To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 868
- compare with another revision
- download diff
- download tarball
- view history from revision 868
- Committer: Teddy Hogeborn
- Date: 2016-07-03 03:32:28 UTC
- Revision ID: teddy@recompile.se-20160703033228-cafpnnfs53kdg52g
Change all http:// URLs to https:// wherever possible.
* INSTALL (Prerequisites/Libraries/Mandos Server): Change "http://" to
"https://" wherever possible.
* Makefile (FORTIFY): - '' -
* mandos.xml (SEE ALSO): - '' -
* plugin-runner.c (main): - '' -
* plugins.d/mandos-client.c (start_mandos_communication): - '' -
* plugins.d/mandos-client.xml (SEE ALSO): - '' -
* INSTALL (Prerequisites/Libraries/Mandos Server): Change "http://" to
"https://" wherever possible.
* Makefile (FORTIFY): - '' -
* mandos.xml (SEE ALSO): - '' -
* plugin-runner.c (main): - '' -
* plugins.d/mandos-client.c (start_mandos_communication): - '' -
* plugins.d/mandos-client.xml (SEE ALSO): - '' -
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import unittest
81
79
82
80
import dbus
83
81
import dbus.service
84
import gi
85
82
from gi.repository import GLib
86
83
from dbus.mainloop.glib import DBusGMainLoop
87
84
import ctypes
89
86
import xml.dom.minidom
90
87
import inspect
91
88
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
95
# Show warnings by default
96
if not sys.warnoptions:
97
import warnings
98
warnings.simplefilter("default")
99
100
89
# Try to find the value of SO_BINDTODEVICE:
101
90
try:
102
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
125
114
if sys.version_info.major == 2:
126
115
str = unicode
127
116
128
if sys.version_info < (3, 2):
129
configparser.Configparser = configparser.SafeConfigParser
130
131
version = "1.8.9"
117
version = "1.7.10"
132
118
stored_state_file = "clients.pickle"
133
119
134
120
logger = logging.getLogger()
135
logging.captureWarnings(True) # Show warnings via the logging system
136
121
syslogger = None
137
122
138
123
try:
139
124
if_nametoindex = ctypes.cdll.LoadLibrary(
140
125
ctypes.util.find_library("c")).if_nametoindex
141
126
except (OSError, AttributeError):
142
127
143
128
def if_nametoindex(interface):
144
129
"Get an interface index the hard way, i.e. using fcntl()"
145
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
168
153
169
154
def initlogger(debug, level=logging.WARNING):
170
155
"""init logger and add loglevel"""
171
156
172
157
global syslogger
173
158
syslogger = (logging.handlers.SysLogHandler(
174
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
address="/dev/log"))
159
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
160
address = "/dev/log"))
176
161
syslogger.setFormatter(logging.Formatter
177
162
('Mandos [%(process)d]: %(levelname)s:'
178
163
' %(message)s'))
179
164
logger.addHandler(syslogger)
180
165
181
166
if debug:
182
167
console = logging.StreamHandler()
183
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
193
178
pass
194
179
195
180
196
class PGPEngine:
181
class PGPEngine(object):
197
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
198
183
199
184
def __init__(self):
200
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
201
186
self.gpg = "gpg"
203
188
output = subprocess.check_output(["gpgconf"])
204
189
for line in output.splitlines():
205
190
name, text, path = line.split(b":")
206
if name == b"gpg":
191
if name == "gpg":
207
192
self.gpg = path
208
193
break
209
194
except OSError as e:
214
199
'--force-mdc',
215
200
'--quiet']
216
201
# Only GPG version 1 has the --no-use-agent option.
217
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
218
203
self.gnupgargs.append("--no-use-agent")
219
204
220
205
def __enter__(self):
221
206
return self
222
207
223
208
def __exit__(self, exc_type, exc_value, traceback):
224
209
self._cleanup()
225
210
return False
226
211
227
212
def __del__(self):
228
213
self._cleanup()
229
214
230
215
def _cleanup(self):
231
216
if self.tempdir is not None:
232
217
# Delete contents of tempdir
233
218
for root, dirs, files in os.walk(self.tempdir,
234
topdown=False):
219
topdown = False):
235
220
for filename in files:
236
221
os.remove(os.path.join(root, filename))
237
222
for dirname in dirs:
239
224
# Remove tempdir
240
225
os.rmdir(self.tempdir)
241
226
self.tempdir = None
242
227
243
228
def password_encode(self, password):
244
229
# Passphrase can not be empty and can not contain newlines or
245
230
# NUL bytes. So we prefix it and hex encode it.
250
235
.replace(b"\n", b"\\n")
251
236
.replace(b"\0", b"\\x00"))
252
237
return encoded
253
238
254
239
def encrypt(self, data, password):
255
240
passphrase = self.password_encode(password)
256
241
with tempfile.NamedTemporaryFile(
261
246
'--passphrase-file',
262
247
passfile.name]
263
248
+ self.gnupgargs,
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
249
stdin = subprocess.PIPE,
250
stdout = subprocess.PIPE,
251
stderr = subprocess.PIPE)
252
ciphertext, err = proc.communicate(input = data)
268
253
if proc.returncode != 0:
269
254
raise PGPError(err)
270
255
return ciphertext
271
256
272
257
def decrypt(self, data, password):
273
258
passphrase = self.password_encode(password)
274
259
with tempfile.NamedTemporaryFile(
275
dir=self.tempdir) as passfile:
260
dir = self.tempdir) as passfile:
276
261
passfile.write(passphrase)
277
262
passfile.flush()
278
263
proc = subprocess.Popen([self.gpg, '--decrypt',
279
264
'--passphrase-file',
280
265
passfile.name]
281
266
+ self.gnupgargs,
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
267
stdin = subprocess.PIPE,
268
stdout = subprocess.PIPE,
269
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
286
271
if proc.returncode != 0:
287
272
raise PGPError(err)
288
273
return decrypted_plaintext
289
274
290
291
275
# Pretend that we have an Avahi module
292
class avahi:
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
276
class Avahi(object):
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
298
283
DBUS_NAME = "org.freedesktop.Avahi"
299
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
286
DBUS_PATH_SERVER = "/"
302
303
@staticmethod
304
def string_array_to_txt_array(t):
287
def string_array_to_txt_array(self, t):
305
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
289
for s in t), signature="ay")
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
315
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
298
avahi = Avahi()
316
299
317
300
class AvahiError(Exception):
318
301
def __init__(self, value, *args, **kwargs):
329
312
pass
330
313
331
314
332
class AvahiService:
315
class AvahiService(object):
333
316
"""An Avahi (Zeroconf) service.
334
317
335
318
Attributes:
336
319
interface: integer; avahi.IF_UNSPEC or an interface index.
337
320
Used to optionally bind to the specified interface.
349
332
server: D-Bus Server
350
333
bus: dbus.SystemBus()
351
334
"""
352
335
353
336
def __init__(self,
354
interface=avahi.IF_UNSPEC,
355
name=None,
356
servicetype=None,
357
port=None,
358
TXT=None,
359
domain="",
360
host="",
361
max_renames=32768,
362
protocol=avahi.PROTO_UNSPEC,
363
bus=None):
337
interface = avahi.IF_UNSPEC,
338
name = None,
339
servicetype = None,
340
port = None,
341
TXT = None,
342
domain = "",
343
host = "",
344
max_renames = 32768,
345
protocol = avahi.PROTO_UNSPEC,
346
bus = None):
364
347
self.interface = interface
365
348
self.name = name
366
349
self.type = servicetype
375
358
self.server = None
376
359
self.bus = bus
377
360
self.entry_group_state_changed_match = None
378
361
379
362
def rename(self, remove=True):
380
363
"""Derived from the Avahi example code"""
381
364
if self.rename_count >= self.max_renames:
401
384
logger.critical("D-Bus Exception", exc_info=error)
402
385
self.cleanup()
403
386
os._exit(1)
404
387
405
388
def remove(self):
406
389
"""Derived from the Avahi example code"""
407
390
if self.entry_group_state_changed_match is not None:
409
392
self.entry_group_state_changed_match = None
410
393
if self.group is not None:
411
394
self.group.Reset()
412
395
413
396
def add(self):
414
397
"""Derived from the Avahi example code"""
415
398
self.remove()
432
415
dbus.UInt16(self.port),
433
416
avahi.string_array_to_txt_array(self.TXT))
434
417
self.group.Commit()
435
418
436
419
def entry_group_state_changed(self, state, error):
437
420
"""Derived from the Avahi example code"""
438
421
logger.debug("Avahi entry group state change: %i", state)
439
422
440
423
if state == avahi.ENTRY_GROUP_ESTABLISHED:
441
424
logger.debug("Zeroconf service established.")
442
425
elif state == avahi.ENTRY_GROUP_COLLISION:
446
429
logger.critical("Avahi: Error in group state changed %s",
447
430
str(error))
448
431
raise AvahiGroupError("State changed: {!s}".format(error))
449
432
450
433
def cleanup(self):
451
434
"""Derived from the Avahi example code"""
452
435
if self.group is not None:
457
440
pass
458
441
self.group = None
459
442
self.remove()
460
443
461
444
def server_state_changed(self, state, error=None):
462
445
"""Derived from the Avahi example code"""
463
446
logger.debug("Avahi server state change: %i", state)
492
475
logger.debug("Unknown state: %r", state)
493
476
else:
494
477
logger.debug("Unknown state: %r: %r", state, error)
495
478
496
479
def activate(self):
497
480
"""Derived from the Avahi example code"""
498
481
if self.server is None:
509
492
class AvahiServiceToSyslog(AvahiService):
510
493
def rename(self, *args, **kwargs):
511
494
"""Add the new name to the syslog messages"""
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
495
ret = AvahiService.rename(self, *args, **kwargs)
513
496
syslogger.setFormatter(logging.Formatter(
514
497
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
515
498
.format(self.name)))
516
499
return ret
517
500
518
519
501
# Pretend that we have a GnuTLS module
520
class gnutls:
521
"""This isn't so much a class as it is a module-like namespace."""
522
523
library = ctypes.util.find_library("gnutls")
524
if library is None:
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
527
del library
528
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
505
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
509
def __init__(self):
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
512
# happens.
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
516
529
517
# Unless otherwise indicated, the constants and types below are
530
518
# all from the gnutls/gnutls.h C header file.
531
519
532
520
# Constants
533
521
E_SUCCESS = 0
534
522
E_INTERRUPTED = -52
535
523
E_AGAIN = -28
536
524
CRT_OPENPGP = 2
537
CRT_RAWPK = 3
538
525
CLIENT = 2
539
526
SHUT_RDWR = 0
540
527
CRD_CERTIFICATE = 1
541
528
E_NO_CERTIFICATE_FOUND = -49
542
X509_FMT_DER = 0
543
NO_TICKETS = 1<<10
544
ENABLE_RAWPK = 1<<18
545
CTYPE_PEERS = 3
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
547
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
530
549
531
# Types
550
532
class session_int(ctypes.Structure):
551
533
_fields_ = []
552
534
session_t = ctypes.POINTER(session_int)
553
554
535
class certificate_credentials_st(ctypes.Structure):
555
536
_fields_ = []
556
537
certificate_credentials_t = ctypes.POINTER(
557
538
certificate_credentials_st)
558
539
certificate_type_t = ctypes.c_int
559
560
540
class datum_t(ctypes.Structure):
561
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
542
('size', ctypes.c_uint)]
563
564
543
class openpgp_crt_int(ctypes.Structure):
565
544
_fields_ = []
566
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
568
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
569
548
credentials_type_t = ctypes.c_int
570
549
transport_ptr_t = ctypes.c_void_p
571
550
close_request_t = ctypes.c_int
572
551
573
552
# Exceptions
574
553
class Error(Exception):
575
def __init__(self, message=None, code=None, args=()):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
576
559
# Default usage is by a message string, but if a return
577
560
# code is passed, convert it to a string with
578
561
# gnutls.strerror()
579
562
self.code = code
580
563
if message is None and code is not None:
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
583
566
message, *args)
584
567
585
568
class CertificateSecurityError(Error):
586
569
pass
587
570
588
571
# Classes
589
class Credentials:
572
class Credentials(object):
590
573
def __init__(self):
591
574
self._c_object = gnutls.certificate_credentials_t()
592
575
gnutls.certificate_allocate_credentials(
593
576
ctypes.byref(self._c_object))
594
577
self.type = gnutls.CRD_CERTIFICATE
595
578
596
579
def __del__(self):
597
580
gnutls.certificate_free_credentials(self._c_object)
598
599
class ClientSession:
600
def __init__(self, socket, credentials=None):
581
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
601
584
self._c_object = gnutls.session_t()
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
605
if gnutls.has_rawpk:
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
608
del gnutls_flags
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
609
586
gnutls.set_default_priority(self._c_object)
610
587
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
588
gnutls.handshake_set_private_extensions(self._c_object,
617
594
ctypes.cast(credentials._c_object,
618
595
ctypes.c_void_p))
619
596
self.credentials = credentials
620
597
621
598
def __del__(self):
622
599
gnutls.deinit(self._c_object)
623
600
624
601
def handshake(self):
625
602
return gnutls.handshake(self._c_object)
626
603
627
604
def send(self, data):
628
605
data = bytes(data)
629
606
data_len = len(data)
631
608
data_len -= gnutls.record_send(self._c_object,
632
609
data[-data_len:],
633
610
data_len)
634
611
635
612
def bye(self):
636
613
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
637
614
638
615
# Error handling functions
639
616
def _error_code(result):
640
617
"""A function to raise exceptions on errors, suitable
642
619
if result >= 0:
643
620
return result
644
621
if result == gnutls.E_NO_CERTIFICATE_FOUND:
645
raise gnutls.CertificateSecurityError(code=result)
646
raise gnutls.Error(code=result)
647
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
624
648
625
def _retry_on_error(result, func, arguments):
649
626
"""A function to retry on some errors, suitable
650
627
for the 'errcheck' attribute on ctypes functions"""
653
630
return _error_code(result)
654
631
result = func(*arguments)
655
632
return result
656
633
657
634
# Unless otherwise indicated, the function declarations below are
658
635
# all from the gnutls/gnutls.h C header file.
659
636
660
637
# Functions
661
638
priority_set_direct = _library.gnutls_priority_set_direct
662
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
663
640
ctypes.POINTER(ctypes.c_char_p)]
664
641
priority_set_direct.restype = _error_code
665
642
666
643
init = _library.gnutls_init
667
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
668
645
init.restype = _error_code
669
646
670
647
set_default_priority = _library.gnutls_set_default_priority
671
648
set_default_priority.argtypes = [session_t]
672
649
set_default_priority.restype = _error_code
673
650
674
651
record_send = _library.gnutls_record_send
675
652
record_send.argtypes = [session_t, ctypes.c_void_p,
676
653
ctypes.c_size_t]
677
654
record_send.restype = ctypes.c_ssize_t
678
655
record_send.errcheck = _retry_on_error
679
656
680
657
certificate_allocate_credentials = (
681
658
_library.gnutls_certificate_allocate_credentials)
682
659
certificate_allocate_credentials.argtypes = [
683
660
ctypes.POINTER(certificate_credentials_t)]
684
661
certificate_allocate_credentials.restype = _error_code
685
662
686
663
certificate_free_credentials = (
687
664
_library.gnutls_certificate_free_credentials)
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
690
666
certificate_free_credentials.restype = None
691
667
692
668
handshake_set_private_extensions = (
693
669
_library.gnutls_handshake_set_private_extensions)
694
670
handshake_set_private_extensions.argtypes = [session_t,
695
671
ctypes.c_int]
696
672
handshake_set_private_extensions.restype = None
697
673
698
674
credentials_set = _library.gnutls_credentials_set
699
675
credentials_set.argtypes = [session_t, credentials_type_t,
700
676
ctypes.c_void_p]
701
677
credentials_set.restype = _error_code
702
678
703
679
strerror = _library.gnutls_strerror
704
680
strerror.argtypes = [ctypes.c_int]
705
681
strerror.restype = ctypes.c_char_p
706
682
707
683
certificate_type_get = _library.gnutls_certificate_type_get
708
684
certificate_type_get.argtypes = [session_t]
709
685
certificate_type_get.restype = _error_code
710
686
711
687
certificate_get_peers = _library.gnutls_certificate_get_peers
712
688
certificate_get_peers.argtypes = [session_t,
713
689
ctypes.POINTER(ctypes.c_uint)]
714
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
715
691
716
692
global_set_log_level = _library.gnutls_global_set_log_level
717
693
global_set_log_level.argtypes = [ctypes.c_int]
718
694
global_set_log_level.restype = None
719
695
720
696
global_set_log_function = _library.gnutls_global_set_log_function
721
697
global_set_log_function.argtypes = [log_func]
722
698
global_set_log_function.restype = None
723
699
724
700
deinit = _library.gnutls_deinit
725
701
deinit.argtypes = [session_t]
726
702
deinit.restype = None
727
703
728
704
handshake = _library.gnutls_handshake
729
705
handshake.argtypes = [session_t]
730
706
handshake.restype = _error_code
731
707
handshake.errcheck = _retry_on_error
732
708
733
709
transport_set_ptr = _library.gnutls_transport_set_ptr
734
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
735
711
transport_set_ptr.restype = None
736
712
737
713
bye = _library.gnutls_bye
738
714
bye.argtypes = [session_t, close_request_t]
739
715
bye.restype = _error_code
740
716
bye.errcheck = _retry_on_error
741
717
742
718
check_version = _library.gnutls_check_version
743
719
check_version.argtypes = [ctypes.c_char_p]
744
720
check_version.restype = ctypes.c_char_p
745
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
750
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
753
754
if has_rawpk:
755
# Types
756
class pubkey_st(ctypes.Structure):
757
_fields = []
758
pubkey_t = ctypes.POINTER(pubkey_st)
759
760
x509_crt_fmt_t = ctypes.c_int
761
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
766
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
769
x509_crt_fmt_t]
770
pubkey_import.restype = _error_code
771
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
777
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
781
else:
782
# All the function declarations below are from gnutls/openpgp.h
783
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
787
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
791
openpgp_crt_fmt_t]
792
openpgp_crt_import.restype = _error_code
793
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
798
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
802
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
806
ctypes.c_void_p,
807
ctypes.POINTER(
808
ctypes.c_size_t)]
809
openpgp_crt_get_fingerprint.restype = _error_code
810
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
815
721
722
# All the function declarations below are from gnutls/openpgp.h
723
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
727
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
731
openpgp_crt_fmt_t]
732
openpgp_crt_import.restype = _error_code
733
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
738
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
742
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
746
ctypes.c_void_p,
747
ctypes.POINTER(
748
ctypes.c_size_t)]
749
openpgp_crt_get_fingerprint.restype = _error_code
750
816
751
# Remove non-public functions
817
752
del _error_code, _retry_on_error
818
753
# Create the global "gnutls" object, simulating a module
754
gnutls = GnuTLS()
819
755
820
756
def call_pipe(connection, # : multiprocessing.Connection
821
757
func, *args, **kwargs):
822
758
"""This function is meant to be called by multiprocessing.Process
823
759
824
760
This function runs func(*args, **kwargs), and writes the resulting
825
761
return value on the provided multiprocessing.Connection.
826
762
"""
827
763
connection.send(func(*args, **kwargs))
828
764
connection.close()
829
765
830
831
class Client:
766
class Client(object):
832
767
"""A representation of a client host served by this server.
833
768
834
769
Attributes:
835
770
approved: bool(); 'None' if not yet approved/disapproved
836
771
approval_delay: datetime.timedelta(); Time to wait for approval
837
772
approval_duration: datetime.timedelta(); Duration of one approval
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
840
running.
773
checker: subprocess.Popen(); a running checker process used
774
to see if the client lives.
775
'None' if no process is running.
841
776
checker_callback_tag: a GLib event source tag, or None
842
777
checker_command: string; External command which is run to check
843
778
if client lives. %() expansions are done at
851
786
disable_initiator_tag: a GLib event source tag, or None
852
787
enabled: bool()
853
788
fingerprint: string (40 or 32 hexadecimal digits); used to
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
789
uniquely identify the client
857
790
host: string; available for use by the checker command
858
791
interval: datetime.timedelta(); How often to start a new checker
859
792
last_approval_request: datetime.datetime(); (UTC) or None
875
808
disabled, or None
876
809
server_settings: The server_settings dict from main()
877
810
"""
878
811
879
812
runtime_expansions = ("approval_delay", "approval_duration",
880
"created", "enabled", "expires", "key_id",
813
"created", "enabled", "expires",
881
814
"fingerprint", "host", "interval",
882
815
"last_approval_request", "last_checked_ok",
883
816
"last_enabled", "name", "timeout")
892
825
"approved_by_default": "True",
893
826
"enabled": "True",
894
827
}
895
828
896
829
@staticmethod
897
830
def config_parser(config):
898
831
"""Construct a new dict of client settings of this form:
905
838
for client_name in config.sections():
906
839
section = dict(config.items(client_name))
907
840
client = settings[client_name] = {}
908
841
909
842
client["host"] = section["host"]
910
843
# Reformat values from string types to Python types
911
844
client["approved_by_default"] = config.getboolean(
912
845
client_name, "approved_by_default")
913
846
client["enabled"] = config.getboolean(client_name,
914
847
"enabled")
915
916
# Uppercase and remove spaces from key_id and fingerprint
917
# for later comparison purposes with return value from the
918
# key_id() and fingerprint() functions
919
client["key_id"] = (section.get("key_id", "").upper()
920
.replace(" ", ""))
848
849
# Uppercase and remove spaces from fingerprint for later
850
# comparison purposes with return value from the
851
# fingerprint() function
921
852
client["fingerprint"] = (section["fingerprint"].upper()
922
853
.replace(" ", ""))
923
854
if "secret" in section:
944
875
client["last_approval_request"] = None
945
876
client["last_checked_ok"] = None
946
877
client["last_checker_status"] = -2
947
878
948
879
return settings
949
950
def __init__(self, settings, name=None, server_settings=None):
880
881
def __init__(self, settings, name = None, server_settings=None):
951
882
self.name = name
952
883
if server_settings is None:
953
884
server_settings = {}
955
886
# adding all client settings
956
887
for setting, value in settings.items():
957
888
setattr(self, setting, value)
958
889
959
890
if self.enabled:
960
891
if not hasattr(self, "last_enabled"):
961
892
self.last_enabled = datetime.datetime.utcnow()
965
896
else:
966
897
self.last_enabled = None
967
898
self.expires = None
968
899
969
900
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
901
logger.debug(" Fingerprint: %s", self.fingerprint)
972
902
self.created = settings.get("created",
973
903
datetime.datetime.utcnow())
974
904
975
905
# attributes specific for this server instance
976
906
self.checker = None
977
907
self.checker_initiator_tag = None
986
916
for attr in self.__dict__.keys()
987
917
if not attr.startswith("_")]
988
918
self.client_structure.append("client_structure")
989
919
990
920
for name, t in inspect.getmembers(
991
921
type(self), lambda obj: isinstance(obj, property)):
992
922
if not name.startswith("_"):
993
923
self.client_structure.append(name)
994
924
995
925
# Send notice to process children that client state has changed
996
926
def send_changedstate(self):
997
927
with self.changedstate:
998
928
self.changedstate.notify_all()
999
929
1000
930
def enable(self):
1001
931
"""Start this client's checker and timeout hooks"""
1002
932
if getattr(self, "enabled", False):
1007
937
self.last_enabled = datetime.datetime.utcnow()
1008
938
self.init_checker()
1009
939
self.send_changedstate()
1010
940
1011
941
def disable(self, quiet=True):
1012
942
"""Disable this client."""
1013
943
if not getattr(self, "enabled", False):
1027
957
self.send_changedstate()
1028
958
# Do not run this again if called by a GLib.timeout_add
1029
959
return False
1030
960
1031
961
def __del__(self):
1032
962
self.disable()
1033
963
1034
964
def init_checker(self):
1035
965
# Schedule a new checker to be started an 'interval' from now,
1036
966
# and every interval from then on.
1046
976
int(self.timeout.total_seconds() * 1000), self.disable)
1047
977
# Also start a new checker *right now*.
1048
978
self.start_checker()
1049
979
1050
980
def checker_callback(self, source, condition, connection,
1051
981
command):
1052
982
"""The checker has completed, so take appropriate actions."""
983
self.checker_callback_tag = None
984
self.checker = None
1053
985
# Read return code from connection (see call_pipe)
1054
986
returncode = connection.recv()
1055
987
connection.close()
1056
if self.checker is not None:
1057
self.checker.join()
1058
self.checker_callback_tag = None
1059
self.checker = None
1060
988
1061
989
if returncode >= 0:
1062
990
self.last_checker_status = returncode
1063
991
self.last_checker_signal = None
1073
1001
logger.warning("Checker for %(name)s crashed?",
1074
1002
vars(self))
1075
1003
return False
1076
1004
1077
1005
def checked_ok(self):
1078
1006
"""Assert that the client has been seen, alive and well."""
1079
1007
self.last_checked_ok = datetime.datetime.utcnow()
1080
1008
self.last_checker_status = 0
1081
1009
self.last_checker_signal = None
1082
1010
self.bump_timeout()
1083
1011
1084
1012
def bump_timeout(self, timeout=None):
1085
1013
"""Bump up the timeout for this client."""
1086
1014
if timeout is None:
1092
1020
self.disable_initiator_tag = GLib.timeout_add(
1093
1021
int(timeout.total_seconds() * 1000), self.disable)
1094
1022
self.expires = datetime.datetime.utcnow() + timeout
1095
1023
1096
1024
def need_approval(self):
1097
1025
self.last_approval_request = datetime.datetime.utcnow()
1098
1026
1099
1027
def start_checker(self):
1100
1028
"""Start a new checker subprocess if one is not running.
1101
1029
1102
1030
If a checker already exists, leave it running and do
1103
1031
nothing."""
1104
1032
# The reason for not killing a running checker is that if we
1109
1037
# checkers alone, the checker would have to take more time
1110
1038
# than 'timeout' for the client to be disabled, which is as it
1111
1039
# should be.
1112
1040
1113
1041
if self.checker is not None and not self.checker.is_alive():
1114
1042
logger.warning("Checker was not alive; joining")
1115
1043
self.checker.join()
1119
1047
# Escape attributes for the shell
1120
1048
escaped_attrs = {
1121
1049
attr: re.escape(str(getattr(self, attr)))
1122
for attr in self.runtime_expansions}
1050
for attr in self.runtime_expansions }
1123
1051
try:
1124
1052
command = self.checker_command % escaped_attrs
1125
1053
except TypeError as error:
1137
1065
# The exception is when not debugging but nevertheless
1138
1066
# running in the foreground; use the previously
1139
1067
# created wnull.
1140
popen_args = {"close_fds": True,
1141
"shell": True,
1142
"cwd": "/"}
1068
popen_args = { "close_fds": True,
1069
"shell": True,
1070
"cwd": "/" }
1143
1071
if (not self.server_settings["debug"]
1144
1072
and self.server_settings["foreground"]):
1145
1073
popen_args.update({"stdout": wnull,
1146
"stderr": wnull})
1147
pipe = multiprocessing.Pipe(duplex=False)
1074
"stderr": wnull })
1075
pipe = multiprocessing.Pipe(duplex = False)
1148
1076
self.checker = multiprocessing.Process(
1149
target=call_pipe,
1150
args=(pipe[1], subprocess.call, command),
1151
kwargs=popen_args)
1077
target = call_pipe,
1078
args = (pipe[1], subprocess.call, command),
1079
kwargs = popen_args)
1152
1080
self.checker.start()
1153
1081
self.checker_callback_tag = GLib.io_add_watch(
1154
GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1082
pipe[0].fileno(), GLib.IO_IN,
1156
1083
self.checker_callback, pipe[0], command)
1157
1084
# Re-run this periodically if run by GLib.timeout_add
1158
1085
return True
1159
1086
1160
1087
def stop_checker(self):
1161
1088
"""Force the checker process, if any, to stop."""
1162
1089
if self.checker_callback_tag:
1175
1102
byte_arrays=False):
1176
1103
"""Decorators for marking methods of a DBusObjectWithProperties to
1177
1104
become properties on the D-Bus.
1178
1105
1179
1106
The decorated method will be called with no arguments by "Get"
1180
1107
and with one argument by "Set".
1181
1108
1182
1109
The parameters, where they are supported, are the same as
1183
1110
dbus.service.method, except there is only "signature", since the
1184
1111
type from Get() and the type sent to Set() is the same.
1188
1115
if byte_arrays and signature != "ay":
1189
1116
raise ValueError("Byte arrays not supported for non-'ay'"
1190
1117
" signature {!r}".format(signature))
1191
1118
1192
1119
def decorator(func):
1193
1120
func._dbus_is_property = True
1194
1121
func._dbus_interface = dbus_interface
1197
1124
func._dbus_name = func.__name__
1198
1125
if func._dbus_name.endswith("_dbus_property"):
1199
1126
func._dbus_name = func._dbus_name[:-14]
1200
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1127
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1201
1128
return func
1202
1129
1203
1130
return decorator
1204
1131
1205
1132
1206
1133
def dbus_interface_annotations(dbus_interface):
1207
1134
"""Decorator for marking functions returning interface annotations
1208
1135
1209
1136
Usage:
1210
1137
1211
1138
@dbus_interface_annotations("org.example.Interface")
1212
1139
def _foo(self): # Function name does not matter
1213
1140
return {"org.freedesktop.DBus.Deprecated": "true",
1214
1141
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1215
1142
"false"}
1216
1143
"""
1217
1144
1218
1145
def decorator(func):
1219
1146
func._dbus_is_interface = True
1220
1147
func._dbus_interface = dbus_interface
1221
1148
func._dbus_name = dbus_interface
1222
1149
return func
1223
1150
1224
1151
return decorator
1225
1152
1226
1153
1227
1154
def dbus_annotations(annotations):
1228
1155
"""Decorator to annotate D-Bus methods, signals or properties
1229
1156
Usage:
1230
1157
1231
1158
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1232
1159
"org.freedesktop.DBus.Property."
1233
1160
"EmitsChangedSignal": "false"})
1235
1162
access="r")
1236
1163
def Property_dbus_property(self):
1237
1164
return dbus.Boolean(False)
1238
1165
1239
1166
See also the DBusObjectWithAnnotations class.
1240
1167
"""
1241
1168
1242
1169
def decorator(func):
1243
1170
func._dbus_annotations = annotations
1244
1171
return func
1245
1172
1246
1173
return decorator
1247
1174
1248
1175
1266
1193
1267
1194
class DBusObjectWithAnnotations(dbus.service.Object):
1268
1195
"""A D-Bus object with annotations.
1269
1196
1270
1197
Classes inheriting from this can use the dbus_annotations
1271
1198
decorator to add annotations to methods or signals.
1272
1199
"""
1273
1200
1274
1201
@staticmethod
1275
1202
def _is_dbus_thing(thing):
1276
1203
"""Returns a function testing if an attribute is a D-Bus thing
1277
1204
1278
1205
If called like _is_dbus_thing("method") it returns a function
1279
1206
suitable for use as predicate to inspect.getmembers().
1280
1207
"""
1281
1208
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1282
1209
False)
1283
1210
1284
1211
def _get_all_dbus_things(self, thing):
1285
1212
"""Returns a generator of (name, attribute) pairs
1286
1213
"""
1289
1216
for cls in self.__class__.__mro__
1290
1217
for name, athing in
1291
1218
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1292
1219
1293
1220
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
out_signature="s",
1295
path_keyword='object_path',
1296
connection_keyword='connection')
1221
out_signature = "s",
1222
path_keyword = 'object_path',
1223
connection_keyword = 'connection')
1297
1224
def Introspect(self, object_path, connection):
1298
1225
"""Overloading of standard D-Bus method.
1299
1226
1300
1227
Inserts annotation tags on methods and signals.
1301
1228
"""
1302
1229
xmlstring = dbus.service.Object.Introspect(self, object_path,
1303
1230
connection)
1304
1231
try:
1305
1232
document = xml.dom.minidom.parseString(xmlstring)
1306
1233
1307
1234
for if_tag in document.getElementsByTagName("interface"):
1308
1235
# Add annotation tags
1309
1236
for typ in ("method", "signal"):
1336
1263
if_tag.appendChild(ann_tag)
1337
1264
# Fix argument name for the Introspect method itself
1338
1265
if (if_tag.getAttribute("name")
1339
== dbus.INTROSPECTABLE_IFACE):
1266
== dbus.INTROSPECTABLE_IFACE):
1340
1267
for cn in if_tag.getElementsByTagName("method"):
1341
1268
if cn.getAttribute("name") == "Introspect":
1342
1269
for arg in cn.getElementsByTagName("arg"):
1355
1282
1356
1283
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1357
1284
"""A D-Bus object with properties.
1358
1285
1359
1286
Classes inheriting from this can use the dbus_service_property
1360
1287
decorator to expose methods as D-Bus properties. It exposes the
1361
1288
standard Get(), Set(), and GetAll() methods on the D-Bus.
1362
1289
"""
1363
1290
1364
1291
def _get_dbus_property(self, interface_name, property_name):
1365
1292
"""Returns a bound method if one exists which is a D-Bus
1366
1293
property with the specified name and interface.
1371
1298
if (value._dbus_name == property_name
1372
1299
and value._dbus_interface == interface_name):
1373
1300
return value.__get__(self)
1374
1301
1375
1302
# No such property
1376
1303
raise DBusPropertyNotFound("{}:{}.{}".format(
1377
1304
self.dbus_object_path, interface_name, property_name))
1378
1305
1379
1306
@classmethod
1380
1307
def _get_all_interface_names(cls):
1381
1308
"""Get a sequence of all interfaces supported by an object"""
1384
1311
for x in (inspect.getmro(cls))
1385
1312
for attr in dir(x))
1386
1313
if name is not None)
1387
1314
1388
1315
@dbus.service.method(dbus.PROPERTIES_IFACE,
1389
1316
in_signature="ss",
1390
1317
out_signature="v")
1398
1325
if not hasattr(value, "variant_level"):
1399
1326
return value
1400
1327
return type(value)(value, variant_level=value.variant_level+1)
1401
1328
1402
1329
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1403
1330
def Set(self, interface_name, property_name, value):
1404
1331
"""Standard D-Bus property Set() method, see D-Bus standard.
1416
1343
value = dbus.ByteArray(b''.join(chr(byte)
1417
1344
for byte in value))
1418
1345
prop(value)
1419
1346
1420
1347
@dbus.service.method(dbus.PROPERTIES_IFACE,
1421
1348
in_signature="s",
1422
1349
out_signature="a{sv}")
1423
1350
def GetAll(self, interface_name):
1424
1351
"""Standard D-Bus property GetAll() method, see D-Bus
1425
1352
standard.
1426
1353
1427
1354
Note: Will not include properties with access="write".
1428
1355
"""
1429
1356
properties = {}
1440
1367
properties[name] = value
1441
1368
continue
1442
1369
properties[name] = type(value)(
1443
value, variant_level=value.variant_level + 1)
1370
value, variant_level = value.variant_level + 1)
1444
1371
return dbus.Dictionary(properties, signature="sv")
1445
1372
1446
1373
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1447
1374
def PropertiesChanged(self, interface_name, changed_properties,
1448
1375
invalidated_properties):
1450
1377
standard.
1451
1378
"""
1452
1379
pass
1453
1380
1454
1381
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1455
1382
out_signature="s",
1456
1383
path_keyword='object_path',
1457
1384
connection_keyword='connection')
1458
1385
def Introspect(self, object_path, connection):
1459
1386
"""Overloading of standard D-Bus method.
1460
1387
1461
1388
Inserts property tags and interface annotation tags.
1462
1389
"""
1463
1390
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1465
1392
connection)
1466
1393
try:
1467
1394
document = xml.dom.minidom.parseString(xmlstring)
1468
1395
1469
1396
def make_tag(document, name, prop):
1470
1397
e = document.createElement("property")
1471
1398
e.setAttribute("name", name)
1472
1399
e.setAttribute("type", prop._dbus_signature)
1473
1400
e.setAttribute("access", prop._dbus_access)
1474
1401
return e
1475
1402
1476
1403
for if_tag in document.getElementsByTagName("interface"):
1477
1404
# Add property tags
1478
1405
for tag in (make_tag(document, name, prop)
1520
1447
exc_info=error)
1521
1448
return xmlstring
1522
1449
1523
1524
1450
try:
1525
1451
dbus.OBJECT_MANAGER_IFACE
1526
1452
except AttributeError:
1527
1453
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1528
1454
1529
1530
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1531
1456
"""A D-Bus object with an ObjectManager.
1532
1457
1533
1458
Classes inheriting from this exposes the standard
1534
1459
GetManagedObjects call and the InterfacesAdded and
1535
1460
InterfacesRemoved signals on the standard
1536
1461
"org.freedesktop.DBus.ObjectManager" interface.
1537
1462
1538
1463
Note: No signals are sent automatically; they must be sent
1539
1464
manually.
1540
1465
"""
1541
1466
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1542
out_signature="a{oa{sa{sv}}}")
1467
out_signature = "a{oa{sa{sv}}}")
1543
1468
def GetManagedObjects(self):
1544
1469
"""This function must be overridden"""
1545
1470
raise NotImplementedError()
1546
1471
1547
1472
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1548
signature="oa{sa{sv}}")
1473
signature = "oa{sa{sv}}")
1549
1474
def InterfacesAdded(self, object_path, interfaces_and_properties):
1550
1475
pass
1551
1552
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1476
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1553
1478
def InterfacesRemoved(self, object_path, interfaces):
1554
1479
pass
1555
1480
1556
1481
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1557
out_signature="s",
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1560
1485
def Introspect(self, object_path, connection):
1561
1486
"""Overloading of standard D-Bus method.
1562
1487
1563
1488
Override return argument name of GetManagedObjects to be
1564
1489
"objpath_interfaces_and_properties"
1565
1490
"""
1568
1493
connection)
1569
1494
try:
1570
1495
document = xml.dom.minidom.parseString(xmlstring)
1571
1496
1572
1497
for if_tag in document.getElementsByTagName("interface"):
1573
1498
# Fix argument name for the GetManagedObjects method
1574
1499
if (if_tag.getAttribute("name")
1575
== dbus.OBJECT_MANAGER_IFACE):
1500
== dbus.OBJECT_MANAGER_IFACE):
1576
1501
for cn in if_tag.getElementsByTagName("method"):
1577
1502
if (cn.getAttribute("name")
1578
1503
== "GetManagedObjects"):
1588
1513
except (AttributeError, xml.dom.DOMException,
1589
1514
xml.parsers.expat.ExpatError) as error:
1590
1515
logger.error("Failed to override Introspection method",
1591
exc_info=error)
1516
exc_info = error)
1592
1517
return xmlstring
1593
1518
1594
1595
1519
def datetime_to_dbus(dt, variant_level=0):
1596
1520
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1597
1521
if dt is None:
1598
return dbus.String("", variant_level=variant_level)
1522
return dbus.String("", variant_level = variant_level)
1599
1523
return dbus.String(dt.isoformat(), variant_level=variant_level)
1600
1524
1601
1525
1604
1528
dbus.service.Object, it will add alternate D-Bus attributes with
1605
1529
interface names according to the "alt_interface_names" mapping.
1606
1530
Usage:
1607
1531
1608
1532
@alternate_dbus_interfaces({"org.example.Interface":
1609
1533
"net.example.AlternateInterface"})
1610
1534
class SampleDBusObject(dbus.service.Object):
1611
1535
@dbus.service.method("org.example.Interface")
1612
1536
def SampleDBusMethod():
1613
1537
pass
1614
1538
1615
1539
The above "SampleDBusMethod" on "SampleDBusObject" will be
1616
1540
reachable via two interfaces: "org.example.Interface" and
1617
1541
"net.example.AlternateInterface", the latter of which will have
1618
1542
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1619
1543
"true", unless "deprecate" is passed with a False value.
1620
1544
1621
1545
This works for methods and signals, and also for D-Bus properties
1622
1546
(from DBusObjectWithProperties) and interfaces (from the
1623
1547
dbus_interface_annotations decorator).
1624
1548
"""
1625
1549
1626
1550
def wrapper(cls):
1627
1551
for orig_interface_name, alt_interface_name in (
1628
1552
alt_interface_names.items()):
1668
1592
attribute._dbus_annotations)
1669
1593
except AttributeError:
1670
1594
pass
1671
1672
1595
# Define a creator of a function to call both the
1673
1596
# original and alternate functions, so both the
1674
1597
# original and alternate signals gets sent when
1677
1600
"""This function is a scope container to pass
1678
1601
func1 and func2 to the "call_both" function
1679
1602
outside of its arguments"""
1680
1603
1681
1604
@functools.wraps(func2)
1682
1605
def call_both(*args, **kwargs):
1683
1606
"""This function will emit two D-Bus
1684
1607
signals by calling func1 and func2"""
1685
1608
func1(*args, **kwargs)
1686
1609
func2(*args, **kwargs)
1687
# Make wrapper function look like a D-Bus
1688
# signal
1610
# Make wrapper function look like a D-Bus signal
1689
1611
for name, attr in inspect.getmembers(func2):
1690
1612
if name.startswith("_dbus_"):
1691
1613
setattr(call_both, name, attr)
1692
1614
1693
1615
return call_both
1694
1616
# Create the "call_both" function and add it to
1695
1617
# the class
1741
1663
(copy_function(attribute)))
1742
1664
if deprecate:
1743
1665
# Deprecate all alternate interfaces
1744
iname = "_AlternateDBusNames_interface_annotation{}"
1666
iname="_AlternateDBusNames_interface_annotation{}"
1745
1667
for interface_name in interface_names:
1746
1668
1747
1669
@dbus_interface_annotations(interface_name)
1748
1670
def func(self):
1749
return {"org.freedesktop.DBus.Deprecated":
1750
"true"}
1671
return { "org.freedesktop.DBus.Deprecated":
1672
"true" }
1751
1673
# Find an unused name
1752
1674
for aname in (iname.format(i)
1753
1675
for i in itertools.count()):
1764
1686
cls = type("{}Alternate".format(cls.__name__),
1765
1687
(cls, ), attr)
1766
1688
return cls
1767
1689
1768
1690
return wrapper
1769
1691
1770
1692
1772
1694
"se.bsnet.fukt.Mandos"})
1773
1695
class ClientDBus(Client, DBusObjectWithProperties):
1774
1696
"""A Client class using D-Bus
1775
1697
1776
1698
Attributes:
1777
1699
dbus_object_path: dbus.ObjectPath
1778
1700
bus: dbus.SystemBus()
1779
1701
"""
1780
1702
1781
1703
runtime_expansions = (Client.runtime_expansions
1782
1704
+ ("dbus_object_path", ))
1783
1705
1784
1706
_interface = "se.recompile.Mandos.Client"
1785
1707
1786
1708
# dbus.service.Object doesn't use super(), so we can't either.
1787
1788
def __init__(self, bus=None, *args, **kwargs):
1709
1710
def __init__(self, bus = None, *args, **kwargs):
1789
1711
self.bus = bus
1790
1712
Client.__init__(self, *args, **kwargs)
1791
1713
# Only now, when this client is initialized, can it show up on
1797
1719
"/clients/" + client_object_name)
1798
1720
DBusObjectWithProperties.__init__(self, self.bus,
1799
1721
self.dbus_object_path)
1800
1722
1801
1723
def notifychangeproperty(transform_func, dbus_name,
1802
1724
type_func=lambda x: x,
1803
1725
variant_level=1,
1805
1727
_interface=_interface):
1806
1728
""" Modify a variable so that it's a property which announces
1807
1729
its changes to DBus.
1808
1730
1809
1731
transform_fun: Function that takes a value and a variant_level
1810
1732
and transforms it to a D-Bus type.
1811
1733
dbus_name: D-Bus name of the variable
1814
1736
variant_level: D-Bus variant level. Default: 1
1815
1737
"""
1816
1738
attrname = "_{}".format(dbus_name)
1817
1739
1818
1740
def setter(self, value):
1819
1741
if hasattr(self, "dbus_object_path"):
1820
1742
if (not hasattr(self, attrname) or
1827
1749
else:
1828
1750
dbus_value = transform_func(
1829
1751
type_func(value),
1830
variant_level=variant_level)
1752
variant_level = variant_level)
1831
1753
self.PropertyChanged(dbus.String(dbus_name),
1832
1754
dbus_value)
1833
1755
self.PropertiesChanged(
1834
1756
_interface,
1835
dbus.Dictionary({dbus.String(dbus_name):
1836
dbus_value}),
1757
dbus.Dictionary({ dbus.String(dbus_name):
1758
dbus_value }),
1837
1759
dbus.Array())
1838
1760
setattr(self, attrname, value)
1839
1761
1840
1762
return property(lambda self: getattr(self, attrname), setter)
1841
1763
1842
1764
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1843
1765
approvals_pending = notifychangeproperty(dbus.Boolean,
1844
1766
"ApprovalPending",
1845
type_func=bool)
1767
type_func = bool)
1846
1768
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1847
1769
last_enabled = notifychangeproperty(datetime_to_dbus,
1848
1770
"LastEnabled")
1849
1771
checker = notifychangeproperty(
1850
1772
dbus.Boolean, "CheckerRunning",
1851
type_func=lambda checker: checker is not None)
1773
type_func = lambda checker: checker is not None)
1852
1774
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1853
1775
"LastCheckedOK")
1854
1776
last_checker_status = notifychangeproperty(dbus.Int16,
1859
1781
"ApprovedByDefault")
1860
1782
approval_delay = notifychangeproperty(
1861
1783
dbus.UInt64, "ApprovalDelay",
1862
type_func=lambda td: td.total_seconds() * 1000)
1784
type_func = lambda td: td.total_seconds() * 1000)
1863
1785
approval_duration = notifychangeproperty(
1864
1786
dbus.UInt64, "ApprovalDuration",
1865
type_func=lambda td: td.total_seconds() * 1000)
1787
type_func = lambda td: td.total_seconds() * 1000)
1866
1788
host = notifychangeproperty(dbus.String, "Host")
1867
1789
timeout = notifychangeproperty(
1868
1790
dbus.UInt64, "Timeout",
1869
type_func=lambda td: td.total_seconds() * 1000)
1791
type_func = lambda td: td.total_seconds() * 1000)
1870
1792
extended_timeout = notifychangeproperty(
1871
1793
dbus.UInt64, "ExtendedTimeout",
1872
type_func=lambda td: td.total_seconds() * 1000)
1794
type_func = lambda td: td.total_seconds() * 1000)
1873
1795
interval = notifychangeproperty(
1874
1796
dbus.UInt64, "Interval",
1875
type_func=lambda td: td.total_seconds() * 1000)
1797
type_func = lambda td: td.total_seconds() * 1000)
1876
1798
checker_command = notifychangeproperty(dbus.String, "Checker")
1877
1799
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1878
1800
invalidate_only=True)
1879
1801
1880
1802
del notifychangeproperty
1881
1803
1882
1804
def __del__(self, *args, **kwargs):
1883
1805
try:
1884
1806
self.remove_from_connection()
1887
1809
if hasattr(DBusObjectWithProperties, "__del__"):
1888
1810
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1889
1811
Client.__del__(self, *args, **kwargs)
1890
1812
1891
1813
def checker_callback(self, source, condition,
1892
1814
connection, command, *args, **kwargs):
1893
1815
ret = Client.checker_callback(self, source, condition,
1909
1831
| self.last_checker_signal),
1910
1832
dbus.String(command))
1911
1833
return ret
1912
1834
1913
1835
def start_checker(self, *args, **kwargs):
1914
1836
old_checker_pid = getattr(self.checker, "pid", None)
1915
1837
r = Client.start_checker(self, *args, **kwargs)
1919
1841
# Emit D-Bus signal
1920
1842
self.CheckerStarted(self.current_checker_command)
1921
1843
return r
1922
1844
1923
1845
def _reset_approved(self):
1924
1846
self.approved = None
1925
1847
return False
1926
1848
1927
1849
def approve(self, value=True):
1928
1850
self.approved = value
1929
1851
GLib.timeout_add(int(self.approval_duration.total_seconds()
1930
1852
* 1000), self._reset_approved)
1931
1853
self.send_changedstate()
1932
1933
# D-Bus methods, signals & properties
1934
1935
# Interfaces
1936
1937
# Signals
1938
1854
1855
## D-Bus methods, signals & properties
1856
1857
## Interfaces
1858
1859
## Signals
1860
1939
1861
# CheckerCompleted - signal
1940
1862
@dbus.service.signal(_interface, signature="nxs")
1941
1863
def CheckerCompleted(self, exitcode, waitstatus, command):
1942
1864
"D-Bus signal"
1943
1865
pass
1944
1866
1945
1867
# CheckerStarted - signal
1946
1868
@dbus.service.signal(_interface, signature="s")
1947
1869
def CheckerStarted(self, command):
1948
1870
"D-Bus signal"
1949
1871
pass
1950
1872
1951
1873
# PropertyChanged - signal
1952
1874
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1953
1875
@dbus.service.signal(_interface, signature="sv")
1954
1876
def PropertyChanged(self, property, value):
1955
1877
"D-Bus signal"
1956
1878
pass
1957
1879
1958
1880
# GotSecret - signal
1959
1881
@dbus.service.signal(_interface)
1960
1882
def GotSecret(self):
1963
1885
server to mandos-client
1964
1886
"""
1965
1887
pass
1966
1888
1967
1889
# Rejected - signal
1968
1890
@dbus.service.signal(_interface, signature="s")
1969
1891
def Rejected(self, reason):
1970
1892
"D-Bus signal"
1971
1893
pass
1972
1894
1973
1895
# NeedApproval - signal
1974
1896
@dbus.service.signal(_interface, signature="tb")
1975
1897
def NeedApproval(self, timeout, default):
1976
1898
"D-Bus signal"
1977
1899
return self.need_approval()
1978
1979
# Methods
1980
1900
1901
## Methods
1902
1981
1903
# Approve - method
1982
1904
@dbus.service.method(_interface, in_signature="b")
1983
1905
def Approve(self, value):
1984
1906
self.approve(value)
1985
1907
1986
1908
# CheckedOK - method
1987
1909
@dbus.service.method(_interface)
1988
1910
def CheckedOK(self):
1989
1911
self.checked_ok()
1990
1912
1991
1913
# Enable - method
1992
1914
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1993
1915
@dbus.service.method(_interface)
1994
1916
def Enable(self):
1995
1917
"D-Bus method"
1996
1918
self.enable()
1997
1919
1998
1920
# StartChecker - method
1999
1921
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2000
1922
@dbus.service.method(_interface)
2001
1923
def StartChecker(self):
2002
1924
"D-Bus method"
2003
1925
self.start_checker()
2004
1926
2005
1927
# Disable - method
2006
1928
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2007
1929
@dbus.service.method(_interface)
2008
1930
def Disable(self):
2009
1931
"D-Bus method"
2010
1932
self.disable()
2011
1933
2012
1934
# StopChecker - method
2013
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2014
1936
@dbus.service.method(_interface)
2015
1937
def StopChecker(self):
2016
1938
self.stop_checker()
2017
2018
# Properties
2019
1939
1940
## Properties
1941
2020
1942
# ApprovalPending - property
2021
1943
@dbus_service_property(_interface, signature="b", access="read")
2022
1944
def ApprovalPending_dbus_property(self):
2023
1945
return dbus.Boolean(bool(self.approvals_pending))
2024
1946
2025
1947
# ApprovedByDefault - property
2026
1948
@dbus_service_property(_interface,
2027
1949
signature="b",
2030
1952
if value is None: # get
2031
1953
return dbus.Boolean(self.approved_by_default)
2032
1954
self.approved_by_default = bool(value)
2033
1955
2034
1956
# ApprovalDelay - property
2035
1957
@dbus_service_property(_interface,
2036
1958
signature="t",
2040
1962
return dbus.UInt64(self.approval_delay.total_seconds()
2041
1963
* 1000)
2042
1964
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2043
1965
2044
1966
# ApprovalDuration - property
2045
1967
@dbus_service_property(_interface,
2046
1968
signature="t",
2050
1972
return dbus.UInt64(self.approval_duration.total_seconds()
2051
1973
* 1000)
2052
1974
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2053
1975
2054
1976
# Name - property
2055
1977
@dbus_annotations(
2056
1978
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2057
1979
@dbus_service_property(_interface, signature="s", access="read")
2058
1980
def Name_dbus_property(self):
2059
1981
return dbus.String(self.name)
2060
2061
# KeyID - property
2062
@dbus_annotations(
2063
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2064
@dbus_service_property(_interface, signature="s", access="read")
2065
def KeyID_dbus_property(self):
2066
return dbus.String(self.key_id)
2067
1982
2068
1983
# Fingerprint - property
2069
1984
@dbus_annotations(
2070
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2071
1986
@dbus_service_property(_interface, signature="s", access="read")
2072
1987
def Fingerprint_dbus_property(self):
2073
1988
return dbus.String(self.fingerprint)
2074
1989
2075
1990
# Host - property
2076
1991
@dbus_service_property(_interface,
2077
1992
signature="s",
2080
1995
if value is None: # get
2081
1996
return dbus.String(self.host)
2082
1997
self.host = str(value)
2083
1998
2084
1999
# Created - property
2085
2000
@dbus_annotations(
2086
2001
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2087
2002
@dbus_service_property(_interface, signature="s", access="read")
2088
2003
def Created_dbus_property(self):
2089
2004
return datetime_to_dbus(self.created)
2090
2005
2091
2006
# LastEnabled - property
2092
2007
@dbus_service_property(_interface, signature="s", access="read")
2093
2008
def LastEnabled_dbus_property(self):
2094
2009
return datetime_to_dbus(self.last_enabled)
2095
2010
2096
2011
# Enabled - property
2097
2012
@dbus_service_property(_interface,
2098
2013
signature="b",
2104
2019
self.enable()
2105
2020
else:
2106
2021
self.disable()
2107
2022
2108
2023
# LastCheckedOK - property
2109
2024
@dbus_service_property(_interface,
2110
2025
signature="s",
2114
2029
self.checked_ok()
2115
2030
return
2116
2031
return datetime_to_dbus(self.last_checked_ok)
2117
2032
2118
2033
# LastCheckerStatus - property
2119
2034
@dbus_service_property(_interface, signature="n", access="read")
2120
2035
def LastCheckerStatus_dbus_property(self):
2121
2036
return dbus.Int16(self.last_checker_status)
2122
2037
2123
2038
# Expires - property
2124
2039
@dbus_service_property(_interface, signature="s", access="read")
2125
2040
def Expires_dbus_property(self):
2126
2041
return datetime_to_dbus(self.expires)
2127
2042
2128
2043
# LastApprovalRequest - property
2129
2044
@dbus_service_property(_interface, signature="s", access="read")
2130
2045
def LastApprovalRequest_dbus_property(self):
2131
2046
return datetime_to_dbus(self.last_approval_request)
2132
2047
2133
2048
# Timeout - property
2134
2049
@dbus_service_property(_interface,
2135
2050
signature="t",
2154
2069
self.disable_initiator_tag = GLib.timeout_add(
2155
2070
int((self.expires - now).total_seconds() * 1000),
2156
2071
self.disable)
2157
2072
2158
2073
# ExtendedTimeout - property
2159
2074
@dbus_service_property(_interface,
2160
2075
signature="t",
2164
2079
return dbus.UInt64(self.extended_timeout.total_seconds()
2165
2080
* 1000)
2166
2081
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2167
2082
2168
2083
# Interval - property
2169
2084
@dbus_service_property(_interface,
2170
2085
signature="t",
2180
2095
GLib.source_remove(self.checker_initiator_tag)
2181
2096
self.checker_initiator_tag = GLib.timeout_add(
2182
2097
value, self.start_checker)
2183
self.start_checker() # Start one now, too
2184
2098
self.start_checker() # Start one now, too
2099
2185
2100
# Checker - property
2186
2101
@dbus_service_property(_interface,
2187
2102
signature="s",
2190
2105
if value is None: # get
2191
2106
return dbus.String(self.checker_command)
2192
2107
self.checker_command = str(value)
2193
2108
2194
2109
# CheckerRunning - property
2195
2110
@dbus_service_property(_interface,
2196
2111
signature="b",
2202
2117
self.start_checker()
2203
2118
else:
2204
2119
self.stop_checker()
2205
2120
2206
2121
# ObjectPath - property
2207
2122
@dbus_annotations(
2208
2123
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2209
2124
"org.freedesktop.DBus.Deprecated": "true"})
2210
2125
@dbus_service_property(_interface, signature="o", access="read")
2211
2126
def ObjectPath_dbus_property(self):
2212
return self.dbus_object_path # is already a dbus.ObjectPath
2213
2127
return self.dbus_object_path # is already a dbus.ObjectPath
2128
2214
2129
# Secret = property
2215
2130
@dbus_annotations(
2216
2131
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2221
2136
byte_arrays=True)
2222
2137
def Secret_dbus_property(self, value):
2223
2138
self.secret = bytes(value)
2224
2139
2225
2140
del _interface
2226
2141
2227
2142
2228
class ProxyClient:
2229
def __init__(self, child_pipe, key_id, fpr, address):
2143
class ProxyClient(object):
2144
def __init__(self, child_pipe, fpr, address):
2230
2145
self._pipe = child_pipe
2231
self._pipe.send(('init', key_id, fpr, address))
2146
self._pipe.send(('init', fpr, address))
2232
2147
if not self._pipe.recv():
2233
raise KeyError(key_id or fpr)
2234
2148
raise KeyError(fpr)
2149
2235
2150
def __getattribute__(self, name):
2236
2151
if name == '_pipe':
2237
2152
return super(ProxyClient, self).__getattribute__(name)
2240
2155
if data[0] == 'data':
2241
2156
return data[1]
2242
2157
if data[0] == 'function':
2243
2158
2244
2159
def func(*args, **kwargs):
2245
2160
self._pipe.send(('funcall', name, args, kwargs))
2246
2161
return self._pipe.recv()[1]
2247
2162
2248
2163
return func
2249
2164
2250
2165
def __setattr__(self, name, value):
2251
2166
if name == '_pipe':
2252
2167
return super(ProxyClient, self).__setattr__(name, value)
2255
2170
2256
2171
class ClientHandler(socketserver.BaseRequestHandler, object):
2257
2172
"""A class to handle client connections.
2258
2173
2259
2174
Instantiated once for each connection to handle it.
2260
2175
Note: This will run in its own forked process."""
2261
2176
2262
2177
def handle(self):
2263
2178
with contextlib.closing(self.server.child_pipe) as child_pipe:
2264
2179
logger.info("TCP connection from: %s",
2265
2180
str(self.client_address))
2266
2181
logger.debug("Pipe FD: %d",
2267
2182
self.server.child_pipe.fileno())
2268
2183
2269
2184
session = gnutls.ClientSession(self.request)
2270
2271
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2272
# "+AES-256-CBC", "+SHA1",
2273
# "+COMP-NULL", "+CTYPE-OPENPGP",
2274
# "+DHE-DSS"))
2185
2186
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
# "+AES-256-CBC", "+SHA1",
2188
# "+COMP-NULL", "+CTYPE-OPENPGP",
2189
# "+DHE-DSS"))
2275
2190
# Use a fallback default, since this MUST be set.
2276
2191
priority = self.server.gnutls_priority
2277
2192
if priority is None:
2279
2194
gnutls.priority_set_direct(session._c_object,
2280
2195
priority.encode("utf-8"),
2281
2196
None)
2282
2197
2283
2198
# Start communication using the Mandos protocol
2284
2199
# Get protocol number
2285
2200
line = self.request.makefile().readline()
2290
2205
except (ValueError, IndexError, RuntimeError) as error:
2291
2206
logger.error("Unknown protocol version: %s", error)
2292
2207
return
2293
2208
2294
2209
# Start GnuTLS connection
2295
2210
try:
2296
2211
session.handshake()
2300
2215
# established. Just abandon the request.
2301
2216
return
2302
2217
logger.debug("Handshake succeeded")
2303
2218
2304
2219
approval_required = False
2305
2220
try:
2306
if gnutls.has_rawpk:
2307
fpr = b""
2308
try:
2309
key_id = self.key_id(
2310
self.peer_certificate(session))
2311
except (TypeError, gnutls.Error) as error:
2312
logger.warning("Bad certificate: %s", error)
2313
return
2314
logger.debug("Key ID: %s", key_id)
2315
2316
else:
2317
key_id = b""
2318
try:
2319
fpr = self.fingerprint(
2320
self.peer_certificate(session))
2321
except (TypeError, gnutls.Error) as error:
2322
logger.warning("Bad certificate: %s", error)
2323
return
2324
logger.debug("Fingerprint: %s", fpr)
2325
2326
try:
2327
client = ProxyClient(child_pipe, key_id, fpr,
2221
try:
2222
fpr = self.fingerprint(
2223
self.peer_certificate(session))
2224
except (TypeError, gnutls.Error) as error:
2225
logger.warning("Bad certificate: %s", error)
2226
return
2227
logger.debug("Fingerprint: %s", fpr)
2228
2229
try:
2230
client = ProxyClient(child_pipe, fpr,
2328
2231
self.client_address)
2329
2232
except KeyError:
2330
2233
return
2331
2234
2332
2235
if client.approval_delay:
2333
2236
delay = client.approval_delay
2334
2237
client.approvals_pending += 1
2335
2238
approval_required = True
2336
2239
2337
2240
while True:
2338
2241
if not client.enabled:
2339
2242
logger.info("Client %s is disabled",
2342
2245
# Emit D-Bus signal
2343
2246
client.Rejected("Disabled")
2344
2247
return
2345
2248
2346
2249
if client.approved or not client.approval_delay:
2347
# We are approved or approval is disabled
2250
#We are approved or approval is disabled
2348
2251
break
2349
2252
elif client.approved is None:
2350
2253
logger.info("Client %s needs approval",
2361
2264
# Emit D-Bus signal
2362
2265
client.Rejected("Denied")
2363
2266
return
2364
2365
# wait until timeout or approved
2267
2268
#wait until timeout or approved
2366
2269
time = datetime.datetime.now()
2367
2270
client.changedstate.acquire()
2368
2271
client.changedstate.wait(delay.total_seconds())
2381
2284
break
2382
2285
else:
2383
2286
delay -= time2 - time
2384
2287
2385
2288
try:
2386
2289
session.send(client.secret)
2387
2290
except gnutls.Error as error:
2388
2291
logger.warning("gnutls send failed",
2389
exc_info=error)
2292
exc_info = error)
2390
2293
return
2391
2294
2392
2295
logger.info("Sending secret to %s", client.name)
2393
2296
# bump the timeout using extended_timeout
2394
2297
client.bump_timeout(client.extended_timeout)
2395
2298
if self.server.use_dbus:
2396
2299
# Emit D-Bus signal
2397
2300
client.GotSecret()
2398
2301
2399
2302
finally:
2400
2303
if approval_required:
2401
2304
client.approvals_pending -= 1
2404
2307
except gnutls.Error as error:
2405
2308
logger.warning("GnuTLS bye failed",
2406
2309
exc_info=error)
2407
2310
2408
2311
@staticmethod
2409
2312
def peer_certificate(session):
2410
"Return the peer's certificate as a bytestring"
2411
try:
2412
cert_type = gnutls.certificate_type_get2(session._c_object,
2413
gnutls.CTYPE_PEERS)
2414
except AttributeError:
2415
cert_type = gnutls.certificate_type_get(session._c_object)
2416
if gnutls.has_rawpk:
2417
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2418
else:
2419
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2420
# If not a valid certificate type...
2421
if cert_type not in valid_cert_types:
2422
logger.info("Cert type %r not in %r", cert_type,
2423
valid_cert_types)
2313
"Return the peer's OpenPGP certificate as a bytestring"
2314
# If not an OpenPGP certificate...
2315
if (gnutls.certificate_type_get(session._c_object)
2316
!= gnutls.CRT_OPENPGP):
2424
2317
# ...return invalid data
2425
2318
return b""
2426
2319
list_size = ctypes.c_uint(1)
2432
2325
return None
2433
2326
cert = cert_list[0]
2434
2327
return ctypes.string_at(cert.data, cert.size)
2435
2436
@staticmethod
2437
def key_id(certificate):
2438
"Convert a certificate bytestring to a hexdigit key ID"
2439
# New GnuTLS "datum" with the public key
2440
datum = gnutls.datum_t(
2441
ctypes.cast(ctypes.c_char_p(certificate),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.c_uint(len(certificate)))
2444
# XXX all these need to be created in the gnutls "module"
2445
# New empty GnuTLS certificate
2446
pubkey = gnutls.pubkey_t()
2447
gnutls.pubkey_init(ctypes.byref(pubkey))
2448
# Import the raw public key into the certificate
2449
gnutls.pubkey_import(pubkey,
2450
ctypes.byref(datum),
2451
gnutls.X509_FMT_DER)
2452
# New buffer for the key ID
2453
buf = ctypes.create_string_buffer(32)
2454
buf_len = ctypes.c_size_t(len(buf))
2455
# Get the key ID from the raw public key into the buffer
2456
gnutls.pubkey_get_key_id(pubkey,
2457
gnutls.KEYID_USE_SHA256,
2458
ctypes.cast(ctypes.byref(buf),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.byref(buf_len))
2461
# Deinit the certificate
2462
gnutls.pubkey_deinit(pubkey)
2463
2464
# Convert the buffer to a Python bytestring
2465
key_id = ctypes.string_at(buf, buf_len.value)
2466
# Convert the bytestring to hexadecimal notation
2467
hex_key_id = binascii.hexlify(key_id).upper()
2468
return hex_key_id
2469
2328
2470
2329
@staticmethod
2471
2330
def fingerprint(openpgp):
2472
2331
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2487
2346
ctypes.byref(crtverify))
2488
2347
if crtverify.value != 0:
2489
2348
gnutls.openpgp_crt_deinit(crt)
2490
raise gnutls.CertificateSecurityError(code
2491
=crtverify.value)
2349
raise gnutls.CertificateSecurityError("Verify failed")
2492
2350
# New buffer for the fingerprint
2493
2351
buf = ctypes.create_string_buffer(20)
2494
2352
buf_len = ctypes.c_size_t()
2504
2362
return hex_fpr
2505
2363
2506
2364
2507
class MultiprocessingMixIn:
2365
class MultiprocessingMixIn(object):
2508
2366
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2509
2367
2510
2368
def sub_process_main(self, request, address):
2511
2369
try:
2512
2370
self.finish_request(request, address)
2513
2371
except Exception:
2514
2372
self.handle_error(request, address)
2515
2373
self.close_request(request)
2516
2374
2517
2375
def process_request(self, request, address):
2518
2376
"""Start a new process to process the request."""
2519
proc = multiprocessing.Process(target=self.sub_process_main,
2520
args=(request, address))
2377
proc = multiprocessing.Process(target = self.sub_process_main,
2378
args = (request, address))
2521
2379
proc.start()
2522
2380
return proc
2523
2381
2524
2382
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2383
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2526
2384
""" adds a pipe to the MixIn """
2527
2385
2528
2386
def process_request(self, request, client_address):
2529
2387
"""Overrides and wraps the original process_request().
2530
2388
2531
2389
This function creates a new pipe in self.pipe
2532
2390
"""
2533
2391
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2534
2392
2535
2393
proc = MultiprocessingMixIn.process_request(self, request,
2536
2394
client_address)
2537
2395
self.child_pipe.close()
2538
2396
self.add_pipe(parent_pipe, proc)
2539
2397
2540
2398
def add_pipe(self, parent_pipe, proc):
2541
2399
"""Dummy function; override as necessary"""
2542
2400
raise NotImplementedError()
2543
2401
2544
2402
2545
2403
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2546
socketserver.TCPServer):
2404
socketserver.TCPServer, object):
2547
2405
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2548
2406
2549
2407
Attributes:
2550
2408
enabled: Boolean; whether this server is activated yet
2551
2409
interface: None or a network interface name (string)
2552
2410
use_ipv6: Boolean; to use IPv6 or not
2553
2411
"""
2554
2412
2555
2413
def __init__(self, server_address, RequestHandlerClass,
2556
2414
interface=None,
2557
2415
use_ipv6=True,
2567
2425
self.socketfd = socketfd
2568
2426
# Save the original socket.socket() function
2569
2427
self.socket_socket = socket.socket
2570
2571
2428
# To implement --socket, we monkey patch socket.socket.
2572
#
2429
#
2573
2430
# (When socketserver.TCPServer is a new-style class, we
2574
2431
# could make self.socket into a property instead of monkey
2575
2432
# patching socket.socket.)
2576
#
2433
#
2577
2434
# Create a one-time-only replacement for socket.socket()
2578
2435
@functools.wraps(socket.socket)
2579
2436
def socket_wrapper(*args, **kwargs):
2591
2448
# socket_wrapper(), if socketfd was set.
2592
2449
socketserver.TCPServer.__init__(self, server_address,
2593
2450
RequestHandlerClass)
2594
2451
2595
2452
def server_bind(self):
2596
2453
"""This overrides the normal server_bind() function
2597
2454
to bind to an interface if one was specified, and also NOT to
2622
2479
raise
2623
2480
# Only bind(2) the socket if we really need to.
2624
2481
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2627
2482
if not self.server_address[0]:
2628
2483
if self.address_family == socket.AF_INET6:
2629
any_address = "::" # in6addr_any
2484
any_address = "::" # in6addr_any
2630
2485
else:
2631
any_address = "0.0.0.0" # INADDR_ANY
2486
any_address = "0.0.0.0" # INADDR_ANY
2632
2487
self.server_address = (any_address,
2633
2488
self.server_address[1])
2634
2489
elif not self.server_address[1]:
2644
2499
2645
2500
class MandosServer(IPv6_TCPServer):
2646
2501
"""Mandos server.
2647
2502
2648
2503
Attributes:
2649
2504
clients: set of Client objects
2650
2505
gnutls_priority GnuTLS priority string
2651
2506
use_dbus: Boolean; to emit D-Bus signals or not
2652
2507
2653
2508
Assumes a GLib.MainLoop event loop.
2654
2509
"""
2655
2510
2656
2511
def __init__(self, server_address, RequestHandlerClass,
2657
2512
interface=None,
2658
2513
use_ipv6=True,
2668
2523
self.gnutls_priority = gnutls_priority
2669
2524
IPv6_TCPServer.__init__(self, server_address,
2670
2525
RequestHandlerClass,
2671
interface=interface,
2672
use_ipv6=use_ipv6,
2673
socketfd=socketfd)
2674
2526
interface = interface,
2527
use_ipv6 = use_ipv6,
2528
socketfd = socketfd)
2529
2675
2530
def server_activate(self):
2676
2531
if self.enabled:
2677
2532
return socketserver.TCPServer.server_activate(self)
2678
2533
2679
2534
def enable(self):
2680
2535
self.enabled = True
2681
2536
2682
2537
def add_pipe(self, parent_pipe, proc):
2683
2538
# Call "handle_ipc" for both data and EOF events
2684
2539
GLib.io_add_watch(
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2540
parent_pipe.fileno(),
2541
GLib.IO_IN | GLib.IO_HUP,
2687
2542
functools.partial(self.handle_ipc,
2688
parent_pipe=parent_pipe,
2689
proc=proc))
2690
2543
parent_pipe = parent_pipe,
2544
proc = proc))
2545
2691
2546
def handle_ipc(self, source, condition,
2692
2547
parent_pipe=None,
2693
proc=None,
2548
proc = None,
2694
2549
client_object=None):
2695
2550
# error, or the other end of multiprocessing.Pipe has closed
2696
2551
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2697
2552
# Wait for other process to exit
2698
2553
proc.join()
2699
2554
return False
2700
2555
2701
2556
# Read a request from the child
2702
2557
request = parent_pipe.recv()
2703
2558
command = request[0]
2704
2559
2705
2560
if command == 'init':
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2709
2561
fpr = request[1]
2562
address = request[2]
2563
2710
2564
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2712
continue
2713
if key_id and c.key_id == key_id:
2714
client = c
2715
break
2716
if fpr and c.fingerprint == fpr:
2565
if c.fingerprint == fpr:
2717
2566
client = c
2718
2567
break
2719
2568
else:
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2569
logger.info("Client not found for fingerprint: %s, ad"
2570
"dress: %s", fpr, address)
2722
2571
if self.use_dbus:
2723
2572
# Emit D-Bus signal
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2573
mandos_dbus_service.ClientNotFound(fpr,
2725
2574
address[0])
2726
2575
parent_pipe.send(False)
2727
2576
return False
2728
2577
2729
2578
GLib.io_add_watch(
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2579
parent_pipe.fileno(),
2580
GLib.IO_IN | GLib.IO_HUP,
2732
2581
functools.partial(self.handle_ipc,
2733
parent_pipe=parent_pipe,
2734
proc=proc,
2735
client_object=client))
2582
parent_pipe = parent_pipe,
2583
proc = proc,
2584
client_object = client))
2736
2585
parent_pipe.send(True)
2737
2586
# remove the old hook in favor of the new above hook on
2738
2587
# same fileno
2741
2590
funcname = request[1]
2742
2591
args = request[2]
2743
2592
kwargs = request[3]
2744
2593
2745
2594
parent_pipe.send(('data', getattr(client_object,
2746
2595
funcname)(*args,
2747
2596
**kwargs)))
2748
2597
2749
2598
if command == 'getattr':
2750
2599
attrname = request[1]
2751
2600
if isinstance(client_object.__getattribute__(attrname),
2754
2603
else:
2755
2604
parent_pipe.send((
2756
2605
'data', client_object.__getattribute__(attrname)))
2757
2606
2758
2607
if command == 'setattr':
2759
2608
attrname = request[1]
2760
2609
value = request[2]
2761
2610
setattr(client_object, attrname, value)
2762
2611
2763
2612
return True
2764
2613
2765
2614
2766
2615
def rfc3339_duration_to_delta(duration):
2767
2616
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2768
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
True
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
True
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
True
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
True
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
True
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
True
2617
2618
>>> rfc3339_duration_to_delta("P7D")
2619
datetime.timedelta(7)
2620
>>> rfc3339_duration_to_delta("PT60S")
2621
datetime.timedelta(0, 60)
2622
>>> rfc3339_duration_to_delta("PT60M")
2623
datetime.timedelta(0, 3600)
2624
>>> rfc3339_duration_to_delta("PT24H")
2625
datetime.timedelta(1)
2626
>>> rfc3339_duration_to_delta("P1W")
2627
datetime.timedelta(7)
2628
>>> rfc3339_duration_to_delta("PT5M30S")
2629
datetime.timedelta(0, 330)
2630
>>> rfc3339_duration_to_delta("P1DT3M20S")
2631
datetime.timedelta(1, 200)
2783
2632
"""
2784
2633
2785
2634
# Parsing an RFC 3339 duration with regular expressions is not
2786
2635
# possible - there would have to be multiple places for the same
2787
2636
# values, like seconds. The current code, while more esoteric, is
2788
2637
# cleaner without depending on a parsing library. If Python had a
2789
2638
# built-in library for parsing we would use it, but we'd like to
2790
2639
# avoid excessive use of external libraries.
2791
2640
2792
2641
# New type for defining tokens, syntax, and semantics all-in-one
2793
2642
Token = collections.namedtuple("Token", (
2794
2643
"regexp", # To match token; if "value" is not None, must have
2827
2676
frozenset((token_year, token_month,
2828
2677
token_day, token_time,
2829
2678
token_week)))
2830
# Define starting values:
2831
# Value so far
2832
value = datetime.timedelta()
2679
# Define starting values
2680
value = datetime.timedelta() # Value so far
2833
2681
found_token = None
2834
# Following valid tokens
2835
followers = frozenset((token_duration, ))
2836
# String left to parse
2837
s = duration
2682
followers = frozenset((token_duration, )) # Following valid tokens
2683
s = duration # String left to parse
2838
2684
# Loop until end token is found
2839
2685
while found_token is not token_end:
2840
2686
# Search for any currently valid tokens
2864
2710
2865
2711
def string_to_delta(interval):
2866
2712
"""Parse a string and return a datetime.timedelta
2867
2868
>>> string_to_delta('7d') == datetime.timedelta(7)
2869
True
2870
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
True
2872
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
True
2874
>>> string_to_delta('24h') == datetime.timedelta(1)
2875
True
2876
>>> string_to_delta('1w') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2879
True
2713
2714
>>> string_to_delta('7d')
2715
datetime.timedelta(7)
2716
>>> string_to_delta('60s')
2717
datetime.timedelta(0, 60)
2718
>>> string_to_delta('60m')
2719
datetime.timedelta(0, 3600)
2720
>>> string_to_delta('24h')
2721
datetime.timedelta(1)
2722
>>> string_to_delta('1w')
2723
datetime.timedelta(7)
2724
>>> string_to_delta('5m 30s')
2725
datetime.timedelta(0, 330)
2880
2726
"""
2881
2727
2882
2728
try:
2883
2729
return rfc3339_duration_to_delta(interval)
2884
2730
except ValueError:
2885
2731
pass
2886
2732
2887
2733
timevalue = datetime.timedelta(0)
2888
2734
for s in interval.split():
2889
2735
try:
2907
2753
return timevalue
2908
2754
2909
2755
2910
def daemon(nochdir=False, noclose=False):
2756
def daemon(nochdir = False, noclose = False):
2911
2757
"""See daemon(3). Standard BSD Unix function.
2912
2758
2913
2759
This should really exist as os.daemon, but it doesn't (yet)."""
2914
2760
if os.fork():
2915
2761
sys.exit()
2933
2779
2934
2780
2935
2781
def main():
2936
2782
2937
2783
##################################################################
2938
2784
# Parsing of options, both command line and config file
2939
2785
2940
2786
parser = argparse.ArgumentParser()
2941
2787
parser.add_argument("-v", "--version", action="version",
2942
version="%(prog)s {}".format(version),
2788
version = "%(prog)s {}".format(version),
2943
2789
help="show version number and exit")
2944
2790
parser.add_argument("-i", "--interface", metavar="IF",
2945
2791
help="Bind to interface IF")
2981
2827
parser.add_argument("--no-zeroconf", action="store_false",
2982
2828
dest="zeroconf", help="Do not use Zeroconf",
2983
2829
default=None)
2984
2830
2985
2831
options = parser.parse_args()
2986
2832
2833
if options.check:
2834
import doctest
2835
fail_count, test_count = doctest.testmod()
2836
sys.exit(os.EX_OK if fail_count == 0 else 1)
2837
2987
2838
# Default values for config file for server-global settings
2988
if gnutls.has_rawpk:
2989
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2990
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2991
else:
2992
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2993
":+SIGN-DSA-SHA256")
2994
server_defaults = {"interface": "",
2995
"address": "",
2996
"port": "",
2997
"debug": "False",
2998
"priority": priority,
2999
"servicename": "Mandos",
3000
"use_dbus": "True",
3001
"use_ipv6": "True",
3002
"debuglevel": "",
3003
"restore": "True",
3004
"socket": "",
3005
"statedir": "/var/lib/mandos",
3006
"foreground": "False",
3007
"zeroconf": "True",
3008
}
3009
del priority
3010
2839
server_defaults = { "interface": "",
2840
"address": "",
2841
"port": "",
2842
"debug": "False",
2843
"priority":
2844
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2845
":+SIGN-DSA-SHA256",
2846
"servicename": "Mandos",
2847
"use_dbus": "True",
2848
"use_ipv6": "True",
2849
"debuglevel": "",
2850
"restore": "True",
2851
"socket": "",
2852
"statedir": "/var/lib/mandos",
2853
"foreground": "False",
2854
"zeroconf": "True",
2855
}
2856
3011
2857
# Parse config file for server-global settings
3012
server_config = configparser.ConfigParser(server_defaults)
2858
server_config = configparser.SafeConfigParser(server_defaults)
3013
2859
del server_defaults
3014
2860
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3015
# Convert the ConfigParser object to a dict
2861
# Convert the SafeConfigParser object to a dict
3016
2862
server_settings = server_config.defaults()
3017
2863
# Use the appropriate methods on the non-string config options
3018
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3019
"foreground", "zeroconf"):
2864
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3020
2865
server_settings[option] = server_config.getboolean("DEFAULT",
3021
2866
option)
3022
2867
if server_settings["port"]:
3032
2877
server_settings["socket"] = os.dup(server_settings
3033
2878
["socket"])
3034
2879
del server_config
3035
2880
3036
2881
# Override the settings from the config file with command line
3037
2882
# options, if set.
3038
2883
for option in ("interface", "address", "port", "debug",
3056
2901
if server_settings["debug"]:
3057
2902
server_settings["foreground"] = True
3058
2903
# Now we have our good server settings in "server_settings"
3059
2904
3060
2905
##################################################################
3061
2906
3062
2907
if (not server_settings["zeroconf"]
3063
2908
and not (server_settings["port"]
3064
2909
or server_settings["socket"] != "")):
3065
2910
parser.error("Needs port or socket to work without Zeroconf")
3066
2911
3067
2912
# For convenience
3068
2913
debug = server_settings["debug"]
3069
2914
debuglevel = server_settings["debuglevel"]
3073
2918
stored_state_file)
3074
2919
foreground = server_settings["foreground"]
3075
2920
zeroconf = server_settings["zeroconf"]
3076
2921
3077
2922
if debug:
3078
2923
initlogger(debug, logging.DEBUG)
3079
2924
else:
3082
2927
else:
3083
2928
level = getattr(logging, debuglevel.upper())
3084
2929
initlogger(debug, level)
3085
2930
3086
2931
if server_settings["servicename"] != "Mandos":
3087
2932
syslogger.setFormatter(
3088
2933
logging.Formatter('Mandos ({}) [%(process)d]:'
3089
2934
' %(levelname)s: %(message)s'.format(
3090
2935
server_settings["servicename"])))
3091
2936
3092
2937
# Parse config file with clients
3093
client_config = configparser.ConfigParser(Client.client_defaults)
2938
client_config = configparser.SafeConfigParser(Client
2939
.client_defaults)
3094
2940
client_config.read(os.path.join(server_settings["configdir"],
3095
2941
"clients.conf"))
3096
2942
3097
2943
global mandos_dbus_service
3098
2944
mandos_dbus_service = None
3099
2945
3100
2946
socketfd = None
3101
2947
if server_settings["socket"] != "":
3102
2948
socketfd = server_settings["socket"]
3118
2964
except IOError as e:
3119
2965
logger.error("Could not open file %r", pidfilename,
3120
2966
exc_info=e)
3121
2967
3122
2968
for name, group in (("_mandos", "_mandos"),
3123
2969
("mandos", "mandos"),
3124
2970
("nobody", "nogroup")):
3142
2988
.format(uid, gid, os.strerror(error.errno)))
3143
2989
if error.errno != errno.EPERM:
3144
2990
raise
3145
2991
3146
2992
if debug:
3147
2993
# Enable all possible GnuTLS debugging
3148
2994
3149
2995
# "Use a log level over 10 to enable all debugging options."
3150
2996
# - GnuTLS manual
3151
2997
gnutls.global_set_log_level(11)
3152
2998
3153
2999
@gnutls.log_func
3154
3000
def debug_gnutls(level, string):
3155
3001
logger.debug("GnuTLS: %s", string[:-1])
3156
3002
3157
3003
gnutls.global_set_log_function(debug_gnutls)
3158
3004
3159
3005
# Redirect stdin so all checkers get /dev/null
3160
3006
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3161
3007
os.dup2(null, sys.stdin.fileno())
3162
3008
if null > 2:
3163
3009
os.close(null)
3164
3010
3165
3011
# Need to fork before connecting to D-Bus
3166
3012
if not foreground:
3167
3013
# Close all input and output, do double fork, etc.
3168
3014
daemon()
3169
3170
if gi.version_info < (3, 10, 2):
3171
# multiprocessing will use threads, so before we use GLib we
3172
# need to inform GLib that threads will be used.
3173
GLib.threads_init()
3174
3015
3016
# multiprocessing will use threads, so before we use GLib we need
3017
# to inform GLib that threads will be used.
3018
GLib.threads_init()
3019
3175
3020
global main_loop
3176
3021
# From the Avahi example code
3177
3022
DBusGMainLoop(set_as_default=True)
3194
3039
if zeroconf:
3195
3040
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3196
3041
service = AvahiServiceToSyslog(
3197
name=server_settings["servicename"],
3198
servicetype="_mandos._tcp",
3199
protocol=protocol,
3200
bus=bus)
3042
name = server_settings["servicename"],
3043
servicetype = "_mandos._tcp",
3044
protocol = protocol,
3045
bus = bus)
3201
3046
if server_settings["interface"]:
3202
3047
service.interface = if_nametoindex(
3203
3048
server_settings["interface"].encode("utf-8"))
3204
3049
3205
3050
global multiprocessing_manager
3206
3051
multiprocessing_manager = multiprocessing.Manager()
3207
3052
3208
3053
client_class = Client
3209
3054
if use_dbus:
3210
client_class = functools.partial(ClientDBus, bus=bus)
3211
3055
client_class = functools.partial(ClientDBus, bus = bus)
3056
3212
3057
client_settings = Client.config_parser(client_config)
3213
3058
old_client_settings = {}
3214
3059
clients_data = {}
3215
3060
3216
3061
# This is used to redirect stdout and stderr for checker processes
3217
3062
global wnull
3218
wnull = open(os.devnull, "w") # A writable /dev/null
3063
wnull = open(os.devnull, "w") # A writable /dev/null
3219
3064
# Only used if server is running in foreground but not in debug
3220
3065
# mode
3221
3066
if debug or not foreground:
3222
3067
wnull.close()
3223
3068
3224
3069
# Get client data and settings from last running state.
3225
3070
if server_settings["restore"]:
3226
3071
try:
3227
3072
with open(stored_state_path, "rb") as stored_state:
3228
if sys.version_info.major == 2:
3073
if sys.version_info.major == 2:
3229
3074
clients_data, old_client_settings = pickle.load(
3230
3075
stored_state)
3231
3076
else:
3232
3077
bytes_clients_data, bytes_old_client_settings = (
3233
pickle.load(stored_state, encoding="bytes"))
3234
# Fix bytes to strings
3235
# clients_data
3078
pickle.load(stored_state, encoding = "bytes"))
3079
### Fix bytes to strings
3080
## clients_data
3236
3081
# .keys()
3237
clients_data = {(key.decode("utf-8")
3238
if isinstance(key, bytes)
3239
else key): value
3240
for key, value in
3241
bytes_clients_data.items()}
3082
clients_data = { (key.decode("utf-8")
3083
if isinstance(key, bytes)
3084
else key): value
3085
for key, value in
3086
bytes_clients_data.items() }
3242
3087
del bytes_clients_data
3243
3088
for key in clients_data:
3244
value = {(k.decode("utf-8")
3245
if isinstance(k, bytes) else k): v
3246
for k, v in
3247
clients_data[key].items()}
3089
value = { (k.decode("utf-8")
3090
if isinstance(k, bytes) else k): v
3091
for k, v in
3092
clients_data[key].items() }
3248
3093
clients_data[key] = value
3249
3094
# .client_structure
3250
3095
value["client_structure"] = [
3251
3096
(s.decode("utf-8")
3252
3097
if isinstance(s, bytes)
3253
3098
else s) for s in
3254
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3099
value["client_structure"] ]
3100
# .name & .host
3101
for k in ("name", "host"):
3257
3102
if isinstance(value[k], bytes):
3258
3103
value[k] = value[k].decode("utf-8")
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
# old_client_settings
3104
## old_client_settings
3264
3105
# .keys()
3265
3106
old_client_settings = {
3266
3107
(key.decode("utf-8")
3267
3108
if isinstance(key, bytes)
3268
3109
else key): value
3269
3110
for key, value in
3270
bytes_old_client_settings.items()}
3111
bytes_old_client_settings.items() }
3271
3112
del bytes_old_client_settings
3272
# .host and .checker_command
3113
# .host
3273
3114
for value in old_client_settings.values():
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3277
.decode("utf-8"))
3115
if isinstance(value["host"], bytes):
3116
value["host"] = (value["host"]
3117
.decode("utf-8"))
3278
3118
os.remove(stored_state_path)
3279
3119
except IOError as e:
3280
3120
if e.errno == errno.ENOENT:
3288
3128
logger.warning("Could not load persistent state: "
3289
3129
"EOFError:",
3290
3130
exc_info=e)
3291
3131
3292
3132
with PGPEngine() as pgp:
3293
3133
for client_name, client in clients_data.items():
3294
3134
# Skip removed clients
3295
3135
if client_name not in client_settings:
3296
3136
continue
3297
3137
3298
3138
# Decide which value to use after restoring saved state.
3299
3139
# We have three different values: Old config file,
3300
3140
# new config file, and saved state.
3311
3151
client[name] = value
3312
3152
except KeyError:
3313
3153
pass
3314
3154
3315
3155
# Clients who has passed its expire date can still be
3316
3156
# enabled if its last checker was successful. A Client
3317
3157
# whose checker succeeded before we stored its state is
3350
3190
client_name))
3351
3191
client["secret"] = (client_settings[client_name]
3352
3192
["secret"])
3353
3193
3354
3194
# Add/remove clients based on new changes made to config
3355
3195
for client_name in (set(old_client_settings)
3356
3196
- set(client_settings)):
3358
3198
for client_name in (set(client_settings)
3359
3199
- set(old_client_settings)):
3360
3200
clients_data[client_name] = client_settings[client_name]
3361
3201
3362
3202
# Create all client objects
3363
3203
for client_name, client in clients_data.items():
3364
3204
tcp_server.clients[client_name] = client_class(
3365
name=client_name,
3366
settings=client,
3367
server_settings=server_settings)
3368
3205
name = client_name,
3206
settings = client,
3207
server_settings = server_settings)
3208
3369
3209
if not tcp_server.clients:
3370
3210
logger.warning("No clients defined")
3371
3211
3372
3212
if not foreground:
3373
3213
if pidfile is not None:
3374
3214
pid = os.getpid()
3380
3220
pidfilename, pid)
3381
3221
del pidfile
3382
3222
del pidfilename
3383
3223
3384
3224
for termsig in (signal.SIGHUP, signal.SIGTERM):
3385
3225
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3386
3226
lambda: main_loop.quit() and False)
3387
3227
3388
3228
if use_dbus:
3389
3229
3390
3230
@alternate_dbus_interfaces(
3391
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3231
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3392
3232
class MandosDBusService(DBusObjectWithObjectManager):
3393
3233
"""A D-Bus proxy object"""
3394
3234
3395
3235
def __init__(self):
3396
3236
dbus.service.Object.__init__(self, bus, "/")
3397
3237
3398
3238
_interface = "se.recompile.Mandos"
3399
3239
3400
3240
@dbus.service.signal(_interface, signature="o")
3401
3241
def ClientAdded(self, objpath):
3402
3242
"D-Bus signal"
3403
3243
pass
3404
3244
3405
3245
@dbus.service.signal(_interface, signature="ss")
3406
def ClientNotFound(self, key_id, address):
3246
def ClientNotFound(self, fingerprint, address):
3407
3247
"D-Bus signal"
3408
3248
pass
3409
3249
3410
3250
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3411
3251
"true"})
3412
3252
@dbus.service.signal(_interface, signature="os")
3413
3253
def ClientRemoved(self, objpath, name):
3414
3254
"D-Bus signal"
3415
3255
pass
3416
3256
3417
3257
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3418
3258
"true"})
3419
3259
@dbus.service.method(_interface, out_signature="ao")
3421
3261
"D-Bus method"
3422
3262
return dbus.Array(c.dbus_object_path for c in
3423
3263
tcp_server.clients.values())
3424
3264
3425
3265
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3426
3266
"true"})
3427
3267
@dbus.service.method(_interface,
3429
3269
def GetAllClientsWithProperties(self):
3430
3270
"D-Bus method"
3431
3271
return dbus.Dictionary(
3432
{c.dbus_object_path: c.GetAll(
3272
{ c.dbus_object_path: c.GetAll(
3433
3273
"se.recompile.Mandos.Client")
3434
for c in tcp_server.clients.values()},
3274
for c in tcp_server.clients.values() },
3435
3275
signature="oa{sv}")
3436
3276
3437
3277
@dbus.service.method(_interface, in_signature="o")
3438
3278
def RemoveClient(self, object_path):
3439
3279
"D-Bus method"
3447
3287
self.client_removed_signal(c)
3448
3288
return
3449
3289
raise KeyError(object_path)
3450
3290
3451
3291
del _interface
3452
3292
3453
3293
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3454
out_signature="a{oa{sa{sv}}}")
3294
out_signature = "a{oa{sa{sv}}}")
3455
3295
def GetManagedObjects(self):
3456
3296
"""D-Bus method"""
3457
3297
return dbus.Dictionary(
3458
{client.dbus_object_path:
3459
dbus.Dictionary(
3460
{interface: client.GetAll(interface)
3461
for interface in
3462
client._get_all_interface_names()})
3463
for client in tcp_server.clients.values()})
3464
3298
{ client.dbus_object_path:
3299
dbus.Dictionary(
3300
{ interface: client.GetAll(interface)
3301
for interface in
3302
client._get_all_interface_names()})
3303
for client in tcp_server.clients.values()})
3304
3465
3305
def client_added_signal(self, client):
3466
3306
"""Send the new standard signal and the old signal"""
3467
3307
if use_dbus:
3469
3309
self.InterfacesAdded(
3470
3310
client.dbus_object_path,
3471
3311
dbus.Dictionary(
3472
{interface: client.GetAll(interface)
3473
for interface in
3474
client._get_all_interface_names()}))
3312
{ interface: client.GetAll(interface)
3313
for interface in
3314
client._get_all_interface_names()}))
3475
3315
# Old signal
3476
3316
self.ClientAdded(client.dbus_object_path)
3477
3317
3478
3318
def client_removed_signal(self, client):
3479
3319
"""Send the new standard signal and the old signal"""
3480
3320
if use_dbus:
3485
3325
# Old signal
3486
3326
self.ClientRemoved(client.dbus_object_path,
3487
3327
client.name)
3488
3328
3489
3329
mandos_dbus_service = MandosDBusService()
3490
3330
3491
3331
# Save modules to variables to exempt the modules from being
3492
3332
# unloaded before the function registered with atexit() is run.
3493
3333
mp = multiprocessing
3494
3334
wn = wnull
3495
3496
3335
def cleanup():
3497
3336
"Cleanup function; run on exit"
3498
3337
if zeroconf:
3499
3338
service.cleanup()
3500
3339
3501
3340
mp.active_children()
3502
3341
wn.close()
3503
3342
if not (tcp_server.clients or client_settings):
3504
3343
return
3505
3344
3506
3345
# Store client before exiting. Secrets are encrypted with key
3507
3346
# based on what config file has. If config file is
3508
3347
# removed/edited, old secret will thus be unrecovable.
3513
3352
client.encrypted_secret = pgp.encrypt(client.secret,
3514
3353
key)
3515
3354
client_dict = {}
3516
3355
3517
3356
# A list of attributes that can not be pickled
3518
3357
# + secret.
3519
exclude = {"bus", "changedstate", "secret",
3520
"checker", "server_settings"}
3358
exclude = { "bus", "changedstate", "secret",
3359
"checker", "server_settings" }
3521
3360
for name, typ in inspect.getmembers(dbus.service
3522
3361
.Object):
3523
3362
exclude.add(name)
3524
3363
3525
3364
client_dict["encrypted_secret"] = (client
3526
3365
.encrypted_secret)
3527
3366
for attr in client.client_structure:
3528
3367
if attr not in exclude:
3529
3368
client_dict[attr] = getattr(client, attr)
3530
3369
3531
3370
clients[client.name] = client_dict
3532
3371
del client_settings[client.name]["secret"]
3533
3372
3534
3373
try:
3535
3374
with tempfile.NamedTemporaryFile(
3536
3375
mode='wb',
3539
3378
dir=os.path.dirname(stored_state_path),
3540
3379
delete=False) as stored_state:
3541
3380
pickle.dump((clients, client_settings), stored_state,
3542
protocol=2)
3381
protocol = 2)
3543
3382
tempname = stored_state.name
3544
3383
os.rename(tempname, stored_state_path)
3545
3384
except (IOError, OSError) as e:
3555
3394
logger.warning("Could not save persistent state:",
3556
3395
exc_info=e)
3557
3396
raise
3558
3397
3559
3398
# Delete all clients, and settings from config
3560
3399
while tcp_server.clients:
3561
3400
name, client = tcp_server.clients.popitem()
3567
3406
if use_dbus:
3568
3407
mandos_dbus_service.client_removed_signal(client)
3569
3408
client_settings.clear()
3570
3409
3571
3410
atexit.register(cleanup)
3572
3411
3573
3412
for client in tcp_server.clients.values():
3574
3413
if use_dbus:
3575
3414
# Emit D-Bus signal for adding
3577
3416
# Need to initiate checking of clients
3578
3417
if client.enabled:
3579
3418
client.init_checker()
3580
3419
3581
3420
tcp_server.enable()
3582
3421
tcp_server.server_activate()
3583
3422
3584
3423
# Find out what port we got
3585
3424
if zeroconf:
3586
3425
service.port = tcp_server.socket.getsockname()[1]
3591
3430
else: # IPv4
3592
3431
logger.info("Now listening on address %r, port %d",
3593
3432
*tcp_server.socket.getsockname())
3594
3595
# service.interface = tcp_server.socket.getsockname()[3]
3596
3433
3434
#service.interface = tcp_server.socket.getsockname()[3]
3435
3597
3436
try:
3598
3437
if zeroconf:
3599
3438
# From the Avahi example code
3604
3443
cleanup()
3605
3444
sys.exit(1)
3606
3445
# End of Avahi example code
3607
3608
GLib.io_add_watch(
3609
GLib.IOChannel.unix_new(tcp_server.fileno()),
3610
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3611
lambda *args, **kwargs: (tcp_server.handle_request
3612
(*args[2:], **kwargs) or True))
3613
3446
3447
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3448
lambda *args, **kwargs:
3449
(tcp_server.handle_request
3450
(*args[2:], **kwargs) or True))
3451
3614
3452
logger.debug("Starting main loop")
3615
3453
main_loop.run()
3616
3454
except AvahiError as error:
3625
3463
# Must run before the D-Bus bus name gets deregistered
3626
3464
cleanup()
3627
3465
3628
3629
def should_only_run_tests():
3630
parser = argparse.ArgumentParser(add_help=False)
3631
parser.add_argument("--check", action='store_true')
3632
args, unknown_args = parser.parse_known_args()
3633
run_tests = args.check
3634
if run_tests:
3635
# Remove --check argument from sys.argv
3636
sys.argv[1:] = unknown_args
3637
return run_tests
3638
3639
# Add all tests from doctest strings
3640
def load_tests(loader, tests, none):
3641
import doctest
3642
tests.addTests(doctest.DocTestSuite())
3643
return tests
3644
3466
3645
3467
if __name__ == '__main__':
3646
try:
3647
if should_only_run_tests():
3648
# Call using ./mandos --check [--verbose]
3649
unittest.main()
3650
else:
3651
main()
3652
finally:
3653
logging.shutdown()
3468
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0