1240
1085
return True
1241
1086
1242
1087
def stop_checker(self):
1243
1088
"""Force the checker process, if any, to stop."""
1244
1089
if self.checker_callback_tag:
1246
1091
self.checker_callback_tag = None
1247
1092
if getattr(self, "checker", None) is None:
1248
1093
return
1249
log.debug("Stopping checker for %(name)s", vars(self))
1094
logger.debug("Stopping checker for %(name)s", vars(self))
1250
1095
self.checker.terminate()
1251
1096
self.checker = None
1252
1097
1257
1102
byte_arrays=False):
1258
1103
"""Decorators for marking methods of a DBusObjectWithProperties to
1259
1104
become properties on the D-Bus.
1260
1105
1261
1106
The decorated method will be called with no arguments by "Get"
1262
1107
and with one argument by "Set".
1263
1108
1264
1109
The parameters, where they are supported, are the same as
1265
1110
dbus.service.method, except there is only "signature", since the
1266
1111
type from Get() and the type sent to Set() is the same.
1270
1115
if byte_arrays and signature != "ay":
1271
1116
raise ValueError("Byte arrays not supported for non-'ay'"
1272
1117
" signature {!r}".format(signature))
1273
1118
1274
1119
def decorator(func):
1275
1120
func._dbus_is_property = True
1276
1121
func._dbus_interface = dbus_interface
1279
1124
func._dbus_name = func.__name__
1280
1125
if func._dbus_name.endswith("_dbus_property"):
1281
1126
func._dbus_name = func._dbus_name[:-14]
1282
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1127
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1283
1128
return func
1284
1129
1285
1130
return decorator
1286
1131
1287
1132
1288
1133
def dbus_interface_annotations(dbus_interface):
1289
1134
"""Decorator for marking functions returning interface annotations
1290
1135
1291
1136
Usage:
1292
1137
1293
1138
@dbus_interface_annotations("org.example.Interface")
1294
1139
def _foo(self): # Function name does not matter
1295
1140
return {"org.freedesktop.DBus.Deprecated": "true",
1296
1141
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1297
1142
"false"}
1298
1143
"""
1299
1144
1300
1145
def decorator(func):
1301
1146
func._dbus_is_interface = True
1302
1147
func._dbus_interface = dbus_interface
1303
1148
func._dbus_name = dbus_interface
1304
1149
return func
1305
1150
1306
1151
return decorator
1307
1152
1308
1153
1309
1154
def dbus_annotations(annotations):
1310
1155
"""Decorator to annotate D-Bus methods, signals or properties
1311
1156
Usage:
1312
1157
1313
1158
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1314
1159
"org.freedesktop.DBus.Property."
1315
1160
"EmitsChangedSignal": "false"})
1317
1162
access="r")
1318
1163
def Property_dbus_property(self):
1319
1164
return dbus.Boolean(False)
1320
1165
1321
1166
See also the DBusObjectWithAnnotations class.
1322
1167
"""
1323
1168
1324
1169
def decorator(func):
1325
1170
func._dbus_annotations = annotations
1326
1171
return func
1327
1172
1328
1173
return decorator
1329
1174
1330
1175
1348
1193
1349
1194
class DBusObjectWithAnnotations(dbus.service.Object):
1350
1195
"""A D-Bus object with annotations.
1351
1196
1352
1197
Classes inheriting from this can use the dbus_annotations
1353
1198
decorator to add annotations to methods or signals.
1354
1199
"""
1355
1200
1356
1201
@staticmethod
1357
1202
def _is_dbus_thing(thing):
1358
1203
"""Returns a function testing if an attribute is a D-Bus thing
1359
1204
1360
1205
If called like _is_dbus_thing("method") it returns a function
1361
1206
suitable for use as predicate to inspect.getmembers().
1362
1207
"""
1363
1208
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1364
1209
False)
1365
1210
1366
1211
def _get_all_dbus_things(self, thing):
1367
1212
"""Returns a generator of (name, attribute) pairs
1368
1213
"""
1371
1216
for cls in self.__class__.__mro__
1372
1217
for name, athing in
1373
1218
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1374
1219
1375
1220
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1376
out_signature="s",
1377
path_keyword="object_path",
1378
connection_keyword="connection")
1221
out_signature = "s",
1222
path_keyword = 'object_path',
1223
connection_keyword = 'connection')
1379
1224
def Introspect(self, object_path, connection):
1380
1225
"""Overloading of standard D-Bus method.
1381
1226
1382
1227
Inserts annotation tags on methods and signals.
1383
1228
"""
1384
1229
xmlstring = dbus.service.Object.Introspect(self, object_path,
1385
1230
connection)
1386
1231
try:
1387
1232
document = xml.dom.minidom.parseString(xmlstring)
1388
1233
1389
1234
for if_tag in document.getElementsByTagName("interface"):
1390
1235
# Add annotation tags
1391
1236
for typ in ("method", "signal"):
1418
1263
if_tag.appendChild(ann_tag)
1419
1264
# Fix argument name for the Introspect method itself
1420
1265
if (if_tag.getAttribute("name")
1421
== dbus.INTROSPECTABLE_IFACE):
1266
== dbus.INTROSPECTABLE_IFACE):
1422
1267
for cn in if_tag.getElementsByTagName("method"):
1423
1268
if cn.getAttribute("name") == "Introspect":
1424
1269
for arg in cn.getElementsByTagName("arg"):
1430
1275
document.unlink()
1431
1276
except (AttributeError, xml.dom.DOMException,
1432
1277
xml.parsers.expat.ExpatError) as error:
1433
log.error("Failed to override Introspection method",
1434
exc_info=error)
1278
logger.error("Failed to override Introspection method",
1279
exc_info=error)
1435
1280
return xmlstring
1436
1281
1437
1282
1438
1283
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1439
1284
"""A D-Bus object with properties.
1440
1285
1441
1286
Classes inheriting from this can use the dbus_service_property
1442
1287
decorator to expose methods as D-Bus properties. It exposes the
1443
1288
standard Get(), Set(), and GetAll() methods on the D-Bus.
1444
1289
"""
1445
1290
1446
1291
def _get_dbus_property(self, interface_name, property_name):
1447
1292
"""Returns a bound method if one exists which is a D-Bus
1448
1293
property with the specified name and interface.
1453
1298
if (value._dbus_name == property_name
1454
1299
and value._dbus_interface == interface_name):
1455
1300
return value.__get__(self)
1456
1301
1457
1302
# No such property
1458
1303
raise DBusPropertyNotFound("{}:{}.{}".format(
1459
1304
self.dbus_object_path, interface_name, property_name))
1460
1305
1461
1306
@classmethod
1462
1307
def _get_all_interface_names(cls):
1463
1308
"""Get a sequence of all interfaces supported by an object"""
1466
1311
for x in (inspect.getmro(cls))
1467
1312
for attr in dir(x))
1468
1313
if name is not None)
1469
1314
1470
1315
@dbus.service.method(dbus.PROPERTIES_IFACE,
1471
1316
in_signature="ss",
1472
1317
out_signature="v")
1480
1325
if not hasattr(value, "variant_level"):
1481
1326
return value
1482
1327
return type(value)(value, variant_level=value.variant_level+1)
1483
1328
1484
1329
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1485
1330
def Set(self, interface_name, property_name, value):
1486
1331
"""Standard D-Bus property Set() method, see D-Bus standard.
1495
1340
raise ValueError("Byte arrays not supported for non-"
1496
1341
"'ay' signature {!r}"
1497
1342
.format(prop._dbus_signature))
1498
value = dbus.ByteArray(bytes(value))
1343
value = dbus.ByteArray(b''.join(chr(byte)
1344
for byte in value))
1499
1345
prop(value)
1500
1346
1501
1347
@dbus.service.method(dbus.PROPERTIES_IFACE,
1502
1348
in_signature="s",
1503
1349
out_signature="a{sv}")
1504
1350
def GetAll(self, interface_name):
1505
1351
"""Standard D-Bus property GetAll() method, see D-Bus
1506
1352
standard.
1507
1353
1508
1354
Note: Will not include properties with access="write".
1509
1355
"""
1510
1356
properties = {}
1521
1367
properties[name] = value
1522
1368
continue
1523
1369
properties[name] = type(value)(
1524
value, variant_level=value.variant_level + 1)
1370
value, variant_level = value.variant_level + 1)
1525
1371
return dbus.Dictionary(properties, signature="sv")
1526
1372
1527
1373
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1528
1374
def PropertiesChanged(self, interface_name, changed_properties,
1529
1375
invalidated_properties):
1531
1377
standard.
1532
1378
"""
1533
1379
pass
1534
1380
1535
1381
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1536
1382
out_signature="s",
1537
path_keyword="object_path",
1538
connection_keyword="connection")
1383
path_keyword='object_path',
1384
connection_keyword='connection')
1539
1385
def Introspect(self, object_path, connection):
1540
1386
"""Overloading of standard D-Bus method.
1541
1387
1542
1388
Inserts property tags and interface annotation tags.
1543
1389
"""
1544
1390
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1546
1392
connection)
1547
1393
try:
1548
1394
document = xml.dom.minidom.parseString(xmlstring)
1549
1395
1550
1396
def make_tag(document, name, prop):
1551
1397
e = document.createElement("property")
1552
1398
e.setAttribute("name", name)
1553
1399
e.setAttribute("type", prop._dbus_signature)
1554
1400
e.setAttribute("access", prop._dbus_access)
1555
1401
return e
1556
1402
1557
1403
for if_tag in document.getElementsByTagName("interface"):
1558
1404
# Add property tags
1559
1405
for tag in (make_tag(document, name, prop)
1597
1443
document.unlink()
1598
1444
except (AttributeError, xml.dom.DOMException,
1599
1445
xml.parsers.expat.ExpatError) as error:
1600
log.error("Failed to override Introspection method",
1601
exc_info=error)
1446
logger.error("Failed to override Introspection method",
1447
exc_info=error)
1602
1448
return xmlstring
1603
1449
1604
1605
1450
try:
1606
1451
dbus.OBJECT_MANAGER_IFACE
1607
1452
except AttributeError:
1608
1453
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1609
1454
1610
1611
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1612
1456
"""A D-Bus object with an ObjectManager.
1613
1457
1614
1458
Classes inheriting from this exposes the standard
1615
1459
GetManagedObjects call and the InterfacesAdded and
1616
1460
InterfacesRemoved signals on the standard
1617
1461
"org.freedesktop.DBus.ObjectManager" interface.
1618
1462
1619
1463
Note: No signals are sent automatically; they must be sent
1620
1464
manually.
1621
1465
"""
1622
1466
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1623
out_signature="a{oa{sa{sv}}}")
1467
out_signature = "a{oa{sa{sv}}}")
1624
1468
def GetManagedObjects(self):
1625
1469
"""This function must be overridden"""
1626
1470
raise NotImplementedError()
1627
1471
1628
1472
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1629
signature="oa{sa{sv}}")
1473
signature = "oa{sa{sv}}")
1630
1474
def InterfacesAdded(self, object_path, interfaces_and_properties):
1631
1475
pass
1632
1633
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1476
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1634
1478
def InterfacesRemoved(self, object_path, interfaces):
1635
1479
pass
1636
1480
1637
1481
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1638
out_signature="s",
1639
path_keyword="object_path",
1640
connection_keyword="connection")
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1641
1485
def Introspect(self, object_path, connection):
1642
1486
"""Overloading of standard D-Bus method.
1643
1487
1644
1488
Override return argument name of GetManagedObjects to be
1645
1489
"objpath_interfaces_and_properties"
1646
1490
"""
1649
1493
connection)
1650
1494
try:
1651
1495
document = xml.dom.minidom.parseString(xmlstring)
1652
1496
1653
1497
for if_tag in document.getElementsByTagName("interface"):
1654
1498
# Fix argument name for the GetManagedObjects method
1655
1499
if (if_tag.getAttribute("name")
1656
== dbus.OBJECT_MANAGER_IFACE):
1500
== dbus.OBJECT_MANAGER_IFACE):
1657
1501
for cn in if_tag.getElementsByTagName("method"):
1658
1502
if (cn.getAttribute("name")
1659
1503
== "GetManagedObjects"):
1668
1512
document.unlink()
1669
1513
except (AttributeError, xml.dom.DOMException,
1670
1514
xml.parsers.expat.ExpatError) as error:
1671
log.error("Failed to override Introspection method",
1672
exc_info=error)
1515
logger.error("Failed to override Introspection method",
1516
exc_info = error)
1673
1517
return xmlstring
1674
1518
1675
1676
1519
def datetime_to_dbus(dt, variant_level=0):
1677
1520
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1678
1521
if dt is None:
1679
return dbus.String("", variant_level=variant_level)
1522
return dbus.String("", variant_level = variant_level)
1680
1523
return dbus.String(dt.isoformat(), variant_level=variant_level)
1681
1524
1682
1525
1685
1528
dbus.service.Object, it will add alternate D-Bus attributes with
1686
1529
interface names according to the "alt_interface_names" mapping.
1687
1530
Usage:
1688
1531
1689
1532
@alternate_dbus_interfaces({"org.example.Interface":
1690
1533
"net.example.AlternateInterface"})
1691
1534
class SampleDBusObject(dbus.service.Object):
1692
1535
@dbus.service.method("org.example.Interface")
1693
1536
def SampleDBusMethod():
1694
1537
pass
1695
1538
1696
1539
The above "SampleDBusMethod" on "SampleDBusObject" will be
1697
1540
reachable via two interfaces: "org.example.Interface" and
1698
1541
"net.example.AlternateInterface", the latter of which will have
1699
1542
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1700
1543
"true", unless "deprecate" is passed with a False value.
1701
1544
1702
1545
This works for methods and signals, and also for D-Bus properties
1703
1546
(from DBusObjectWithProperties) and interfaces (from the
1704
1547
dbus_interface_annotations decorator).
1705
1548
"""
1706
1549
1707
1550
def wrapper(cls):
1708
1551
for orig_interface_name, alt_interface_name in (
1709
1552
alt_interface_names.items()):
1749
1592
attribute._dbus_annotations)
1750
1593
except AttributeError:
1751
1594
pass
1752
1753
1595
# Define a creator of a function to call both the
1754
1596
# original and alternate functions, so both the
1755
1597
# original and alternate signals gets sent when
1758
1600
"""This function is a scope container to pass
1759
1601
func1 and func2 to the "call_both" function
1760
1602
outside of its arguments"""
1761
1603
1762
1604
@functools.wraps(func2)
1763
1605
def call_both(*args, **kwargs):
1764
1606
"""This function will emit two D-Bus
1765
1607
signals by calling func1 and func2"""
1766
1608
func1(*args, **kwargs)
1767
1609
func2(*args, **kwargs)
1768
# Make wrapper function look like a D-Bus
1769
# signal
1610
# Make wrapper function look like a D-Bus signal
1770
1611
for name, attr in inspect.getmembers(func2):
1771
1612
if name.startswith("_dbus_"):
1772
1613
setattr(call_both, name, attr)
1773
1614
1774
1615
return call_both
1775
1616
# Create the "call_both" function and add it to
1776
1617
# the class
1822
1663
(copy_function(attribute)))
1823
1664
if deprecate:
1824
1665
# Deprecate all alternate interfaces
1825
iname = "_AlternateDBusNames_interface_annotation{}"
1666
iname="_AlternateDBusNames_interface_annotation{}"
1826
1667
for interface_name in interface_names:
1827
1668
1828
1669
@dbus_interface_annotations(interface_name)
1829
1670
def func(self):
1830
return {"org.freedesktop.DBus.Deprecated":
1831
"true"}
1671
return { "org.freedesktop.DBus.Deprecated":
1672
"true" }
1832
1673
# Find an unused name
1833
1674
for aname in (iname.format(i)
1834
1675
for i in itertools.count()):
1845
1686
cls = type("{}Alternate".format(cls.__name__),
1846
1687
(cls, ), attr)
1847
1688
return cls
1848
1689
1849
1690
return wrapper
1850
1691
1851
1692
1853
1694
"se.bsnet.fukt.Mandos"})
1854
1695
class ClientDBus(Client, DBusObjectWithProperties):
1855
1696
"""A Client class using D-Bus
1856
1697
1857
1698
Attributes:
1858
1699
dbus_object_path: dbus.ObjectPath
1859
1700
bus: dbus.SystemBus()
1860
1701
"""
1861
1702
1862
1703
runtime_expansions = (Client.runtime_expansions
1863
1704
+ ("dbus_object_path", ))
1864
1705
1865
1706
_interface = "se.recompile.Mandos.Client"
1866
1707
1867
1708
# dbus.service.Object doesn't use super(), so we can't either.
1868
1869
def __init__(self, bus=None, *args, **kwargs):
1709
1710
def __init__(self, bus = None, *args, **kwargs):
1870
1711
self.bus = bus
1871
1712
Client.__init__(self, *args, **kwargs)
1872
1713
# Only now, when this client is initialized, can it show up on
1878
1719
"/clients/" + client_object_name)
1879
1720
DBusObjectWithProperties.__init__(self, self.bus,
1880
1721
self.dbus_object_path)
1881
1722
1882
1723
def notifychangeproperty(transform_func, dbus_name,
1883
1724
type_func=lambda x: x,
1884
1725
variant_level=1,
1886
1727
_interface=_interface):
1887
1728
""" Modify a variable so that it's a property which announces
1888
1729
its changes to DBus.
1889
1730
1890
1731
transform_fun: Function that takes a value and a variant_level
1891
1732
and transforms it to a D-Bus type.
1892
1733
dbus_name: D-Bus name of the variable
1895
1736
variant_level: D-Bus variant level. Default: 1
1896
1737
"""
1897
1738
attrname = "_{}".format(dbus_name)
1898
1739
1899
1740
def setter(self, value):
1900
1741
if hasattr(self, "dbus_object_path"):
1901
1742
if (not hasattr(self, attrname) or
1908
1749
else:
1909
1750
dbus_value = transform_func(
1910
1751
type_func(value),
1911
variant_level=variant_level)
1752
variant_level = variant_level)
1912
1753
self.PropertyChanged(dbus.String(dbus_name),
1913
1754
dbus_value)
1914
1755
self.PropertiesChanged(
1915
1756
_interface,
1916
dbus.Dictionary({dbus.String(dbus_name):
1917
dbus_value}),
1757
dbus.Dictionary({ dbus.String(dbus_name):
1758
dbus_value }),
1918
1759
dbus.Array())
1919
1760
setattr(self, attrname, value)
1920
1761
1921
1762
return property(lambda self: getattr(self, attrname), setter)
1922
1763
1923
1764
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1924
1765
approvals_pending = notifychangeproperty(dbus.Boolean,
1925
1766
"ApprovalPending",
1926
type_func=bool)
1767
type_func = bool)
1927
1768
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1928
1769
last_enabled = notifychangeproperty(datetime_to_dbus,
1929
1770
"LastEnabled")
1930
1771
checker = notifychangeproperty(
1931
1772
dbus.Boolean, "CheckerRunning",
1932
type_func=lambda checker: checker is not None)
1773
type_func = lambda checker: checker is not None)
1933
1774
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1934
1775
"LastCheckedOK")
1935
1776
last_checker_status = notifychangeproperty(dbus.Int16,
1940
1781
"ApprovedByDefault")
1941
1782
approval_delay = notifychangeproperty(
1942
1783
dbus.UInt64, "ApprovalDelay",
1943
type_func=lambda td: td.total_seconds() * 1000)
1784
type_func = lambda td: td.total_seconds() * 1000)
1944
1785
approval_duration = notifychangeproperty(
1945
1786
dbus.UInt64, "ApprovalDuration",
1946
type_func=lambda td: td.total_seconds() * 1000)
1787
type_func = lambda td: td.total_seconds() * 1000)
1947
1788
host = notifychangeproperty(dbus.String, "Host")
1948
1789
timeout = notifychangeproperty(
1949
1790
dbus.UInt64, "Timeout",
1950
type_func=lambda td: td.total_seconds() * 1000)
1791
type_func = lambda td: td.total_seconds() * 1000)
1951
1792
extended_timeout = notifychangeproperty(
1952
1793
dbus.UInt64, "ExtendedTimeout",
1953
type_func=lambda td: td.total_seconds() * 1000)
1794
type_func = lambda td: td.total_seconds() * 1000)
1954
1795
interval = notifychangeproperty(
1955
1796
dbus.UInt64, "Interval",
1956
type_func=lambda td: td.total_seconds() * 1000)
1797
type_func = lambda td: td.total_seconds() * 1000)
1957
1798
checker_command = notifychangeproperty(dbus.String, "Checker")
1958
1799
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1959
1800
invalidate_only=True)
1960
1801
1961
1802
del notifychangeproperty
1962
1803
1963
1804
def __del__(self, *args, **kwargs):
1964
1805
try:
1965
1806
self.remove_from_connection()
1968
1809
if hasattr(DBusObjectWithProperties, "__del__"):
1969
1810
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1970
1811
Client.__del__(self, *args, **kwargs)
1971
1812
1972
1813
def checker_callback(self, source, condition,
1973
1814
connection, command, *args, **kwargs):
1974
1815
ret = Client.checker_callback(self, source, condition,
1990
1831
| self.last_checker_signal),
1991
1832
dbus.String(command))
1992
1833
return ret
1993
1834
1994
1835
def start_checker(self, *args, **kwargs):
1995
1836
old_checker_pid = getattr(self.checker, "pid", None)
1996
1837
r = Client.start_checker(self, *args, **kwargs)
2000
1841
# Emit D-Bus signal
2001
1842
self.CheckerStarted(self.current_checker_command)
2002
1843
return r
2003
1844
2004
1845
def _reset_approved(self):
2005
1846
self.approved = None
2006
1847
return False
2007
1848
2008
1849
def approve(self, value=True):
2009
1850
self.approved = value
2010
1851
GLib.timeout_add(int(self.approval_duration.total_seconds()
2011
1852
* 1000), self._reset_approved)
2012
1853
self.send_changedstate()
2013
2014
# D-Bus methods, signals & properties
2015
2016
# Interfaces
2017
2018
# Signals
2019
1854
1855
## D-Bus methods, signals & properties
1856
1857
## Interfaces
1858
1859
## Signals
1860
2020
1861
# CheckerCompleted - signal
2021
1862
@dbus.service.signal(_interface, signature="nxs")
2022
1863
def CheckerCompleted(self, exitcode, waitstatus, command):
2023
1864
"D-Bus signal"
2024
1865
pass
2025
1866
2026
1867
# CheckerStarted - signal
2027
1868
@dbus.service.signal(_interface, signature="s")
2028
1869
def CheckerStarted(self, command):
2029
1870
"D-Bus signal"
2030
1871
pass
2031
1872
2032
1873
# PropertyChanged - signal
2033
1874
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2034
1875
@dbus.service.signal(_interface, signature="sv")
2035
1876
def PropertyChanged(self, property, value):
2036
1877
"D-Bus signal"
2037
1878
pass
2038
1879
2039
1880
# GotSecret - signal
2040
1881
@dbus.service.signal(_interface)
2041
1882
def GotSecret(self):
2044
1885
server to mandos-client
2045
1886
"""
2046
1887
pass
2047
1888
2048
1889
# Rejected - signal
2049
1890
@dbus.service.signal(_interface, signature="s")
2050
1891
def Rejected(self, reason):
2051
1892
"D-Bus signal"
2052
1893
pass
2053
1894
2054
1895
# NeedApproval - signal
2055
1896
@dbus.service.signal(_interface, signature="tb")
2056
1897
def NeedApproval(self, timeout, default):
2057
1898
"D-Bus signal"
2058
1899
return self.need_approval()
2059
2060
# Methods
2061
1900
1901
## Methods
1902
2062
1903
# Approve - method
2063
1904
@dbus.service.method(_interface, in_signature="b")
2064
1905
def Approve(self, value):
2065
1906
self.approve(value)
2066
1907
2067
1908
# CheckedOK - method
2068
1909
@dbus.service.method(_interface)
2069
1910
def CheckedOK(self):
2070
1911
self.checked_ok()
2071
1912
2072
1913
# Enable - method
2073
1914
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2074
1915
@dbus.service.method(_interface)
2075
1916
def Enable(self):
2076
1917
"D-Bus method"
2077
1918
self.enable()
2078
1919
2079
1920
# StartChecker - method
2080
1921
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2081
1922
@dbus.service.method(_interface)
2082
1923
def StartChecker(self):
2083
1924
"D-Bus method"
2084
1925
self.start_checker()
2085
1926
2086
1927
# Disable - method
2087
1928
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2088
1929
@dbus.service.method(_interface)
2089
1930
def Disable(self):
2090
1931
"D-Bus method"
2091
1932
self.disable()
2092
1933
2093
1934
# StopChecker - method
2094
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2095
1936
@dbus.service.method(_interface)
2096
1937
def StopChecker(self):
2097
1938
self.stop_checker()
2098
2099
# Properties
2100
1939
1940
## Properties
1941
2101
1942
# ApprovalPending - property
2102
1943
@dbus_service_property(_interface, signature="b", access="read")
2103
1944
def ApprovalPending_dbus_property(self):
2104
1945
return dbus.Boolean(bool(self.approvals_pending))
2105
1946
2106
1947
# ApprovedByDefault - property
2107
1948
@dbus_service_property(_interface,
2108
1949
signature="b",
2111
1952
if value is None: # get
2112
1953
return dbus.Boolean(self.approved_by_default)
2113
1954
self.approved_by_default = bool(value)
2114
1955
2115
1956
# ApprovalDelay - property
2116
1957
@dbus_service_property(_interface,
2117
1958
signature="t",
2121
1962
return dbus.UInt64(self.approval_delay.total_seconds()
2122
1963
* 1000)
2123
1964
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2124
1965
2125
1966
# ApprovalDuration - property
2126
1967
@dbus_service_property(_interface,
2127
1968
signature="t",
2131
1972
return dbus.UInt64(self.approval_duration.total_seconds()
2132
1973
* 1000)
2133
1974
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2134
1975
2135
1976
# Name - property
2136
1977
@dbus_annotations(
2137
1978
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2138
1979
@dbus_service_property(_interface, signature="s", access="read")
2139
1980
def Name_dbus_property(self):
2140
1981
return dbus.String(self.name)
2141
2142
# KeyID - property
2143
@dbus_annotations(
2144
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2145
@dbus_service_property(_interface, signature="s", access="read")
2146
def KeyID_dbus_property(self):
2147
return dbus.String(self.key_id)
2148
1982
2149
1983
# Fingerprint - property
2150
1984
@dbus_annotations(
2151
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2152
1986
@dbus_service_property(_interface, signature="s", access="read")
2153
1987
def Fingerprint_dbus_property(self):
2154
1988
return dbus.String(self.fingerprint)
2155
1989
2156
1990
# Host - property
2157
1991
@dbus_service_property(_interface,
2158
1992
signature="s",
2161
1995
if value is None: # get
2162
1996
return dbus.String(self.host)
2163
1997
self.host = str(value)
2164
1998
2165
1999
# Created - property
2166
2000
@dbus_annotations(
2167
2001
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2168
2002
@dbus_service_property(_interface, signature="s", access="read")
2169
2003
def Created_dbus_property(self):
2170
2004
return datetime_to_dbus(self.created)
2171
2005
2172
2006
# LastEnabled - property
2173
2007
@dbus_service_property(_interface, signature="s", access="read")
2174
2008
def LastEnabled_dbus_property(self):
2175
2009
return datetime_to_dbus(self.last_enabled)
2176
2010
2177
2011
# Enabled - property
2178
2012
@dbus_service_property(_interface,
2179
2013
signature="b",
2185
2019
self.enable()
2186
2020
else:
2187
2021
self.disable()
2188
2022
2189
2023
# LastCheckedOK - property
2190
2024
@dbus_service_property(_interface,
2191
2025
signature="s",
2195
2029
self.checked_ok()
2196
2030
return
2197
2031
return datetime_to_dbus(self.last_checked_ok)
2198
2032
2199
2033
# LastCheckerStatus - property
2200
2034
@dbus_service_property(_interface, signature="n", access="read")
2201
2035
def LastCheckerStatus_dbus_property(self):
2202
2036
return dbus.Int16(self.last_checker_status)
2203
2037
2204
2038
# Expires - property
2205
2039
@dbus_service_property(_interface, signature="s", access="read")
2206
2040
def Expires_dbus_property(self):
2207
2041
return datetime_to_dbus(self.expires)
2208
2042
2209
2043
# LastApprovalRequest - property
2210
2044
@dbus_service_property(_interface, signature="s", access="read")
2211
2045
def LastApprovalRequest_dbus_property(self):
2212
2046
return datetime_to_dbus(self.last_approval_request)
2213
2047
2214
2048
# Timeout - property
2215
2049
@dbus_service_property(_interface,
2216
2050
signature="t",
2235
2069
self.disable_initiator_tag = GLib.timeout_add(
2236
2070
int((self.expires - now).total_seconds() * 1000),
2237
2071
self.disable)
2238
2072
2239
2073
# ExtendedTimeout - property
2240
2074
@dbus_service_property(_interface,
2241
2075
signature="t",
2245
2079
return dbus.UInt64(self.extended_timeout.total_seconds()
2246
2080
* 1000)
2247
2081
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2248
2082
2249
2083
# Interval - property
2250
2084
@dbus_service_property(_interface,
2251
2085
signature="t",
2261
2095
GLib.source_remove(self.checker_initiator_tag)
2262
2096
self.checker_initiator_tag = GLib.timeout_add(
2263
2097
value, self.start_checker)
2264
self.start_checker() # Start one now, too
2265
2098
self.start_checker() # Start one now, too
2099
2266
2100
# Checker - property
2267
2101
@dbus_service_property(_interface,
2268
2102
signature="s",
2271
2105
if value is None: # get
2272
2106
return dbus.String(self.checker_command)
2273
2107
self.checker_command = str(value)
2274
2108
2275
2109
# CheckerRunning - property
2276
2110
@dbus_service_property(_interface,
2277
2111
signature="b",
2283
2117
self.start_checker()
2284
2118
else:
2285
2119
self.stop_checker()
2286
2120
2287
2121
# ObjectPath - property
2288
2122
@dbus_annotations(
2289
2123
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2290
2124
"org.freedesktop.DBus.Deprecated": "true"})
2291
2125
@dbus_service_property(_interface, signature="o", access="read")
2292
2126
def ObjectPath_dbus_property(self):
2293
return self.dbus_object_path # is already a dbus.ObjectPath
2294
2127
return self.dbus_object_path # is already a dbus.ObjectPath
2128
2295
2129
# Secret = property
2296
2130
@dbus_annotations(
2297
2131
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2302
2136
byte_arrays=True)
2303
2137
def Secret_dbus_property(self, value):
2304
2138
self.secret = bytes(value)
2305
2139
2306
2140
del _interface
2307
2141
2308
2142
2309
class ProxyClient:
2310
def __init__(self, child_pipe, key_id, fpr, address):
2143
class ProxyClient(object):
2144
def __init__(self, child_pipe, fpr, address):
2311
2145
self._pipe = child_pipe
2312
self._pipe.send(("init", key_id, fpr, address))
2146
self._pipe.send(('init', fpr, address))
2313
2147
if not self._pipe.recv():
2314
raise KeyError(key_id or fpr)
2315
2148
raise KeyError(fpr)
2149
2316
2150
def __getattribute__(self, name):
2317
if name == "_pipe":
2151
if name == '_pipe':
2318
2152
return super(ProxyClient, self).__getattribute__(name)
2319
self._pipe.send(("getattr", name))
2153
self._pipe.send(('getattr', name))
2320
2154
data = self._pipe.recv()
2321
if data[0] == "data":
2155
if data[0] == 'data':
2322
2156
return data[1]
2323
if data[0] == "function":
2324
2157
if data[0] == 'function':
2158
2325
2159
def func(*args, **kwargs):
2326
self._pipe.send(("funcall", name, args, kwargs))
2160
self._pipe.send(('funcall', name, args, kwargs))
2327
2161
return self._pipe.recv()[1]
2328
2162
2329
2163
return func
2330
2164
2331
2165
def __setattr__(self, name, value):
2332
if name == "_pipe":
2166
if name == '_pipe':
2333
2167
return super(ProxyClient, self).__setattr__(name, value)
2334
self._pipe.send(("setattr", name, value))
2168
self._pipe.send(('setattr', name, value))
2335
2169
2336
2170
2337
2171
class ClientHandler(socketserver.BaseRequestHandler, object):
2338
2172
"""A class to handle client connections.
2339
2173
2340
2174
Instantiated once for each connection to handle it.
2341
2175
Note: This will run in its own forked process."""
2342
2176
2343
2177
def handle(self):
2344
2178
with contextlib.closing(self.server.child_pipe) as child_pipe:
2345
log.info("TCP connection from: %s",
2346
str(self.client_address))
2347
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2348
2179
logger.info("TCP connection from: %s",
2180
str(self.client_address))
2181
logger.debug("Pipe FD: %d",
2182
self.server.child_pipe.fileno())
2183
2349
2184
session = gnutls.ClientSession(self.request)
2350
2351
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2352
# "+AES-256-CBC", "+SHA1",
2353
# "+COMP-NULL", "+CTYPE-OPENPGP",
2354
# "+DHE-DSS"))
2185
2186
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
# "+AES-256-CBC", "+SHA1",
2188
# "+COMP-NULL", "+CTYPE-OPENPGP",
2189
# "+DHE-DSS"))
2355
2190
# Use a fallback default, since this MUST be set.
2356
2191
priority = self.server.gnutls_priority
2357
2192
if priority is None:
2358
2193
priority = "NORMAL"
2359
gnutls.priority_set_direct(session,
2360
priority.encode("utf-8"), None)
2361
2194
gnutls.priority_set_direct(session._c_object,
2195
priority.encode("utf-8"),
2196
None)
2197
2362
2198
# Start communication using the Mandos protocol
2363
2199
# Get protocol number
2364
2200
line = self.request.makefile().readline()
2365
log.debug("Protocol version: %r", line)
2201
logger.debug("Protocol version: %r", line)
2366
2202
try:
2367
2203
if int(line.strip().split()[0]) > 1:
2368
2204
raise RuntimeError(line)
2369
2205
except (ValueError, IndexError, RuntimeError) as error:
2370
log.error("Unknown protocol version: %s", error)
2206
logger.error("Unknown protocol version: %s", error)
2371
2207
return
2372
2208
2373
2209
# Start GnuTLS connection
2374
2210
try:
2375
2211
session.handshake()
2376
2212
except gnutls.Error as error:
2377
log.warning("Handshake failed: %s", error)
2213
logger.warning("Handshake failed: %s", error)
2378
2214
# Do not run session.bye() here: the session is not
2379
2215
# established. Just abandon the request.
2380
2216
return
2381
log.debug("Handshake succeeded")
2382
2217
logger.debug("Handshake succeeded")
2218
2383
2219
approval_required = False
2384
2220
try:
2385
if gnutls.has_rawpk:
2386
fpr = b""
2387
try:
2388
key_id = self.key_id(
2389
self.peer_certificate(session))
2390
except (TypeError, gnutls.Error) as error:
2391
log.warning("Bad certificate: %s", error)
2392
return
2393
log.debug("Key ID: %s",
2394
key_id.decode("utf-8",
2395
errors="replace"))
2396
2397
else:
2398
key_id = b""
2399
try:
2400
fpr = self.fingerprint(
2401
self.peer_certificate(session))
2402
except (TypeError, gnutls.Error) as error:
2403
log.warning("Bad certificate: %s", error)
2404
return
2405
log.debug("Fingerprint: %s", fpr)
2406
2407
try:
2408
client = ProxyClient(child_pipe, key_id, fpr,
2221
try:
2222
fpr = self.fingerprint(
2223
self.peer_certificate(session))
2224
except (TypeError, gnutls.Error) as error:
2225
logger.warning("Bad certificate: %s", error)
2226
return
2227
logger.debug("Fingerprint: %s", fpr)
2228
2229
try:
2230
client = ProxyClient(child_pipe, fpr,
2409
2231
self.client_address)
2410
2232
except KeyError:
2411
2233
return
2412
2234
2413
2235
if client.approval_delay:
2414
2236
delay = client.approval_delay
2415
2237
client.approvals_pending += 1
2416
2238
approval_required = True
2417
2239
2418
2240
while True:
2419
2241
if not client.enabled:
2420
log.info("Client %s is disabled", client.name)
2242
logger.info("Client %s is disabled",
2243
client.name)
2421
2244
if self.server.use_dbus:
2422
2245
# Emit D-Bus signal
2423
2246
client.Rejected("Disabled")
2424
2247
return
2425
2248
2426
2249
if client.approved or not client.approval_delay:
2427
# We are approved or approval is disabled
2250
#We are approved or approval is disabled
2428
2251
break
2429
2252
elif client.approved is None:
2430
log.info("Client %s needs approval",
2431
client.name)
2253
logger.info("Client %s needs approval",
2254
client.name)
2432
2255
if self.server.use_dbus:
2433
2256
# Emit D-Bus signal
2434
2257
client.NeedApproval(
2435
2258
client.approval_delay.total_seconds()
2436
2259
* 1000, client.approved_by_default)
2437
2260
else:
2438
log.warning("Client %s was not approved",
2439
client.name)
2261
logger.warning("Client %s was not approved",
2262
client.name)
2440
2263
if self.server.use_dbus:
2441
2264
# Emit D-Bus signal
2442
2265
client.Rejected("Denied")
2443
2266
return
2444
2445
# wait until timeout or approved
2267
2268
#wait until timeout or approved
2446
2269
time = datetime.datetime.now()
2447
2270
client.changedstate.acquire()
2448
2271
client.changedstate.wait(delay.total_seconds())
2450
2273
time2 = datetime.datetime.now()
2451
2274
if (time2 - time) >= delay:
2452
2275
if not client.approved_by_default:
2453
log.warning("Client %s timed out while"
2454
" waiting for approval",
2455
client.name)
2276
logger.warning("Client %s timed out while"
2277
" waiting for approval",
2278
client.name)
2456
2279
if self.server.use_dbus:
2457
2280
# Emit D-Bus signal
2458
2281
client.Rejected("Approval timed out")
2461
2284
break
2462
2285
else:
2463
2286
delay -= time2 - time
2464
2287
2465
2288
try:
2466
2289
session.send(client.secret)
2467
2290
except gnutls.Error as error:
2468
log.warning("gnutls send failed", exc_info=error)
2291
logger.warning("gnutls send failed",
2292
exc_info = error)
2469
2293
return
2470
2471
log.info("Sending secret to %s", client.name)
2294
2295
logger.info("Sending secret to %s", client.name)
2472
2296
# bump the timeout using extended_timeout
2473
2297
client.bump_timeout(client.extended_timeout)
2474
2298
if self.server.use_dbus:
2475
2299
# Emit D-Bus signal
2476
2300
client.GotSecret()
2477
2301
2478
2302
finally:
2479
2303
if approval_required:
2480
2304
client.approvals_pending -= 1
2481
2305
try:
2482
2306
session.bye()
2483
2307
except gnutls.Error as error:
2484
log.warning("GnuTLS bye failed", exc_info=error)
2485
2308
logger.warning("GnuTLS bye failed",
2309
exc_info=error)
2310
2486
2311
@staticmethod
2487
2312
def peer_certificate(session):
2488
"Return the peer's certificate as a bytestring"
2489
try:
2490
cert_type = gnutls.certificate_type_get2(
2491
session, gnutls.CTYPE_PEERS)
2492
except AttributeError:
2493
cert_type = gnutls.certificate_type_get(session)
2494
if gnutls.has_rawpk:
2495
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2496
else:
2497
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2498
# If not a valid certificate type...
2499
if cert_type not in valid_cert_types:
2500
log.info("Cert type %r not in %r", cert_type,
2501
valid_cert_types)
2313
"Return the peer's OpenPGP certificate as a bytestring"
2314
# If not an OpenPGP certificate...
2315
if (gnutls.certificate_type_get(session._c_object)
2316
!= gnutls.CRT_OPENPGP):
2502
2317
# ...return invalid data
2503
2318
return b""
2504
2319
list_size = ctypes.c_uint(1)
2505
2320
cert_list = (gnutls.certificate_get_peers
2506
(session, ctypes.byref(list_size)))
2321
(session._c_object, ctypes.byref(list_size)))
2507
2322
if not bool(cert_list) and list_size.value != 0:
2508
2323
raise gnutls.Error("error getting peer certificate")
2509
2324
if list_size.value == 0:
2510
2325
return None
2511
2326
cert = cert_list[0]
2512
2327
return ctypes.string_at(cert.data, cert.size)
2513
2514
@staticmethod
2515
def key_id(certificate):
2516
"Convert a certificate bytestring to a hexdigit key ID"
2517
# New GnuTLS "datum" with the public key
2518
datum = gnutls.datum_t(
2519
ctypes.cast(ctypes.c_char_p(certificate),
2520
ctypes.POINTER(ctypes.c_ubyte)),
2521
ctypes.c_uint(len(certificate)))
2522
# XXX all these need to be created in the gnutls "module"
2523
# New empty GnuTLS certificate
2524
pubkey = gnutls.pubkey_t()
2525
gnutls.pubkey_init(ctypes.byref(pubkey))
2526
# Import the raw public key into the certificate
2527
gnutls.pubkey_import(pubkey,
2528
ctypes.byref(datum),
2529
gnutls.X509_FMT_DER)
2530
# New buffer for the key ID
2531
buf = ctypes.create_string_buffer(32)
2532
buf_len = ctypes.c_size_t(len(buf))
2533
# Get the key ID from the raw public key into the buffer
2534
gnutls.pubkey_get_key_id(
2535
pubkey,
2536
gnutls.KEYID_USE_SHA256,
2537
ctypes.cast(ctypes.byref(buf),
2538
ctypes.POINTER(ctypes.c_ubyte)),
2539
ctypes.byref(buf_len))
2540
# Deinit the certificate
2541
gnutls.pubkey_deinit(pubkey)
2542
2543
# Convert the buffer to a Python bytestring
2544
key_id = ctypes.string_at(buf, buf_len.value)
2545
# Convert the bytestring to hexadecimal notation
2546
hex_key_id = binascii.hexlify(key_id).upper()
2547
return hex_key_id
2548
2328
2549
2329
@staticmethod
2550
2330
def fingerprint(openpgp):
2551
2331
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2566
2346
ctypes.byref(crtverify))
2567
2347
if crtverify.value != 0:
2568
2348
gnutls.openpgp_crt_deinit(crt)
2569
raise gnutls.CertificateSecurityError(code
2570
=crtverify.value)
2349
raise gnutls.CertificateSecurityError("Verify failed")
2571
2350
# New buffer for the fingerprint
2572
2351
buf = ctypes.create_string_buffer(20)
2573
2352
buf_len = ctypes.c_size_t()
2583
2362
return hex_fpr
2584
2363
2585
2364
2586
class MultiprocessingMixIn:
2365
class MultiprocessingMixIn(object):
2587
2366
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2588
2367
2589
2368
def sub_process_main(self, request, address):
2590
2369
try:
2591
2370
self.finish_request(request, address)
2592
2371
except Exception:
2593
2372
self.handle_error(request, address)
2594
2373
self.close_request(request)
2595
2374
2596
2375
def process_request(self, request, address):
2597
2376
"""Start a new process to process the request."""
2598
proc = multiprocessing.Process(target=self.sub_process_main,
2599
args=(request, address))
2377
proc = multiprocessing.Process(target = self.sub_process_main,
2378
args = (request, address))
2600
2379
proc.start()
2601
2380
return proc
2602
2381
2603
2382
2604
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2383
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2605
2384
""" adds a pipe to the MixIn """
2606
2385
2607
2386
def process_request(self, request, client_address):
2608
2387
"""Overrides and wraps the original process_request().
2609
2388
2610
2389
This function creates a new pipe in self.pipe
2611
2390
"""
2612
2391
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2613
2392
2614
2393
proc = MultiprocessingMixIn.process_request(self, request,
2615
2394
client_address)
2616
2395
self.child_pipe.close()
2617
2396
self.add_pipe(parent_pipe, proc)
2618
2397
2619
2398
def add_pipe(self, parent_pipe, proc):
2620
2399
"""Dummy function; override as necessary"""
2621
2400
raise NotImplementedError()
2622
2401
2623
2402
2624
2403
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2625
socketserver.TCPServer):
2626
"""IPv6-capable TCP server. Accepts None as address and/or port
2627
2404
socketserver.TCPServer, object):
2405
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2406
2628
2407
Attributes:
2629
2408
enabled: Boolean; whether this server is activated yet
2630
2409
interface: None or a network interface name (string)
2631
2410
use_ipv6: Boolean; to use IPv6 or not
2632
2411
"""
2633
2412
2634
2413
def __init__(self, server_address, RequestHandlerClass,
2635
2414
interface=None,
2636
2415
use_ipv6=True,
2646
2425
self.socketfd = socketfd
2647
2426
# Save the original socket.socket() function
2648
2427
self.socket_socket = socket.socket
2649
2650
2428
# To implement --socket, we monkey patch socket.socket.
2651
#
2429
#
2652
2430
# (When socketserver.TCPServer is a new-style class, we
2653
2431
# could make self.socket into a property instead of monkey
2654
2432
# patching socket.socket.)
2655
#
2433
#
2656
2434
# Create a one-time-only replacement for socket.socket()
2657
2435
@functools.wraps(socket.socket)
2658
2436
def socket_wrapper(*args, **kwargs):
2670
2448
# socket_wrapper(), if socketfd was set.
2671
2449
socketserver.TCPServer.__init__(self, server_address,
2672
2450
RequestHandlerClass)
2673
2451
2674
2452
def server_bind(self):
2675
2453
"""This overrides the normal server_bind() function
2676
2454
to bind to an interface if one was specified, and also NOT to
2677
2455
bind to an address or port if they were not specified."""
2678
global SO_BINDTODEVICE
2679
2456
if self.interface is not None:
2680
2457
if SO_BINDTODEVICE is None:
2681
2458
# Fall back to a hard-coded value which seems to be
2682
2459
# common enough.
2683
log.warning("SO_BINDTODEVICE not found, trying 25")
2460
logger.warning("SO_BINDTODEVICE not found, trying 25")
2684
2461
SO_BINDTODEVICE = 25
2685
2462
try:
2686
2463
self.socket.setsockopt(
2688
2465
(self.interface + "\0").encode("utf-8"))
2689
2466
except socket.error as error:
2690
2467
if error.errno == errno.EPERM:
2691
log.error("No permission to bind to interface %s",
2692
self.interface)
2468
logger.error("No permission to bind to"
2469
" interface %s", self.interface)
2693
2470
elif error.errno == errno.ENOPROTOOPT:
2694
log.error("SO_BINDTODEVICE not available; cannot"
2695
" bind to interface %s", self.interface)
2471
logger.error("SO_BINDTODEVICE not available;"
2472
" cannot bind to interface %s",
2473
self.interface)
2696
2474
elif error.errno == errno.ENODEV:
2697
log.error("Interface %s does not exist, cannot"
2698
" bind", self.interface)
2475
logger.error("Interface %s does not exist,"
2476
" cannot bind", self.interface)
2699
2477
else:
2700
2478
raise
2701
2479
# Only bind(2) the socket if we really need to.
2702
2480
if self.server_address[0] or self.server_address[1]:
2703
if self.server_address[1]:
2704
self.allow_reuse_address = True
2705
2481
if not self.server_address[0]:
2706
2482
if self.address_family == socket.AF_INET6:
2707
any_address = "::" # in6addr_any
2483
any_address = "::" # in6addr_any
2708
2484
else:
2709
any_address = "0.0.0.0" # INADDR_ANY
2485
any_address = "0.0.0.0" # INADDR_ANY
2710
2486
self.server_address = (any_address,
2711
2487
self.server_address[1])
2712
2488
elif not self.server_address[1]:
2722
2498
2723
2499
class MandosServer(IPv6_TCPServer):
2724
2500
"""Mandos server.
2725
2501
2726
2502
Attributes:
2727
2503
clients: set of Client objects
2728
2504
gnutls_priority GnuTLS priority string
2729
2505
use_dbus: Boolean; to emit D-Bus signals or not
2730
2506
2731
2507
Assumes a GLib.MainLoop event loop.
2732
2508
"""
2733
2509
2734
2510
def __init__(self, server_address, RequestHandlerClass,
2735
2511
interface=None,
2736
2512
use_ipv6=True,
2746
2522
self.gnutls_priority = gnutls_priority
2747
2523
IPv6_TCPServer.__init__(self, server_address,
2748
2524
RequestHandlerClass,
2749
interface=interface,
2750
use_ipv6=use_ipv6,
2751
socketfd=socketfd)
2752
2525
interface = interface,
2526
use_ipv6 = use_ipv6,
2527
socketfd = socketfd)
2528
2753
2529
def server_activate(self):
2754
2530
if self.enabled:
2755
2531
return socketserver.TCPServer.server_activate(self)
2756
2532
2757
2533
def enable(self):
2758
2534
self.enabled = True
2759
2535
2760
2536
def add_pipe(self, parent_pipe, proc):
2761
2537
# Call "handle_ipc" for both data and EOF events
2762
2538
GLib.io_add_watch(
2763
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2764
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2539
parent_pipe.fileno(),
2540
GLib.IO_IN | GLib.IO_HUP,
2765
2541
functools.partial(self.handle_ipc,
2766
parent_pipe=parent_pipe,
2767
proc=proc))
2768
2542
parent_pipe = parent_pipe,
2543
proc = proc))
2544
2769
2545
def handle_ipc(self, source, condition,
2770
2546
parent_pipe=None,
2771
proc=None,
2547
proc = None,
2772
2548
client_object=None):
2773
2549
# error, or the other end of multiprocessing.Pipe has closed
2774
2550
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2775
2551
# Wait for other process to exit
2776
2552
proc.join()
2777
2553
return False
2778
2554
2779
2555
# Read a request from the child
2780
2556
request = parent_pipe.recv()
2781
2557
command = request[0]
2782
2783
if command == "init":
2784
key_id = request[1].decode("ascii")
2785
fpr = request[2].decode("ascii")
2786
address = request[3]
2787
2558
2559
if command == 'init':
2560
fpr = request[1]
2561
address = request[2]
2562
2788
2563
for c in self.clients.values():
2789
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2790
"27AE41E4649B934CA495991B7852B855"):
2791
continue
2792
if key_id and c.key_id == key_id:
2793
client = c
2794
break
2795
if fpr and c.fingerprint == fpr:
2564
if c.fingerprint == fpr:
2796
2565
client = c
2797
2566
break
2798
2567
else:
2799
log.info("Client not found for key ID: %s, address:"
2800
" %s", key_id or fpr, address)
2568
logger.info("Client not found for fingerprint: %s, ad"
2569
"dress: %s", fpr, address)
2801
2570
if self.use_dbus:
2802
2571
# Emit D-Bus signal
2803
mandos_dbus_service.ClientNotFound(key_id or fpr,
2572
mandos_dbus_service.ClientNotFound(fpr,
2804
2573
address[0])
2805
2574
parent_pipe.send(False)
2806
2575
return False
2807
2576
2808
2577
GLib.io_add_watch(
2809
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2810
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2578
parent_pipe.fileno(),
2579
GLib.IO_IN | GLib.IO_HUP,
2811
2580
functools.partial(self.handle_ipc,
2812
parent_pipe=parent_pipe,
2813
proc=proc,
2814
client_object=client))
2581
parent_pipe = parent_pipe,
2582
proc = proc,
2583
client_object = client))
2815
2584
parent_pipe.send(True)
2816
2585
# remove the old hook in favor of the new above hook on
2817
2586
# same fileno
2818
2587
return False
2819
if command == "funcall":
2588
if command == 'funcall':
2820
2589
funcname = request[1]
2821
2590
args = request[2]
2822
2591
kwargs = request[3]
2823
2824
parent_pipe.send(("data", getattr(client_object,
2592
2593
parent_pipe.send(('data', getattr(client_object,
2825
2594
funcname)(*args,
2826
2595
**kwargs)))
2827
2828
if command == "getattr":
2596
2597
if command == 'getattr':
2829
2598
attrname = request[1]
2830
2599
if isinstance(client_object.__getattribute__(attrname),
2831
collections.abc.Callable):
2832
parent_pipe.send(("function", ))
2600
collections.Callable):
2601
parent_pipe.send(('function', ))
2833
2602
else:
2834
2603
parent_pipe.send((
2835
"data", client_object.__getattribute__(attrname)))
2836
2837
if command == "setattr":
2604
'data', client_object.__getattribute__(attrname)))
2605
2606
if command == 'setattr':
2838
2607
attrname = request[1]
2839
2608
value = request[2]
2840
2609
setattr(client_object, attrname, value)
2841
2610
2842
2611
return True
2843
2612
2844
2613
2845
2614
def rfc3339_duration_to_delta(duration):
2846
2615
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2847
2848
>>> timedelta = datetime.timedelta
2849
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2850
True
2851
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2852
True
2853
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2854
True
2855
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2856
True
2857
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2858
True
2859
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2860
True
2861
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2862
True
2863
>>> del timedelta
2616
2617
>>> rfc3339_duration_to_delta("P7D")
2618
datetime.timedelta(7)
2619
>>> rfc3339_duration_to_delta("PT60S")
2620
datetime.timedelta(0, 60)
2621
>>> rfc3339_duration_to_delta("PT60M")
2622
datetime.timedelta(0, 3600)
2623
>>> rfc3339_duration_to_delta("PT24H")
2624
datetime.timedelta(1)
2625
>>> rfc3339_duration_to_delta("P1W")
2626
datetime.timedelta(7)
2627
>>> rfc3339_duration_to_delta("PT5M30S")
2628
datetime.timedelta(0, 330)
2629
>>> rfc3339_duration_to_delta("P1DT3M20S")
2630
datetime.timedelta(1, 200)
2864
2631
"""
2865
2632
2866
2633
# Parsing an RFC 3339 duration with regular expressions is not
2867
2634
# possible - there would have to be multiple places for the same
2868
2635
# values, like seconds. The current code, while more esoteric, is
2869
2636
# cleaner without depending on a parsing library. If Python had a
2870
2637
# built-in library for parsing we would use it, but we'd like to
2871
2638
# avoid excessive use of external libraries.
2872
2639
2873
2640
# New type for defining tokens, syntax, and semantics all-in-one
2874
2641
Token = collections.namedtuple("Token", (
2875
2642
"regexp", # To match token; if "value" is not None, must have
2908
2675
frozenset((token_year, token_month,
2909
2676
token_day, token_time,
2910
2677
token_week)))
2911
# Define starting values:
2912
# Value so far
2913
value = datetime.timedelta()
2678
# Define starting values
2679
value = datetime.timedelta() # Value so far
2914
2680
found_token = None
2915
# Following valid tokens
2916
followers = frozenset((token_duration, ))
2917
# String left to parse
2918
s = duration
2681
followers = frozenset((token_duration, )) # Following valid tokens
2682
s = duration # String left to parse
2919
2683
# Loop until end token is found
2920
2684
while found_token is not token_end:
2921
2685
# Search for any currently valid tokens
2945
2709
2946
2710
def string_to_delta(interval):
2947
2711
"""Parse a string and return a datetime.timedelta
2948
2949
>>> string_to_delta("7d") == datetime.timedelta(7)
2950
True
2951
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2952
True
2953
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2954
True
2955
>>> string_to_delta("24h") == datetime.timedelta(1)
2956
True
2957
>>> string_to_delta("1w") == datetime.timedelta(7)
2958
True
2959
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2960
True
2712
2713
>>> string_to_delta('7d')
2714
datetime.timedelta(7)
2715
>>> string_to_delta('60s')
2716
datetime.timedelta(0, 60)
2717
>>> string_to_delta('60m')
2718
datetime.timedelta(0, 3600)
2719
>>> string_to_delta('24h')
2720
datetime.timedelta(1)
2721
>>> string_to_delta('1w')
2722
datetime.timedelta(7)
2723
>>> string_to_delta('5m 30s')
2724
datetime.timedelta(0, 330)
2961
2725
"""
2962
2726
2963
2727
try:
2964
2728
return rfc3339_duration_to_delta(interval)
2965
2729
except ValueError:
2966
2730
pass
2967
2731
2968
2732
timevalue = datetime.timedelta(0)
2969
2733
for s in interval.split():
2970
2734
try:
2988
2752
return timevalue
2989
2753
2990
2754
2991
def daemon(nochdir=False, noclose=False):
2755
def daemon(nochdir = False, noclose = False):
2992
2756
"""See daemon(3). Standard BSD Unix function.
2993
2757
2994
2758
This should really exist as os.daemon, but it doesn't (yet)."""
2995
2759
if os.fork():
2996
2760
sys.exit()
3014
2778
3015
2779
3016
2780
def main():
3017
2781
3018
2782
##################################################################
3019
2783
# Parsing of options, both command line and config file
3020
2784
3021
2785
parser = argparse.ArgumentParser()
3022
2786
parser.add_argument("-v", "--version", action="version",
3023
version="%(prog)s {}".format(version),
2787
version = "%(prog)s {}".format(version),
3024
2788
help="show version number and exit")
3025
2789
parser.add_argument("-i", "--interface", metavar="IF",
3026
2790
help="Bind to interface IF")
3062
2826
parser.add_argument("--no-zeroconf", action="store_false",
3063
2827
dest="zeroconf", help="Do not use Zeroconf",
3064
2828
default=None)
3065
2829
3066
2830
options = parser.parse_args()
3067
2831
2832
if options.check:
2833
import doctest
2834
fail_count, test_count = doctest.testmod()
2835
sys.exit(os.EX_OK if fail_count == 0 else 1)
2836
3068
2837
# Default values for config file for server-global settings
3069
if gnutls.has_rawpk:
3070
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3072
else:
3073
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3074
":+SIGN-DSA-SHA256")
3075
server_defaults = {"interface": "",
3076
"address": "",
3077
"port": "",
3078
"debug": "False",
3079
"priority": priority,
3080
"servicename": "Mandos",
3081
"use_dbus": "True",
3082
"use_ipv6": "True",
3083
"debuglevel": "",
3084
"restore": "True",
3085
"socket": "",
3086
"statedir": "/var/lib/mandos",
3087
"foreground": "False",
3088
"zeroconf": "True",
3089
}
3090
del priority
3091
2838
server_defaults = { "interface": "",
2839
"address": "",
2840
"port": "",
2841
"debug": "False",
2842
"priority":
2843
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2844
":+SIGN-DSA-SHA256",
2845
"servicename": "Mandos",
2846
"use_dbus": "True",
2847
"use_ipv6": "True",
2848
"debuglevel": "",
2849
"restore": "True",
2850
"socket": "",
2851
"statedir": "/var/lib/mandos",
2852
"foreground": "False",
2853
"zeroconf": "True",
2854
}
2855
3092
2856
# Parse config file for server-global settings
3093
server_config = configparser.ConfigParser(server_defaults)
2857
server_config = configparser.SafeConfigParser(server_defaults)
3094
2858
del server_defaults
3095
2859
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3096
# Convert the ConfigParser object to a dict
2860
# Convert the SafeConfigParser object to a dict
3097
2861
server_settings = server_config.defaults()
3098
2862
# Use the appropriate methods on the non-string config options
3099
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3100
"foreground", "zeroconf"):
2863
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3101
2864
server_settings[option] = server_config.getboolean("DEFAULT",
3102
2865
option)
3103
2866
if server_settings["port"]:
3109
2872
# Later, stdin will, and stdout and stderr might, be dup'ed
3110
2873
# over with an opened os.devnull. But we don't want this to
3111
2874
# happen with a supplied network socket.
3112
while 0 <= server_settings["socket"] <= 2:
2875
if 0 <= server_settings["socket"] <= 2:
3113
2876
server_settings["socket"] = os.dup(server_settings
3114
2877
["socket"])
3115
os.set_inheritable(server_settings["socket"], False)
3116
2878
del server_config
3117
2879
3118
2880
# Override the settings from the config file with command line
3119
2881
# options, if set.
3120
2882
for option in ("interface", "address", "port", "debug",
3138
2900
if server_settings["debug"]:
3139
2901
server_settings["foreground"] = True
3140
2902
# Now we have our good server settings in "server_settings"
3141
2903
3142
2904
##################################################################
3143
2905
3144
2906
if (not server_settings["zeroconf"]
3145
2907
and not (server_settings["port"]
3146
2908
or server_settings["socket"] != "")):
3147
2909
parser.error("Needs port or socket to work without Zeroconf")
3148
2910
3149
2911
# For convenience
3150
2912
debug = server_settings["debug"]
3151
2913
debuglevel = server_settings["debuglevel"]
3155
2917
stored_state_file)
3156
2918
foreground = server_settings["foreground"]
3157
2919
zeroconf = server_settings["zeroconf"]
3158
2920
3159
2921
if debug:
3160
2922
initlogger(debug, logging.DEBUG)
3161
2923
else:
3164
2926
else:
3165
2927
level = getattr(logging, debuglevel.upper())
3166
2928
initlogger(debug, level)
3167
2929
3168
2930
if server_settings["servicename"] != "Mandos":
3169
2931
syslogger.setFormatter(
3170
logging.Formatter("Mandos ({}) [%(process)d]:"
3171
" %(levelname)s: %(message)s".format(
2932
logging.Formatter('Mandos ({}) [%(process)d]:'
2933
' %(levelname)s: %(message)s'.format(
3172
2934
server_settings["servicename"])))
3173
2935
3174
2936
# Parse config file with clients
3175
client_config = configparser.ConfigParser(Client.client_defaults)
2937
client_config = configparser.SafeConfigParser(Client
2938
.client_defaults)
3176
2939
client_config.read(os.path.join(server_settings["configdir"],
3177
2940
"clients.conf"))
3178
2941
3179
2942
global mandos_dbus_service
3180
2943
mandos_dbus_service = None
3181
2944
3182
2945
socketfd = None
3183
2946
if server_settings["socket"] != "":
3184
2947
socketfd = server_settings["socket"]
3198
2961
try:
3199
2962
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3200
2963
except IOError as e:
3201
log.error("Could not open file %r", pidfilename,
3202
exc_info=e)
3203
2964
logger.error("Could not open file %r", pidfilename,
2965
exc_info=e)
2966
3204
2967
for name, group in (("_mandos", "_mandos"),
3205
2968
("mandos", "mandos"),
3206
2969
("nobody", "nogroup")):
3216
2979
try:
3217
2980
os.setgid(gid)
3218
2981
os.setuid(uid)
3219
log.debug("Did setuid/setgid to %s:%s", uid, gid)
2982
if debug:
2983
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2984
gid))
3220
2985
except OSError as error:
3221
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3222
os.strerror(error.errno))
2986
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2987
.format(uid, gid, os.strerror(error.errno)))
3223
2988
if error.errno != errno.EPERM:
3224
2989
raise
3225
2990
3226
2991
if debug:
3227
2992
# Enable all possible GnuTLS debugging
3228
2993
3229
2994
# "Use a log level over 10 to enable all debugging options."
3230
2995
# - GnuTLS manual
3231
2996
gnutls.global_set_log_level(11)
3232
2997
3233
2998
@gnutls.log_func
3234
2999
def debug_gnutls(level, string):
3235
log.debug("GnuTLS: %s",
3236
string[:-1].decode("utf-8", errors="replace"))
3237
3000
logger.debug("GnuTLS: %s", string[:-1])
3001
3238
3002
gnutls.global_set_log_function(debug_gnutls)
3239
3003
3240
3004
# Redirect stdin so all checkers get /dev/null
3241
3005
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3242
3006
os.dup2(null, sys.stdin.fileno())
3243
3007
if null > 2:
3244
3008
os.close(null)
3245
3009
3246
3010
# Need to fork before connecting to D-Bus
3247
3011
if not foreground:
3248
3012
# Close all input and output, do double fork, etc.
3249
3013
daemon()
3250
3251
if gi.version_info < (3, 10, 2):
3252
# multiprocessing will use threads, so before we use GLib we
3253
# need to inform GLib that threads will be used.
3254
GLib.threads_init()
3255
3014
3015
# multiprocessing will use threads, so before we use GLib we need
3016
# to inform GLib that threads will be used.
3017
GLib.threads_init()
3018
3256
3019
global main_loop
3257
3020
# From the Avahi example code
3258
3021
DBusGMainLoop(set_as_default=True)
3259
3022
main_loop = GLib.MainLoop()
3260
if use_dbus or zeroconf:
3261
bus = dbus.SystemBus()
3023
bus = dbus.SystemBus()
3262
3024
# End of Avahi example code
3263
3025
if use_dbus:
3264
3026
try:
3269
3031
"se.bsnet.fukt.Mandos", bus,
3270
3032
do_not_queue=True)
3271
3033
except dbus.exceptions.DBusException as e:
3272
log.error("Disabling D-Bus:", exc_info=e)
3034
logger.error("Disabling D-Bus:", exc_info=e)
3273
3035
use_dbus = False
3274
3036
server_settings["use_dbus"] = False
3275
3037
tcp_server.use_dbus = False
3276
3038
if zeroconf:
3277
3039
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3278
3040
service = AvahiServiceToSyslog(
3279
name=server_settings["servicename"],
3280
servicetype="_mandos._tcp",
3281
protocol=protocol,
3282
bus=bus)
3041
name = server_settings["servicename"],
3042
servicetype = "_mandos._tcp",
3043
protocol = protocol,
3044
bus = bus)
3283
3045
if server_settings["interface"]:
3284
3046
service.interface = if_nametoindex(
3285
3047
server_settings["interface"].encode("utf-8"))
3286
3048
3287
3049
global multiprocessing_manager
3288
3050
multiprocessing_manager = multiprocessing.Manager()
3289
3051
3290
3052
client_class = Client
3291
3053
if use_dbus:
3292
client_class = functools.partial(ClientDBus, bus=bus)
3293
3054
client_class = functools.partial(ClientDBus, bus = bus)
3055
3294
3056
client_settings = Client.config_parser(client_config)
3295
3057
old_client_settings = {}
3296
3058
clients_data = {}
3297
3059
3298
3060
# This is used to redirect stdout and stderr for checker processes
3299
3061
global wnull
3300
wnull = open(os.devnull, "w") # A writable /dev/null
3062
wnull = open(os.devnull, "w") # A writable /dev/null
3301
3063
# Only used if server is running in foreground but not in debug
3302
3064
# mode
3303
3065
if debug or not foreground:
3304
3066
wnull.close()
3305
3067
3306
3068
# Get client data and settings from last running state.
3307
3069
if server_settings["restore"]:
3308
3070
try:
3309
3071
with open(stored_state_path, "rb") as stored_state:
3310
if sys.version_info.major == 2:
3072
if sys.version_info.major == 2:
3311
3073
clients_data, old_client_settings = pickle.load(
3312
3074
stored_state)
3313
3075
else:
3314
3076
bytes_clients_data, bytes_old_client_settings = (
3315
pickle.load(stored_state, encoding="bytes"))
3316
# Fix bytes to strings
3317
# clients_data
3077
pickle.load(stored_state, encoding = "bytes"))
3078
### Fix bytes to strings
3079
## clients_data
3318
3080
# .keys()
3319
clients_data = {(key.decode("utf-8")
3320
if isinstance(key, bytes)
3321
else key): value
3322
for key, value in
3323
bytes_clients_data.items()}
3081
clients_data = { (key.decode("utf-8")
3082
if isinstance(key, bytes)
3083
else key): value
3084
for key, value in
3085
bytes_clients_data.items() }
3324
3086
del bytes_clients_data
3325
3087
for key in clients_data:
3326
value = {(k.decode("utf-8")
3327
if isinstance(k, bytes) else k): v
3328
for k, v in
3329
clients_data[key].items()}
3088
value = { (k.decode("utf-8")
3089
if isinstance(k, bytes) else k): v
3090
for k, v in
3091
clients_data[key].items() }
3330
3092
clients_data[key] = value
3331
3093
# .client_structure
3332
3094
value["client_structure"] = [
3333
3095
(s.decode("utf-8")
3334
3096
if isinstance(s, bytes)
3335
3097
else s) for s in
3336
value["client_structure"]]
3337
# .name, .host, and .checker_command
3338
for k in ("name", "host", "checker_command"):
3098
value["client_structure"] ]
3099
# .name & .host
3100
for k in ("name", "host"):
3339
3101
if isinstance(value[k], bytes):
3340
3102
value[k] = value[k].decode("utf-8")
3341
if "key_id" not in value:
3342
value["key_id"] = ""
3343
elif "fingerprint" not in value:
3344
value["fingerprint"] = ""
3345
# old_client_settings
3103
## old_client_settings
3346
3104
# .keys()
3347
3105
old_client_settings = {
3348
3106
(key.decode("utf-8")
3349
3107
if isinstance(key, bytes)
3350
3108
else key): value
3351
3109
for key, value in
3352
bytes_old_client_settings.items()}
3110
bytes_old_client_settings.items() }
3353
3111
del bytes_old_client_settings
3354
# .host and .checker_command
3112
# .host
3355
3113
for value in old_client_settings.values():
3356
for attribute in ("host", "checker_command"):
3357
if isinstance(value[attribute], bytes):
3358
value[attribute] = (value[attribute]
3359
.decode("utf-8"))
3114
if isinstance(value["host"], bytes):
3115
value["host"] = (value["host"]
3116
.decode("utf-8"))
3360
3117
os.remove(stored_state_path)
3361
3118
except IOError as e:
3362
3119
if e.errno == errno.ENOENT:
3363
log.warning("Could not load persistent state:"
3364
" %s", os.strerror(e.errno))
3120
logger.warning("Could not load persistent state:"
3121
" {}".format(os.strerror(e.errno)))
3365
3122
else:
3366
log.critical("Could not load persistent state:",
3367
exc_info=e)
3123
logger.critical("Could not load persistent state:",
3124
exc_info=e)
3368
3125
raise
3369
3126
except EOFError as e:
3370
log.warning("Could not load persistent state: EOFError:",
3371
exc_info=e)
3372
3127
logger.warning("Could not load persistent state: "
3128
"EOFError:",
3129
exc_info=e)
3130
3373
3131
with PGPEngine() as pgp:
3374
3132
for client_name, client in clients_data.items():
3375
3133
# Skip removed clients
3376
3134
if client_name not in client_settings:
3377
3135
continue
3378
3136
3379
3137
# Decide which value to use after restoring saved state.
3380
3138
# We have three different values: Old config file,
3381
3139
# new config file, and saved state.
3392
3150
client[name] = value
3393
3151
except KeyError:
3394
3152
pass
3395
3153
3396
3154
# Clients who has passed its expire date can still be
3397
3155
# enabled if its last checker was successful. A Client
3398
3156
# whose checker succeeded before we stored its state is
3401
3159
if client["enabled"]:
3402
3160
if datetime.datetime.utcnow() >= client["expires"]:
3403
3161
if not client["last_checked_ok"]:
3404
log.warning("disabling client %s - Client"
3405
" never performed a successful"
3406
" checker", client_name)
3162
logger.warning(
3163
"disabling client {} - Client never "
3164
"performed a successful checker".format(
3165
client_name))
3407
3166
client["enabled"] = False
3408
3167
elif client["last_checker_status"] != 0:
3409
log.warning("disabling client %s - Client"
3410
" last checker failed with error"
3411
" code %s", client_name,
3412
client["last_checker_status"])
3168
logger.warning(
3169
"disabling client {} - Client last"
3170
" checker failed with error code"
3171
" {}".format(
3172
client_name,
3173
client["last_checker_status"]))
3413
3174
client["enabled"] = False
3414
3175
else:
3415
3176
client["expires"] = (
3416
3177
datetime.datetime.utcnow()
3417
3178
+ client["timeout"])
3418
log.debug("Last checker succeeded, keeping %s"
3419
" enabled", client_name)
3179
logger.debug("Last checker succeeded,"
3180
" keeping {} enabled".format(
3181
client_name))
3420
3182
try:
3421
3183
client["secret"] = pgp.decrypt(
3422
3184
client["encrypted_secret"],
3423
3185
client_settings[client_name]["secret"])
3424
3186
except PGPError:
3425
3187
# If decryption fails, we use secret from new settings
3426
log.debug("Failed to decrypt %s old secret",
3427
client_name)
3188
logger.debug("Failed to decrypt {} old secret".format(
3189
client_name))
3428
3190
client["secret"] = (client_settings[client_name]
3429
3191
["secret"])
3430
3192
3431
3193
# Add/remove clients based on new changes made to config
3432
3194
for client_name in (set(old_client_settings)
3433
3195
- set(client_settings)):
3435
3197
for client_name in (set(client_settings)
3436
3198
- set(old_client_settings)):
3437
3199
clients_data[client_name] = client_settings[client_name]
3438
3200
3439
3201
# Create all client objects
3440
3202
for client_name, client in clients_data.items():
3441
3203
tcp_server.clients[client_name] = client_class(
3442
name=client_name,
3443
settings=client,
3444
server_settings=server_settings)
3445
3204
name = client_name,
3205
settings = client,
3206
server_settings = server_settings)
3207
3446
3208
if not tcp_server.clients:
3447
log.warning("No clients defined")
3448
3209
logger.warning("No clients defined")
3210
3449
3211
if not foreground:
3450
3212
if pidfile is not None:
3451
3213
pid = os.getpid()
3453
3215
with pidfile:
3454
3216
print(pid, file=pidfile)
3455
3217
except IOError:
3456
log.error("Could not write to file %r with PID %d",
3457
pidfilename, pid)
3218
logger.error("Could not write to file %r with PID %d",
3219
pidfilename, pid)
3458
3220
del pidfile
3459
3221
del pidfilename
3460
3222
3461
3223
for termsig in (signal.SIGHUP, signal.SIGTERM):
3462
3224
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3463
3225
lambda: main_loop.quit() and False)
3464
3226
3465
3227
if use_dbus:
3466
3228
3467
3229
@alternate_dbus_interfaces(
3468
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3230
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3469
3231
class MandosDBusService(DBusObjectWithObjectManager):
3470
3232
"""A D-Bus proxy object"""
3471
3233
3472
3234
def __init__(self):
3473
3235
dbus.service.Object.__init__(self, bus, "/")
3474
3236
3475
3237
_interface = "se.recompile.Mandos"
3476
3238
3477
3239
@dbus.service.signal(_interface, signature="o")
3478
3240
def ClientAdded(self, objpath):
3479
3241
"D-Bus signal"
3480
3242
pass
3481
3243
3482
3244
@dbus.service.signal(_interface, signature="ss")
3483
def ClientNotFound(self, key_id, address):
3245
def ClientNotFound(self, fingerprint, address):
3484
3246
"D-Bus signal"
3485
3247
pass
3486
3248
3487
3249
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3488
3250
"true"})
3489
3251
@dbus.service.signal(_interface, signature="os")
3490
3252
def ClientRemoved(self, objpath, name):
3491
3253
"D-Bus signal"
3492
3254
pass
3493
3255
3494
3256
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3495
3257
"true"})
3496
3258
@dbus.service.method(_interface, out_signature="ao")
3498
3260
"D-Bus method"
3499
3261
return dbus.Array(c.dbus_object_path for c in
3500
3262
tcp_server.clients.values())
3501
3263
3502
3264
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3503
3265
"true"})
3504
3266
@dbus.service.method(_interface,
3506
3268
def GetAllClientsWithProperties(self):
3507
3269
"D-Bus method"
3508
3270
return dbus.Dictionary(
3509
{c.dbus_object_path: c.GetAll(
3271
{ c.dbus_object_path: c.GetAll(
3510
3272
"se.recompile.Mandos.Client")
3511
for c in tcp_server.clients.values()},
3273
for c in tcp_server.clients.values() },
3512
3274
signature="oa{sv}")
3513
3275
3514
3276
@dbus.service.method(_interface, in_signature="o")
3515
3277
def RemoveClient(self, object_path):
3516
3278
"D-Bus method"
3524
3286
self.client_removed_signal(c)
3525
3287
return
3526
3288
raise KeyError(object_path)
3527
3289
3528
3290
del _interface
3529
3291
3530
3292
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3531
out_signature="a{oa{sa{sv}}}")
3293
out_signature = "a{oa{sa{sv}}}")
3532
3294
def GetManagedObjects(self):
3533
3295
"""D-Bus method"""
3534
3296
return dbus.Dictionary(
3535
{client.dbus_object_path:
3536
dbus.Dictionary(
3537
{interface: client.GetAll(interface)
3538
for interface in
3539
client._get_all_interface_names()})
3540
for client in tcp_server.clients.values()})
3541
3297
{ client.dbus_object_path:
3298
dbus.Dictionary(
3299
{ interface: client.GetAll(interface)
3300
for interface in
3301
client._get_all_interface_names()})
3302
for client in tcp_server.clients.values()})
3303
3542
3304
def client_added_signal(self, client):
3543
3305
"""Send the new standard signal and the old signal"""
3544
3306
if use_dbus:
3546
3308
self.InterfacesAdded(
3547
3309
client.dbus_object_path,
3548
3310
dbus.Dictionary(
3549
{interface: client.GetAll(interface)
3550
for interface in
3551
client._get_all_interface_names()}))
3311
{ interface: client.GetAll(interface)
3312
for interface in
3313
client._get_all_interface_names()}))
3552
3314
# Old signal
3553
3315
self.ClientAdded(client.dbus_object_path)
3554
3316
3555
3317
def client_removed_signal(self, client):
3556
3318
"""Send the new standard signal and the old signal"""
3557
3319
if use_dbus:
3562
3324
# Old signal
3563
3325
self.ClientRemoved(client.dbus_object_path,
3564
3326
client.name)
3565
3327
3566
3328
mandos_dbus_service = MandosDBusService()
3567
3329
3568
3330
# Save modules to variables to exempt the modules from being
3569
3331
# unloaded before the function registered with atexit() is run.
3570
3332
mp = multiprocessing
3571
3333
wn = wnull
3572
3573
3334
def cleanup():
3574
3335
"Cleanup function; run on exit"
3575
3336
if zeroconf:
3576
3337
service.cleanup()
3577
3338
3578
3339
mp.active_children()
3579
3340
wn.close()
3580
3341
if not (tcp_server.clients or client_settings):
3581
3342
return
3582
3343
3583
3344
# Store client before exiting. Secrets are encrypted with key
3584
3345
# based on what config file has. If config file is
3585
3346
# removed/edited, old secret will thus be unrecovable.
3590
3351
client.encrypted_secret = pgp.encrypt(client.secret,
3591
3352
key)
3592
3353
client_dict = {}
3593
3354
3594
3355
# A list of attributes that can not be pickled
3595
3356
# + secret.
3596
exclude = {"bus", "changedstate", "secret",
3597
"checker", "server_settings"}
3357
exclude = { "bus", "changedstate", "secret",
3358
"checker", "server_settings" }
3598
3359
for name, typ in inspect.getmembers(dbus.service
3599
3360
.Object):
3600
3361
exclude.add(name)
3601
3362
3602
3363
client_dict["encrypted_secret"] = (client
3603
3364
.encrypted_secret)
3604
3365
for attr in client.client_structure:
3605
3366
if attr not in exclude:
3606
3367
client_dict[attr] = getattr(client, attr)
3607
3368
3608
3369
clients[client.name] = client_dict
3609
3370
del client_settings[client.name]["secret"]
3610
3371
3611
3372
try:
3612
3373
with tempfile.NamedTemporaryFile(
3613
mode="wb",
3374
mode='wb',
3614
3375
suffix=".pickle",
3615
prefix="clients-",
3376
prefix='clients-',
3616
3377
dir=os.path.dirname(stored_state_path),
3617
3378
delete=False) as stored_state:
3618
3379
pickle.dump((clients, client_settings), stored_state,
3619
protocol=2)
3380
protocol = 2)
3620
3381
tempname = stored_state.name
3621
3382
os.rename(tempname, stored_state_path)
3622
3383
except (IOError, OSError) as e:
3626
3387
except NameError:
3627
3388
pass
3628
3389
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3629
log.warning("Could not save persistent state: %s",
3630
os.strerror(e.errno))
3390
logger.warning("Could not save persistent state: {}"
3391
.format(os.strerror(e.errno)))
3631
3392
else:
3632
log.warning("Could not save persistent state:",
3633
exc_info=e)
3393
logger.warning("Could not save persistent state:",
3394
exc_info=e)
3634
3395
raise
3635
3396
3636
3397
# Delete all clients, and settings from config
3637
3398
while tcp_server.clients:
3638
3399
name, client = tcp_server.clients.popitem()
3644
3405
if use_dbus:
3645
3406
mandos_dbus_service.client_removed_signal(client)
3646
3407
client_settings.clear()
3647
3408
3648
3409
atexit.register(cleanup)
3649
3410
3650
3411
for client in tcp_server.clients.values():
3651
3412
if use_dbus:
3652
3413
# Emit D-Bus signal for adding
3653
3414
mandos_dbus_service.client_added_signal(client)
3654
3415
# Need to initiate checking of clients
3655
3416
if client.enabled:
3656
client.init_checker(randomize_start=True)
3657
3417
client.init_checker()
3418
3658
3419
tcp_server.enable()
3659
3420
tcp_server.server_activate()
3660
3421
3661
3422
# Find out what port we got
3662
3423
if zeroconf:
3663
3424
service.port = tcp_server.socket.getsockname()[1]
3664
3425
if use_ipv6:
3665
log.info("Now listening on address %r, port %d, flowinfo %d,"
3666
" scope_id %d", *tcp_server.socket.getsockname())
3426
logger.info("Now listening on address %r, port %d,"
3427
" flowinfo %d, scope_id %d",
3428
*tcp_server.socket.getsockname())
3667
3429
else: # IPv4
3668
log.info("Now listening on address %r, port %d",
3669
*tcp_server.socket.getsockname())
3670
3671
# service.interface = tcp_server.socket.getsockname()[3]
3672
3430
logger.info("Now listening on address %r, port %d",
3431
*tcp_server.socket.getsockname())
3432
3433
#service.interface = tcp_server.socket.getsockname()[3]
3434
3673
3435
try:
3674
3436
if zeroconf:
3675
3437
# From the Avahi example code
3676
3438
try:
3677
3439
service.activate()
3678
3440
except dbus.exceptions.DBusException as error:
3679
log.critical("D-Bus Exception", exc_info=error)
3441
logger.critical("D-Bus Exception", exc_info=error)
3680
3442
cleanup()
3681
3443
sys.exit(1)
3682
3444
# End of Avahi example code
3683
3684
GLib.io_add_watch(
3685
GLib.IOChannel.unix_new(tcp_server.fileno()),
3686
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3687
lambda *args, **kwargs: (tcp_server.handle_request
3688
(*args[2:], **kwargs) or True))
3689
3690
log.debug("Starting main loop")
3445
3446
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3447
lambda *args, **kwargs:
3448
(tcp_server.handle_request
3449
(*args[2:], **kwargs) or True))
3450
3451
logger.debug("Starting main loop")
3691
3452
main_loop.run()
3692
3453
except AvahiError as error:
3693
log.critical("Avahi Error", exc_info=error)
3454
logger.critical("Avahi Error", exc_info=error)
3694
3455
cleanup()
3695
3456
sys.exit(1)
3696
3457
except KeyboardInterrupt:
3697
3458
if debug:
3698
3459
print("", file=sys.stderr)
3699
log.debug("Server received KeyboardInterrupt")
3700
log.debug("Server exiting")
3460
logger.debug("Server received KeyboardInterrupt")
3461
logger.debug("Server exiting")
3701
3462
# Must run before the D-Bus bus name gets deregistered
3702
3463
cleanup()
3703
3464
3704
3705
def parse_test_args():
3706
# type: () -> argparse.Namespace
3707
parser = argparse.ArgumentParser(add_help=False)
3708
parser.add_argument("--check", action="store_true")
3709
parser.add_argument("--prefix", )
3710
args, unknown_args = parser.parse_known_args()
3711
if args.check:
3712
# Remove test options from sys.argv
3713
sys.argv[1:] = unknown_args
3714
return args
3715
3716
# Add all tests from doctest strings
3717
def load_tests(loader, tests, none):
3718
import doctest
3719
tests.addTests(doctest.DocTestSuite())
3720
return tests
3721
3722
if __name__ == "__main__":
3723
options = parse_test_args()
3724
try:
3725
if options.check:
3726
extra_test_prefix = options.prefix
3727
if extra_test_prefix is not None:
3728
if not (unittest.main(argv=[""], exit=False)
3729
.result.wasSuccessful()):
3730
sys.exit(1)
3731
class ExtraTestLoader(unittest.TestLoader):
3732
testMethodPrefix = extra_test_prefix
3733
# Call using ./scriptname --test [--verbose]
3734
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3735
else:
3736
unittest.main(argv=[""])
3737
else:
3738
main()
3739
finally:
3740
logging.shutdown()
3741
3742
# Local Variables:
3743
# run-tests:
3744
# (lambda (&optional extra)
3745
# (if (not (funcall run-tests-in-test-buffer default-directory
3746
# extra))
3747
# (funcall show-test-buffer-in-test-window)
3748
# (funcall remove-test-window)
3749
# (if extra (message "Extra tests run successfully!"))))
3750
# run-tests-in-test-buffer:
3751
# (lambda (dir &optional extra)
3752
# (with-current-buffer (get-buffer-create "*Test*")
3753
# (setq buffer-read-only nil
3754
# default-directory dir)
3755
# (erase-buffer)
3756
# (compilation-mode))
3757
# (let ((process-result
3758
# (let ((inhibit-read-only t))
3759
# (process-file-shell-command
3760
# (funcall get-command-line extra) nil "*Test*"))))
3761
# (and (numberp process-result)
3762
# (= process-result 0))))
3763
# get-command-line:
3764
# (lambda (&optional extra)
3765
# (let ((quoted-script
3766
# (shell-quote-argument (funcall get-script-name))))
3767
# (format
3768
# (concat "%s --check" (if extra " --prefix=atest" ""))
3769
# quoted-script)))
3770
# get-script-name:
3771
# (lambda ()
3772
# (if (fboundp 'file-local-name)
3773
# (file-local-name (buffer-file-name))
3774
# (or (file-remote-p (buffer-file-name) 'localname)
3775
# (buffer-file-name))))
3776
# remove-test-window:
3777
# (lambda ()
3778
# (let ((test-window (get-buffer-window "*Test*")))
3779
# (if test-window (delete-window test-window))))
3780
# show-test-buffer-in-test-window:
3781
# (lambda ()
3782
# (when (not (get-buffer-window-list "*Test*"))
3783
# (setq next-error-last-buffer (get-buffer "*Test*"))
3784
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3785
# (display-buffer-overriding-action
3786
# `((display-buffer-in-side-window) (side . ,side)
3787
# (window-height . fit-window-to-buffer)
3788
# (window-width . fit-window-to-buffer))))
3789
# (display-buffer "*Test*"))))
3790
# eval:
3791
# (progn
3792
# (let* ((run-extra-tests (lambda () (interactive)
3793
# (funcall run-tests t)))
3794
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3795
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3796
# (setq minor-mode-overriding-map-alist
3797
# (cons `(run-tests . ,outer-keymap)
3798
# minor-mode-overriding-map-alist)))
3799
# (add-hook 'after-save-hook run-tests 90 t))
3800
# End:
3465
3466
if __name__ == '__main__':
3467
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0