To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 885
- compare with another revision
- download diff
- download tarball
- view history from revision 885
- Committer: Teddy Hogeborn
- Date: 2016-10-29 14:22:26 UTC
- Revision ID: teddy@recompile.se-20161029142226-n4s9d70tuk615pg1
Makefile: Clarify message when running client.
* Makefile (run-client): Clarify message.
* Makefile (run-client): Clarify message.
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
23
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
25
# GNU General Public License for more details.
26
#
26
#
27
27
# You should have received a copy of the GNU General Public License
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
#
30
#
31
31
# Contact the authors at <mandos@recompile.se>.
32
#
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
38
41
39
42
try:
40
43
import SocketServer as socketserver
76
79
77
80
import dbus
78
81
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
83
import avahi
82
from gi.repository import GLib
84
83
from dbus.mainloop.glib import DBusGMainLoop
85
84
import ctypes
86
85
import ctypes.util
87
86
import xml.dom.minidom
88
87
import inspect
89
88
89
# Try to find the value of SO_BINDTODEVICE:
90
90
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
91
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
94
except AttributeError:
93
95
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
94
98
from IN import SO_BINDTODEVICE
95
99
except ImportError:
96
SO_BINDTODEVICE = None
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
97
113
98
114
if sys.version_info.major == 2:
99
115
str = unicode
100
116
101
version = "1.7.1"
117
version = "1.7.13"
102
118
stored_state_file = "clients.pickle"
103
119
104
120
logger = logging.getLogger()
108
124
if_nametoindex = ctypes.cdll.LoadLibrary(
109
125
ctypes.util.find_library("c")).if_nametoindex
110
126
except (OSError, AttributeError):
111
127
112
128
def if_nametoindex(interface):
113
129
"Get an interface index the hard way, i.e. using fcntl()"
114
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
135
return interface_index
120
136
121
137
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
122
154
def initlogger(debug, level=logging.WARNING):
123
155
"""init logger and add loglevel"""
124
156
125
157
global syslogger
126
158
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
address="/dev/log"))
129
161
syslogger.setFormatter(logging.Formatter
130
162
('Mandos [%(process)d]: %(levelname)s:'
131
163
' %(message)s'))
132
164
logger.addHandler(syslogger)
133
165
134
166
if debug:
135
167
console = logging.StreamHandler()
136
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
148
180
149
181
class PGPEngine(object):
150
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
183
152
184
def __init__(self):
153
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
self.gpg = "gpg"
187
try:
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
191
if name == "gpg":
192
self.gpg = path
193
break
194
except OSError as e:
195
if e.errno != errno.ENOENT:
196
raise
154
197
self.gnupgargs = ['--batch',
155
'--home', self.tempdir,
198
'--homedir', self.tempdir,
156
199
'--force-mdc',
157
'--quiet',
158
'--no-use-agent']
159
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
204
160
205
def __enter__(self):
161
206
return self
162
207
163
208
def __exit__(self, exc_type, exc_value, traceback):
164
209
self._cleanup()
165
210
return False
166
211
167
212
def __del__(self):
168
213
self._cleanup()
169
214
170
215
def _cleanup(self):
171
216
if self.tempdir is not None:
172
217
# Delete contents of tempdir
173
218
for root, dirs, files in os.walk(self.tempdir,
174
topdown = False):
219
topdown=False):
175
220
for filename in files:
176
221
os.remove(os.path.join(root, filename))
177
222
for dirname in dirs:
179
224
# Remove tempdir
180
225
os.rmdir(self.tempdir)
181
226
self.tempdir = None
182
227
183
228
def password_encode(self, password):
184
229
# Passphrase can not be empty and can not contain newlines or
185
230
# NUL bytes. So we prefix it and hex encode it.
190
235
.replace(b"\n", b"\\n")
191
236
.replace(b"\0", b"\\x00"))
192
237
return encoded
193
238
194
239
def encrypt(self, data, password):
195
240
passphrase = self.password_encode(password)
196
241
with tempfile.NamedTemporaryFile(
197
242
dir=self.tempdir) as passfile:
198
243
passfile.write(passphrase)
199
244
passfile.flush()
200
proc = subprocess.Popen(['gpg', '--symmetric',
245
proc = subprocess.Popen([self.gpg, '--symmetric',
201
246
'--passphrase-file',
202
247
passfile.name]
203
248
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
208
253
if proc.returncode != 0:
209
254
raise PGPError(err)
210
255
return ciphertext
211
256
212
257
def decrypt(self, data, password):
213
258
passphrase = self.password_encode(password)
214
259
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
260
dir=self.tempdir) as passfile:
216
261
passfile.write(passphrase)
217
262
passfile.flush()
218
proc = subprocess.Popen(['gpg', '--decrypt',
263
proc = subprocess.Popen([self.gpg, '--decrypt',
219
264
'--passphrase-file',
220
265
passfile.name]
221
266
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
226
271
if proc.returncode != 0:
227
272
raise PGPError(err)
228
273
return decrypted_plaintext
229
274
230
275
276
# Pretend that we have an Avahi module
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
288
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
301
302
231
303
class AvahiError(Exception):
232
304
def __init__(self, value, *args, **kwargs):
233
305
self.value = value
245
317
246
318
class AvahiService(object):
247
319
"""An Avahi (Zeroconf) service.
248
320
249
321
Attributes:
250
322
interface: integer; avahi.IF_UNSPEC or an interface index.
251
323
Used to optionally bind to the specified interface.
263
335
server: D-Bus Server
264
336
bus: dbus.SystemBus()
265
337
"""
266
338
267
339
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
278
350
self.interface = interface
279
351
self.name = name
280
352
self.type = servicetype
289
361
self.server = None
290
362
self.bus = bus
291
363
self.entry_group_state_changed_match = None
292
364
293
365
def rename(self, remove=True):
294
366
"""Derived from the Avahi example code"""
295
367
if self.rename_count >= self.max_renames:
315
387
logger.critical("D-Bus Exception", exc_info=error)
316
388
self.cleanup()
317
389
os._exit(1)
318
390
319
391
def remove(self):
320
392
"""Derived from the Avahi example code"""
321
393
if self.entry_group_state_changed_match is not None:
323
395
self.entry_group_state_changed_match = None
324
396
if self.group is not None:
325
397
self.group.Reset()
326
398
327
399
def add(self):
328
400
"""Derived from the Avahi example code"""
329
401
self.remove()
346
418
dbus.UInt16(self.port),
347
419
avahi.string_array_to_txt_array(self.TXT))
348
420
self.group.Commit()
349
421
350
422
def entry_group_state_changed(self, state, error):
351
423
"""Derived from the Avahi example code"""
352
424
logger.debug("Avahi entry group state change: %i", state)
353
425
354
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
355
427
logger.debug("Zeroconf service established.")
356
428
elif state == avahi.ENTRY_GROUP_COLLISION:
360
432
logger.critical("Avahi: Error in group state changed %s",
361
433
str(error))
362
434
raise AvahiGroupError("State changed: {!s}".format(error))
363
435
364
436
def cleanup(self):
365
437
"""Derived from the Avahi example code"""
366
438
if self.group is not None:
371
443
pass
372
444
self.group = None
373
445
self.remove()
374
446
375
447
def server_state_changed(self, state, error=None):
376
448
"""Derived from the Avahi example code"""
377
449
logger.debug("Avahi server state change: %i", state)
406
478
logger.debug("Unknown state: %r", state)
407
479
else:
408
480
logger.debug("Unknown state: %r: %r", state, error)
409
481
410
482
def activate(self):
411
483
"""Derived from the Avahi example code"""
412
484
if self.server is None:
429
501
.format(self.name)))
430
502
return ret
431
503
504
432
505
# Pretend that we have a GnuTLS module
433
506
class GnuTLS(object):
434
507
"""This isn't so much a class as it is a module-like namespace.
435
508
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
509
510
library = ctypes.util.find_library("gnutls")
511
if library is None:
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
514
del library
515
_need_version = b"3.3.0"
516
440
517
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
523
448
524
# Unless otherwise indicated, the constants and types below are
449
525
# all from the gnutls/gnutls.h C header file.
450
526
451
527
# Constants
452
528
E_SUCCESS = 0
453
529
E_INTERRUPTED = -52
458
534
CRD_CERTIFICATE = 1
459
535
E_NO_CERTIFICATE_FOUND = -49
460
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
537
462
538
# Types
463
539
class session_int(ctypes.Structure):
464
540
_fields_ = []
465
541
session_t = ctypes.POINTER(session_int)
542
466
543
class certificate_credentials_st(ctypes.Structure):
467
544
_fields_ = []
468
545
certificate_credentials_t = ctypes.POINTER(
469
546
certificate_credentials_st)
470
547
certificate_type_t = ctypes.c_int
548
471
549
class datum_t(ctypes.Structure):
472
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
551
('size', ctypes.c_uint)]
552
474
553
class openpgp_crt_int(ctypes.Structure):
475
554
_fields_ = []
476
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
558
credentials_type_t = ctypes.c_int
480
559
transport_ptr_t = ctypes.c_void_p
481
560
close_request_t = ctypes.c_int
482
561
483
562
# Exceptions
484
563
class Error(Exception):
485
564
# We need to use the class name "GnuTLS" here, since this
486
565
# exception might be raised from within GnuTLS.__init__,
487
566
# which is called before the assignment to the "gnutls"
488
567
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
568
def __init__(self, message=None, code=None, args=()):
490
569
# Default usage is by a message string, but if a return
491
570
# code is passed, convert it to a string with
492
571
# gnutls.strerror()
495
574
message = GnuTLS.strerror(code)
496
575
return super(GnuTLS.Error, self).__init__(
497
576
message, *args)
498
577
499
578
class CertificateSecurityError(Error):
500
579
pass
501
580
502
581
# Classes
503
582
class Credentials(object):
504
583
def __init__(self):
506
585
gnutls.certificate_allocate_credentials(
507
586
ctypes.byref(self._c_object))
508
587
self.type = gnutls.CRD_CERTIFICATE
509
588
510
589
def __del__(self):
511
590
gnutls.certificate_free_credentials(self._c_object)
512
591
513
592
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
593
def __init__(self, socket, credentials=None):
515
594
self._c_object = gnutls.session_t()
516
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
596
gnutls.set_default_priority(self._c_object)
525
604
ctypes.cast(credentials._c_object,
526
605
ctypes.c_void_p))
527
606
self.credentials = credentials
528
607
529
608
def __del__(self):
530
609
gnutls.deinit(self._c_object)
531
610
532
611
def handshake(self):
533
612
return gnutls.handshake(self._c_object)
534
613
535
614
def send(self, data):
536
615
data = bytes(data)
537
616
data_len = len(data)
539
618
data_len -= gnutls.record_send(self._c_object,
540
619
data[-data_len:],
541
620
data_len)
542
621
543
622
def bye(self):
544
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
624
546
625
# Error handling functions
547
626
def _error_code(result):
548
627
"""A function to raise exceptions on errors, suitable
550
629
if result >= 0:
551
630
return result
552
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
634
556
635
def _retry_on_error(result, func, arguments):
557
636
"""A function to retry on some errors, suitable
558
637
for the 'errcheck' attribute on ctypes functions"""
561
640
return _error_code(result)
562
641
result = func(*arguments)
563
642
return result
564
643
565
644
# Unless otherwise indicated, the function declarations below are
566
645
# all from the gnutls/gnutls.h C header file.
567
646
568
647
# Functions
569
648
priority_set_direct = _library.gnutls_priority_set_direct
570
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
650
ctypes.POINTER(ctypes.c_char_p)]
572
651
priority_set_direct.restype = _error_code
573
652
574
653
init = _library.gnutls_init
575
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
655
init.restype = _error_code
577
656
578
657
set_default_priority = _library.gnutls_set_default_priority
579
658
set_default_priority.argtypes = [session_t]
580
659
set_default_priority.restype = _error_code
581
660
582
661
record_send = _library.gnutls_record_send
583
662
record_send.argtypes = [session_t, ctypes.c_void_p,
584
663
ctypes.c_size_t]
585
664
record_send.restype = ctypes.c_ssize_t
586
665
record_send.errcheck = _retry_on_error
587
666
588
667
certificate_allocate_credentials = (
589
668
_library.gnutls_certificate_allocate_credentials)
590
669
certificate_allocate_credentials.argtypes = [
591
670
ctypes.POINTER(certificate_credentials_t)]
592
671
certificate_allocate_credentials.restype = _error_code
593
672
594
673
certificate_free_credentials = (
595
674
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
597
677
certificate_free_credentials.restype = None
598
678
599
679
handshake_set_private_extensions = (
600
680
_library.gnutls_handshake_set_private_extensions)
601
681
handshake_set_private_extensions.argtypes = [session_t,
602
682
ctypes.c_int]
603
683
handshake_set_private_extensions.restype = None
604
684
605
685
credentials_set = _library.gnutls_credentials_set
606
686
credentials_set.argtypes = [session_t, credentials_type_t,
607
687
ctypes.c_void_p]
608
688
credentials_set.restype = _error_code
609
689
610
690
strerror = _library.gnutls_strerror
611
691
strerror.argtypes = [ctypes.c_int]
612
692
strerror.restype = ctypes.c_char_p
613
693
614
694
certificate_type_get = _library.gnutls_certificate_type_get
615
695
certificate_type_get.argtypes = [session_t]
616
696
certificate_type_get.restype = _error_code
617
697
618
698
certificate_get_peers = _library.gnutls_certificate_get_peers
619
699
certificate_get_peers.argtypes = [session_t,
620
700
ctypes.POINTER(ctypes.c_uint)]
621
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
702
623
703
global_set_log_level = _library.gnutls_global_set_log_level
624
704
global_set_log_level.argtypes = [ctypes.c_int]
625
705
global_set_log_level.restype = None
626
706
627
707
global_set_log_function = _library.gnutls_global_set_log_function
628
708
global_set_log_function.argtypes = [log_func]
629
709
global_set_log_function.restype = None
630
710
631
711
deinit = _library.gnutls_deinit
632
712
deinit.argtypes = [session_t]
633
713
deinit.restype = None
634
714
635
715
handshake = _library.gnutls_handshake
636
716
handshake.argtypes = [session_t]
637
717
handshake.restype = _error_code
638
718
handshake.errcheck = _retry_on_error
639
719
640
720
transport_set_ptr = _library.gnutls_transport_set_ptr
641
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
722
transport_set_ptr.restype = None
643
723
644
724
bye = _library.gnutls_bye
645
725
bye.argtypes = [session_t, close_request_t]
646
726
bye.restype = _error_code
647
727
bye.errcheck = _retry_on_error
648
728
649
729
check_version = _library.gnutls_check_version
650
730
check_version.argtypes = [ctypes.c_char_p]
651
731
check_version.restype = ctypes.c_char_p
652
732
653
733
# All the function declarations below are from gnutls/openpgp.h
654
734
655
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
737
openpgp_crt_init.restype = _error_code
658
738
659
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
741
ctypes.POINTER(datum_t),
662
742
openpgp_crt_fmt_t]
663
743
openpgp_crt_import.restype = _error_code
664
744
665
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
747
ctypes.POINTER(ctypes.c_uint)]
668
748
openpgp_crt_verify_self.restype = _error_code
669
749
670
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
752
openpgp_crt_deinit.restype = None
673
753
674
754
openpgp_crt_get_fingerprint = (
675
755
_library.gnutls_openpgp_crt_get_fingerprint)
676
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
678
758
ctypes.POINTER(
679
759
ctypes.c_size_t)]
680
760
openpgp_crt_get_fingerprint.restype = _error_code
681
761
682
762
# Remove non-public functions
683
763
del _error_code, _retry_on_error
684
764
# Create the global "gnutls" object, simulating a module
685
765
gnutls = GnuTLS()
686
766
767
687
768
def call_pipe(connection, # : multiprocessing.Connection
688
769
func, *args, **kwargs):
689
770
"""This function is meant to be called by multiprocessing.Process
690
771
691
772
This function runs func(*args, **kwargs), and writes the resulting
692
773
return value on the provided multiprocessing.Connection.
693
774
"""
694
775
connection.send(func(*args, **kwargs))
695
776
connection.close()
696
777
778
697
779
class Client(object):
698
780
"""A representation of a client host served by this server.
699
781
700
782
Attributes:
701
783
approved: bool(); 'None' if not yet approved/disapproved
702
784
approval_delay: datetime.timedelta(); Time to wait for approval
704
786
checker: subprocess.Popen(); a running checker process used
705
787
to see if the client lives.
706
788
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
789
checker_callback_tag: a GLib event source tag, or None
708
790
checker_command: string; External command which is run to check
709
791
if client lives. %() expansions are done at
710
792
runtime with vars(self) as dict, so that for
711
793
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
794
checker_initiator_tag: a GLib event source tag, or None
713
795
created: datetime.datetime(); (UTC) object creation
714
796
client_structure: Object describing what attributes a client has
715
797
and is used for storing the client at exit
716
798
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
799
disable_initiator_tag: a GLib event source tag, or None
718
800
enabled: bool()
719
801
fingerprint: string (40 or 32 hexadecimal digits); used to
720
802
uniquely identify the client
739
821
disabled, or None
740
822
server_settings: The server_settings dict from main()
741
823
"""
742
824
743
825
runtime_expansions = ("approval_delay", "approval_duration",
744
826
"created", "enabled", "expires",
745
827
"fingerprint", "host", "interval",
756
838
"approved_by_default": "True",
757
839
"enabled": "True",
758
840
}
759
841
760
842
@staticmethod
761
843
def config_parser(config):
762
844
"""Construct a new dict of client settings of this form:
769
851
for client_name in config.sections():
770
852
section = dict(config.items(client_name))
771
853
client = settings[client_name] = {}
772
854
773
855
client["host"] = section["host"]
774
856
# Reformat values from string types to Python types
775
857
client["approved_by_default"] = config.getboolean(
776
858
client_name, "approved_by_default")
777
859
client["enabled"] = config.getboolean(client_name,
778
860
"enabled")
779
861
780
862
# Uppercase and remove spaces from fingerprint for later
781
863
# comparison purposes with return value from the
782
864
# fingerprint() function
783
865
client["fingerprint"] = (section["fingerprint"].upper()
784
866
.replace(" ", ""))
785
867
if "secret" in section:
786
client["secret"] = section["secret"].decode("base64")
868
client["secret"] = codecs.decode(section["secret"]
869
.encode("utf-8"),
870
"base64")
787
871
elif "secfile" in section:
788
872
with open(os.path.expanduser(os.path.expandvars
789
873
(section["secfile"])),
804
888
client["last_approval_request"] = None
805
889
client["last_checked_ok"] = None
806
890
client["last_checker_status"] = -2
807
891
808
892
return settings
809
810
def __init__(self, settings, name = None, server_settings=None):
893
894
def __init__(self, settings, name=None, server_settings=None):
811
895
self.name = name
812
896
if server_settings is None:
813
897
server_settings = {}
815
899
# adding all client settings
816
900
for setting, value in settings.items():
817
901
setattr(self, setting, value)
818
902
819
903
if self.enabled:
820
904
if not hasattr(self, "last_enabled"):
821
905
self.last_enabled = datetime.datetime.utcnow()
825
909
else:
826
910
self.last_enabled = None
827
911
self.expires = None
828
912
829
913
logger.debug("Creating client %r", self.name)
830
914
logger.debug(" Fingerprint: %s", self.fingerprint)
831
915
self.created = settings.get("created",
832
916
datetime.datetime.utcnow())
833
917
834
918
# attributes specific for this server instance
835
919
self.checker = None
836
920
self.checker_initiator_tag = None
842
926
self.changedstate = multiprocessing_manager.Condition(
843
927
multiprocessing_manager.Lock())
844
928
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
929
for attr in self.__dict__.keys()
846
930
if not attr.startswith("_")]
847
931
self.client_structure.append("client_structure")
848
932
849
933
for name, t in inspect.getmembers(
850
934
type(self), lambda obj: isinstance(obj, property)):
851
935
if not name.startswith("_"):
852
936
self.client_structure.append(name)
853
937
854
938
# Send notice to process children that client state has changed
855
939
def send_changedstate(self):
856
940
with self.changedstate:
857
941
self.changedstate.notify_all()
858
942
859
943
def enable(self):
860
944
"""Start this client's checker and timeout hooks"""
861
945
if getattr(self, "enabled", False):
866
950
self.last_enabled = datetime.datetime.utcnow()
867
951
self.init_checker()
868
952
self.send_changedstate()
869
953
870
954
def disable(self, quiet=True):
871
955
"""Disable this client."""
872
956
if not getattr(self, "enabled", False):
874
958
if not quiet:
875
959
logger.info("Disabling client %s", self.name)
876
960
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
961
GLib.source_remove(self.disable_initiator_tag)
878
962
self.disable_initiator_tag = None
879
963
self.expires = None
880
964
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
965
GLib.source_remove(self.checker_initiator_tag)
882
966
self.checker_initiator_tag = None
883
967
self.stop_checker()
884
968
self.enabled = False
885
969
if not quiet:
886
970
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
971
# Do not run this again if called by a GLib.timeout_add
888
972
return False
889
973
890
974
def __del__(self):
891
975
self.disable()
892
976
893
977
def init_checker(self):
894
978
# Schedule a new checker to be started an 'interval' from now,
895
979
# and every interval from then on.
896
980
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
899
983
int(self.interval.total_seconds() * 1000),
900
984
self.start_checker)
901
985
# Schedule a disable() when 'timeout' has passed
902
986
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
905
989
int(self.timeout.total_seconds() * 1000), self.disable)
906
990
# Also start a new checker *right now*.
907
991
self.start_checker()
908
992
909
993
def checker_callback(self, source, condition, connection,
910
994
command):
911
995
"""The checker has completed, so take appropriate actions."""
914
998
# Read return code from connection (see call_pipe)
915
999
returncode = connection.recv()
916
1000
connection.close()
917
1001
918
1002
if returncode >= 0:
919
1003
self.last_checker_status = returncode
920
1004
self.last_checker_signal = None
930
1014
logger.warning("Checker for %(name)s crashed?",
931
1015
vars(self))
932
1016
return False
933
1017
934
1018
def checked_ok(self):
935
1019
"""Assert that the client has been seen, alive and well."""
936
1020
self.last_checked_ok = datetime.datetime.utcnow()
937
1021
self.last_checker_status = 0
938
1022
self.last_checker_signal = None
939
1023
self.bump_timeout()
940
1024
941
1025
def bump_timeout(self, timeout=None):
942
1026
"""Bump up the timeout for this client."""
943
1027
if timeout is None:
944
1028
timeout = self.timeout
945
1029
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1030
GLib.source_remove(self.disable_initiator_tag)
947
1031
self.disable_initiator_tag = None
948
1032
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1033
self.disable_initiator_tag = GLib.timeout_add(
950
1034
int(timeout.total_seconds() * 1000), self.disable)
951
1035
self.expires = datetime.datetime.utcnow() + timeout
952
1036
953
1037
def need_approval(self):
954
1038
self.last_approval_request = datetime.datetime.utcnow()
955
1039
956
1040
def start_checker(self):
957
1041
"""Start a new checker subprocess if one is not running.
958
1042
959
1043
If a checker already exists, leave it running and do
960
1044
nothing."""
961
1045
# The reason for not killing a running checker is that if we
966
1050
# checkers alone, the checker would have to take more time
967
1051
# than 'timeout' for the client to be disabled, which is as it
968
1052
# should be.
969
1053
970
1054
if self.checker is not None and not self.checker.is_alive():
971
1055
logger.warning("Checker was not alive; joining")
972
1056
self.checker.join()
976
1060
# Escape attributes for the shell
977
1061
escaped_attrs = {
978
1062
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
1063
for attr in self.runtime_expansions}
980
1064
try:
981
1065
command = self.checker_command % escaped_attrs
982
1066
except TypeError as error:
994
1078
# The exception is when not debugging but nevertheless
995
1079
# running in the foreground; use the previously
996
1080
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1081
popen_args = {"close_fds": True,
1082
"shell": True,
1083
"cwd": "/"}
1000
1084
if (not self.server_settings["debug"]
1001
1085
and self.server_settings["foreground"]):
1002
1086
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1087
"stderr": wnull})
1088
pipe = multiprocessing.Pipe(duplex=False)
1005
1089
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1090
target=call_pipe,
1091
args=(pipe[1], subprocess.call, command),
1092
kwargs=popen_args)
1009
1093
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1012
1096
self.checker_callback, pipe[0], command)
1013
# Re-run this periodically if run by gobject.timeout_add
1097
# Re-run this periodically if run by GLib.timeout_add
1014
1098
return True
1015
1099
1016
1100
def stop_checker(self):
1017
1101
"""Force the checker process, if any, to stop."""
1018
1102
if self.checker_callback_tag:
1019
gobject.source_remove(self.checker_callback_tag)
1103
GLib.source_remove(self.checker_callback_tag)
1020
1104
self.checker_callback_tag = None
1021
1105
if getattr(self, "checker", None) is None:
1022
1106
return
1031
1115
byte_arrays=False):
1032
1116
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
1117
become properties on the D-Bus.
1034
1118
1035
1119
The decorated method will be called with no arguments by "Get"
1036
1120
and with one argument by "Set".
1037
1121
1038
1122
The parameters, where they are supported, are the same as
1039
1123
dbus.service.method, except there is only "signature", since the
1040
1124
type from Get() and the type sent to Set() is the same.
1044
1128
if byte_arrays and signature != "ay":
1045
1129
raise ValueError("Byte arrays not supported for non-'ay'"
1046
1130
" signature {!r}".format(signature))
1047
1131
1048
1132
def decorator(func):
1049
1133
func._dbus_is_property = True
1050
1134
func._dbus_interface = dbus_interface
1053
1137
func._dbus_name = func.__name__
1054
1138
if func._dbus_name.endswith("_dbus_property"):
1055
1139
func._dbus_name = func._dbus_name[:-14]
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1057
1141
return func
1058
1142
1059
1143
return decorator
1060
1144
1061
1145
1062
1146
def dbus_interface_annotations(dbus_interface):
1063
1147
"""Decorator for marking functions returning interface annotations
1064
1148
1065
1149
Usage:
1066
1150
1067
1151
@dbus_interface_annotations("org.example.Interface")
1068
1152
def _foo(self): # Function name does not matter
1069
1153
return {"org.freedesktop.DBus.Deprecated": "true",
1070
1154
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
1155
"false"}
1072
1156
"""
1073
1157
1074
1158
def decorator(func):
1075
1159
func._dbus_is_interface = True
1076
1160
func._dbus_interface = dbus_interface
1077
1161
func._dbus_name = dbus_interface
1078
1162
return func
1079
1163
1080
1164
return decorator
1081
1165
1082
1166
1083
1167
def dbus_annotations(annotations):
1084
1168
"""Decorator to annotate D-Bus methods, signals or properties
1085
1169
Usage:
1086
1170
1087
1171
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
1172
"org.freedesktop.DBus.Property."
1089
1173
"EmitsChangedSignal": "false"})
1091
1175
access="r")
1092
1176
def Property_dbus_property(self):
1093
1177
return dbus.Boolean(False)
1094
1178
1095
1179
See also the DBusObjectWithAnnotations class.
1096
1180
"""
1097
1181
1098
1182
def decorator(func):
1099
1183
func._dbus_annotations = annotations
1100
1184
return func
1101
1185
1102
1186
return decorator
1103
1187
1104
1188
1122
1206
1123
1207
class DBusObjectWithAnnotations(dbus.service.Object):
1124
1208
"""A D-Bus object with annotations.
1125
1209
1126
1210
Classes inheriting from this can use the dbus_annotations
1127
1211
decorator to add annotations to methods or signals.
1128
1212
"""
1129
1213
1130
1214
@staticmethod
1131
1215
def _is_dbus_thing(thing):
1132
1216
"""Returns a function testing if an attribute is a D-Bus thing
1133
1217
1134
1218
If called like _is_dbus_thing("method") it returns a function
1135
1219
suitable for use as predicate to inspect.getmembers().
1136
1220
"""
1137
1221
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1138
1222
False)
1139
1223
1140
1224
def _get_all_dbus_things(self, thing):
1141
1225
"""Returns a generator of (name, attribute) pairs
1142
1226
"""
1145
1229
for cls in self.__class__.__mro__
1146
1230
for name, athing in
1147
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1232
1149
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1234
out_signature="s",
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1153
1237
def Introspect(self, object_path, connection):
1154
1238
"""Overloading of standard D-Bus method.
1155
1239
1156
1240
Inserts annotation tags on methods and signals.
1157
1241
"""
1158
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
1243
connection)
1160
1244
try:
1161
1245
document = xml.dom.minidom.parseString(xmlstring)
1162
1246
1163
1247
for if_tag in document.getElementsByTagName("interface"):
1164
1248
# Add annotation tags
1165
1249
for typ in ("method", "signal"):
1192
1276
if_tag.appendChild(ann_tag)
1193
1277
# Fix argument name for the Introspect method itself
1194
1278
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1279
== dbus.INTROSPECTABLE_IFACE):
1196
1280
for cn in if_tag.getElementsByTagName("method"):
1197
1281
if cn.getAttribute("name") == "Introspect":
1198
1282
for arg in cn.getElementsByTagName("arg"):
1211
1295
1212
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
1297
"""A D-Bus object with properties.
1214
1298
1215
1299
Classes inheriting from this can use the dbus_service_property
1216
1300
decorator to expose methods as D-Bus properties. It exposes the
1217
1301
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
1302
"""
1219
1303
1220
1304
def _get_dbus_property(self, interface_name, property_name):
1221
1305
"""Returns a bound method if one exists which is a D-Bus
1222
1306
property with the specified name and interface.
1227
1311
if (value._dbus_name == property_name
1228
1312
and value._dbus_interface == interface_name):
1229
1313
return value.__get__(self)
1230
1314
1231
1315
# No such property
1232
1316
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
1317
self.dbus_object_path, interface_name, property_name))
1234
1318
1235
1319
@classmethod
1236
1320
def _get_all_interface_names(cls):
1237
1321
"""Get a sequence of all interfaces supported by an object"""
1240
1324
for x in (inspect.getmro(cls))
1241
1325
for attr in dir(x))
1242
1326
if name is not None)
1243
1327
1244
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
1329
in_signature="ss",
1246
1330
out_signature="v")
1254
1338
if not hasattr(value, "variant_level"):
1255
1339
return value
1256
1340
return type(value)(value, variant_level=value.variant_level+1)
1257
1341
1258
1342
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1259
1343
def Set(self, interface_name, property_name, value):
1260
1344
"""Standard D-Bus property Set() method, see D-Bus standard.
1272
1356
value = dbus.ByteArray(b''.join(chr(byte)
1273
1357
for byte in value))
1274
1358
prop(value)
1275
1359
1276
1360
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
1361
in_signature="s",
1278
1362
out_signature="a{sv}")
1279
1363
def GetAll(self, interface_name):
1280
1364
"""Standard D-Bus property GetAll() method, see D-Bus
1281
1365
standard.
1282
1366
1283
1367
Note: Will not include properties with access="write".
1284
1368
"""
1285
1369
properties = {}
1296
1380
properties[name] = value
1297
1381
continue
1298
1382
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
1383
value, variant_level=value.variant_level + 1)
1300
1384
return dbus.Dictionary(properties, signature="sv")
1301
1385
1302
1386
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
1387
def PropertiesChanged(self, interface_name, changed_properties,
1304
1388
invalidated_properties):
1306
1390
standard.
1307
1391
"""
1308
1392
pass
1309
1393
1310
1394
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
1395
out_signature="s",
1312
1396
path_keyword='object_path',
1313
1397
connection_keyword='connection')
1314
1398
def Introspect(self, object_path, connection):
1315
1399
"""Overloading of standard D-Bus method.
1316
1400
1317
1401
Inserts property tags and interface annotation tags.
1318
1402
"""
1319
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1321
1405
connection)
1322
1406
try:
1323
1407
document = xml.dom.minidom.parseString(xmlstring)
1324
1408
1325
1409
def make_tag(document, name, prop):
1326
1410
e = document.createElement("property")
1327
1411
e.setAttribute("name", name)
1328
1412
e.setAttribute("type", prop._dbus_signature)
1329
1413
e.setAttribute("access", prop._dbus_access)
1330
1414
return e
1331
1415
1332
1416
for if_tag in document.getElementsByTagName("interface"):
1333
1417
# Add property tags
1334
1418
for tag in (make_tag(document, name, prop)
1381
1465
except AttributeError:
1382
1466
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1467
1468
1384
1469
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1470
"""A D-Bus object with an ObjectManager.
1386
1471
1387
1472
Classes inheriting from this exposes the standard
1388
1473
GetManagedObjects call and the InterfacesAdded and
1389
1474
InterfacesRemoved signals on the standard
1390
1475
"org.freedesktop.DBus.ObjectManager" interface.
1391
1476
1392
1477
Note: No signals are sent automatically; they must be sent
1393
1478
manually.
1394
1479
"""
1395
1480
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1481
out_signature="a{oa{sa{sv}}}")
1397
1482
def GetManagedObjects(self):
1398
1483
"""This function must be overridden"""
1399
1484
raise NotImplementedError()
1400
1485
1401
1486
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1487
signature="oa{sa{sv}}")
1403
1488
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
1489
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1490
1491
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1492
def InterfacesRemoved(self, object_path, interfaces):
1408
1493
pass
1409
1494
1410
1495
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1496
out_signature="s",
1497
path_keyword='object_path',
1498
connection_keyword='connection')
1414
1499
def Introspect(self, object_path, connection):
1415
1500
"""Overloading of standard D-Bus method.
1416
1501
1417
1502
Override return argument name of GetManagedObjects to be
1418
1503
"objpath_interfaces_and_properties"
1419
1504
"""
1422
1507
connection)
1423
1508
try:
1424
1509
document = xml.dom.minidom.parseString(xmlstring)
1425
1510
1426
1511
for if_tag in document.getElementsByTagName("interface"):
1427
1512
# Fix argument name for the GetManagedObjects method
1428
1513
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1514
== dbus.OBJECT_MANAGER_IFACE):
1430
1515
for cn in if_tag.getElementsByTagName("method"):
1431
1516
if (cn.getAttribute("name")
1432
1517
== "GetManagedObjects"):
1442
1527
except (AttributeError, xml.dom.DOMException,
1443
1528
xml.parsers.expat.ExpatError) as error:
1444
1529
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1530
exc_info=error)
1446
1531
return xmlstring
1447
1532
1533
1448
1534
def datetime_to_dbus(dt, variant_level=0):
1449
1535
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1536
if dt is None:
1451
return dbus.String("", variant_level = variant_level)
1537
return dbus.String("", variant_level=variant_level)
1452
1538
return dbus.String(dt.isoformat(), variant_level=variant_level)
1453
1539
1454
1540
1457
1543
dbus.service.Object, it will add alternate D-Bus attributes with
1458
1544
interface names according to the "alt_interface_names" mapping.
1459
1545
Usage:
1460
1546
1461
1547
@alternate_dbus_interfaces({"org.example.Interface":
1462
1548
"net.example.AlternateInterface"})
1463
1549
class SampleDBusObject(dbus.service.Object):
1464
1550
@dbus.service.method("org.example.Interface")
1465
1551
def SampleDBusMethod():
1466
1552
pass
1467
1553
1468
1554
The above "SampleDBusMethod" on "SampleDBusObject" will be
1469
1555
reachable via two interfaces: "org.example.Interface" and
1470
1556
"net.example.AlternateInterface", the latter of which will have
1471
1557
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1472
1558
"true", unless "deprecate" is passed with a False value.
1473
1559
1474
1560
This works for methods and signals, and also for D-Bus properties
1475
1561
(from DBusObjectWithProperties) and interfaces (from the
1476
1562
dbus_interface_annotations decorator).
1477
1563
"""
1478
1564
1479
1565
def wrapper(cls):
1480
1566
for orig_interface_name, alt_interface_name in (
1481
1567
alt_interface_names.items()):
1496
1582
interface_names.add(alt_interface)
1497
1583
# Is this a D-Bus signal?
1498
1584
if getattr(attribute, "_dbus_is_signal", False):
1585
# Extract the original non-method undecorated
1586
# function by black magic
1499
1587
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
1588
nonmethod_func = (dict(
1503
1589
zip(attribute.func_code.co_freevars,
1504
1590
attribute.__closure__))
1505
1591
["func"].cell_contents)
1506
1592
else:
1507
nonmethod_func = attribute
1593
nonmethod_func = (dict(
1594
zip(attribute.__code__.co_freevars,
1595
attribute.__closure__))
1596
["func"].cell_contents)
1508
1597
# Create a new, but exactly alike, function
1509
1598
# object, and decorate it to be a new D-Bus signal
1510
1599
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1600
new_function = copy_function(nonmethod_func)
1525
1601
new_function = (dbus.service.signal(
1526
1602
alt_interface,
1527
1603
attribute._dbus_signature)(new_function))
1531
1607
attribute._dbus_annotations)
1532
1608
except AttributeError:
1533
1609
pass
1610
1534
1611
# Define a creator of a function to call both the
1535
1612
# original and alternate functions, so both the
1536
1613
# original and alternate signals gets sent when
1539
1616
"""This function is a scope container to pass
1540
1617
func1 and func2 to the "call_both" function
1541
1618
outside of its arguments"""
1542
1619
1543
1620
@functools.wraps(func2)
1544
1621
def call_both(*args, **kwargs):
1545
1622
"""This function will emit two D-Bus
1546
1623
signals by calling func1 and func2"""
1547
1624
func1(*args, **kwargs)
1548
1625
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1626
# Make wrapper function look like a D-Bus
1627
# signal
1550
1628
for name, attr in inspect.getmembers(func2):
1551
1629
if name.startswith("_dbus_"):
1552
1630
setattr(call_both, name, attr)
1553
1631
1554
1632
return call_both
1555
1633
# Create the "call_both" function and add it to
1556
1634
# the class
1566
1644
alt_interface,
1567
1645
attribute._dbus_in_signature,
1568
1646
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1647
(copy_function(attribute)))
1574
1648
# Copy annotations, if any
1575
1649
try:
1576
1650
attr[attrname]._dbus_annotations = dict(
1588
1662
attribute._dbus_access,
1589
1663
attribute._dbus_get_args_options
1590
1664
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1665
(copy_function(attribute)))
1597
1666
# Copy annotations, if any
1598
1667
try:
1599
1668
attr[attrname]._dbus_annotations = dict(
1608
1677
# to the class.
1609
1678
attr[attrname] = (
1610
1679
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1680
(copy_function(attribute)))
1616
1681
if deprecate:
1617
1682
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1683
iname = "_AlternateDBusNames_interface_annotation{}"
1619
1684
for interface_name in interface_names:
1620
1685
1621
1686
@dbus_interface_annotations(interface_name)
1622
1687
def func(self):
1623
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1688
return {"org.freedesktop.DBus.Deprecated":
1689
"true"}
1625
1690
# Find an unused name
1626
1691
for aname in (iname.format(i)
1627
1692
for i in itertools.count()):
1631
1696
if interface_names:
1632
1697
# Replace the class with a new subclass of it with
1633
1698
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1699
if sys.version_info.major == 2:
1700
cls = type(b"{}Alternate".format(cls.__name__),
1701
(cls, ), attr)
1702
else:
1703
cls = type("{}Alternate".format(cls.__name__),
1704
(cls, ), attr)
1636
1705
return cls
1637
1706
1638
1707
return wrapper
1639
1708
1640
1709
1642
1711
"se.bsnet.fukt.Mandos"})
1643
1712
class ClientDBus(Client, DBusObjectWithProperties):
1644
1713
"""A Client class using D-Bus
1645
1714
1646
1715
Attributes:
1647
1716
dbus_object_path: dbus.ObjectPath
1648
1717
bus: dbus.SystemBus()
1649
1718
"""
1650
1719
1651
1720
runtime_expansions = (Client.runtime_expansions
1652
1721
+ ("dbus_object_path", ))
1653
1722
1654
1723
_interface = "se.recompile.Mandos.Client"
1655
1724
1656
1725
# dbus.service.Object doesn't use super(), so we can't either.
1657
1658
def __init__(self, bus = None, *args, **kwargs):
1726
1727
def __init__(self, bus=None, *args, **kwargs):
1659
1728
self.bus = bus
1660
1729
Client.__init__(self, *args, **kwargs)
1661
1730
# Only now, when this client is initialized, can it show up on
1667
1736
"/clients/" + client_object_name)
1668
1737
DBusObjectWithProperties.__init__(self, self.bus,
1669
1738
self.dbus_object_path)
1670
1739
1671
1740
def notifychangeproperty(transform_func, dbus_name,
1672
1741
type_func=lambda x: x,
1673
1742
variant_level=1,
1675
1744
_interface=_interface):
1676
1745
""" Modify a variable so that it's a property which announces
1677
1746
its changes to DBus.
1678
1747
1679
1748
transform_fun: Function that takes a value and a variant_level
1680
1749
and transforms it to a D-Bus type.
1681
1750
dbus_name: D-Bus name of the variable
1684
1753
variant_level: D-Bus variant level. Default: 1
1685
1754
"""
1686
1755
attrname = "_{}".format(dbus_name)
1687
1756
1688
1757
def setter(self, value):
1689
1758
if hasattr(self, "dbus_object_path"):
1690
1759
if (not hasattr(self, attrname) or
1697
1766
else:
1698
1767
dbus_value = transform_func(
1699
1768
type_func(value),
1700
variant_level = variant_level)
1769
variant_level=variant_level)
1701
1770
self.PropertyChanged(dbus.String(dbus_name),
1702
1771
dbus_value)
1703
1772
self.PropertiesChanged(
1704
1773
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1774
dbus.Dictionary({dbus.String(dbus_name):
1775
dbus_value}),
1707
1776
dbus.Array())
1708
1777
setattr(self, attrname, value)
1709
1778
1710
1779
return property(lambda self: getattr(self, attrname), setter)
1711
1780
1712
1781
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1713
1782
approvals_pending = notifychangeproperty(dbus.Boolean,
1714
1783
"ApprovalPending",
1715
type_func = bool)
1784
type_func=bool)
1716
1785
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1786
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1787
"LastEnabled")
1719
1788
checker = notifychangeproperty(
1720
1789
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1790
type_func=lambda checker: checker is not None)
1722
1791
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1792
"LastCheckedOK")
1724
1793
last_checker_status = notifychangeproperty(dbus.Int16,
1729
1798
"ApprovedByDefault")
1730
1799
approval_delay = notifychangeproperty(
1731
1800
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1801
type_func=lambda td: td.total_seconds() * 1000)
1733
1802
approval_duration = notifychangeproperty(
1734
1803
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1804
type_func=lambda td: td.total_seconds() * 1000)
1736
1805
host = notifychangeproperty(dbus.String, "Host")
1737
1806
timeout = notifychangeproperty(
1738
1807
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1808
type_func=lambda td: td.total_seconds() * 1000)
1740
1809
extended_timeout = notifychangeproperty(
1741
1810
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1811
type_func=lambda td: td.total_seconds() * 1000)
1743
1812
interval = notifychangeproperty(
1744
1813
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1814
type_func=lambda td: td.total_seconds() * 1000)
1746
1815
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
1816
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
1817
invalidate_only=True)
1749
1818
1750
1819
del notifychangeproperty
1751
1820
1752
1821
def __del__(self, *args, **kwargs):
1753
1822
try:
1754
1823
self.remove_from_connection()
1757
1826
if hasattr(DBusObjectWithProperties, "__del__"):
1758
1827
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1828
Client.__del__(self, *args, **kwargs)
1760
1829
1761
1830
def checker_callback(self, source, condition,
1762
1831
connection, command, *args, **kwargs):
1763
1832
ret = Client.checker_callback(self, source, condition,
1779
1848
| self.last_checker_signal),
1780
1849
dbus.String(command))
1781
1850
return ret
1782
1851
1783
1852
def start_checker(self, *args, **kwargs):
1784
1853
old_checker_pid = getattr(self.checker, "pid", None)
1785
1854
r = Client.start_checker(self, *args, **kwargs)
1789
1858
# Emit D-Bus signal
1790
1859
self.CheckerStarted(self.current_checker_command)
1791
1860
return r
1792
1861
1793
1862
def _reset_approved(self):
1794
1863
self.approved = None
1795
1864
return False
1796
1865
1797
1866
def approve(self, value=True):
1798
1867
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1868
GLib.timeout_add(int(self.approval_duration.total_seconds()
1869
* 1000), self._reset_approved)
1801
1870
self.send_changedstate()
1802
1803
## D-Bus methods, signals & properties
1804
1805
## Interfaces
1806
1807
## Signals
1808
1871
1872
# D-Bus methods, signals & properties
1873
1874
# Interfaces
1875
1876
# Signals
1877
1809
1878
# CheckerCompleted - signal
1810
1879
@dbus.service.signal(_interface, signature="nxs")
1811
1880
def CheckerCompleted(self, exitcode, waitstatus, command):
1812
1881
"D-Bus signal"
1813
1882
pass
1814
1883
1815
1884
# CheckerStarted - signal
1816
1885
@dbus.service.signal(_interface, signature="s")
1817
1886
def CheckerStarted(self, command):
1818
1887
"D-Bus signal"
1819
1888
pass
1820
1889
1821
1890
# PropertyChanged - signal
1822
1891
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
1892
@dbus.service.signal(_interface, signature="sv")
1824
1893
def PropertyChanged(self, property, value):
1825
1894
"D-Bus signal"
1826
1895
pass
1827
1896
1828
1897
# GotSecret - signal
1829
1898
@dbus.service.signal(_interface)
1830
1899
def GotSecret(self):
1833
1902
server to mandos-client
1834
1903
"""
1835
1904
pass
1836
1905
1837
1906
# Rejected - signal
1838
1907
@dbus.service.signal(_interface, signature="s")
1839
1908
def Rejected(self, reason):
1840
1909
"D-Bus signal"
1841
1910
pass
1842
1911
1843
1912
# NeedApproval - signal
1844
1913
@dbus.service.signal(_interface, signature="tb")
1845
1914
def NeedApproval(self, timeout, default):
1846
1915
"D-Bus signal"
1847
1916
return self.need_approval()
1848
1849
## Methods
1850
1917
1918
# Methods
1919
1851
1920
# Approve - method
1852
1921
@dbus.service.method(_interface, in_signature="b")
1853
1922
def Approve(self, value):
1854
1923
self.approve(value)
1855
1924
1856
1925
# CheckedOK - method
1857
1926
@dbus.service.method(_interface)
1858
1927
def CheckedOK(self):
1859
1928
self.checked_ok()
1860
1929
1861
1930
# Enable - method
1862
1931
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
1932
@dbus.service.method(_interface)
1864
1933
def Enable(self):
1865
1934
"D-Bus method"
1866
1935
self.enable()
1867
1936
1868
1937
# StartChecker - method
1869
1938
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
1939
@dbus.service.method(_interface)
1871
1940
def StartChecker(self):
1872
1941
"D-Bus method"
1873
1942
self.start_checker()
1874
1943
1875
1944
# Disable - method
1876
1945
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
1946
@dbus.service.method(_interface)
1878
1947
def Disable(self):
1879
1948
"D-Bus method"
1880
1949
self.disable()
1881
1950
1882
1951
# StopChecker - method
1883
1952
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
1953
@dbus.service.method(_interface)
1885
1954
def StopChecker(self):
1886
1955
self.stop_checker()
1887
1888
## Properties
1889
1956
1957
# Properties
1958
1890
1959
# ApprovalPending - property
1891
1960
@dbus_service_property(_interface, signature="b", access="read")
1892
1961
def ApprovalPending_dbus_property(self):
1893
1962
return dbus.Boolean(bool(self.approvals_pending))
1894
1963
1895
1964
# ApprovedByDefault - property
1896
1965
@dbus_service_property(_interface,
1897
1966
signature="b",
1900
1969
if value is None: # get
1901
1970
return dbus.Boolean(self.approved_by_default)
1902
1971
self.approved_by_default = bool(value)
1903
1972
1904
1973
# ApprovalDelay - property
1905
1974
@dbus_service_property(_interface,
1906
1975
signature="t",
1910
1979
return dbus.UInt64(self.approval_delay.total_seconds()
1911
1980
* 1000)
1912
1981
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
1982
1914
1983
# ApprovalDuration - property
1915
1984
@dbus_service_property(_interface,
1916
1985
signature="t",
1920
1989
return dbus.UInt64(self.approval_duration.total_seconds()
1921
1990
* 1000)
1922
1991
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
1992
1924
1993
# Name - property
1925
1994
@dbus_annotations(
1926
1995
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
1996
@dbus_service_property(_interface, signature="s", access="read")
1928
1997
def Name_dbus_property(self):
1929
1998
return dbus.String(self.name)
1930
1999
1931
2000
# Fingerprint - property
1932
2001
@dbus_annotations(
1933
2002
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
2003
@dbus_service_property(_interface, signature="s", access="read")
1935
2004
def Fingerprint_dbus_property(self):
1936
2005
return dbus.String(self.fingerprint)
1937
2006
1938
2007
# Host - property
1939
2008
@dbus_service_property(_interface,
1940
2009
signature="s",
1943
2012
if value is None: # get
1944
2013
return dbus.String(self.host)
1945
2014
self.host = str(value)
1946
2015
1947
2016
# Created - property
1948
2017
@dbus_annotations(
1949
2018
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
2019
@dbus_service_property(_interface, signature="s", access="read")
1951
2020
def Created_dbus_property(self):
1952
2021
return datetime_to_dbus(self.created)
1953
2022
1954
2023
# LastEnabled - property
1955
2024
@dbus_service_property(_interface, signature="s", access="read")
1956
2025
def LastEnabled_dbus_property(self):
1957
2026
return datetime_to_dbus(self.last_enabled)
1958
2027
1959
2028
# Enabled - property
1960
2029
@dbus_service_property(_interface,
1961
2030
signature="b",
1967
2036
self.enable()
1968
2037
else:
1969
2038
self.disable()
1970
2039
1971
2040
# LastCheckedOK - property
1972
2041
@dbus_service_property(_interface,
1973
2042
signature="s",
1977
2046
self.checked_ok()
1978
2047
return
1979
2048
return datetime_to_dbus(self.last_checked_ok)
1980
2049
1981
2050
# LastCheckerStatus - property
1982
2051
@dbus_service_property(_interface, signature="n", access="read")
1983
2052
def LastCheckerStatus_dbus_property(self):
1984
2053
return dbus.Int16(self.last_checker_status)
1985
2054
1986
2055
# Expires - property
1987
2056
@dbus_service_property(_interface, signature="s", access="read")
1988
2057
def Expires_dbus_property(self):
1989
2058
return datetime_to_dbus(self.expires)
1990
2059
1991
2060
# LastApprovalRequest - property
1992
2061
@dbus_service_property(_interface, signature="s", access="read")
1993
2062
def LastApprovalRequest_dbus_property(self):
1994
2063
return datetime_to_dbus(self.last_approval_request)
1995
2064
1996
2065
# Timeout - property
1997
2066
@dbus_service_property(_interface,
1998
2067
signature="t",
2013
2082
if (getattr(self, "disable_initiator_tag", None)
2014
2083
is None):
2015
2084
return
2016
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2085
GLib.source_remove(self.disable_initiator_tag)
2086
self.disable_initiator_tag = GLib.timeout_add(
2018
2087
int((self.expires - now).total_seconds() * 1000),
2019
2088
self.disable)
2020
2089
2021
2090
# ExtendedTimeout - property
2022
2091
@dbus_service_property(_interface,
2023
2092
signature="t",
2027
2096
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
2097
* 1000)
2029
2098
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
2099
2031
2100
# Interval - property
2032
2101
@dbus_service_property(_interface,
2033
2102
signature="t",
2040
2109
return
2041
2110
if self.enabled:
2042
2111
# Reschedule checker run
2043
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2112
GLib.source_remove(self.checker_initiator_tag)
2113
self.checker_initiator_tag = GLib.timeout_add(
2045
2114
value, self.start_checker)
2046
self.start_checker() # Start one now, too
2047
2115
self.start_checker() # Start one now, too
2116
2048
2117
# Checker - property
2049
2118
@dbus_service_property(_interface,
2050
2119
signature="s",
2053
2122
if value is None: # get
2054
2123
return dbus.String(self.checker_command)
2055
2124
self.checker_command = str(value)
2056
2125
2057
2126
# CheckerRunning - property
2058
2127
@dbus_service_property(_interface,
2059
2128
signature="b",
2065
2134
self.start_checker()
2066
2135
else:
2067
2136
self.stop_checker()
2068
2137
2069
2138
# ObjectPath - property
2070
2139
@dbus_annotations(
2071
2140
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
2141
"org.freedesktop.DBus.Deprecated": "true"})
2073
2142
@dbus_service_property(_interface, signature="o", access="read")
2074
2143
def ObjectPath_dbus_property(self):
2075
return self.dbus_object_path # is already a dbus.ObjectPath
2076
2144
return self.dbus_object_path # is already a dbus.ObjectPath
2145
2077
2146
# Secret = property
2078
2147
@dbus_annotations(
2079
2148
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2084
2153
byte_arrays=True)
2085
2154
def Secret_dbus_property(self, value):
2086
2155
self.secret = bytes(value)
2087
2156
2088
2157
del _interface
2089
2158
2090
2159
2094
2163
self._pipe.send(('init', fpr, address))
2095
2164
if not self._pipe.recv():
2096
2165
raise KeyError(fpr)
2097
2166
2098
2167
def __getattribute__(self, name):
2099
2168
if name == '_pipe':
2100
2169
return super(ProxyClient, self).__getattribute__(name)
2103
2172
if data[0] == 'data':
2104
2173
return data[1]
2105
2174
if data[0] == 'function':
2106
2175
2107
2176
def func(*args, **kwargs):
2108
2177
self._pipe.send(('funcall', name, args, kwargs))
2109
2178
return self._pipe.recv()[1]
2110
2179
2111
2180
return func
2112
2181
2113
2182
def __setattr__(self, name, value):
2114
2183
if name == '_pipe':
2115
2184
return super(ProxyClient, self).__setattr__(name, value)
2118
2187
2119
2188
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2189
"""A class to handle client connections.
2121
2190
2122
2191
Instantiated once for each connection to handle it.
2123
2192
Note: This will run in its own forked process."""
2124
2193
2125
2194
def handle(self):
2126
2195
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
2196
logger.info("TCP connection from: %s",
2128
2197
str(self.client_address))
2129
2198
logger.debug("Pipe FD: %d",
2130
2199
self.server.child_pipe.fileno())
2131
2200
2132
2201
session = gnutls.ClientSession(self.request)
2133
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2137
# "+DHE-DSS"))
2202
2203
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2204
# "+AES-256-CBC", "+SHA1",
2205
# "+COMP-NULL", "+CTYPE-OPENPGP",
2206
# "+DHE-DSS"))
2138
2207
# Use a fallback default, since this MUST be set.
2139
2208
priority = self.server.gnutls_priority
2140
2209
if priority is None:
2141
2210
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2211
gnutls.priority_set_direct(session._c_object,
2212
priority.encode("utf-8"),
2143
2213
None)
2144
2214
2145
2215
# Start communication using the Mandos protocol
2146
2216
# Get protocol number
2147
2217
line = self.request.makefile().readline()
2152
2222
except (ValueError, IndexError, RuntimeError) as error:
2153
2223
logger.error("Unknown protocol version: %s", error)
2154
2224
return
2155
2225
2156
2226
# Start GnuTLS connection
2157
2227
try:
2158
2228
session.handshake()
2162
2232
# established. Just abandon the request.
2163
2233
return
2164
2234
logger.debug("Handshake succeeded")
2165
2235
2166
2236
approval_required = False
2167
2237
try:
2168
2238
try:
2172
2242
logger.warning("Bad certificate: %s", error)
2173
2243
return
2174
2244
logger.debug("Fingerprint: %s", fpr)
2175
2245
2176
2246
try:
2177
2247
client = ProxyClient(child_pipe, fpr,
2178
2248
self.client_address)
2179
2249
except KeyError:
2180
2250
return
2181
2251
2182
2252
if client.approval_delay:
2183
2253
delay = client.approval_delay
2184
2254
client.approvals_pending += 1
2185
2255
approval_required = True
2186
2256
2187
2257
while True:
2188
2258
if not client.enabled:
2189
2259
logger.info("Client %s is disabled",
2192
2262
# Emit D-Bus signal
2193
2263
client.Rejected("Disabled")
2194
2264
return
2195
2265
2196
2266
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2267
# We are approved or approval is disabled
2198
2268
break
2199
2269
elif client.approved is None:
2200
2270
logger.info("Client %s needs approval",
2211
2281
# Emit D-Bus signal
2212
2282
client.Rejected("Denied")
2213
2283
return
2214
2215
#wait until timeout or approved
2284
2285
# wait until timeout or approved
2216
2286
time = datetime.datetime.now()
2217
2287
client.changedstate.acquire()
2218
2288
client.changedstate.wait(delay.total_seconds())
2231
2301
break
2232
2302
else:
2233
2303
delay -= time2 - time
2234
2304
2235
2305
try:
2236
2306
session.send(client.secret)
2237
2307
except gnutls.Error as error:
2238
2308
logger.warning("gnutls send failed",
2239
exc_info = error)
2309
exc_info=error)
2240
2310
return
2241
2311
2242
2312
logger.info("Sending secret to %s", client.name)
2243
2313
# bump the timeout using extended_timeout
2244
2314
client.bump_timeout(client.extended_timeout)
2245
2315
if self.server.use_dbus:
2246
2316
# Emit D-Bus signal
2247
2317
client.GotSecret()
2248
2318
2249
2319
finally:
2250
2320
if approval_required:
2251
2321
client.approvals_pending -= 1
2254
2324
except gnutls.Error as error:
2255
2325
logger.warning("GnuTLS bye failed",
2256
2326
exc_info=error)
2257
2327
2258
2328
@staticmethod
2259
2329
def peer_certificate(session):
2260
2330
"Return the peer's OpenPGP certificate as a bytestring"
2272
2342
return None
2273
2343
cert = cert_list[0]
2274
2344
return ctypes.string_at(cert.data, cert.size)
2275
2345
2276
2346
@staticmethod
2277
2347
def fingerprint(openpgp):
2278
2348
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2311
2381
2312
2382
class MultiprocessingMixIn(object):
2313
2383
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2384
2315
2385
def sub_process_main(self, request, address):
2316
2386
try:
2317
2387
self.finish_request(request, address)
2318
2388
except Exception:
2319
2389
self.handle_error(request, address)
2320
2390
self.close_request(request)
2321
2391
2322
2392
def process_request(self, request, address):
2323
2393
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2394
proc = multiprocessing.Process(target=self.sub_process_main,
2395
args=(request, address))
2326
2396
proc.start()
2327
2397
return proc
2328
2398
2329
2399
2330
2400
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2331
2401
""" adds a pipe to the MixIn """
2332
2402
2333
2403
def process_request(self, request, client_address):
2334
2404
"""Overrides and wraps the original process_request().
2335
2405
2336
2406
This function creates a new pipe in self.pipe
2337
2407
"""
2338
2408
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2339
2409
2340
2410
proc = MultiprocessingMixIn.process_request(self, request,
2341
2411
client_address)
2342
2412
self.child_pipe.close()
2343
2413
self.add_pipe(parent_pipe, proc)
2344
2414
2345
2415
def add_pipe(self, parent_pipe, proc):
2346
2416
"""Dummy function; override as necessary"""
2347
2417
raise NotImplementedError()
2350
2420
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
2421
socketserver.TCPServer, object):
2352
2422
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2353
2423
2354
2424
Attributes:
2355
2425
enabled: Boolean; whether this server is activated yet
2356
2426
interface: None or a network interface name (string)
2357
2427
use_ipv6: Boolean; to use IPv6 or not
2358
2428
"""
2359
2429
2360
2430
def __init__(self, server_address, RequestHandlerClass,
2361
2431
interface=None,
2362
2432
use_ipv6=True,
2372
2442
self.socketfd = socketfd
2373
2443
# Save the original socket.socket() function
2374
2444
self.socket_socket = socket.socket
2445
2375
2446
# To implement --socket, we monkey patch socket.socket.
2376
#
2447
#
2377
2448
# (When socketserver.TCPServer is a new-style class, we
2378
2449
# could make self.socket into a property instead of monkey
2379
2450
# patching socket.socket.)
2380
#
2451
#
2381
2452
# Create a one-time-only replacement for socket.socket()
2382
2453
@functools.wraps(socket.socket)
2383
2454
def socket_wrapper(*args, **kwargs):
2395
2466
# socket_wrapper(), if socketfd was set.
2396
2467
socketserver.TCPServer.__init__(self, server_address,
2397
2468
RequestHandlerClass)
2398
2469
2399
2470
def server_bind(self):
2400
2471
"""This overrides the normal server_bind() function
2401
2472
to bind to an interface if one was specified, and also NOT to
2402
2473
bind to an address or port if they were not specified."""
2474
global SO_BINDTODEVICE
2403
2475
if self.interface is not None:
2404
2476
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2407
self.interface)
2408
else:
2409
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2420
self.interface)
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2424
else:
2425
raise
2477
# Fall back to a hard-coded value which seems to be
2478
# common enough.
2479
logger.warning("SO_BINDTODEVICE not found, trying 25")
2480
SO_BINDTODEVICE = 25
2481
try:
2482
self.socket.setsockopt(
2483
socket.SOL_SOCKET, SO_BINDTODEVICE,
2484
(self.interface + "\0").encode("utf-8"))
2485
except socket.error as error:
2486
if error.errno == errno.EPERM:
2487
logger.error("No permission to bind to"
2488
" interface %s", self.interface)
2489
elif error.errno == errno.ENOPROTOOPT:
2490
logger.error("SO_BINDTODEVICE not available;"
2491
" cannot bind to interface %s",
2492
self.interface)
2493
elif error.errno == errno.ENODEV:
2494
logger.error("Interface %s does not exist,"
2495
" cannot bind", self.interface)
2496
else:
2497
raise
2426
2498
# Only bind(2) the socket if we really need to.
2427
2499
if self.server_address[0] or self.server_address[1]:
2428
2500
if not self.server_address[0]:
2429
2501
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2502
any_address = "::" # in6addr_any
2431
2503
else:
2432
any_address = "0.0.0.0" # INADDR_ANY
2504
any_address = "0.0.0.0" # INADDR_ANY
2433
2505
self.server_address = (any_address,
2434
2506
self.server_address[1])
2435
2507
elif not self.server_address[1]:
2445
2517
2446
2518
class MandosServer(IPv6_TCPServer):
2447
2519
"""Mandos server.
2448
2520
2449
2521
Attributes:
2450
2522
clients: set of Client objects
2451
2523
gnutls_priority GnuTLS priority string
2452
2524
use_dbus: Boolean; to emit D-Bus signals or not
2453
2454
Assumes a gobject.MainLoop event loop.
2525
2526
Assumes a GLib.MainLoop event loop.
2455
2527
"""
2456
2528
2457
2529
def __init__(self, server_address, RequestHandlerClass,
2458
2530
interface=None,
2459
2531
use_ipv6=True,
2469
2541
self.gnutls_priority = gnutls_priority
2470
2542
IPv6_TCPServer.__init__(self, server_address,
2471
2543
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2475
2544
interface=interface,
2545
use_ipv6=use_ipv6,
2546
socketfd=socketfd)
2547
2476
2548
def server_activate(self):
2477
2549
if self.enabled:
2478
2550
return socketserver.TCPServer.server_activate(self)
2479
2551
2480
2552
def enable(self):
2481
2553
self.enabled = True
2482
2554
2483
2555
def add_pipe(self, parent_pipe, proc):
2484
2556
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2557
GLib.io_add_watch(
2486
2558
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2559
GLib.IO_IN | GLib.IO_HUP,
2488
2560
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2491
2561
parent_pipe=parent_pipe,
2562
proc=proc))
2563
2492
2564
def handle_ipc(self, source, condition,
2493
2565
parent_pipe=None,
2494
proc = None,
2566
proc=None,
2495
2567
client_object=None):
2496
2568
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2569
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2570
# Wait for other process to exit
2499
2571
proc.join()
2500
2572
return False
2501
2573
2502
2574
# Read a request from the child
2503
2575
request = parent_pipe.recv()
2504
2576
command = request[0]
2505
2577
2506
2578
if command == 'init':
2507
2579
fpr = request[1]
2508
2580
address = request[2]
2509
2510
for c in self.clients.itervalues():
2581
2582
for c in self.clients.values():
2511
2583
if c.fingerprint == fpr:
2512
2584
client = c
2513
2585
break
2520
2592
address[0])
2521
2593
parent_pipe.send(False)
2522
2594
return False
2523
2524
gobject.io_add_watch(
2595
2596
GLib.io_add_watch(
2525
2597
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2598
GLib.IO_IN | GLib.IO_HUP,
2527
2599
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2600
parent_pipe=parent_pipe,
2601
proc=proc,
2602
client_object=client))
2531
2603
parent_pipe.send(True)
2532
2604
# remove the old hook in favor of the new above hook on
2533
2605
# same fileno
2536
2608
funcname = request[1]
2537
2609
args = request[2]
2538
2610
kwargs = request[3]
2539
2611
2540
2612
parent_pipe.send(('data', getattr(client_object,
2541
2613
funcname)(*args,
2542
2614
**kwargs)))
2543
2615
2544
2616
if command == 'getattr':
2545
2617
attrname = request[1]
2546
2618
if isinstance(client_object.__getattribute__(attrname),
2549
2621
else:
2550
2622
parent_pipe.send((
2551
2623
'data', client_object.__getattribute__(attrname)))
2552
2624
2553
2625
if command == 'setattr':
2554
2626
attrname = request[1]
2555
2627
value = request[2]
2556
2628
setattr(client_object, attrname, value)
2557
2629
2558
2630
return True
2559
2631
2560
2632
2561
2633
def rfc3339_duration_to_delta(duration):
2562
2634
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2563
2635
2564
2636
>>> rfc3339_duration_to_delta("P7D")
2565
2637
datetime.timedelta(7)
2566
2638
>>> rfc3339_duration_to_delta("PT60S")
2576
2648
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
2649
datetime.timedelta(1, 200)
2578
2650
"""
2579
2651
2580
2652
# Parsing an RFC 3339 duration with regular expressions is not
2581
2653
# possible - there would have to be multiple places for the same
2582
2654
# values, like seconds. The current code, while more esoteric, is
2583
2655
# cleaner without depending on a parsing library. If Python had a
2584
2656
# built-in library for parsing we would use it, but we'd like to
2585
2657
# avoid excessive use of external libraries.
2586
2658
2587
2659
# New type for defining tokens, syntax, and semantics all-in-one
2588
2660
Token = collections.namedtuple("Token", (
2589
2661
"regexp", # To match token; if "value" is not None, must have
2622
2694
frozenset((token_year, token_month,
2623
2695
token_day, token_time,
2624
2696
token_week)))
2625
# Define starting values
2626
value = datetime.timedelta() # Value so far
2697
# Define starting values:
2698
# Value so far
2699
value = datetime.timedelta()
2627
2700
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2629
s = duration # String left to parse
2701
# Following valid tokens
2702
followers = frozenset((token_duration, ))
2703
# String left to parse
2704
s = duration
2630
2705
# Loop until end token is found
2631
2706
while found_token is not token_end:
2632
2707
# Search for any currently valid tokens
2656
2731
2657
2732
def string_to_delta(interval):
2658
2733
"""Parse a string and return a datetime.timedelta
2659
2734
2660
2735
>>> string_to_delta('7d')
2661
2736
datetime.timedelta(7)
2662
2737
>>> string_to_delta('60s')
2670
2745
>>> string_to_delta('5m 30s')
2671
2746
datetime.timedelta(0, 330)
2672
2747
"""
2673
2748
2674
2749
try:
2675
2750
return rfc3339_duration_to_delta(interval)
2676
2751
except ValueError:
2677
2752
pass
2678
2753
2679
2754
timevalue = datetime.timedelta(0)
2680
2755
for s in interval.split():
2681
2756
try:
2699
2774
return timevalue
2700
2775
2701
2776
2702
def daemon(nochdir = False, noclose = False):
2777
def daemon(nochdir=False, noclose=False):
2703
2778
"""See daemon(3). Standard BSD Unix function.
2704
2779
2705
2780
This should really exist as os.daemon, but it doesn't (yet)."""
2706
2781
if os.fork():
2707
2782
sys.exit()
2725
2800
2726
2801
2727
2802
def main():
2728
2803
2729
2804
##################################################################
2730
2805
# Parsing of options, both command line and config file
2731
2806
2732
2807
parser = argparse.ArgumentParser()
2733
2808
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2809
version="%(prog)s {}".format(version),
2735
2810
help="show version number and exit")
2736
2811
parser.add_argument("-i", "--interface", metavar="IF",
2737
2812
help="Bind to interface IF")
2773
2848
parser.add_argument("--no-zeroconf", action="store_false",
2774
2849
dest="zeroconf", help="Do not use Zeroconf",
2775
2850
default=None)
2776
2851
2777
2852
options = parser.parse_args()
2778
2853
2779
2854
if options.check:
2780
2855
import doctest
2781
2856
fail_count, test_count = doctest.testmod()
2782
2857
sys.exit(os.EX_OK if fail_count == 0 else 1)
2783
2858
2784
2859
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2786
"address": "",
2787
"port": "",
2788
"debug": "False",
2789
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2793
"use_dbus": "True",
2794
"use_ipv6": "True",
2795
"debuglevel": "",
2796
"restore": "True",
2797
"socket": "",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2802
2860
server_defaults = {"interface": "",
2861
"address": "",
2862
"port": "",
2863
"debug": "False",
2864
"priority":
2865
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2866
":+SIGN-DSA-SHA256",
2867
"servicename": "Mandos",
2868
"use_dbus": "True",
2869
"use_ipv6": "True",
2870
"debuglevel": "",
2871
"restore": "True",
2872
"socket": "",
2873
"statedir": "/var/lib/mandos",
2874
"foreground": "False",
2875
"zeroconf": "True",
2876
}
2877
2803
2878
# Parse config file for server-global settings
2804
2879
server_config = configparser.SafeConfigParser(server_defaults)
2805
2880
del server_defaults
2823
2898
server_settings["socket"] = os.dup(server_settings
2824
2899
["socket"])
2825
2900
del server_config
2826
2901
2827
2902
# Override the settings from the config file with command line
2828
2903
# options, if set.
2829
2904
for option in ("interface", "address", "port", "debug",
2847
2922
if server_settings["debug"]:
2848
2923
server_settings["foreground"] = True
2849
2924
# Now we have our good server settings in "server_settings"
2850
2925
2851
2926
##################################################################
2852
2927
2853
2928
if (not server_settings["zeroconf"]
2854
2929
and not (server_settings["port"]
2855
2930
or server_settings["socket"] != "")):
2856
2931
parser.error("Needs port or socket to work without Zeroconf")
2857
2932
2858
2933
# For convenience
2859
2934
debug = server_settings["debug"]
2860
2935
debuglevel = server_settings["debuglevel"]
2864
2939
stored_state_file)
2865
2940
foreground = server_settings["foreground"]
2866
2941
zeroconf = server_settings["zeroconf"]
2867
2942
2868
2943
if debug:
2869
2944
initlogger(debug, logging.DEBUG)
2870
2945
else:
2873
2948
else:
2874
2949
level = getattr(logging, debuglevel.upper())
2875
2950
initlogger(debug, level)
2876
2951
2877
2952
if server_settings["servicename"] != "Mandos":
2878
2953
syslogger.setFormatter(
2879
2954
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
2955
' %(levelname)s: %(message)s'.format(
2881
2956
server_settings["servicename"])))
2882
2957
2883
2958
# Parse config file with clients
2884
2959
client_config = configparser.SafeConfigParser(Client
2885
2960
.client_defaults)
2886
2961
client_config.read(os.path.join(server_settings["configdir"],
2887
2962
"clients.conf"))
2888
2963
2889
2964
global mandos_dbus_service
2890
2965
mandos_dbus_service = None
2891
2966
2892
2967
socketfd = None
2893
2968
if server_settings["socket"] != "":
2894
2969
socketfd = server_settings["socket"]
2910
2985
except IOError as e:
2911
2986
logger.error("Could not open file %r", pidfilename,
2912
2987
exc_info=e)
2913
2914
for name in ("_mandos", "mandos", "nobody"):
2988
2989
for name, group in (("_mandos", "_mandos"),
2990
("mandos", "mandos"),
2991
("nobody", "nogroup")):
2915
2992
try:
2916
2993
uid = pwd.getpwnam(name).pw_uid
2917
gid = pwd.getpwnam(name).pw_gid
2994
gid = pwd.getpwnam(group).pw_gid
2918
2995
break
2919
2996
except KeyError:
2920
2997
continue
2924
3001
try:
2925
3002
os.setgid(gid)
2926
3003
os.setuid(uid)
3004
if debug:
3005
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3006
gid))
2927
3007
except OSError as error:
3008
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3009
.format(uid, gid, os.strerror(error.errno)))
2928
3010
if error.errno != errno.EPERM:
2929
3011
raise
2930
3012
2931
3013
if debug:
2932
3014
# Enable all possible GnuTLS debugging
2933
3015
2934
3016
# "Use a log level over 10 to enable all debugging options."
2935
3017
# - GnuTLS manual
2936
3018
gnutls.global_set_log_level(11)
2937
3019
2938
3020
@gnutls.log_func
2939
3021
def debug_gnutls(level, string):
2940
3022
logger.debug("GnuTLS: %s", string[:-1])
2941
3023
2942
3024
gnutls.global_set_log_function(debug_gnutls)
2943
3025
2944
3026
# Redirect stdin so all checkers get /dev/null
2945
3027
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2946
3028
os.dup2(null, sys.stdin.fileno())
2947
3029
if null > 2:
2948
3030
os.close(null)
2949
3031
2950
3032
# Need to fork before connecting to D-Bus
2951
3033
if not foreground:
2952
3034
# Close all input and output, do double fork, etc.
2953
3035
daemon()
2954
2955
# multiprocessing will use threads, so before we use gobject we
2956
# need to inform gobject that threads will be used.
2957
gobject.threads_init()
2958
3036
3037
# multiprocessing will use threads, so before we use GLib we need
3038
# to inform GLib that threads will be used.
3039
GLib.threads_init()
3040
2959
3041
global main_loop
2960
3042
# From the Avahi example code
2961
3043
DBusGMainLoop(set_as_default=True)
2962
main_loop = gobject.MainLoop()
3044
main_loop = GLib.MainLoop()
2963
3045
bus = dbus.SystemBus()
2964
3046
# End of Avahi example code
2965
3047
if use_dbus:
2978
3060
if zeroconf:
2979
3061
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3062
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
3063
name=server_settings["servicename"],
3064
servicetype="_mandos._tcp",
3065
protocol=protocol,
3066
bus=bus)
2985
3067
if server_settings["interface"]:
2986
3068
service.interface = if_nametoindex(
2987
3069
server_settings["interface"].encode("utf-8"))
2988
3070
2989
3071
global multiprocessing_manager
2990
3072
multiprocessing_manager = multiprocessing.Manager()
2991
3073
2992
3074
client_class = Client
2993
3075
if use_dbus:
2994
client_class = functools.partial(ClientDBus, bus = bus)
2995
3076
client_class = functools.partial(ClientDBus, bus=bus)
3077
2996
3078
client_settings = Client.config_parser(client_config)
2997
3079
old_client_settings = {}
2998
3080
clients_data = {}
2999
3081
3000
3082
# This is used to redirect stdout and stderr for checker processes
3001
3083
global wnull
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3084
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3085
# Only used if server is running in foreground but not in debug
3004
3086
# mode
3005
3087
if debug or not foreground:
3006
3088
wnull.close()
3007
3089
3008
3090
# Get client data and settings from last running state.
3009
3091
if server_settings["restore"]:
3010
3092
try:
3011
3093
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
3094
if sys.version_info.major == 2:
3095
clients_data, old_client_settings = pickle.load(
3096
stored_state)
3097
else:
3098
bytes_clients_data, bytes_old_client_settings = (
3099
pickle.load(stored_state, encoding="bytes"))
3100
# Fix bytes to strings
3101
# clients_data
3102
# .keys()
3103
clients_data = {(key.decode("utf-8")
3104
if isinstance(key, bytes)
3105
else key): value
3106
for key, value in
3107
bytes_clients_data.items()}
3108
del bytes_clients_data
3109
for key in clients_data:
3110
value = {(k.decode("utf-8")
3111
if isinstance(k, bytes) else k): v
3112
for k, v in
3113
clients_data[key].items()}
3114
clients_data[key] = value
3115
# .client_structure
3116
value["client_structure"] = [
3117
(s.decode("utf-8")
3118
if isinstance(s, bytes)
3119
else s) for s in
3120
value["client_structure"]]
3121
# .name & .host
3122
for k in ("name", "host"):
3123
if isinstance(value[k], bytes):
3124
value[k] = value[k].decode("utf-8")
3125
# old_client_settings
3126
# .keys()
3127
old_client_settings = {
3128
(key.decode("utf-8")
3129
if isinstance(key, bytes)
3130
else key): value
3131
for key, value in
3132
bytes_old_client_settings.items()}
3133
del bytes_old_client_settings
3134
# .host
3135
for value in old_client_settings.values():
3136
if isinstance(value["host"], bytes):
3137
value["host"] = (value["host"]
3138
.decode("utf-8"))
3014
3139
os.remove(stored_state_path)
3015
3140
except IOError as e:
3016
3141
if e.errno == errno.ENOENT:
3024
3149
logger.warning("Could not load persistent state: "
3025
3150
"EOFError:",
3026
3151
exc_info=e)
3027
3152
3028
3153
with PGPEngine() as pgp:
3029
3154
for client_name, client in clients_data.items():
3030
3155
# Skip removed clients
3031
3156
if client_name not in client_settings:
3032
3157
continue
3033
3158
3034
3159
# Decide which value to use after restoring saved state.
3035
3160
# We have three different values: Old config file,
3036
3161
# new config file, and saved state.
3047
3172
client[name] = value
3048
3173
except KeyError:
3049
3174
pass
3050
3175
3051
3176
# Clients who has passed its expire date can still be
3052
3177
# enabled if its last checker was successful. A Client
3053
3178
# whose checker succeeded before we stored its state is
3086
3211
client_name))
3087
3212
client["secret"] = (client_settings[client_name]
3088
3213
["secret"])
3089
3214
3090
3215
# Add/remove clients based on new changes made to config
3091
3216
for client_name in (set(old_client_settings)
3092
3217
- set(client_settings)):
3094
3219
for client_name in (set(client_settings)
3095
3220
- set(old_client_settings)):
3096
3221
clients_data[client_name] = client_settings[client_name]
3097
3222
3098
3223
# Create all client objects
3099
3224
for client_name, client in clients_data.items():
3100
3225
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
3103
server_settings = server_settings)
3104
3226
name=client_name,
3227
settings=client,
3228
server_settings=server_settings)
3229
3105
3230
if not tcp_server.clients:
3106
3231
logger.warning("No clients defined")
3107
3232
3108
3233
if not foreground:
3109
3234
if pidfile is not None:
3110
3235
pid = os.getpid()
3116
3241
pidfilename, pid)
3117
3242
del pidfile
3118
3243
del pidfilename
3119
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
3244
3245
for termsig in (signal.SIGHUP, signal.SIGTERM):
3246
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3247
lambda: main_loop.quit() and False)
3248
3123
3249
if use_dbus:
3124
3250
3125
3251
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3252
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3253
class MandosDBusService(DBusObjectWithObjectManager):
3128
3254
"""A D-Bus proxy object"""
3129
3255
3130
3256
def __init__(self):
3131
3257
dbus.service.Object.__init__(self, bus, "/")
3132
3258
3133
3259
_interface = "se.recompile.Mandos"
3134
3260
3135
3261
@dbus.service.signal(_interface, signature="o")
3136
3262
def ClientAdded(self, objpath):
3137
3263
"D-Bus signal"
3138
3264
pass
3139
3265
3140
3266
@dbus.service.signal(_interface, signature="ss")
3141
3267
def ClientNotFound(self, fingerprint, address):
3142
3268
"D-Bus signal"
3143
3269
pass
3144
3270
3145
3271
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
3272
"true"})
3147
3273
@dbus.service.signal(_interface, signature="os")
3148
3274
def ClientRemoved(self, objpath, name):
3149
3275
"D-Bus signal"
3150
3276
pass
3151
3277
3152
3278
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
3279
"true"})
3154
3280
@dbus.service.method(_interface, out_signature="ao")
3155
3281
def GetAllClients(self):
3156
3282
"D-Bus method"
3157
3283
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3159
3284
tcp_server.clients.values())
3285
3160
3286
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
3287
"true"})
3162
3288
@dbus.service.method(_interface,
3164
3290
def GetAllClientsWithProperties(self):
3165
3291
"D-Bus method"
3166
3292
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3293
{c.dbus_object_path: c.GetAll(
3168
3294
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
3295
for c in tcp_server.clients.values()},
3170
3296
signature="oa{sv}")
3171
3297
3172
3298
@dbus.service.method(_interface, in_signature="o")
3173
3299
def RemoveClient(self, object_path):
3174
3300
"D-Bus method"
3175
for c in tcp_server.clients.itervalues():
3301
for c in tcp_server.clients.values():
3176
3302
if c.dbus_object_path == object_path:
3177
3303
del tcp_server.clients[c.name]
3178
3304
c.remove_from_connection()
3182
3308
self.client_removed_signal(c)
3183
3309
return
3184
3310
raise KeyError(object_path)
3185
3311
3186
3312
del _interface
3187
3313
3188
3314
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3315
out_signature="a{oa{sa{sv}}}")
3190
3316
def GetManagedObjects(self):
3191
3317
"""D-Bus method"""
3192
3318
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3319
{client.dbus_object_path:
3320
dbus.Dictionary(
3321
{interface: client.GetAll(interface)
3322
for interface in
3323
client._get_all_interface_names()})
3324
for client in tcp_server.clients.values()})
3325
3200
3326
def client_added_signal(self, client):
3201
3327
"""Send the new standard signal and the old signal"""
3202
3328
if use_dbus:
3204
3330
self.InterfacesAdded(
3205
3331
client.dbus_object_path,
3206
3332
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3333
{interface: client.GetAll(interface)
3334
for interface in
3335
client._get_all_interface_names()}))
3210
3336
# Old signal
3211
3337
self.ClientAdded(client.dbus_object_path)
3212
3338
3213
3339
def client_removed_signal(self, client):
3214
3340
"""Send the new standard signal and the old signal"""
3215
3341
if use_dbus:
3220
3346
# Old signal
3221
3347
self.ClientRemoved(client.dbus_object_path,
3222
3348
client.name)
3223
3349
3224
3350
mandos_dbus_service = MandosDBusService()
3225
3351
3352
# Save modules to variables to exempt the modules from being
3353
# unloaded before the function registered with atexit() is run.
3354
mp = multiprocessing
3355
wn = wnull
3356
3226
3357
def cleanup():
3227
3358
"Cleanup function; run on exit"
3228
3359
if zeroconf:
3229
3360
service.cleanup()
3230
3231
multiprocessing.active_children()
3232
wnull.close()
3361
3362
mp.active_children()
3363
wn.close()
3233
3364
if not (tcp_server.clients or client_settings):
3234
3365
return
3235
3366
3236
3367
# Store client before exiting. Secrets are encrypted with key
3237
3368
# based on what config file has. If config file is
3238
3369
# removed/edited, old secret will thus be unrecovable.
3239
3370
clients = {}
3240
3371
with PGPEngine() as pgp:
3241
for client in tcp_server.clients.itervalues():
3372
for client in tcp_server.clients.values():
3242
3373
key = client_settings[client.name]["secret"]
3243
3374
client.encrypted_secret = pgp.encrypt(client.secret,
3244
3375
key)
3245
3376
client_dict = {}
3246
3377
3247
3378
# A list of attributes that can not be pickled
3248
3379
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3380
exclude = {"bus", "changedstate", "secret",
3381
"checker", "server_settings"}
3251
3382
for name, typ in inspect.getmembers(dbus.service
3252
3383
.Object):
3253
3384
exclude.add(name)
3254
3385
3255
3386
client_dict["encrypted_secret"] = (client
3256
3387
.encrypted_secret)
3257
3388
for attr in client.client_structure:
3258
3389
if attr not in exclude:
3259
3390
client_dict[attr] = getattr(client, attr)
3260
3391
3261
3392
clients[client.name] = client_dict
3262
3393
del client_settings[client.name]["secret"]
3263
3394
3264
3395
try:
3265
3396
with tempfile.NamedTemporaryFile(
3266
3397
mode='wb',
3268
3399
prefix='clients-',
3269
3400
dir=os.path.dirname(stored_state_path),
3270
3401
delete=False) as stored_state:
3271
pickle.dump((clients, client_settings), stored_state)
3402
pickle.dump((clients, client_settings), stored_state,
3403
protocol=2)
3272
3404
tempname = stored_state.name
3273
3405
os.rename(tempname, stored_state_path)
3274
3406
except (IOError, OSError) as e:
3284
3416
logger.warning("Could not save persistent state:",
3285
3417
exc_info=e)
3286
3418
raise
3287
3419
3288
3420
# Delete all clients, and settings from config
3289
3421
while tcp_server.clients:
3290
3422
name, client = tcp_server.clients.popitem()
3296
3428
if use_dbus:
3297
3429
mandos_dbus_service.client_removed_signal(client)
3298
3430
client_settings.clear()
3299
3431
3300
3432
atexit.register(cleanup)
3301
3302
for client in tcp_server.clients.itervalues():
3433
3434
for client in tcp_server.clients.values():
3303
3435
if use_dbus:
3304
3436
# Emit D-Bus signal for adding
3305
3437
mandos_dbus_service.client_added_signal(client)
3306
3438
# Need to initiate checking of clients
3307
3439
if client.enabled:
3308
3440
client.init_checker()
3309
3441
3310
3442
tcp_server.enable()
3311
3443
tcp_server.server_activate()
3312
3444
3313
3445
# Find out what port we got
3314
3446
if zeroconf:
3315
3447
service.port = tcp_server.socket.getsockname()[1]
3320
3452
else: # IPv4
3321
3453
logger.info("Now listening on address %r, port %d",
3322
3454
*tcp_server.socket.getsockname())
3323
3324
#service.interface = tcp_server.socket.getsockname()[3]
3325
3455
3456
# service.interface = tcp_server.socket.getsockname()[3]
3457
3326
3458
try:
3327
3459
if zeroconf:
3328
3460
# From the Avahi example code
3333
3465
cleanup()
3334
3466
sys.exit(1)
3335
3467
# End of Avahi example code
3336
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3341
3468
3469
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3470
lambda *args, **kwargs:
3471
(tcp_server.handle_request
3472
(*args[2:], **kwargs) or True))
3473
3342
3474
logger.debug("Starting main loop")
3343
3475
main_loop.run()
3344
3476
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0