To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 878
- compare with another revision
- download diff
- download tarball
- view history from revision 878
- Committer: Teddy Hogeborn
- Date: 2016-10-05 20:58:06 UTC
- mfrom: (237.4.84 release)
- Revision ID: teddy@recompile.se-20161005205806-14z03l0dow1y69mj
Merge from release branch
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
14
# Copyright © 2008-2016 Teddy Hogeborn
15
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
23
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
25
# GNU General Public License for more details.
26
#
26
#
27
27
# You should have received a copy of the GNU General Public License
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
#
30
#
31
31
# Contact the authors at <mandos@recompile.se>.
32
#
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
38
41
39
42
try:
40
43
import SocketServer as socketserver
76
79
77
80
import dbus
78
81
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
82
from gi.repository import GLib
84
83
from dbus.mainloop.glib import DBusGMainLoop
85
84
import ctypes
86
85
import ctypes.util
87
86
import xml.dom.minidom
88
87
import inspect
89
88
89
# Try to find the value of SO_BINDTODEVICE:
90
90
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
91
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
94
except AttributeError:
93
95
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
94
98
from IN import SO_BINDTODEVICE
95
99
except ImportError:
96
SO_BINDTODEVICE = None
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
97
113
98
114
if sys.version_info.major == 2:
99
115
str = unicode
100
116
101
version = "1.7.3"
117
version = "1.7.12"
102
118
stored_state_file = "clients.pickle"
103
119
104
120
logger = logging.getLogger()
108
124
if_nametoindex = ctypes.cdll.LoadLibrary(
109
125
ctypes.util.find_library("c")).if_nametoindex
110
126
except (OSError, AttributeError):
111
127
112
128
def if_nametoindex(interface):
113
129
"Get an interface index the hard way, i.e. using fcntl()"
114
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
135
return interface_index
120
136
121
137
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
122
154
def initlogger(debug, level=logging.WARNING):
123
155
"""init logger and add loglevel"""
124
156
125
157
global syslogger
126
158
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
address="/dev/log"))
129
161
syslogger.setFormatter(logging.Formatter
130
162
('Mandos [%(process)d]: %(levelname)s:'
131
163
' %(message)s'))
132
164
logger.addHandler(syslogger)
133
165
134
166
if debug:
135
167
console = logging.StreamHandler()
136
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
148
180
149
181
class PGPEngine(object):
150
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
183
152
184
def __init__(self):
153
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
186
self.gpg = "gpg"
155
187
try:
156
188
output = subprocess.check_output(["gpgconf"])
157
189
for line in output.splitlines():
158
name, text, path = line.split(":")
190
name, text, path = line.split(b":")
159
191
if name == "gpg":
160
192
self.gpg = path
161
193
break
165
197
self.gnupgargs = ['--batch',
166
198
'--homedir', self.tempdir,
167
199
'--force-mdc',
168
'--quiet',
169
'--no-use-agent']
170
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
204
171
205
def __enter__(self):
172
206
return self
173
207
174
208
def __exit__(self, exc_type, exc_value, traceback):
175
209
self._cleanup()
176
210
return False
177
211
178
212
def __del__(self):
179
213
self._cleanup()
180
214
181
215
def _cleanup(self):
182
216
if self.tempdir is not None:
183
217
# Delete contents of tempdir
184
218
for root, dirs, files in os.walk(self.tempdir,
185
topdown = False):
219
topdown=False):
186
220
for filename in files:
187
221
os.remove(os.path.join(root, filename))
188
222
for dirname in dirs:
190
224
# Remove tempdir
191
225
os.rmdir(self.tempdir)
192
226
self.tempdir = None
193
227
194
228
def password_encode(self, password):
195
229
# Passphrase can not be empty and can not contain newlines or
196
230
# NUL bytes. So we prefix it and hex encode it.
201
235
.replace(b"\n", b"\\n")
202
236
.replace(b"\0", b"\\x00"))
203
237
return encoded
204
238
205
239
def encrypt(self, data, password):
206
240
passphrase = self.password_encode(password)
207
241
with tempfile.NamedTemporaryFile(
212
246
'--passphrase-file',
213
247
passfile.name]
214
248
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
219
253
if proc.returncode != 0:
220
254
raise PGPError(err)
221
255
return ciphertext
222
256
223
257
def decrypt(self, data, password):
224
258
passphrase = self.password_encode(password)
225
259
with tempfile.NamedTemporaryFile(
226
dir = self.tempdir) as passfile:
260
dir=self.tempdir) as passfile:
227
261
passfile.write(passphrase)
228
262
passfile.flush()
229
263
proc = subprocess.Popen([self.gpg, '--decrypt',
230
264
'--passphrase-file',
231
265
passfile.name]
232
266
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
237
271
if proc.returncode != 0:
238
272
raise PGPError(err)
239
273
return decrypted_plaintext
240
274
241
275
276
# Pretend that we have an Avahi module
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
288
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
301
302
242
303
class AvahiError(Exception):
243
304
def __init__(self, value, *args, **kwargs):
244
305
self.value = value
256
317
257
318
class AvahiService(object):
258
319
"""An Avahi (Zeroconf) service.
259
320
260
321
Attributes:
261
322
interface: integer; avahi.IF_UNSPEC or an interface index.
262
323
Used to optionally bind to the specified interface.
274
335
server: D-Bus Server
275
336
bus: dbus.SystemBus()
276
337
"""
277
338
278
339
def __init__(self,
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
289
350
self.interface = interface
290
351
self.name = name
291
352
self.type = servicetype
300
361
self.server = None
301
362
self.bus = bus
302
363
self.entry_group_state_changed_match = None
303
364
304
365
def rename(self, remove=True):
305
366
"""Derived from the Avahi example code"""
306
367
if self.rename_count >= self.max_renames:
326
387
logger.critical("D-Bus Exception", exc_info=error)
327
388
self.cleanup()
328
389
os._exit(1)
329
390
330
391
def remove(self):
331
392
"""Derived from the Avahi example code"""
332
393
if self.entry_group_state_changed_match is not None:
334
395
self.entry_group_state_changed_match = None
335
396
if self.group is not None:
336
397
self.group.Reset()
337
398
338
399
def add(self):
339
400
"""Derived from the Avahi example code"""
340
401
self.remove()
357
418
dbus.UInt16(self.port),
358
419
avahi.string_array_to_txt_array(self.TXT))
359
420
self.group.Commit()
360
421
361
422
def entry_group_state_changed(self, state, error):
362
423
"""Derived from the Avahi example code"""
363
424
logger.debug("Avahi entry group state change: %i", state)
364
425
365
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
366
427
logger.debug("Zeroconf service established.")
367
428
elif state == avahi.ENTRY_GROUP_COLLISION:
371
432
logger.critical("Avahi: Error in group state changed %s",
372
433
str(error))
373
434
raise AvahiGroupError("State changed: {!s}".format(error))
374
435
375
436
def cleanup(self):
376
437
"""Derived from the Avahi example code"""
377
438
if self.group is not None:
382
443
pass
383
444
self.group = None
384
445
self.remove()
385
446
386
447
def server_state_changed(self, state, error=None):
387
448
"""Derived from the Avahi example code"""
388
449
logger.debug("Avahi server state change: %i", state)
417
478
logger.debug("Unknown state: %r", state)
418
479
else:
419
480
logger.debug("Unknown state: %r: %r", state, error)
420
481
421
482
def activate(self):
422
483
"""Derived from the Avahi example code"""
423
484
if self.server is None:
440
501
.format(self.name)))
441
502
return ret
442
503
504
443
505
# Pretend that we have a GnuTLS module
444
506
class GnuTLS(object):
445
507
"""This isn't so much a class as it is a module-like namespace.
446
508
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
509
510
library = ctypes.util.find_library("gnutls")
511
if library is None:
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
514
del library
515
_need_version = b"3.3.0"
516
451
517
def __init__(self):
452
518
# Need to use class name "GnuTLS" here, since this method is
453
519
# called before the assignment to the "gnutls" global variable
455
521
if GnuTLS.check_version(self._need_version) is None:
456
522
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
523
.format(self._need_version))
458
524
459
525
# Unless otherwise indicated, the constants and types below are
460
526
# all from the gnutls/gnutls.h C header file.
461
527
462
528
# Constants
463
529
E_SUCCESS = 0
464
530
E_INTERRUPTED = -52
469
535
CRD_CERTIFICATE = 1
470
536
E_NO_CERTIFICATE_FOUND = -49
471
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
472
538
473
539
# Types
474
540
class session_int(ctypes.Structure):
475
541
_fields_ = []
476
542
session_t = ctypes.POINTER(session_int)
543
477
544
class certificate_credentials_st(ctypes.Structure):
478
545
_fields_ = []
479
546
certificate_credentials_t = ctypes.POINTER(
480
547
certificate_credentials_st)
481
548
certificate_type_t = ctypes.c_int
549
482
550
class datum_t(ctypes.Structure):
483
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
552
('size', ctypes.c_uint)]
553
485
554
class openpgp_crt_int(ctypes.Structure):
486
555
_fields_ = []
487
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
credentials_type_t = ctypes.c_int #
559
credentials_type_t = ctypes.c_int
491
560
transport_ptr_t = ctypes.c_void_p
492
561
close_request_t = ctypes.c_int
493
562
494
563
# Exceptions
495
564
class Error(Exception):
496
565
# We need to use the class name "GnuTLS" here, since this
497
566
# exception might be raised from within GnuTLS.__init__,
498
567
# which is called before the assignment to the "gnutls"
499
568
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
569
def __init__(self, message=None, code=None, args=()):
501
570
# Default usage is by a message string, but if a return
502
571
# code is passed, convert it to a string with
503
572
# gnutls.strerror()
506
575
message = GnuTLS.strerror(code)
507
576
return super(GnuTLS.Error, self).__init__(
508
577
message, *args)
509
578
510
579
class CertificateSecurityError(Error):
511
580
pass
512
581
513
582
# Classes
514
583
class Credentials(object):
515
584
def __init__(self):
517
586
gnutls.certificate_allocate_credentials(
518
587
ctypes.byref(self._c_object))
519
588
self.type = gnutls.CRD_CERTIFICATE
520
589
521
590
def __del__(self):
522
591
gnutls.certificate_free_credentials(self._c_object)
523
592
524
593
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
594
def __init__(self, socket, credentials=None):
526
595
self._c_object = gnutls.session_t()
527
596
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
528
597
gnutls.set_default_priority(self._c_object)
536
605
ctypes.cast(credentials._c_object,
537
606
ctypes.c_void_p))
538
607
self.credentials = credentials
539
608
540
609
def __del__(self):
541
610
gnutls.deinit(self._c_object)
542
611
543
612
def handshake(self):
544
613
return gnutls.handshake(self._c_object)
545
614
546
615
def send(self, data):
547
616
data = bytes(data)
548
617
data_len = len(data)
550
619
data_len -= gnutls.record_send(self._c_object,
551
620
data[-data_len:],
552
621
data_len)
553
622
554
623
def bye(self):
555
624
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
625
557
626
# Error handling functions
558
627
def _error_code(result):
559
628
"""A function to raise exceptions on errors, suitable
561
630
if result >= 0:
562
631
return result
563
632
if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
633
raise gnutls.CertificateSecurityError(code=result)
634
raise gnutls.Error(code=result)
635
567
636
def _retry_on_error(result, func, arguments):
568
637
"""A function to retry on some errors, suitable
569
638
for the 'errcheck' attribute on ctypes functions"""
572
641
return _error_code(result)
573
642
result = func(*arguments)
574
643
return result
575
644
576
645
# Unless otherwise indicated, the function declarations below are
577
646
# all from the gnutls/gnutls.h C header file.
578
647
579
648
# Functions
580
649
priority_set_direct = _library.gnutls_priority_set_direct
581
650
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
651
ctypes.POINTER(ctypes.c_char_p)]
583
652
priority_set_direct.restype = _error_code
584
653
585
654
init = _library.gnutls_init
586
655
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
656
init.restype = _error_code
588
657
589
658
set_default_priority = _library.gnutls_set_default_priority
590
659
set_default_priority.argtypes = [session_t]
591
660
set_default_priority.restype = _error_code
592
661
593
662
record_send = _library.gnutls_record_send
594
663
record_send.argtypes = [session_t, ctypes.c_void_p,
595
664
ctypes.c_size_t]
596
665
record_send.restype = ctypes.c_ssize_t
597
666
record_send.errcheck = _retry_on_error
598
667
599
668
certificate_allocate_credentials = (
600
669
_library.gnutls_certificate_allocate_credentials)
601
670
certificate_allocate_credentials.argtypes = [
602
671
ctypes.POINTER(certificate_credentials_t)]
603
672
certificate_allocate_credentials.restype = _error_code
604
673
605
674
certificate_free_credentials = (
606
675
_library.gnutls_certificate_free_credentials)
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
676
certificate_free_credentials.argtypes = [
677
certificate_credentials_t]
608
678
certificate_free_credentials.restype = None
609
679
610
680
handshake_set_private_extensions = (
611
681
_library.gnutls_handshake_set_private_extensions)
612
682
handshake_set_private_extensions.argtypes = [session_t,
613
683
ctypes.c_int]
614
684
handshake_set_private_extensions.restype = None
615
685
616
686
credentials_set = _library.gnutls_credentials_set
617
687
credentials_set.argtypes = [session_t, credentials_type_t,
618
688
ctypes.c_void_p]
619
689
credentials_set.restype = _error_code
620
690
621
691
strerror = _library.gnutls_strerror
622
692
strerror.argtypes = [ctypes.c_int]
623
693
strerror.restype = ctypes.c_char_p
624
694
625
695
certificate_type_get = _library.gnutls_certificate_type_get
626
696
certificate_type_get.argtypes = [session_t]
627
697
certificate_type_get.restype = _error_code
628
698
629
699
certificate_get_peers = _library.gnutls_certificate_get_peers
630
700
certificate_get_peers.argtypes = [session_t,
631
701
ctypes.POINTER(ctypes.c_uint)]
632
702
certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
703
634
704
global_set_log_level = _library.gnutls_global_set_log_level
635
705
global_set_log_level.argtypes = [ctypes.c_int]
636
706
global_set_log_level.restype = None
637
707
638
708
global_set_log_function = _library.gnutls_global_set_log_function
639
709
global_set_log_function.argtypes = [log_func]
640
710
global_set_log_function.restype = None
641
711
642
712
deinit = _library.gnutls_deinit
643
713
deinit.argtypes = [session_t]
644
714
deinit.restype = None
645
715
646
716
handshake = _library.gnutls_handshake
647
717
handshake.argtypes = [session_t]
648
718
handshake.restype = _error_code
649
719
handshake.errcheck = _retry_on_error
650
720
651
721
transport_set_ptr = _library.gnutls_transport_set_ptr
652
722
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
723
transport_set_ptr.restype = None
654
724
655
725
bye = _library.gnutls_bye
656
726
bye.argtypes = [session_t, close_request_t]
657
727
bye.restype = _error_code
658
728
bye.errcheck = _retry_on_error
659
729
660
730
check_version = _library.gnutls_check_version
661
731
check_version.argtypes = [ctypes.c_char_p]
662
732
check_version.restype = ctypes.c_char_p
663
733
664
734
# All the function declarations below are from gnutls/openpgp.h
665
735
666
736
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
737
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
738
openpgp_crt_init.restype = _error_code
669
739
670
740
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
741
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
742
ctypes.POINTER(datum_t),
673
743
openpgp_crt_fmt_t]
674
744
openpgp_crt_import.restype = _error_code
675
745
676
746
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
747
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
748
ctypes.POINTER(ctypes.c_uint)]
679
749
openpgp_crt_verify_self.restype = _error_code
680
750
681
751
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
752
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
753
openpgp_crt_deinit.restype = None
684
754
685
755
openpgp_crt_get_fingerprint = (
686
756
_library.gnutls_openpgp_crt_get_fingerprint)
687
757
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
689
759
ctypes.POINTER(
690
760
ctypes.c_size_t)]
691
761
openpgp_crt_get_fingerprint.restype = _error_code
692
762
693
763
# Remove non-public functions
694
764
del _error_code, _retry_on_error
695
765
# Create the global "gnutls" object, simulating a module
696
766
gnutls = GnuTLS()
697
767
768
698
769
def call_pipe(connection, # : multiprocessing.Connection
699
770
func, *args, **kwargs):
700
771
"""This function is meant to be called by multiprocessing.Process
701
772
702
773
This function runs func(*args, **kwargs), and writes the resulting
703
774
return value on the provided multiprocessing.Connection.
704
775
"""
705
776
connection.send(func(*args, **kwargs))
706
777
connection.close()
707
778
779
708
780
class Client(object):
709
781
"""A representation of a client host served by this server.
710
782
711
783
Attributes:
712
784
approved: bool(); 'None' if not yet approved/disapproved
713
785
approval_delay: datetime.timedelta(); Time to wait for approval
715
787
checker: subprocess.Popen(); a running checker process used
716
788
to see if the client lives.
717
789
'None' if no process is running.
718
checker_callback_tag: a gobject event source tag, or None
790
checker_callback_tag: a GLib event source tag, or None
719
791
checker_command: string; External command which is run to check
720
792
if client lives. %() expansions are done at
721
793
runtime with vars(self) as dict, so that for
722
794
instance %(name)s can be used in the command.
723
checker_initiator_tag: a gobject event source tag, or None
795
checker_initiator_tag: a GLib event source tag, or None
724
796
created: datetime.datetime(); (UTC) object creation
725
797
client_structure: Object describing what attributes a client has
726
798
and is used for storing the client at exit
727
799
current_checker_command: string; current running checker_command
728
disable_initiator_tag: a gobject event source tag, or None
800
disable_initiator_tag: a GLib event source tag, or None
729
801
enabled: bool()
730
802
fingerprint: string (40 or 32 hexadecimal digits); used to
731
803
uniquely identify the client
750
822
disabled, or None
751
823
server_settings: The server_settings dict from main()
752
824
"""
753
825
754
826
runtime_expansions = ("approval_delay", "approval_duration",
755
827
"created", "enabled", "expires",
756
828
"fingerprint", "host", "interval",
767
839
"approved_by_default": "True",
768
840
"enabled": "True",
769
841
}
770
842
771
843
@staticmethod
772
844
def config_parser(config):
773
845
"""Construct a new dict of client settings of this form:
780
852
for client_name in config.sections():
781
853
section = dict(config.items(client_name))
782
854
client = settings[client_name] = {}
783
855
784
856
client["host"] = section["host"]
785
857
# Reformat values from string types to Python types
786
858
client["approved_by_default"] = config.getboolean(
787
859
client_name, "approved_by_default")
788
860
client["enabled"] = config.getboolean(client_name,
789
861
"enabled")
790
862
791
863
# Uppercase and remove spaces from fingerprint for later
792
864
# comparison purposes with return value from the
793
865
# fingerprint() function
794
866
client["fingerprint"] = (section["fingerprint"].upper()
795
867
.replace(" ", ""))
796
868
if "secret" in section:
797
client["secret"] = section["secret"].decode("base64")
869
client["secret"] = codecs.decode(section["secret"]
870
.encode("utf-8"),
871
"base64")
798
872
elif "secfile" in section:
799
873
with open(os.path.expanduser(os.path.expandvars
800
874
(section["secfile"])),
815
889
client["last_approval_request"] = None
816
890
client["last_checked_ok"] = None
817
891
client["last_checker_status"] = -2
818
892
819
893
return settings
820
821
def __init__(self, settings, name = None, server_settings=None):
894
895
def __init__(self, settings, name=None, server_settings=None):
822
896
self.name = name
823
897
if server_settings is None:
824
898
server_settings = {}
826
900
# adding all client settings
827
901
for setting, value in settings.items():
828
902
setattr(self, setting, value)
829
903
830
904
if self.enabled:
831
905
if not hasattr(self, "last_enabled"):
832
906
self.last_enabled = datetime.datetime.utcnow()
836
910
else:
837
911
self.last_enabled = None
838
912
self.expires = None
839
913
840
914
logger.debug("Creating client %r", self.name)
841
915
logger.debug(" Fingerprint: %s", self.fingerprint)
842
916
self.created = settings.get("created",
843
917
datetime.datetime.utcnow())
844
918
845
919
# attributes specific for this server instance
846
920
self.checker = None
847
921
self.checker_initiator_tag = None
853
927
self.changedstate = multiprocessing_manager.Condition(
854
928
multiprocessing_manager.Lock())
855
929
self.client_structure = [attr
856
for attr in self.__dict__.iterkeys()
930
for attr in self.__dict__.keys()
857
931
if not attr.startswith("_")]
858
932
self.client_structure.append("client_structure")
859
933
860
934
for name, t in inspect.getmembers(
861
935
type(self), lambda obj: isinstance(obj, property)):
862
936
if not name.startswith("_"):
863
937
self.client_structure.append(name)
864
938
865
939
# Send notice to process children that client state has changed
866
940
def send_changedstate(self):
867
941
with self.changedstate:
868
942
self.changedstate.notify_all()
869
943
870
944
def enable(self):
871
945
"""Start this client's checker and timeout hooks"""
872
946
if getattr(self, "enabled", False):
877
951
self.last_enabled = datetime.datetime.utcnow()
878
952
self.init_checker()
879
953
self.send_changedstate()
880
954
881
955
def disable(self, quiet=True):
882
956
"""Disable this client."""
883
957
if not getattr(self, "enabled", False):
885
959
if not quiet:
886
960
logger.info("Disabling client %s", self.name)
887
961
if getattr(self, "disable_initiator_tag", None) is not None:
888
gobject.source_remove(self.disable_initiator_tag)
962
GLib.source_remove(self.disable_initiator_tag)
889
963
self.disable_initiator_tag = None
890
964
self.expires = None
891
965
if getattr(self, "checker_initiator_tag", None) is not None:
892
gobject.source_remove(self.checker_initiator_tag)
966
GLib.source_remove(self.checker_initiator_tag)
893
967
self.checker_initiator_tag = None
894
968
self.stop_checker()
895
969
self.enabled = False
896
970
if not quiet:
897
971
self.send_changedstate()
898
# Do not run this again if called by a gobject.timeout_add
972
# Do not run this again if called by a GLib.timeout_add
899
973
return False
900
974
901
975
def __del__(self):
902
976
self.disable()
903
977
904
978
def init_checker(self):
905
979
# Schedule a new checker to be started an 'interval' from now,
906
980
# and every interval from then on.
907
981
if self.checker_initiator_tag is not None:
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
982
GLib.source_remove(self.checker_initiator_tag)
983
self.checker_initiator_tag = GLib.timeout_add(
910
984
int(self.interval.total_seconds() * 1000),
911
985
self.start_checker)
912
986
# Schedule a disable() when 'timeout' has passed
913
987
if self.disable_initiator_tag is not None:
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
988
GLib.source_remove(self.disable_initiator_tag)
989
self.disable_initiator_tag = GLib.timeout_add(
916
990
int(self.timeout.total_seconds() * 1000), self.disable)
917
991
# Also start a new checker *right now*.
918
992
self.start_checker()
919
993
920
994
def checker_callback(self, source, condition, connection,
921
995
command):
922
996
"""The checker has completed, so take appropriate actions."""
925
999
# Read return code from connection (see call_pipe)
926
1000
returncode = connection.recv()
927
1001
connection.close()
928
1002
929
1003
if returncode >= 0:
930
1004
self.last_checker_status = returncode
931
1005
self.last_checker_signal = None
941
1015
logger.warning("Checker for %(name)s crashed?",
942
1016
vars(self))
943
1017
return False
944
1018
945
1019
def checked_ok(self):
946
1020
"""Assert that the client has been seen, alive and well."""
947
1021
self.last_checked_ok = datetime.datetime.utcnow()
948
1022
self.last_checker_status = 0
949
1023
self.last_checker_signal = None
950
1024
self.bump_timeout()
951
1025
952
1026
def bump_timeout(self, timeout=None):
953
1027
"""Bump up the timeout for this client."""
954
1028
if timeout is None:
955
1029
timeout = self.timeout
956
1030
if self.disable_initiator_tag is not None:
957
gobject.source_remove(self.disable_initiator_tag)
1031
GLib.source_remove(self.disable_initiator_tag)
958
1032
self.disable_initiator_tag = None
959
1033
if getattr(self, "enabled", False):
960
self.disable_initiator_tag = gobject.timeout_add(
1034
self.disable_initiator_tag = GLib.timeout_add(
961
1035
int(timeout.total_seconds() * 1000), self.disable)
962
1036
self.expires = datetime.datetime.utcnow() + timeout
963
1037
964
1038
def need_approval(self):
965
1039
self.last_approval_request = datetime.datetime.utcnow()
966
1040
967
1041
def start_checker(self):
968
1042
"""Start a new checker subprocess if one is not running.
969
1043
970
1044
If a checker already exists, leave it running and do
971
1045
nothing."""
972
1046
# The reason for not killing a running checker is that if we
977
1051
# checkers alone, the checker would have to take more time
978
1052
# than 'timeout' for the client to be disabled, which is as it
979
1053
# should be.
980
1054
981
1055
if self.checker is not None and not self.checker.is_alive():
982
1056
logger.warning("Checker was not alive; joining")
983
1057
self.checker.join()
987
1061
# Escape attributes for the shell
988
1062
escaped_attrs = {
989
1063
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
1064
for attr in self.runtime_expansions}
991
1065
try:
992
1066
command = self.checker_command % escaped_attrs
993
1067
except TypeError as error:
1005
1079
# The exception is when not debugging but nevertheless
1006
1080
# running in the foreground; use the previously
1007
1081
# created wnull.
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1082
popen_args = {"close_fds": True,
1083
"shell": True,
1084
"cwd": "/"}
1011
1085
if (not self.server_settings["debug"]
1012
1086
and self.server_settings["foreground"]):
1013
1087
popen_args.update({"stdout": wnull,
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1088
"stderr": wnull})
1089
pipe = multiprocessing.Pipe(duplex=False)
1016
1090
self.checker = multiprocessing.Process(
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1091
target=call_pipe,
1092
args=(pipe[1], subprocess.call, command),
1093
kwargs=popen_args)
1020
1094
self.checker.start()
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1095
self.checker_callback_tag = GLib.io_add_watch(
1096
pipe[0].fileno(), GLib.IO_IN,
1023
1097
self.checker_callback, pipe[0], command)
1024
# Re-run this periodically if run by gobject.timeout_add
1098
# Re-run this periodically if run by GLib.timeout_add
1025
1099
return True
1026
1100
1027
1101
def stop_checker(self):
1028
1102
"""Force the checker process, if any, to stop."""
1029
1103
if self.checker_callback_tag:
1030
gobject.source_remove(self.checker_callback_tag)
1104
GLib.source_remove(self.checker_callback_tag)
1031
1105
self.checker_callback_tag = None
1032
1106
if getattr(self, "checker", None) is None:
1033
1107
return
1042
1116
byte_arrays=False):
1043
1117
"""Decorators for marking methods of a DBusObjectWithProperties to
1044
1118
become properties on the D-Bus.
1045
1119
1046
1120
The decorated method will be called with no arguments by "Get"
1047
1121
and with one argument by "Set".
1048
1122
1049
1123
The parameters, where they are supported, are the same as
1050
1124
dbus.service.method, except there is only "signature", since the
1051
1125
type from Get() and the type sent to Set() is the same.
1055
1129
if byte_arrays and signature != "ay":
1056
1130
raise ValueError("Byte arrays not supported for non-'ay'"
1057
1131
" signature {!r}".format(signature))
1058
1132
1059
1133
def decorator(func):
1060
1134
func._dbus_is_property = True
1061
1135
func._dbus_interface = dbus_interface
1064
1138
func._dbus_name = func.__name__
1065
1139
if func._dbus_name.endswith("_dbus_property"):
1066
1140
func._dbus_name = func._dbus_name[:-14]
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1141
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1068
1142
return func
1069
1143
1070
1144
return decorator
1071
1145
1072
1146
1073
1147
def dbus_interface_annotations(dbus_interface):
1074
1148
"""Decorator for marking functions returning interface annotations
1075
1149
1076
1150
Usage:
1077
1151
1078
1152
@dbus_interface_annotations("org.example.Interface")
1079
1153
def _foo(self): # Function name does not matter
1080
1154
return {"org.freedesktop.DBus.Deprecated": "true",
1081
1155
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1082
1156
"false"}
1083
1157
"""
1084
1158
1085
1159
def decorator(func):
1086
1160
func._dbus_is_interface = True
1087
1161
func._dbus_interface = dbus_interface
1088
1162
func._dbus_name = dbus_interface
1089
1163
return func
1090
1164
1091
1165
return decorator
1092
1166
1093
1167
1094
1168
def dbus_annotations(annotations):
1095
1169
"""Decorator to annotate D-Bus methods, signals or properties
1096
1170
Usage:
1097
1171
1098
1172
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1099
1173
"org.freedesktop.DBus.Property."
1100
1174
"EmitsChangedSignal": "false"})
1102
1176
access="r")
1103
1177
def Property_dbus_property(self):
1104
1178
return dbus.Boolean(False)
1105
1179
1106
1180
See also the DBusObjectWithAnnotations class.
1107
1181
"""
1108
1182
1109
1183
def decorator(func):
1110
1184
func._dbus_annotations = annotations
1111
1185
return func
1112
1186
1113
1187
return decorator
1114
1188
1115
1189
1133
1207
1134
1208
class DBusObjectWithAnnotations(dbus.service.Object):
1135
1209
"""A D-Bus object with annotations.
1136
1210
1137
1211
Classes inheriting from this can use the dbus_annotations
1138
1212
decorator to add annotations to methods or signals.
1139
1213
"""
1140
1214
1141
1215
@staticmethod
1142
1216
def _is_dbus_thing(thing):
1143
1217
"""Returns a function testing if an attribute is a D-Bus thing
1144
1218
1145
1219
If called like _is_dbus_thing("method") it returns a function
1146
1220
suitable for use as predicate to inspect.getmembers().
1147
1221
"""
1148
1222
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1149
1223
False)
1150
1224
1151
1225
def _get_all_dbus_things(self, thing):
1152
1226
"""Returns a generator of (name, attribute) pairs
1153
1227
"""
1156
1230
for cls in self.__class__.__mro__
1157
1231
for name, athing in
1158
1232
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
1233
1160
1234
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1235
out_signature="s",
1236
path_keyword='object_path',
1237
connection_keyword='connection')
1164
1238
def Introspect(self, object_path, connection):
1165
1239
"""Overloading of standard D-Bus method.
1166
1240
1167
1241
Inserts annotation tags on methods and signals.
1168
1242
"""
1169
1243
xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
1244
connection)
1171
1245
try:
1172
1246
document = xml.dom.minidom.parseString(xmlstring)
1173
1247
1174
1248
for if_tag in document.getElementsByTagName("interface"):
1175
1249
# Add annotation tags
1176
1250
for typ in ("method", "signal"):
1203
1277
if_tag.appendChild(ann_tag)
1204
1278
# Fix argument name for the Introspect method itself
1205
1279
if (if_tag.getAttribute("name")
1206
== dbus.INTROSPECTABLE_IFACE):
1280
== dbus.INTROSPECTABLE_IFACE):
1207
1281
for cn in if_tag.getElementsByTagName("method"):
1208
1282
if cn.getAttribute("name") == "Introspect":
1209
1283
for arg in cn.getElementsByTagName("arg"):
1222
1296
1223
1297
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
1298
"""A D-Bus object with properties.
1225
1299
1226
1300
Classes inheriting from this can use the dbus_service_property
1227
1301
decorator to expose methods as D-Bus properties. It exposes the
1228
1302
standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
1303
"""
1230
1304
1231
1305
def _get_dbus_property(self, interface_name, property_name):
1232
1306
"""Returns a bound method if one exists which is a D-Bus
1233
1307
property with the specified name and interface.
1238
1312
if (value._dbus_name == property_name
1239
1313
and value._dbus_interface == interface_name):
1240
1314
return value.__get__(self)
1241
1315
1242
1316
# No such property
1243
1317
raise DBusPropertyNotFound("{}:{}.{}".format(
1244
1318
self.dbus_object_path, interface_name, property_name))
1245
1319
1246
1320
@classmethod
1247
1321
def _get_all_interface_names(cls):
1248
1322
"""Get a sequence of all interfaces supported by an object"""
1251
1325
for x in (inspect.getmro(cls))
1252
1326
for attr in dir(x))
1253
1327
if name is not None)
1254
1328
1255
1329
@dbus.service.method(dbus.PROPERTIES_IFACE,
1256
1330
in_signature="ss",
1257
1331
out_signature="v")
1265
1339
if not hasattr(value, "variant_level"):
1266
1340
return value
1267
1341
return type(value)(value, variant_level=value.variant_level+1)
1268
1342
1269
1343
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1270
1344
def Set(self, interface_name, property_name, value):
1271
1345
"""Standard D-Bus property Set() method, see D-Bus standard.
1283
1357
value = dbus.ByteArray(b''.join(chr(byte)
1284
1358
for byte in value))
1285
1359
prop(value)
1286
1360
1287
1361
@dbus.service.method(dbus.PROPERTIES_IFACE,
1288
1362
in_signature="s",
1289
1363
out_signature="a{sv}")
1290
1364
def GetAll(self, interface_name):
1291
1365
"""Standard D-Bus property GetAll() method, see D-Bus
1292
1366
standard.
1293
1367
1294
1368
Note: Will not include properties with access="write".
1295
1369
"""
1296
1370
properties = {}
1307
1381
properties[name] = value
1308
1382
continue
1309
1383
properties[name] = type(value)(
1310
value, variant_level = value.variant_level + 1)
1384
value, variant_level=value.variant_level + 1)
1311
1385
return dbus.Dictionary(properties, signature="sv")
1312
1386
1313
1387
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1314
1388
def PropertiesChanged(self, interface_name, changed_properties,
1315
1389
invalidated_properties):
1317
1391
standard.
1318
1392
"""
1319
1393
pass
1320
1394
1321
1395
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1322
1396
out_signature="s",
1323
1397
path_keyword='object_path',
1324
1398
connection_keyword='connection')
1325
1399
def Introspect(self, object_path, connection):
1326
1400
"""Overloading of standard D-Bus method.
1327
1401
1328
1402
Inserts property tags and interface annotation tags.
1329
1403
"""
1330
1404
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1332
1406
connection)
1333
1407
try:
1334
1408
document = xml.dom.minidom.parseString(xmlstring)
1335
1409
1336
1410
def make_tag(document, name, prop):
1337
1411
e = document.createElement("property")
1338
1412
e.setAttribute("name", name)
1339
1413
e.setAttribute("type", prop._dbus_signature)
1340
1414
e.setAttribute("access", prop._dbus_access)
1341
1415
return e
1342
1416
1343
1417
for if_tag in document.getElementsByTagName("interface"):
1344
1418
# Add property tags
1345
1419
for tag in (make_tag(document, name, prop)
1392
1466
except AttributeError:
1393
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
1468
1469
1395
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
1471
"""A D-Bus object with an ObjectManager.
1397
1472
1398
1473
Classes inheriting from this exposes the standard
1399
1474
GetManagedObjects call and the InterfacesAdded and
1400
1475
InterfacesRemoved signals on the standard
1401
1476
"org.freedesktop.DBus.ObjectManager" interface.
1402
1477
1403
1478
Note: No signals are sent automatically; they must be sent
1404
1479
manually.
1405
1480
"""
1406
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
out_signature = "a{oa{sa{sv}}}")
1482
out_signature="a{oa{sa{sv}}}")
1408
1483
def GetManagedObjects(self):
1409
1484
"""This function must be overridden"""
1410
1485
raise NotImplementedError()
1411
1486
1412
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
signature = "oa{sa{sv}}")
1488
signature="oa{sa{sv}}")
1414
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
1490
pass
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1491
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1418
1493
def InterfacesRemoved(self, object_path, interfaces):
1419
1494
pass
1420
1495
1421
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1497
out_signature="s",
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1425
1500
def Introspect(self, object_path, connection):
1426
1501
"""Overloading of standard D-Bus method.
1427
1502
1428
1503
Override return argument name of GetManagedObjects to be
1429
1504
"objpath_interfaces_and_properties"
1430
1505
"""
1433
1508
connection)
1434
1509
try:
1435
1510
document = xml.dom.minidom.parseString(xmlstring)
1436
1511
1437
1512
for if_tag in document.getElementsByTagName("interface"):
1438
1513
# Fix argument name for the GetManagedObjects method
1439
1514
if (if_tag.getAttribute("name")
1440
== dbus.OBJECT_MANAGER_IFACE):
1515
== dbus.OBJECT_MANAGER_IFACE):
1441
1516
for cn in if_tag.getElementsByTagName("method"):
1442
1517
if (cn.getAttribute("name")
1443
1518
== "GetManagedObjects"):
1453
1528
except (AttributeError, xml.dom.DOMException,
1454
1529
xml.parsers.expat.ExpatError) as error:
1455
1530
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1531
exc_info=error)
1457
1532
return xmlstring
1458
1533
1534
1459
1535
def datetime_to_dbus(dt, variant_level=0):
1460
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1461
1537
if dt is None:
1462
return dbus.String("", variant_level = variant_level)
1538
return dbus.String("", variant_level=variant_level)
1463
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1464
1540
1465
1541
1468
1544
dbus.service.Object, it will add alternate D-Bus attributes with
1469
1545
interface names according to the "alt_interface_names" mapping.
1470
1546
Usage:
1471
1547
1472
1548
@alternate_dbus_interfaces({"org.example.Interface":
1473
1549
"net.example.AlternateInterface"})
1474
1550
class SampleDBusObject(dbus.service.Object):
1475
1551
@dbus.service.method("org.example.Interface")
1476
1552
def SampleDBusMethod():
1477
1553
pass
1478
1554
1479
1555
The above "SampleDBusMethod" on "SampleDBusObject" will be
1480
1556
reachable via two interfaces: "org.example.Interface" and
1481
1557
"net.example.AlternateInterface", the latter of which will have
1482
1558
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1483
1559
"true", unless "deprecate" is passed with a False value.
1484
1560
1485
1561
This works for methods and signals, and also for D-Bus properties
1486
1562
(from DBusObjectWithProperties) and interfaces (from the
1487
1563
dbus_interface_annotations decorator).
1488
1564
"""
1489
1565
1490
1566
def wrapper(cls):
1491
1567
for orig_interface_name, alt_interface_name in (
1492
1568
alt_interface_names.items()):
1507
1583
interface_names.add(alt_interface)
1508
1584
# Is this a D-Bus signal?
1509
1585
if getattr(attribute, "_dbus_is_signal", False):
1586
# Extract the original non-method undecorated
1587
# function by black magic
1510
1588
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1513
1589
nonmethod_func = (dict(
1514
1590
zip(attribute.func_code.co_freevars,
1515
1591
attribute.__closure__))
1516
1592
["func"].cell_contents)
1517
1593
else:
1518
nonmethod_func = attribute
1594
nonmethod_func = (dict(
1595
zip(attribute.__code__.co_freevars,
1596
attribute.__closure__))
1597
["func"].cell_contents)
1519
1598
# Create a new, but exactly alike, function
1520
1599
# object, and decorate it to be a new D-Bus signal
1521
1600
# with the alternate D-Bus interface name
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1601
new_function = copy_function(nonmethod_func)
1536
1602
new_function = (dbus.service.signal(
1537
1603
alt_interface,
1538
1604
attribute._dbus_signature)(new_function))
1542
1608
attribute._dbus_annotations)
1543
1609
except AttributeError:
1544
1610
pass
1611
1545
1612
# Define a creator of a function to call both the
1546
1613
# original and alternate functions, so both the
1547
1614
# original and alternate signals gets sent when
1550
1617
"""This function is a scope container to pass
1551
1618
func1 and func2 to the "call_both" function
1552
1619
outside of its arguments"""
1553
1620
1554
1621
@functools.wraps(func2)
1555
1622
def call_both(*args, **kwargs):
1556
1623
"""This function will emit two D-Bus
1557
1624
signals by calling func1 and func2"""
1558
1625
func1(*args, **kwargs)
1559
1626
func2(*args, **kwargs)
1560
# Make wrapper function look like a D-Bus signal
1627
# Make wrapper function look like a D-Bus
1628
# signal
1561
1629
for name, attr in inspect.getmembers(func2):
1562
1630
if name.startswith("_dbus_"):
1563
1631
setattr(call_both, name, attr)
1564
1632
1565
1633
return call_both
1566
1634
# Create the "call_both" function and add it to
1567
1635
# the class
1577
1645
alt_interface,
1578
1646
attribute._dbus_in_signature,
1579
1647
attribute._dbus_out_signature)
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1648
(copy_function(attribute)))
1585
1649
# Copy annotations, if any
1586
1650
try:
1587
1651
attr[attrname]._dbus_annotations = dict(
1599
1663
attribute._dbus_access,
1600
1664
attribute._dbus_get_args_options
1601
1665
["byte_arrays"])
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1666
(copy_function(attribute)))
1608
1667
# Copy annotations, if any
1609
1668
try:
1610
1669
attr[attrname]._dbus_annotations = dict(
1619
1678
# to the class.
1620
1679
attr[attrname] = (
1621
1680
dbus_interface_annotations(alt_interface)
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1681
(copy_function(attribute)))
1627
1682
if deprecate:
1628
1683
# Deprecate all alternate interfaces
1629
iname="_AlternateDBusNames_interface_annotation{}"
1684
iname = "_AlternateDBusNames_interface_annotation{}"
1630
1685
for interface_name in interface_names:
1631
1686
1632
1687
@dbus_interface_annotations(interface_name)
1633
1688
def func(self):
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1689
return {"org.freedesktop.DBus.Deprecated":
1690
"true"}
1636
1691
# Find an unused name
1637
1692
for aname in (iname.format(i)
1638
1693
for i in itertools.count()):
1642
1697
if interface_names:
1643
1698
# Replace the class with a new subclass of it with
1644
1699
# methods, signals, etc. as created above.
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1700
if sys.version_info.major == 2:
1701
cls = type(b"{}Alternate".format(cls.__name__),
1702
(cls, ), attr)
1703
else:
1704
cls = type("{}Alternate".format(cls.__name__),
1705
(cls, ), attr)
1647
1706
return cls
1648
1707
1649
1708
return wrapper
1650
1709
1651
1710
1653
1712
"se.bsnet.fukt.Mandos"})
1654
1713
class ClientDBus(Client, DBusObjectWithProperties):
1655
1714
"""A Client class using D-Bus
1656
1715
1657
1716
Attributes:
1658
1717
dbus_object_path: dbus.ObjectPath
1659
1718
bus: dbus.SystemBus()
1660
1719
"""
1661
1720
1662
1721
runtime_expansions = (Client.runtime_expansions
1663
1722
+ ("dbus_object_path", ))
1664
1723
1665
1724
_interface = "se.recompile.Mandos.Client"
1666
1725
1667
1726
# dbus.service.Object doesn't use super(), so we can't either.
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1727
1728
def __init__(self, bus=None, *args, **kwargs):
1670
1729
self.bus = bus
1671
1730
Client.__init__(self, *args, **kwargs)
1672
1731
# Only now, when this client is initialized, can it show up on
1678
1737
"/clients/" + client_object_name)
1679
1738
DBusObjectWithProperties.__init__(self, self.bus,
1680
1739
self.dbus_object_path)
1681
1740
1682
1741
def notifychangeproperty(transform_func, dbus_name,
1683
1742
type_func=lambda x: x,
1684
1743
variant_level=1,
1686
1745
_interface=_interface):
1687
1746
""" Modify a variable so that it's a property which announces
1688
1747
its changes to DBus.
1689
1748
1690
1749
transform_fun: Function that takes a value and a variant_level
1691
1750
and transforms it to a D-Bus type.
1692
1751
dbus_name: D-Bus name of the variable
1695
1754
variant_level: D-Bus variant level. Default: 1
1696
1755
"""
1697
1756
attrname = "_{}".format(dbus_name)
1698
1757
1699
1758
def setter(self, value):
1700
1759
if hasattr(self, "dbus_object_path"):
1701
1760
if (not hasattr(self, attrname) or
1708
1767
else:
1709
1768
dbus_value = transform_func(
1710
1769
type_func(value),
1711
variant_level = variant_level)
1770
variant_level=variant_level)
1712
1771
self.PropertyChanged(dbus.String(dbus_name),
1713
1772
dbus_value)
1714
1773
self.PropertiesChanged(
1715
1774
_interface,
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1775
dbus.Dictionary({dbus.String(dbus_name):
1776
dbus_value}),
1718
1777
dbus.Array())
1719
1778
setattr(self, attrname, value)
1720
1779
1721
1780
return property(lambda self: getattr(self, attrname), setter)
1722
1781
1723
1782
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1724
1783
approvals_pending = notifychangeproperty(dbus.Boolean,
1725
1784
"ApprovalPending",
1726
type_func = bool)
1785
type_func=bool)
1727
1786
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1728
1787
last_enabled = notifychangeproperty(datetime_to_dbus,
1729
1788
"LastEnabled")
1730
1789
checker = notifychangeproperty(
1731
1790
dbus.Boolean, "CheckerRunning",
1732
type_func = lambda checker: checker is not None)
1791
type_func=lambda checker: checker is not None)
1733
1792
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1734
1793
"LastCheckedOK")
1735
1794
last_checker_status = notifychangeproperty(dbus.Int16,
1740
1799
"ApprovedByDefault")
1741
1800
approval_delay = notifychangeproperty(
1742
1801
dbus.UInt64, "ApprovalDelay",
1743
type_func = lambda td: td.total_seconds() * 1000)
1802
type_func=lambda td: td.total_seconds() * 1000)
1744
1803
approval_duration = notifychangeproperty(
1745
1804
dbus.UInt64, "ApprovalDuration",
1746
type_func = lambda td: td.total_seconds() * 1000)
1805
type_func=lambda td: td.total_seconds() * 1000)
1747
1806
host = notifychangeproperty(dbus.String, "Host")
1748
1807
timeout = notifychangeproperty(
1749
1808
dbus.UInt64, "Timeout",
1750
type_func = lambda td: td.total_seconds() * 1000)
1809
type_func=lambda td: td.total_seconds() * 1000)
1751
1810
extended_timeout = notifychangeproperty(
1752
1811
dbus.UInt64, "ExtendedTimeout",
1753
type_func = lambda td: td.total_seconds() * 1000)
1812
type_func=lambda td: td.total_seconds() * 1000)
1754
1813
interval = notifychangeproperty(
1755
1814
dbus.UInt64, "Interval",
1756
type_func = lambda td: td.total_seconds() * 1000)
1815
type_func=lambda td: td.total_seconds() * 1000)
1757
1816
checker_command = notifychangeproperty(dbus.String, "Checker")
1758
1817
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1759
1818
invalidate_only=True)
1760
1819
1761
1820
del notifychangeproperty
1762
1821
1763
1822
def __del__(self, *args, **kwargs):
1764
1823
try:
1765
1824
self.remove_from_connection()
1768
1827
if hasattr(DBusObjectWithProperties, "__del__"):
1769
1828
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1770
1829
Client.__del__(self, *args, **kwargs)
1771
1830
1772
1831
def checker_callback(self, source, condition,
1773
1832
connection, command, *args, **kwargs):
1774
1833
ret = Client.checker_callback(self, source, condition,
1790
1849
| self.last_checker_signal),
1791
1850
dbus.String(command))
1792
1851
return ret
1793
1852
1794
1853
def start_checker(self, *args, **kwargs):
1795
1854
old_checker_pid = getattr(self.checker, "pid", None)
1796
1855
r = Client.start_checker(self, *args, **kwargs)
1800
1859
# Emit D-Bus signal
1801
1860
self.CheckerStarted(self.current_checker_command)
1802
1861
return r
1803
1862
1804
1863
def _reset_approved(self):
1805
1864
self.approved = None
1806
1865
return False
1807
1866
1808
1867
def approve(self, value=True):
1809
1868
self.approved = value
1810
gobject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
1812
1871
self.send_changedstate()
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1872
1873
# D-Bus methods, signals & properties
1874
1875
# Interfaces
1876
1877
# Signals
1878
1820
1879
# CheckerCompleted - signal
1821
1880
@dbus.service.signal(_interface, signature="nxs")
1822
1881
def CheckerCompleted(self, exitcode, waitstatus, command):
1823
1882
"D-Bus signal"
1824
1883
pass
1825
1884
1826
1885
# CheckerStarted - signal
1827
1886
@dbus.service.signal(_interface, signature="s")
1828
1887
def CheckerStarted(self, command):
1829
1888
"D-Bus signal"
1830
1889
pass
1831
1890
1832
1891
# PropertyChanged - signal
1833
1892
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1834
1893
@dbus.service.signal(_interface, signature="sv")
1835
1894
def PropertyChanged(self, property, value):
1836
1895
"D-Bus signal"
1837
1896
pass
1838
1897
1839
1898
# GotSecret - signal
1840
1899
@dbus.service.signal(_interface)
1841
1900
def GotSecret(self):
1844
1903
server to mandos-client
1845
1904
"""
1846
1905
pass
1847
1906
1848
1907
# Rejected - signal
1849
1908
@dbus.service.signal(_interface, signature="s")
1850
1909
def Rejected(self, reason):
1851
1910
"D-Bus signal"
1852
1911
pass
1853
1912
1854
1913
# NeedApproval - signal
1855
1914
@dbus.service.signal(_interface, signature="tb")
1856
1915
def NeedApproval(self, timeout, default):
1857
1916
"D-Bus signal"
1858
1917
return self.need_approval()
1859
1860
## Methods
1861
1918
1919
# Methods
1920
1862
1921
# Approve - method
1863
1922
@dbus.service.method(_interface, in_signature="b")
1864
1923
def Approve(self, value):
1865
1924
self.approve(value)
1866
1925
1867
1926
# CheckedOK - method
1868
1927
@dbus.service.method(_interface)
1869
1928
def CheckedOK(self):
1870
1929
self.checked_ok()
1871
1930
1872
1931
# Enable - method
1873
1932
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
1933
@dbus.service.method(_interface)
1875
1934
def Enable(self):
1876
1935
"D-Bus method"
1877
1936
self.enable()
1878
1937
1879
1938
# StartChecker - method
1880
1939
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
1940
@dbus.service.method(_interface)
1882
1941
def StartChecker(self):
1883
1942
"D-Bus method"
1884
1943
self.start_checker()
1885
1944
1886
1945
# Disable - method
1887
1946
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
1947
@dbus.service.method(_interface)
1889
1948
def Disable(self):
1890
1949
"D-Bus method"
1891
1950
self.disable()
1892
1951
1893
1952
# StopChecker - method
1894
1953
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
1954
@dbus.service.method(_interface)
1896
1955
def StopChecker(self):
1897
1956
self.stop_checker()
1898
1899
## Properties
1900
1957
1958
# Properties
1959
1901
1960
# ApprovalPending - property
1902
1961
@dbus_service_property(_interface, signature="b", access="read")
1903
1962
def ApprovalPending_dbus_property(self):
1904
1963
return dbus.Boolean(bool(self.approvals_pending))
1905
1964
1906
1965
# ApprovedByDefault - property
1907
1966
@dbus_service_property(_interface,
1908
1967
signature="b",
1911
1970
if value is None: # get
1912
1971
return dbus.Boolean(self.approved_by_default)
1913
1972
self.approved_by_default = bool(value)
1914
1973
1915
1974
# ApprovalDelay - property
1916
1975
@dbus_service_property(_interface,
1917
1976
signature="t",
1921
1980
return dbus.UInt64(self.approval_delay.total_seconds()
1922
1981
* 1000)
1923
1982
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1924
1983
1925
1984
# ApprovalDuration - property
1926
1985
@dbus_service_property(_interface,
1927
1986
signature="t",
1931
1990
return dbus.UInt64(self.approval_duration.total_seconds()
1932
1991
* 1000)
1933
1992
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
1993
1935
1994
# Name - property
1936
1995
@dbus_annotations(
1937
1996
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
1997
@dbus_service_property(_interface, signature="s", access="read")
1939
1998
def Name_dbus_property(self):
1940
1999
return dbus.String(self.name)
1941
2000
1942
2001
# Fingerprint - property
1943
2002
@dbus_annotations(
1944
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
2004
@dbus_service_property(_interface, signature="s", access="read")
1946
2005
def Fingerprint_dbus_property(self):
1947
2006
return dbus.String(self.fingerprint)
1948
2007
1949
2008
# Host - property
1950
2009
@dbus_service_property(_interface,
1951
2010
signature="s",
1954
2013
if value is None: # get
1955
2014
return dbus.String(self.host)
1956
2015
self.host = str(value)
1957
2016
1958
2017
# Created - property
1959
2018
@dbus_annotations(
1960
2019
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
2020
@dbus_service_property(_interface, signature="s", access="read")
1962
2021
def Created_dbus_property(self):
1963
2022
return datetime_to_dbus(self.created)
1964
2023
1965
2024
# LastEnabled - property
1966
2025
@dbus_service_property(_interface, signature="s", access="read")
1967
2026
def LastEnabled_dbus_property(self):
1968
2027
return datetime_to_dbus(self.last_enabled)
1969
2028
1970
2029
# Enabled - property
1971
2030
@dbus_service_property(_interface,
1972
2031
signature="b",
1978
2037
self.enable()
1979
2038
else:
1980
2039
self.disable()
1981
2040
1982
2041
# LastCheckedOK - property
1983
2042
@dbus_service_property(_interface,
1984
2043
signature="s",
1988
2047
self.checked_ok()
1989
2048
return
1990
2049
return datetime_to_dbus(self.last_checked_ok)
1991
2050
1992
2051
# LastCheckerStatus - property
1993
2052
@dbus_service_property(_interface, signature="n", access="read")
1994
2053
def LastCheckerStatus_dbus_property(self):
1995
2054
return dbus.Int16(self.last_checker_status)
1996
2055
1997
2056
# Expires - property
1998
2057
@dbus_service_property(_interface, signature="s", access="read")
1999
2058
def Expires_dbus_property(self):
2000
2059
return datetime_to_dbus(self.expires)
2001
2060
2002
2061
# LastApprovalRequest - property
2003
2062
@dbus_service_property(_interface, signature="s", access="read")
2004
2063
def LastApprovalRequest_dbus_property(self):
2005
2064
return datetime_to_dbus(self.last_approval_request)
2006
2065
2007
2066
# Timeout - property
2008
2067
@dbus_service_property(_interface,
2009
2068
signature="t",
2024
2083
if (getattr(self, "disable_initiator_tag", None)
2025
2084
is None):
2026
2085
return
2027
gobject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = gobject.timeout_add(
2086
GLib.source_remove(self.disable_initiator_tag)
2087
self.disable_initiator_tag = GLib.timeout_add(
2029
2088
int((self.expires - now).total_seconds() * 1000),
2030
2089
self.disable)
2031
2090
2032
2091
# ExtendedTimeout - property
2033
2092
@dbus_service_property(_interface,
2034
2093
signature="t",
2038
2097
return dbus.UInt64(self.extended_timeout.total_seconds()
2039
2098
* 1000)
2040
2099
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2041
2100
2042
2101
# Interval - property
2043
2102
@dbus_service_property(_interface,
2044
2103
signature="t",
2051
2110
return
2052
2111
if self.enabled:
2053
2112
# Reschedule checker run
2054
gobject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = gobject.timeout_add(
2113
GLib.source_remove(self.checker_initiator_tag)
2114
self.checker_initiator_tag = GLib.timeout_add(
2056
2115
value, self.start_checker)
2057
self.start_checker() # Start one now, too
2058
2116
self.start_checker() # Start one now, too
2117
2059
2118
# Checker - property
2060
2119
@dbus_service_property(_interface,
2061
2120
signature="s",
2064
2123
if value is None: # get
2065
2124
return dbus.String(self.checker_command)
2066
2125
self.checker_command = str(value)
2067
2126
2068
2127
# CheckerRunning - property
2069
2128
@dbus_service_property(_interface,
2070
2129
signature="b",
2076
2135
self.start_checker()
2077
2136
else:
2078
2137
self.stop_checker()
2079
2138
2080
2139
# ObjectPath - property
2081
2140
@dbus_annotations(
2082
2141
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
2142
"org.freedesktop.DBus.Deprecated": "true"})
2084
2143
@dbus_service_property(_interface, signature="o", access="read")
2085
2144
def ObjectPath_dbus_property(self):
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2145
return self.dbus_object_path # is already a dbus.ObjectPath
2146
2088
2147
# Secret = property
2089
2148
@dbus_annotations(
2090
2149
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2095
2154
byte_arrays=True)
2096
2155
def Secret_dbus_property(self, value):
2097
2156
self.secret = bytes(value)
2098
2157
2099
2158
del _interface
2100
2159
2101
2160
2105
2164
self._pipe.send(('init', fpr, address))
2106
2165
if not self._pipe.recv():
2107
2166
raise KeyError(fpr)
2108
2167
2109
2168
def __getattribute__(self, name):
2110
2169
if name == '_pipe':
2111
2170
return super(ProxyClient, self).__getattribute__(name)
2114
2173
if data[0] == 'data':
2115
2174
return data[1]
2116
2175
if data[0] == 'function':
2117
2176
2118
2177
def func(*args, **kwargs):
2119
2178
self._pipe.send(('funcall', name, args, kwargs))
2120
2179
return self._pipe.recv()[1]
2121
2180
2122
2181
return func
2123
2182
2124
2183
def __setattr__(self, name, value):
2125
2184
if name == '_pipe':
2126
2185
return super(ProxyClient, self).__setattr__(name, value)
2129
2188
2130
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
2131
2190
"""A class to handle client connections.
2132
2191
2133
2192
Instantiated once for each connection to handle it.
2134
2193
Note: This will run in its own forked process."""
2135
2194
2136
2195
def handle(self):
2137
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
2138
2197
logger.info("TCP connection from: %s",
2139
2198
str(self.client_address))
2140
2199
logger.debug("Pipe FD: %d",
2141
2200
self.server.child_pipe.fileno())
2142
2201
2143
2202
session = gnutls.ClientSession(self.request)
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2203
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2207
# "+DHE-DSS"))
2149
2208
# Use a fallback default, since this MUST be set.
2150
2209
priority = self.server.gnutls_priority
2151
2210
if priority is None:
2152
2211
priority = "NORMAL"
2153
gnutls.priority_set_direct(session._c_object, priority,
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
2154
2214
None)
2155
2215
2156
2216
# Start communication using the Mandos protocol
2157
2217
# Get protocol number
2158
2218
line = self.request.makefile().readline()
2163
2223
except (ValueError, IndexError, RuntimeError) as error:
2164
2224
logger.error("Unknown protocol version: %s", error)
2165
2225
return
2166
2226
2167
2227
# Start GnuTLS connection
2168
2228
try:
2169
2229
session.handshake()
2173
2233
# established. Just abandon the request.
2174
2234
return
2175
2235
logger.debug("Handshake succeeded")
2176
2236
2177
2237
approval_required = False
2178
2238
try:
2179
2239
try:
2183
2243
logger.warning("Bad certificate: %s", error)
2184
2244
return
2185
2245
logger.debug("Fingerprint: %s", fpr)
2186
2246
2187
2247
try:
2188
2248
client = ProxyClient(child_pipe, fpr,
2189
2249
self.client_address)
2190
2250
except KeyError:
2191
2251
return
2192
2252
2193
2253
if client.approval_delay:
2194
2254
delay = client.approval_delay
2195
2255
client.approvals_pending += 1
2196
2256
approval_required = True
2197
2257
2198
2258
while True:
2199
2259
if not client.enabled:
2200
2260
logger.info("Client %s is disabled",
2203
2263
# Emit D-Bus signal
2204
2264
client.Rejected("Disabled")
2205
2265
return
2206
2266
2207
2267
if client.approved or not client.approval_delay:
2208
#We are approved or approval is disabled
2268
# We are approved or approval is disabled
2209
2269
break
2210
2270
elif client.approved is None:
2211
2271
logger.info("Client %s needs approval",
2222
2282
# Emit D-Bus signal
2223
2283
client.Rejected("Denied")
2224
2284
return
2225
2226
#wait until timeout or approved
2285
2286
# wait until timeout or approved
2227
2287
time = datetime.datetime.now()
2228
2288
client.changedstate.acquire()
2229
2289
client.changedstate.wait(delay.total_seconds())
2242
2302
break
2243
2303
else:
2244
2304
delay -= time2 - time
2245
2305
2246
2306
try:
2247
2307
session.send(client.secret)
2248
2308
except gnutls.Error as error:
2249
2309
logger.warning("gnutls send failed",
2250
exc_info = error)
2310
exc_info=error)
2251
2311
return
2252
2312
2253
2313
logger.info("Sending secret to %s", client.name)
2254
2314
# bump the timeout using extended_timeout
2255
2315
client.bump_timeout(client.extended_timeout)
2256
2316
if self.server.use_dbus:
2257
2317
# Emit D-Bus signal
2258
2318
client.GotSecret()
2259
2319
2260
2320
finally:
2261
2321
if approval_required:
2262
2322
client.approvals_pending -= 1
2265
2325
except gnutls.Error as error:
2266
2326
logger.warning("GnuTLS bye failed",
2267
2327
exc_info=error)
2268
2328
2269
2329
@staticmethod
2270
2330
def peer_certificate(session):
2271
2331
"Return the peer's OpenPGP certificate as a bytestring"
2283
2343
return None
2284
2344
cert = cert_list[0]
2285
2345
return ctypes.string_at(cert.data, cert.size)
2286
2346
2287
2347
@staticmethod
2288
2348
def fingerprint(openpgp):
2289
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2322
2382
2323
2383
class MultiprocessingMixIn(object):
2324
2384
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2325
2385
2326
2386
def sub_process_main(self, request, address):
2327
2387
try:
2328
2388
self.finish_request(request, address)
2329
2389
except Exception:
2330
2390
self.handle_error(request, address)
2331
2391
self.close_request(request)
2332
2392
2333
2393
def process_request(self, request, address):
2334
2394
"""Start a new process to process the request."""
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
2337
2397
proc.start()
2338
2398
return proc
2339
2399
2340
2400
2341
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2342
2402
""" adds a pipe to the MixIn """
2343
2403
2344
2404
def process_request(self, request, client_address):
2345
2405
"""Overrides and wraps the original process_request().
2346
2406
2347
2407
This function creates a new pipe in self.pipe
2348
2408
"""
2349
2409
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2350
2410
2351
2411
proc = MultiprocessingMixIn.process_request(self, request,
2352
2412
client_address)
2353
2413
self.child_pipe.close()
2354
2414
self.add_pipe(parent_pipe, proc)
2355
2415
2356
2416
def add_pipe(self, parent_pipe, proc):
2357
2417
"""Dummy function; override as necessary"""
2358
2418
raise NotImplementedError()
2361
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2362
2422
socketserver.TCPServer, object):
2363
2423
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2364
2424
2365
2425
Attributes:
2366
2426
enabled: Boolean; whether this server is activated yet
2367
2427
interface: None or a network interface name (string)
2368
2428
use_ipv6: Boolean; to use IPv6 or not
2369
2429
"""
2370
2430
2371
2431
def __init__(self, server_address, RequestHandlerClass,
2372
2432
interface=None,
2373
2433
use_ipv6=True,
2383
2443
self.socketfd = socketfd
2384
2444
# Save the original socket.socket() function
2385
2445
self.socket_socket = socket.socket
2446
2386
2447
# To implement --socket, we monkey patch socket.socket.
2387
#
2448
#
2388
2449
# (When socketserver.TCPServer is a new-style class, we
2389
2450
# could make self.socket into a property instead of monkey
2390
2451
# patching socket.socket.)
2391
#
2452
#
2392
2453
# Create a one-time-only replacement for socket.socket()
2393
2454
@functools.wraps(socket.socket)
2394
2455
def socket_wrapper(*args, **kwargs):
2406
2467
# socket_wrapper(), if socketfd was set.
2407
2468
socketserver.TCPServer.__init__(self, server_address,
2408
2469
RequestHandlerClass)
2409
2470
2410
2471
def server_bind(self):
2411
2472
"""This overrides the normal server_bind() function
2412
2473
to bind to an interface if one was specified, and also NOT to
2413
2474
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2414
2476
if self.interface is not None:
2415
2477
if SO_BINDTODEVICE is None:
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2478
# Fall back to a hard-coded value which seems to be
2479
# common enough.
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2482
try:
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2493
self.interface)
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2497
else:
2498
raise
2437
2499
# Only bind(2) the socket if we really need to.
2438
2500
if self.server_address[0] or self.server_address[1]:
2439
2501
if not self.server_address[0]:
2440
2502
if self.address_family == socket.AF_INET6:
2441
any_address = "::" # in6addr_any
2503
any_address = "::" # in6addr_any
2442
2504
else:
2443
any_address = "0.0.0.0" # INADDR_ANY
2505
any_address = "0.0.0.0" # INADDR_ANY
2444
2506
self.server_address = (any_address,
2445
2507
self.server_address[1])
2446
2508
elif not self.server_address[1]:
2456
2518
2457
2519
class MandosServer(IPv6_TCPServer):
2458
2520
"""Mandos server.
2459
2521
2460
2522
Attributes:
2461
2523
clients: set of Client objects
2462
2524
gnutls_priority GnuTLS priority string
2463
2525
use_dbus: Boolean; to emit D-Bus signals or not
2464
2465
Assumes a gobject.MainLoop event loop.
2526
2527
Assumes a GLib.MainLoop event loop.
2466
2528
"""
2467
2529
2468
2530
def __init__(self, server_address, RequestHandlerClass,
2469
2531
interface=None,
2470
2532
use_ipv6=True,
2480
2542
self.gnutls_priority = gnutls_priority
2481
2543
IPv6_TCPServer.__init__(self, server_address,
2482
2544
RequestHandlerClass,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2545
interface=interface,
2546
use_ipv6=use_ipv6,
2547
socketfd=socketfd)
2548
2487
2549
def server_activate(self):
2488
2550
if self.enabled:
2489
2551
return socketserver.TCPServer.server_activate(self)
2490
2552
2491
2553
def enable(self):
2492
2554
self.enabled = True
2493
2555
2494
2556
def add_pipe(self, parent_pipe, proc):
2495
2557
# Call "handle_ipc" for both data and EOF events
2496
gobject.io_add_watch(
2558
GLib.io_add_watch(
2497
2559
parent_pipe.fileno(),
2498
gobject.IO_IN | gobject.IO_HUP,
2560
GLib.IO_IN | GLib.IO_HUP,
2499
2561
functools.partial(self.handle_ipc,
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2562
parent_pipe=parent_pipe,
2563
proc=proc))
2564
2503
2565
def handle_ipc(self, source, condition,
2504
2566
parent_pipe=None,
2505
proc = None,
2567
proc=None,
2506
2568
client_object=None):
2507
2569
# error, or the other end of multiprocessing.Pipe has closed
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2570
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2509
2571
# Wait for other process to exit
2510
2572
proc.join()
2511
2573
return False
2512
2574
2513
2575
# Read a request from the child
2514
2576
request = parent_pipe.recv()
2515
2577
command = request[0]
2516
2578
2517
2579
if command == 'init':
2518
2580
fpr = request[1]
2519
2581
address = request[2]
2520
2521
for c in self.clients.itervalues():
2582
2583
for c in self.clients.values():
2522
2584
if c.fingerprint == fpr:
2523
2585
client = c
2524
2586
break
2531
2593
address[0])
2532
2594
parent_pipe.send(False)
2533
2595
return False
2534
2535
gobject.io_add_watch(
2596
2597
GLib.io_add_watch(
2536
2598
parent_pipe.fileno(),
2537
gobject.IO_IN | gobject.IO_HUP,
2599
GLib.IO_IN | GLib.IO_HUP,
2538
2600
functools.partial(self.handle_ipc,
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2601
parent_pipe=parent_pipe,
2602
proc=proc,
2603
client_object=client))
2542
2604
parent_pipe.send(True)
2543
2605
# remove the old hook in favor of the new above hook on
2544
2606
# same fileno
2547
2609
funcname = request[1]
2548
2610
args = request[2]
2549
2611
kwargs = request[3]
2550
2612
2551
2613
parent_pipe.send(('data', getattr(client_object,
2552
2614
funcname)(*args,
2553
2615
**kwargs)))
2554
2616
2555
2617
if command == 'getattr':
2556
2618
attrname = request[1]
2557
2619
if isinstance(client_object.__getattribute__(attrname),
2560
2622
else:
2561
2623
parent_pipe.send((
2562
2624
'data', client_object.__getattribute__(attrname)))
2563
2625
2564
2626
if command == 'setattr':
2565
2627
attrname = request[1]
2566
2628
value = request[2]
2567
2629
setattr(client_object, attrname, value)
2568
2630
2569
2631
return True
2570
2632
2571
2633
2572
2634
def rfc3339_duration_to_delta(duration):
2573
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2574
2636
2575
2637
>>> rfc3339_duration_to_delta("P7D")
2576
2638
datetime.timedelta(7)
2577
2639
>>> rfc3339_duration_to_delta("PT60S")
2587
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
2650
datetime.timedelta(1, 200)
2589
2651
"""
2590
2652
2591
2653
# Parsing an RFC 3339 duration with regular expressions is not
2592
2654
# possible - there would have to be multiple places for the same
2593
2655
# values, like seconds. The current code, while more esoteric, is
2594
2656
# cleaner without depending on a parsing library. If Python had a
2595
2657
# built-in library for parsing we would use it, but we'd like to
2596
2658
# avoid excessive use of external libraries.
2597
2659
2598
2660
# New type for defining tokens, syntax, and semantics all-in-one
2599
2661
Token = collections.namedtuple("Token", (
2600
2662
"regexp", # To match token; if "value" is not None, must have
2633
2695
frozenset((token_year, token_month,
2634
2696
token_day, token_time,
2635
2697
token_week)))
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2698
# Define starting values:
2699
# Value so far
2700
value = datetime.timedelta()
2638
2701
found_token = None
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2702
# Following valid tokens
2703
followers = frozenset((token_duration, ))
2704
# String left to parse
2705
s = duration
2641
2706
# Loop until end token is found
2642
2707
while found_token is not token_end:
2643
2708
# Search for any currently valid tokens
2667
2732
2668
2733
def string_to_delta(interval):
2669
2734
"""Parse a string and return a datetime.timedelta
2670
2735
2671
2736
>>> string_to_delta('7d')
2672
2737
datetime.timedelta(7)
2673
2738
>>> string_to_delta('60s')
2681
2746
>>> string_to_delta('5m 30s')
2682
2747
datetime.timedelta(0, 330)
2683
2748
"""
2684
2749
2685
2750
try:
2686
2751
return rfc3339_duration_to_delta(interval)
2687
2752
except ValueError:
2688
2753
pass
2689
2754
2690
2755
timevalue = datetime.timedelta(0)
2691
2756
for s in interval.split():
2692
2757
try:
2710
2775
return timevalue
2711
2776
2712
2777
2713
def daemon(nochdir = False, noclose = False):
2778
def daemon(nochdir=False, noclose=False):
2714
2779
"""See daemon(3). Standard BSD Unix function.
2715
2780
2716
2781
This should really exist as os.daemon, but it doesn't (yet)."""
2717
2782
if os.fork():
2718
2783
sys.exit()
2736
2801
2737
2802
2738
2803
def main():
2739
2804
2740
2805
##################################################################
2741
2806
# Parsing of options, both command line and config file
2742
2807
2743
2808
parser = argparse.ArgumentParser()
2744
2809
parser.add_argument("-v", "--version", action="version",
2745
version = "%(prog)s {}".format(version),
2810
version="%(prog)s {}".format(version),
2746
2811
help="show version number and exit")
2747
2812
parser.add_argument("-i", "--interface", metavar="IF",
2748
2813
help="Bind to interface IF")
2784
2849
parser.add_argument("--no-zeroconf", action="store_false",
2785
2850
dest="zeroconf", help="Do not use Zeroconf",
2786
2851
default=None)
2787
2852
2788
2853
options = parser.parse_args()
2789
2854
2790
2855
if options.check:
2791
2856
import doctest
2792
2857
fail_count, test_count = doctest.testmod()
2793
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
2859
2795
2860
# Default values for config file for server-global settings
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
2861
server_defaults = {"interface": "",
2862
"address": "",
2863
"port": "",
2864
"debug": "False",
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2869
"use_dbus": "True",
2870
"use_ipv6": "True",
2871
"debuglevel": "",
2872
"restore": "True",
2873
"socket": "",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
2876
"zeroconf": "True",
2877
}
2878
2814
2879
# Parse config file for server-global settings
2815
2880
server_config = configparser.SafeConfigParser(server_defaults)
2816
2881
del server_defaults
2834
2899
server_settings["socket"] = os.dup(server_settings
2835
2900
["socket"])
2836
2901
del server_config
2837
2902
2838
2903
# Override the settings from the config file with command line
2839
2904
# options, if set.
2840
2905
for option in ("interface", "address", "port", "debug",
2858
2923
if server_settings["debug"]:
2859
2924
server_settings["foreground"] = True
2860
2925
# Now we have our good server settings in "server_settings"
2861
2926
2862
2927
##################################################################
2863
2928
2864
2929
if (not server_settings["zeroconf"]
2865
2930
and not (server_settings["port"]
2866
2931
or server_settings["socket"] != "")):
2867
2932
parser.error("Needs port or socket to work without Zeroconf")
2868
2933
2869
2934
# For convenience
2870
2935
debug = server_settings["debug"]
2871
2936
debuglevel = server_settings["debuglevel"]
2875
2940
stored_state_file)
2876
2941
foreground = server_settings["foreground"]
2877
2942
zeroconf = server_settings["zeroconf"]
2878
2943
2879
2944
if debug:
2880
2945
initlogger(debug, logging.DEBUG)
2881
2946
else:
2884
2949
else:
2885
2950
level = getattr(logging, debuglevel.upper())
2886
2951
initlogger(debug, level)
2887
2952
2888
2953
if server_settings["servicename"] != "Mandos":
2889
2954
syslogger.setFormatter(
2890
2955
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
2956
' %(levelname)s: %(message)s'.format(
2892
2957
server_settings["servicename"])))
2893
2958
2894
2959
# Parse config file with clients
2895
2960
client_config = configparser.SafeConfigParser(Client
2896
2961
.client_defaults)
2897
2962
client_config.read(os.path.join(server_settings["configdir"],
2898
2963
"clients.conf"))
2899
2964
2900
2965
global mandos_dbus_service
2901
2966
mandos_dbus_service = None
2902
2967
2903
2968
socketfd = None
2904
2969
if server_settings["socket"] != "":
2905
2970
socketfd = server_settings["socket"]
2921
2986
except IOError as e:
2922
2987
logger.error("Could not open file %r", pidfilename,
2923
2988
exc_info=e)
2924
2925
for name in ("_mandos", "mandos", "nobody"):
2989
2990
for name, group in (("_mandos", "_mandos"),
2991
("mandos", "mandos"),
2992
("nobody", "nogroup")):
2926
2993
try:
2927
2994
uid = pwd.getpwnam(name).pw_uid
2928
gid = pwd.getpwnam(name).pw_gid
2995
gid = pwd.getpwnam(group).pw_gid
2929
2996
break
2930
2997
except KeyError:
2931
2998
continue
2935
3002
try:
2936
3003
os.setgid(gid)
2937
3004
os.setuid(uid)
3005
if debug:
3006
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3007
gid))
2938
3008
except OSError as error:
3009
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
.format(uid, gid, os.strerror(error.errno)))
2939
3011
if error.errno != errno.EPERM:
2940
3012
raise
2941
3013
2942
3014
if debug:
2943
3015
# Enable all possible GnuTLS debugging
2944
3016
2945
3017
# "Use a log level over 10 to enable all debugging options."
2946
3018
# - GnuTLS manual
2947
3019
gnutls.global_set_log_level(11)
2948
3020
2949
3021
@gnutls.log_func
2950
3022
def debug_gnutls(level, string):
2951
3023
logger.debug("GnuTLS: %s", string[:-1])
2952
3024
2953
3025
gnutls.global_set_log_function(debug_gnutls)
2954
3026
2955
3027
# Redirect stdin so all checkers get /dev/null
2956
3028
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2957
3029
os.dup2(null, sys.stdin.fileno())
2958
3030
if null > 2:
2959
3031
os.close(null)
2960
3032
2961
3033
# Need to fork before connecting to D-Bus
2962
3034
if not foreground:
2963
3035
# Close all input and output, do double fork, etc.
2964
3036
daemon()
2965
2966
# multiprocessing will use threads, so before we use gobject we
2967
# need to inform gobject that threads will be used.
2968
gobject.threads_init()
2969
3037
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
3040
GLib.threads_init()
3041
2970
3042
global main_loop
2971
3043
# From the Avahi example code
2972
3044
DBusGMainLoop(set_as_default=True)
2973
main_loop = gobject.MainLoop()
3045
main_loop = GLib.MainLoop()
2974
3046
bus = dbus.SystemBus()
2975
3047
# End of Avahi example code
2976
3048
if use_dbus:
2989
3061
if zeroconf:
2990
3062
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2991
3063
service = AvahiServiceToSyslog(
2992
name = server_settings["servicename"],
2993
servicetype = "_mandos._tcp",
2994
protocol = protocol,
2995
bus = bus)
3064
name=server_settings["servicename"],
3065
servicetype="_mandos._tcp",
3066
protocol=protocol,
3067
bus=bus)
2996
3068
if server_settings["interface"]:
2997
3069
service.interface = if_nametoindex(
2998
3070
server_settings["interface"].encode("utf-8"))
2999
3071
3000
3072
global multiprocessing_manager
3001
3073
multiprocessing_manager = multiprocessing.Manager()
3002
3074
3003
3075
client_class = Client
3004
3076
if use_dbus:
3005
client_class = functools.partial(ClientDBus, bus = bus)
3006
3077
client_class = functools.partial(ClientDBus, bus=bus)
3078
3007
3079
client_settings = Client.config_parser(client_config)
3008
3080
old_client_settings = {}
3009
3081
clients_data = {}
3010
3082
3011
3083
# This is used to redirect stdout and stderr for checker processes
3012
3084
global wnull
3013
wnull = open(os.devnull, "w") # A writable /dev/null
3085
wnull = open(os.devnull, "w") # A writable /dev/null
3014
3086
# Only used if server is running in foreground but not in debug
3015
3087
# mode
3016
3088
if debug or not foreground:
3017
3089
wnull.close()
3018
3090
3019
3091
# Get client data and settings from last running state.
3020
3092
if server_settings["restore"]:
3021
3093
try:
3022
3094
with open(stored_state_path, "rb") as stored_state:
3023
clients_data, old_client_settings = pickle.load(
3024
stored_state)
3095
if sys.version_info.major == 2:
3096
clients_data, old_client_settings = pickle.load(
3097
stored_state)
3098
else:
3099
bytes_clients_data, bytes_old_client_settings = (
3100
pickle.load(stored_state, encoding="bytes"))
3101
# Fix bytes to strings
3102
# clients_data
3103
# .keys()
3104
clients_data = {(key.decode("utf-8")
3105
if isinstance(key, bytes)
3106
else key): value
3107
for key, value in
3108
bytes_clients_data.items()}
3109
del bytes_clients_data
3110
for key in clients_data:
3111
value = {(k.decode("utf-8")
3112
if isinstance(k, bytes) else k): v
3113
for k, v in
3114
clients_data[key].items()}
3115
clients_data[key] = value
3116
# .client_structure
3117
value["client_structure"] = [
3118
(s.decode("utf-8")
3119
if isinstance(s, bytes)
3120
else s) for s in
3121
value["client_structure"]]
3122
# .name & .host
3123
for k in ("name", "host"):
3124
if isinstance(value[k], bytes):
3125
value[k] = value[k].decode("utf-8")
3126
# old_client_settings
3127
# .keys()
3128
old_client_settings = {
3129
(key.decode("utf-8")
3130
if isinstance(key, bytes)
3131
else key): value
3132
for key, value in
3133
bytes_old_client_settings.items()}
3134
del bytes_old_client_settings
3135
# .host
3136
for value in old_client_settings.values():
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3139
.decode("utf-8"))
3025
3140
os.remove(stored_state_path)
3026
3141
except IOError as e:
3027
3142
if e.errno == errno.ENOENT:
3035
3150
logger.warning("Could not load persistent state: "
3036
3151
"EOFError:",
3037
3152
exc_info=e)
3038
3153
3039
3154
with PGPEngine() as pgp:
3040
3155
for client_name, client in clients_data.items():
3041
3156
# Skip removed clients
3042
3157
if client_name not in client_settings:
3043
3158
continue
3044
3159
3045
3160
# Decide which value to use after restoring saved state.
3046
3161
# We have three different values: Old config file,
3047
3162
# new config file, and saved state.
3058
3173
client[name] = value
3059
3174
except KeyError:
3060
3175
pass
3061
3176
3062
3177
# Clients who has passed its expire date can still be
3063
3178
# enabled if its last checker was successful. A Client
3064
3179
# whose checker succeeded before we stored its state is
3097
3212
client_name))
3098
3213
client["secret"] = (client_settings[client_name]
3099
3214
["secret"])
3100
3215
3101
3216
# Add/remove clients based on new changes made to config
3102
3217
for client_name in (set(old_client_settings)
3103
3218
- set(client_settings)):
3105
3220
for client_name in (set(client_settings)
3106
3221
- set(old_client_settings)):
3107
3222
clients_data[client_name] = client_settings[client_name]
3108
3223
3109
3224
# Create all client objects
3110
3225
for client_name, client in clients_data.items():
3111
3226
tcp_server.clients[client_name] = client_class(
3112
name = client_name,
3113
settings = client,
3114
server_settings = server_settings)
3115
3227
name=client_name,
3228
settings=client,
3229
server_settings=server_settings)
3230
3116
3231
if not tcp_server.clients:
3117
3232
logger.warning("No clients defined")
3118
3233
3119
3234
if not foreground:
3120
3235
if pidfile is not None:
3121
3236
pid = os.getpid()
3127
3242
pidfilename, pid)
3128
3243
del pidfile
3129
3244
del pidfilename
3130
3131
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3132
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3133
3245
3246
for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
lambda: main_loop.quit() and False)
3249
3134
3250
if use_dbus:
3135
3251
3136
3252
@alternate_dbus_interfaces(
3137
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3253
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3138
3254
class MandosDBusService(DBusObjectWithObjectManager):
3139
3255
"""A D-Bus proxy object"""
3140
3256
3141
3257
def __init__(self):
3142
3258
dbus.service.Object.__init__(self, bus, "/")
3143
3259
3144
3260
_interface = "se.recompile.Mandos"
3145
3261
3146
3262
@dbus.service.signal(_interface, signature="o")
3147
3263
def ClientAdded(self, objpath):
3148
3264
"D-Bus signal"
3149
3265
pass
3150
3266
3151
3267
@dbus.service.signal(_interface, signature="ss")
3152
3268
def ClientNotFound(self, fingerprint, address):
3153
3269
"D-Bus signal"
3154
3270
pass
3155
3271
3156
3272
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3157
3273
"true"})
3158
3274
@dbus.service.signal(_interface, signature="os")
3159
3275
def ClientRemoved(self, objpath, name):
3160
3276
"D-Bus signal"
3161
3277
pass
3162
3278
3163
3279
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3164
3280
"true"})
3165
3281
@dbus.service.method(_interface, out_signature="ao")
3166
3282
def GetAllClients(self):
3167
3283
"D-Bus method"
3168
3284
return dbus.Array(c.dbus_object_path for c in
3169
tcp_server.clients.itervalues())
3170
3285
tcp_server.clients.values())
3286
3171
3287
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3172
3288
"true"})
3173
3289
@dbus.service.method(_interface,
3175
3291
def GetAllClientsWithProperties(self):
3176
3292
"D-Bus method"
3177
3293
return dbus.Dictionary(
3178
{ c.dbus_object_path: c.GetAll(
3294
{c.dbus_object_path: c.GetAll(
3179
3295
"se.recompile.Mandos.Client")
3180
for c in tcp_server.clients.itervalues() },
3296
for c in tcp_server.clients.values()},
3181
3297
signature="oa{sv}")
3182
3298
3183
3299
@dbus.service.method(_interface, in_signature="o")
3184
3300
def RemoveClient(self, object_path):
3185
3301
"D-Bus method"
3186
for c in tcp_server.clients.itervalues():
3302
for c in tcp_server.clients.values():
3187
3303
if c.dbus_object_path == object_path:
3188
3304
del tcp_server.clients[c.name]
3189
3305
c.remove_from_connection()
3193
3309
self.client_removed_signal(c)
3194
3310
return
3195
3311
raise KeyError(object_path)
3196
3312
3197
3313
del _interface
3198
3314
3199
3315
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3200
out_signature = "a{oa{sa{sv}}}")
3316
out_signature="a{oa{sa{sv}}}")
3201
3317
def GetManagedObjects(self):
3202
3318
"""D-Bus method"""
3203
3319
return dbus.Dictionary(
3204
{ client.dbus_object_path:
3205
dbus.Dictionary(
3206
{ interface: client.GetAll(interface)
3207
for interface in
3208
client._get_all_interface_names()})
3209
for client in tcp_server.clients.values()})
3210
3320
{client.dbus_object_path:
3321
dbus.Dictionary(
3322
{interface: client.GetAll(interface)
3323
for interface in
3324
client._get_all_interface_names()})
3325
for client in tcp_server.clients.values()})
3326
3211
3327
def client_added_signal(self, client):
3212
3328
"""Send the new standard signal and the old signal"""
3213
3329
if use_dbus:
3215
3331
self.InterfacesAdded(
3216
3332
client.dbus_object_path,
3217
3333
dbus.Dictionary(
3218
{ interface: client.GetAll(interface)
3219
for interface in
3220
client._get_all_interface_names()}))
3334
{interface: client.GetAll(interface)
3335
for interface in
3336
client._get_all_interface_names()}))
3221
3337
# Old signal
3222
3338
self.ClientAdded(client.dbus_object_path)
3223
3339
3224
3340
def client_removed_signal(self, client):
3225
3341
"""Send the new standard signal and the old signal"""
3226
3342
if use_dbus:
3231
3347
# Old signal
3232
3348
self.ClientRemoved(client.dbus_object_path,
3233
3349
client.name)
3234
3350
3235
3351
mandos_dbus_service = MandosDBusService()
3236
3352
3353
# Save modules to variables to exempt the modules from being
3354
# unloaded before the function registered with atexit() is run.
3355
mp = multiprocessing
3356
wn = wnull
3357
3237
3358
def cleanup():
3238
3359
"Cleanup function; run on exit"
3239
3360
if zeroconf:
3240
3361
service.cleanup()
3241
3242
multiprocessing.active_children()
3243
wnull.close()
3362
3363
mp.active_children()
3364
wn.close()
3244
3365
if not (tcp_server.clients or client_settings):
3245
3366
return
3246
3367
3247
3368
# Store client before exiting. Secrets are encrypted with key
3248
3369
# based on what config file has. If config file is
3249
3370
# removed/edited, old secret will thus be unrecovable.
3250
3371
clients = {}
3251
3372
with PGPEngine() as pgp:
3252
for client in tcp_server.clients.itervalues():
3373
for client in tcp_server.clients.values():
3253
3374
key = client_settings[client.name]["secret"]
3254
3375
client.encrypted_secret = pgp.encrypt(client.secret,
3255
3376
key)
3256
3377
client_dict = {}
3257
3378
3258
3379
# A list of attributes that can not be pickled
3259
3380
# + secret.
3260
exclude = { "bus", "changedstate", "secret",
3261
"checker", "server_settings" }
3381
exclude = {"bus", "changedstate", "secret",
3382
"checker", "server_settings"}
3262
3383
for name, typ in inspect.getmembers(dbus.service
3263
3384
.Object):
3264
3385
exclude.add(name)
3265
3386
3266
3387
client_dict["encrypted_secret"] = (client
3267
3388
.encrypted_secret)
3268
3389
for attr in client.client_structure:
3269
3390
if attr not in exclude:
3270
3391
client_dict[attr] = getattr(client, attr)
3271
3392
3272
3393
clients[client.name] = client_dict
3273
3394
del client_settings[client.name]["secret"]
3274
3395
3275
3396
try:
3276
3397
with tempfile.NamedTemporaryFile(
3277
3398
mode='wb',
3279
3400
prefix='clients-',
3280
3401
dir=os.path.dirname(stored_state_path),
3281
3402
delete=False) as stored_state:
3282
pickle.dump((clients, client_settings), stored_state)
3403
pickle.dump((clients, client_settings), stored_state,
3404
protocol=2)
3283
3405
tempname = stored_state.name
3284
3406
os.rename(tempname, stored_state_path)
3285
3407
except (IOError, OSError) as e:
3295
3417
logger.warning("Could not save persistent state:",
3296
3418
exc_info=e)
3297
3419
raise
3298
3420
3299
3421
# Delete all clients, and settings from config
3300
3422
while tcp_server.clients:
3301
3423
name, client = tcp_server.clients.popitem()
3307
3429
if use_dbus:
3308
3430
mandos_dbus_service.client_removed_signal(client)
3309
3431
client_settings.clear()
3310
3432
3311
3433
atexit.register(cleanup)
3312
3313
for client in tcp_server.clients.itervalues():
3434
3435
for client in tcp_server.clients.values():
3314
3436
if use_dbus:
3315
3437
# Emit D-Bus signal for adding
3316
3438
mandos_dbus_service.client_added_signal(client)
3317
3439
# Need to initiate checking of clients
3318
3440
if client.enabled:
3319
3441
client.init_checker()
3320
3442
3321
3443
tcp_server.enable()
3322
3444
tcp_server.server_activate()
3323
3445
3324
3446
# Find out what port we got
3325
3447
if zeroconf:
3326
3448
service.port = tcp_server.socket.getsockname()[1]
3331
3453
else: # IPv4
3332
3454
logger.info("Now listening on address %r, port %d",
3333
3455
*tcp_server.socket.getsockname())
3334
3335
#service.interface = tcp_server.socket.getsockname()[3]
3336
3456
3457
# service.interface = tcp_server.socket.getsockname()[3]
3458
3337
3459
try:
3338
3460
if zeroconf:
3339
3461
# From the Avahi example code
3344
3466
cleanup()
3345
3467
sys.exit(1)
3346
3468
# End of Avahi example code
3347
3348
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3349
lambda *args, **kwargs:
3350
(tcp_server.handle_request
3351
(*args[2:], **kwargs) or True))
3352
3469
3470
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
lambda *args, **kwargs:
3472
(tcp_server.handle_request
3473
(*args[2:], **kwargs) or True))
3474
3353
3475
logger.debug("Starting main loop")
3354
3476
main_loop.run()
3355
3477
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0