To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 896
- compare with another revision
- download diff
- download tarball
- view history from revision 896
- Committer: Teddy Hogeborn
- Date: 2017-02-21 21:42:08 UTC
- Revision ID: teddy@recompile.se-20170221214208-09wu1p4l2hjhqfoj
Use "read -r" in shell scripts to avoid backslash escapes
* initramfs-tools-hook: Use "read -r" to read filenames from network
hook given the "files" argument.
* initramfs-tools-script: Use "read -e" when parsing
"/conf/conf.d/cryptroot".
* mandos-keygen (keygen): Use "read -r" when reading passphrase.
* initramfs-tools-hook: Use "read -r" to read filenames from network
hook given the "files" argument.
* initramfs-tools-script: Use "read -e" when parsing
"/conf/conf.d/cryptroot".
* mandos-keygen (keygen): Use "read -r" when reading passphrase.
- files added:
- tmpfiles.d-mandos.conf
- files modified:
- INSTALL
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
14
# Copyright © 2008-2016 Teddy Hogeborn
15
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
23
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
25
# GNU General Public License for more details.
26
#
26
#
27
27
# You should have received a copy of the GNU General Public License
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
#
30
#
31
31
# Contact the authors at <mandos@recompile.se>.
32
#
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
79
79
80
80
import dbus
81
81
import dbus.service
82
try:
83
from gi.repository import GObject
84
except ImportError:
85
import gobject as GObject
82
from gi.repository import GLib
86
83
from dbus.mainloop.glib import DBusGMainLoop
87
84
import ctypes
88
85
import ctypes.util
89
86
import xml.dom.minidom
90
87
import inspect
91
88
89
# Try to find the value of SO_BINDTODEVICE:
92
90
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
93
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
94
except AttributeError:
95
95
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
96
98
from IN import SO_BINDTODEVICE
97
99
except ImportError:
98
SO_BINDTODEVICE = None
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
99
113
100
114
if sys.version_info.major == 2:
101
115
str = unicode
102
116
103
version = "1.7.5"
117
version = "1.7.14"
104
118
stored_state_file = "clients.pickle"
105
119
106
120
logger = logging.getLogger()
110
124
if_nametoindex = ctypes.cdll.LoadLibrary(
111
125
ctypes.util.find_library("c")).if_nametoindex
112
126
except (OSError, AttributeError):
113
127
114
128
def if_nametoindex(interface):
115
129
"Get an interface index the hard way, i.e. using fcntl()"
116
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
139
153
140
154
def initlogger(debug, level=logging.WARNING):
141
155
"""init logger and add loglevel"""
142
156
143
157
global syslogger
144
158
syslogger = (logging.handlers.SysLogHandler(
145
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
146
address = "/dev/log"))
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
address="/dev/log"))
147
161
syslogger.setFormatter(logging.Formatter
148
162
('Mandos [%(process)d]: %(levelname)s:'
149
163
' %(message)s'))
150
164
logger.addHandler(syslogger)
151
165
152
166
if debug:
153
167
console = logging.StreamHandler()
154
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
166
180
167
181
class PGPEngine(object):
168
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
169
183
170
184
def __init__(self):
171
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
172
186
self.gpg = "gpg"
183
197
self.gnupgargs = ['--batch',
184
198
'--homedir', self.tempdir,
185
199
'--force-mdc',
186
'--quiet',
187
'--no-use-agent']
188
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
204
189
205
def __enter__(self):
190
206
return self
191
207
192
208
def __exit__(self, exc_type, exc_value, traceback):
193
209
self._cleanup()
194
210
return False
195
211
196
212
def __del__(self):
197
213
self._cleanup()
198
214
199
215
def _cleanup(self):
200
216
if self.tempdir is not None:
201
217
# Delete contents of tempdir
202
218
for root, dirs, files in os.walk(self.tempdir,
203
topdown = False):
219
topdown=False):
204
220
for filename in files:
205
221
os.remove(os.path.join(root, filename))
206
222
for dirname in dirs:
208
224
# Remove tempdir
209
225
os.rmdir(self.tempdir)
210
226
self.tempdir = None
211
227
212
228
def password_encode(self, password):
213
229
# Passphrase can not be empty and can not contain newlines or
214
230
# NUL bytes. So we prefix it and hex encode it.
219
235
.replace(b"\n", b"\\n")
220
236
.replace(b"\0", b"\\x00"))
221
237
return encoded
222
238
223
239
def encrypt(self, data, password):
224
240
passphrase = self.password_encode(password)
225
241
with tempfile.NamedTemporaryFile(
230
246
'--passphrase-file',
231
247
passfile.name]
232
248
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
237
253
if proc.returncode != 0:
238
254
raise PGPError(err)
239
255
return ciphertext
240
256
241
257
def decrypt(self, data, password):
242
258
passphrase = self.password_encode(password)
243
259
with tempfile.NamedTemporaryFile(
244
dir = self.tempdir) as passfile:
260
dir=self.tempdir) as passfile:
245
261
passfile.write(passphrase)
246
262
passfile.flush()
247
263
proc = subprocess.Popen([self.gpg, '--decrypt',
248
264
'--passphrase-file',
249
265
passfile.name]
250
266
+ self.gnupgargs,
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
255
271
if proc.returncode != 0:
256
272
raise PGPError(err)
257
273
return decrypted_plaintext
258
274
275
259
276
# Pretend that we have an Avahi module
260
277
class Avahi(object):
261
278
"""This isn't so much a class as it is a module-like namespace.
262
279
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
267
284
DBUS_NAME = "org.freedesktop.Avahi"
268
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
269
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
270
287
DBUS_PATH_SERVER = "/"
288
271
289
def string_array_to_txt_array(self, t):
272
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
273
291
for s in t), signature="ay")
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
282
300
avahi = Avahi()
283
301
302
284
303
class AvahiError(Exception):
285
304
def __init__(self, value, *args, **kwargs):
286
305
self.value = value
298
317
299
318
class AvahiService(object):
300
319
"""An Avahi (Zeroconf) service.
301
320
302
321
Attributes:
303
322
interface: integer; avahi.IF_UNSPEC or an interface index.
304
323
Used to optionally bind to the specified interface.
316
335
server: D-Bus Server
317
336
bus: dbus.SystemBus()
318
337
"""
319
338
320
339
def __init__(self,
321
interface = avahi.IF_UNSPEC,
322
name = None,
323
servicetype = None,
324
port = None,
325
TXT = None,
326
domain = "",
327
host = "",
328
max_renames = 32768,
329
protocol = avahi.PROTO_UNSPEC,
330
bus = None):
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
331
350
self.interface = interface
332
351
self.name = name
333
352
self.type = servicetype
342
361
self.server = None
343
362
self.bus = bus
344
363
self.entry_group_state_changed_match = None
345
364
346
365
def rename(self, remove=True):
347
366
"""Derived from the Avahi example code"""
348
367
if self.rename_count >= self.max_renames:
368
387
logger.critical("D-Bus Exception", exc_info=error)
369
388
self.cleanup()
370
389
os._exit(1)
371
390
372
391
def remove(self):
373
392
"""Derived from the Avahi example code"""
374
393
if self.entry_group_state_changed_match is not None:
376
395
self.entry_group_state_changed_match = None
377
396
if self.group is not None:
378
397
self.group.Reset()
379
398
380
399
def add(self):
381
400
"""Derived from the Avahi example code"""
382
401
self.remove()
399
418
dbus.UInt16(self.port),
400
419
avahi.string_array_to_txt_array(self.TXT))
401
420
self.group.Commit()
402
421
403
422
def entry_group_state_changed(self, state, error):
404
423
"""Derived from the Avahi example code"""
405
424
logger.debug("Avahi entry group state change: %i", state)
406
425
407
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
408
427
logger.debug("Zeroconf service established.")
409
428
elif state == avahi.ENTRY_GROUP_COLLISION:
413
432
logger.critical("Avahi: Error in group state changed %s",
414
433
str(error))
415
434
raise AvahiGroupError("State changed: {!s}".format(error))
416
435
417
436
def cleanup(self):
418
437
"""Derived from the Avahi example code"""
419
438
if self.group is not None:
424
443
pass
425
444
self.group = None
426
445
self.remove()
427
446
428
447
def server_state_changed(self, state, error=None):
429
448
"""Derived from the Avahi example code"""
430
449
logger.debug("Avahi server state change: %i", state)
459
478
logger.debug("Unknown state: %r", state)
460
479
else:
461
480
logger.debug("Unknown state: %r: %r", state, error)
462
481
463
482
def activate(self):
464
483
"""Derived from the Avahi example code"""
465
484
if self.server is None:
482
501
.format(self.name)))
483
502
return ret
484
503
504
485
505
# Pretend that we have a GnuTLS module
486
506
class GnuTLS(object):
487
507
"""This isn't so much a class as it is a module-like namespace.
488
508
It is instantiated once, and simulates having a GnuTLS module."""
489
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
509
510
library = ctypes.util.find_library("gnutls")
511
if library is None:
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
514
del library
492
515
_need_version = b"3.3.0"
516
493
517
def __init__(self):
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
496
# happens.
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
500
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
523
501
524
# Unless otherwise indicated, the constants and types below are
502
525
# all from the gnutls/gnutls.h C header file.
503
526
504
527
# Constants
505
528
E_SUCCESS = 0
506
529
E_INTERRUPTED = -52
511
534
CRD_CERTIFICATE = 1
512
535
E_NO_CERTIFICATE_FOUND = -49
513
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
514
537
515
538
# Types
516
539
class session_int(ctypes.Structure):
517
540
_fields_ = []
518
541
session_t = ctypes.POINTER(session_int)
542
519
543
class certificate_credentials_st(ctypes.Structure):
520
544
_fields_ = []
521
545
certificate_credentials_t = ctypes.POINTER(
522
546
certificate_credentials_st)
523
547
certificate_type_t = ctypes.c_int
548
524
549
class datum_t(ctypes.Structure):
525
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
551
('size', ctypes.c_uint)]
552
527
553
class openpgp_crt_int(ctypes.Structure):
528
554
_fields_ = []
529
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
531
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
532
558
credentials_type_t = ctypes.c_int
533
559
transport_ptr_t = ctypes.c_void_p
534
560
close_request_t = ctypes.c_int
535
561
536
562
# Exceptions
537
563
class Error(Exception):
538
564
# We need to use the class name "GnuTLS" here, since this
539
565
# exception might be raised from within GnuTLS.__init__,
540
566
# which is called before the assignment to the "gnutls"
541
567
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
568
def __init__(self, message=None, code=None, args=()):
543
569
# Default usage is by a message string, but if a return
544
570
# code is passed, convert it to a string with
545
571
# gnutls.strerror()
548
574
message = GnuTLS.strerror(code)
549
575
return super(GnuTLS.Error, self).__init__(
550
576
message, *args)
551
577
552
578
class CertificateSecurityError(Error):
553
579
pass
554
580
555
581
# Classes
556
582
class Credentials(object):
557
583
def __init__(self):
559
585
gnutls.certificate_allocate_credentials(
560
586
ctypes.byref(self._c_object))
561
587
self.type = gnutls.CRD_CERTIFICATE
562
588
563
589
def __del__(self):
564
590
gnutls.certificate_free_credentials(self._c_object)
565
591
566
592
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
593
def __init__(self, socket, credentials=None):
568
594
self._c_object = gnutls.session_t()
569
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
570
596
gnutls.set_default_priority(self._c_object)
578
604
ctypes.cast(credentials._c_object,
579
605
ctypes.c_void_p))
580
606
self.credentials = credentials
581
607
582
608
def __del__(self):
583
609
gnutls.deinit(self._c_object)
584
610
585
611
def handshake(self):
586
612
return gnutls.handshake(self._c_object)
587
613
588
614
def send(self, data):
589
615
data = bytes(data)
590
616
data_len = len(data)
592
618
data_len -= gnutls.record_send(self._c_object,
593
619
data[-data_len:],
594
620
data_len)
595
621
596
622
def bye(self):
597
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
598
624
599
625
# Error handling functions
600
626
def _error_code(result):
601
627
"""A function to raise exceptions on errors, suitable
603
629
if result >= 0:
604
630
return result
605
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
608
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
634
609
635
def _retry_on_error(result, func, arguments):
610
636
"""A function to retry on some errors, suitable
611
637
for the 'errcheck' attribute on ctypes functions"""
614
640
return _error_code(result)
615
641
result = func(*arguments)
616
642
return result
617
643
618
644
# Unless otherwise indicated, the function declarations below are
619
645
# all from the gnutls/gnutls.h C header file.
620
646
621
647
# Functions
622
648
priority_set_direct = _library.gnutls_priority_set_direct
623
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
624
650
ctypes.POINTER(ctypes.c_char_p)]
625
651
priority_set_direct.restype = _error_code
626
652
627
653
init = _library.gnutls_init
628
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
629
655
init.restype = _error_code
630
656
631
657
set_default_priority = _library.gnutls_set_default_priority
632
658
set_default_priority.argtypes = [session_t]
633
659
set_default_priority.restype = _error_code
634
660
635
661
record_send = _library.gnutls_record_send
636
662
record_send.argtypes = [session_t, ctypes.c_void_p,
637
663
ctypes.c_size_t]
638
664
record_send.restype = ctypes.c_ssize_t
639
665
record_send.errcheck = _retry_on_error
640
666
641
667
certificate_allocate_credentials = (
642
668
_library.gnutls_certificate_allocate_credentials)
643
669
certificate_allocate_credentials.argtypes = [
644
670
ctypes.POINTER(certificate_credentials_t)]
645
671
certificate_allocate_credentials.restype = _error_code
646
672
647
673
certificate_free_credentials = (
648
674
_library.gnutls_certificate_free_credentials)
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
650
677
certificate_free_credentials.restype = None
651
678
652
679
handshake_set_private_extensions = (
653
680
_library.gnutls_handshake_set_private_extensions)
654
681
handshake_set_private_extensions.argtypes = [session_t,
655
682
ctypes.c_int]
656
683
handshake_set_private_extensions.restype = None
657
684
658
685
credentials_set = _library.gnutls_credentials_set
659
686
credentials_set.argtypes = [session_t, credentials_type_t,
660
687
ctypes.c_void_p]
661
688
credentials_set.restype = _error_code
662
689
663
690
strerror = _library.gnutls_strerror
664
691
strerror.argtypes = [ctypes.c_int]
665
692
strerror.restype = ctypes.c_char_p
666
693
667
694
certificate_type_get = _library.gnutls_certificate_type_get
668
695
certificate_type_get.argtypes = [session_t]
669
696
certificate_type_get.restype = _error_code
670
697
671
698
certificate_get_peers = _library.gnutls_certificate_get_peers
672
699
certificate_get_peers.argtypes = [session_t,
673
700
ctypes.POINTER(ctypes.c_uint)]
674
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
675
702
676
703
global_set_log_level = _library.gnutls_global_set_log_level
677
704
global_set_log_level.argtypes = [ctypes.c_int]
678
705
global_set_log_level.restype = None
679
706
680
707
global_set_log_function = _library.gnutls_global_set_log_function
681
708
global_set_log_function.argtypes = [log_func]
682
709
global_set_log_function.restype = None
683
710
684
711
deinit = _library.gnutls_deinit
685
712
deinit.argtypes = [session_t]
686
713
deinit.restype = None
687
714
688
715
handshake = _library.gnutls_handshake
689
716
handshake.argtypes = [session_t]
690
717
handshake.restype = _error_code
691
718
handshake.errcheck = _retry_on_error
692
719
693
720
transport_set_ptr = _library.gnutls_transport_set_ptr
694
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
695
722
transport_set_ptr.restype = None
696
723
697
724
bye = _library.gnutls_bye
698
725
bye.argtypes = [session_t, close_request_t]
699
726
bye.restype = _error_code
700
727
bye.errcheck = _retry_on_error
701
728
702
729
check_version = _library.gnutls_check_version
703
730
check_version.argtypes = [ctypes.c_char_p]
704
731
check_version.restype = ctypes.c_char_p
705
732
706
733
# All the function declarations below are from gnutls/openpgp.h
707
734
708
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
737
openpgp_crt_init.restype = _error_code
711
738
712
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
741
ctypes.POINTER(datum_t),
715
742
openpgp_crt_fmt_t]
716
743
openpgp_crt_import.restype = _error_code
717
744
718
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
747
ctypes.POINTER(ctypes.c_uint)]
721
748
openpgp_crt_verify_self.restype = _error_code
722
749
723
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
752
openpgp_crt_deinit.restype = None
726
753
727
754
openpgp_crt_get_fingerprint = (
728
755
_library.gnutls_openpgp_crt_get_fingerprint)
729
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
731
758
ctypes.POINTER(
732
759
ctypes.c_size_t)]
733
760
openpgp_crt_get_fingerprint.restype = _error_code
734
761
735
762
# Remove non-public functions
736
763
del _error_code, _retry_on_error
737
764
# Create the global "gnutls" object, simulating a module
738
765
gnutls = GnuTLS()
739
766
767
740
768
def call_pipe(connection, # : multiprocessing.Connection
741
769
func, *args, **kwargs):
742
770
"""This function is meant to be called by multiprocessing.Process
743
771
744
772
This function runs func(*args, **kwargs), and writes the resulting
745
773
return value on the provided multiprocessing.Connection.
746
774
"""
747
775
connection.send(func(*args, **kwargs))
748
776
connection.close()
749
777
778
750
779
class Client(object):
751
780
"""A representation of a client host served by this server.
752
781
753
782
Attributes:
754
783
approved: bool(); 'None' if not yet approved/disapproved
755
784
approval_delay: datetime.timedelta(); Time to wait for approval
757
786
checker: subprocess.Popen(); a running checker process used
758
787
to see if the client lives.
759
788
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
789
checker_callback_tag: a GLib event source tag, or None
761
790
checker_command: string; External command which is run to check
762
791
if client lives. %() expansions are done at
763
792
runtime with vars(self) as dict, so that for
764
793
instance %(name)s can be used in the command.
765
checker_initiator_tag: a GObject event source tag, or None
794
checker_initiator_tag: a GLib event source tag, or None
766
795
created: datetime.datetime(); (UTC) object creation
767
796
client_structure: Object describing what attributes a client has
768
797
and is used for storing the client at exit
769
798
current_checker_command: string; current running checker_command
770
disable_initiator_tag: a GObject event source tag, or None
799
disable_initiator_tag: a GLib event source tag, or None
771
800
enabled: bool()
772
801
fingerprint: string (40 or 32 hexadecimal digits); used to
773
802
uniquely identify the client
792
821
disabled, or None
793
822
server_settings: The server_settings dict from main()
794
823
"""
795
824
796
825
runtime_expansions = ("approval_delay", "approval_duration",
797
826
"created", "enabled", "expires",
798
827
"fingerprint", "host", "interval",
809
838
"approved_by_default": "True",
810
839
"enabled": "True",
811
840
}
812
841
813
842
@staticmethod
814
843
def config_parser(config):
815
844
"""Construct a new dict of client settings of this form:
822
851
for client_name in config.sections():
823
852
section = dict(config.items(client_name))
824
853
client = settings[client_name] = {}
825
854
826
855
client["host"] = section["host"]
827
856
# Reformat values from string types to Python types
828
857
client["approved_by_default"] = config.getboolean(
829
858
client_name, "approved_by_default")
830
859
client["enabled"] = config.getboolean(client_name,
831
860
"enabled")
832
861
833
862
# Uppercase and remove spaces from fingerprint for later
834
863
# comparison purposes with return value from the
835
864
# fingerprint() function
859
888
client["last_approval_request"] = None
860
889
client["last_checked_ok"] = None
861
890
client["last_checker_status"] = -2
862
891
863
892
return settings
864
865
def __init__(self, settings, name = None, server_settings=None):
893
894
def __init__(self, settings, name=None, server_settings=None):
866
895
self.name = name
867
896
if server_settings is None:
868
897
server_settings = {}
870
899
# adding all client settings
871
900
for setting, value in settings.items():
872
901
setattr(self, setting, value)
873
902
874
903
if self.enabled:
875
904
if not hasattr(self, "last_enabled"):
876
905
self.last_enabled = datetime.datetime.utcnow()
880
909
else:
881
910
self.last_enabled = None
882
911
self.expires = None
883
912
884
913
logger.debug("Creating client %r", self.name)
885
914
logger.debug(" Fingerprint: %s", self.fingerprint)
886
915
self.created = settings.get("created",
887
916
datetime.datetime.utcnow())
888
917
889
918
# attributes specific for this server instance
890
919
self.checker = None
891
920
self.checker_initiator_tag = None
900
929
for attr in self.__dict__.keys()
901
930
if not attr.startswith("_")]
902
931
self.client_structure.append("client_structure")
903
932
904
933
for name, t in inspect.getmembers(
905
934
type(self), lambda obj: isinstance(obj, property)):
906
935
if not name.startswith("_"):
907
936
self.client_structure.append(name)
908
937
909
938
# Send notice to process children that client state has changed
910
939
def send_changedstate(self):
911
940
with self.changedstate:
912
941
self.changedstate.notify_all()
913
942
914
943
def enable(self):
915
944
"""Start this client's checker and timeout hooks"""
916
945
if getattr(self, "enabled", False):
921
950
self.last_enabled = datetime.datetime.utcnow()
922
951
self.init_checker()
923
952
self.send_changedstate()
924
953
925
954
def disable(self, quiet=True):
926
955
"""Disable this client."""
927
956
if not getattr(self, "enabled", False):
929
958
if not quiet:
930
959
logger.info("Disabling client %s", self.name)
931
960
if getattr(self, "disable_initiator_tag", None) is not None:
932
GObject.source_remove(self.disable_initiator_tag)
961
GLib.source_remove(self.disable_initiator_tag)
933
962
self.disable_initiator_tag = None
934
963
self.expires = None
935
964
if getattr(self, "checker_initiator_tag", None) is not None:
936
GObject.source_remove(self.checker_initiator_tag)
965
GLib.source_remove(self.checker_initiator_tag)
937
966
self.checker_initiator_tag = None
938
967
self.stop_checker()
939
968
self.enabled = False
940
969
if not quiet:
941
970
self.send_changedstate()
942
# Do not run this again if called by a GObject.timeout_add
971
# Do not run this again if called by a GLib.timeout_add
943
972
return False
944
973
945
974
def __del__(self):
946
975
self.disable()
947
976
948
977
def init_checker(self):
949
978
# Schedule a new checker to be started an 'interval' from now,
950
979
# and every interval from then on.
951
980
if self.checker_initiator_tag is not None:
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
954
983
int(self.interval.total_seconds() * 1000),
955
984
self.start_checker)
956
985
# Schedule a disable() when 'timeout' has passed
957
986
if self.disable_initiator_tag is not None:
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
960
989
int(self.timeout.total_seconds() * 1000), self.disable)
961
990
# Also start a new checker *right now*.
962
991
self.start_checker()
963
992
964
993
def checker_callback(self, source, condition, connection,
965
994
command):
966
995
"""The checker has completed, so take appropriate actions."""
969
998
# Read return code from connection (see call_pipe)
970
999
returncode = connection.recv()
971
1000
connection.close()
972
1001
973
1002
if returncode >= 0:
974
1003
self.last_checker_status = returncode
975
1004
self.last_checker_signal = None
985
1014
logger.warning("Checker for %(name)s crashed?",
986
1015
vars(self))
987
1016
return False
988
1017
989
1018
def checked_ok(self):
990
1019
"""Assert that the client has been seen, alive and well."""
991
1020
self.last_checked_ok = datetime.datetime.utcnow()
992
1021
self.last_checker_status = 0
993
1022
self.last_checker_signal = None
994
1023
self.bump_timeout()
995
1024
996
1025
def bump_timeout(self, timeout=None):
997
1026
"""Bump up the timeout for this client."""
998
1027
if timeout is None:
999
1028
timeout = self.timeout
1000
1029
if self.disable_initiator_tag is not None:
1001
GObject.source_remove(self.disable_initiator_tag)
1030
GLib.source_remove(self.disable_initiator_tag)
1002
1031
self.disable_initiator_tag = None
1003
1032
if getattr(self, "enabled", False):
1004
self.disable_initiator_tag = GObject.timeout_add(
1033
self.disable_initiator_tag = GLib.timeout_add(
1005
1034
int(timeout.total_seconds() * 1000), self.disable)
1006
1035
self.expires = datetime.datetime.utcnow() + timeout
1007
1036
1008
1037
def need_approval(self):
1009
1038
self.last_approval_request = datetime.datetime.utcnow()
1010
1039
1011
1040
def start_checker(self):
1012
1041
"""Start a new checker subprocess if one is not running.
1013
1042
1014
1043
If a checker already exists, leave it running and do
1015
1044
nothing."""
1016
1045
# The reason for not killing a running checker is that if we
1021
1050
# checkers alone, the checker would have to take more time
1022
1051
# than 'timeout' for the client to be disabled, which is as it
1023
1052
# should be.
1024
1053
1025
1054
if self.checker is not None and not self.checker.is_alive():
1026
1055
logger.warning("Checker was not alive; joining")
1027
1056
self.checker.join()
1031
1060
# Escape attributes for the shell
1032
1061
escaped_attrs = {
1033
1062
attr: re.escape(str(getattr(self, attr)))
1034
for attr in self.runtime_expansions }
1063
for attr in self.runtime_expansions}
1035
1064
try:
1036
1065
command = self.checker_command % escaped_attrs
1037
1066
except TypeError as error:
1049
1078
# The exception is when not debugging but nevertheless
1050
1079
# running in the foreground; use the previously
1051
1080
# created wnull.
1052
popen_args = { "close_fds": True,
1053
"shell": True,
1054
"cwd": "/" }
1081
popen_args = {"close_fds": True,
1082
"shell": True,
1083
"cwd": "/"}
1055
1084
if (not self.server_settings["debug"]
1056
1085
and self.server_settings["foreground"]):
1057
1086
popen_args.update({"stdout": wnull,
1058
"stderr": wnull })
1059
pipe = multiprocessing.Pipe(duplex = False)
1087
"stderr": wnull})
1088
pipe = multiprocessing.Pipe(duplex=False)
1060
1089
self.checker = multiprocessing.Process(
1061
target = call_pipe,
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1090
target=call_pipe,
1091
args=(pipe[1], subprocess.call, command),
1092
kwargs=popen_args)
1064
1093
self.checker.start()
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1067
1096
self.checker_callback, pipe[0], command)
1068
# Re-run this periodically if run by GObject.timeout_add
1097
# Re-run this periodically if run by GLib.timeout_add
1069
1098
return True
1070
1099
1071
1100
def stop_checker(self):
1072
1101
"""Force the checker process, if any, to stop."""
1073
1102
if self.checker_callback_tag:
1074
GObject.source_remove(self.checker_callback_tag)
1103
GLib.source_remove(self.checker_callback_tag)
1075
1104
self.checker_callback_tag = None
1076
1105
if getattr(self, "checker", None) is None:
1077
1106
return
1086
1115
byte_arrays=False):
1087
1116
"""Decorators for marking methods of a DBusObjectWithProperties to
1088
1117
become properties on the D-Bus.
1089
1118
1090
1119
The decorated method will be called with no arguments by "Get"
1091
1120
and with one argument by "Set".
1092
1121
1093
1122
The parameters, where they are supported, are the same as
1094
1123
dbus.service.method, except there is only "signature", since the
1095
1124
type from Get() and the type sent to Set() is the same.
1099
1128
if byte_arrays and signature != "ay":
1100
1129
raise ValueError("Byte arrays not supported for non-'ay'"
1101
1130
" signature {!r}".format(signature))
1102
1131
1103
1132
def decorator(func):
1104
1133
func._dbus_is_property = True
1105
1134
func._dbus_interface = dbus_interface
1108
1137
func._dbus_name = func.__name__
1109
1138
if func._dbus_name.endswith("_dbus_property"):
1110
1139
func._dbus_name = func._dbus_name[:-14]
1111
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1112
1141
return func
1113
1142
1114
1143
return decorator
1115
1144
1116
1145
1117
1146
def dbus_interface_annotations(dbus_interface):
1118
1147
"""Decorator for marking functions returning interface annotations
1119
1148
1120
1149
Usage:
1121
1150
1122
1151
@dbus_interface_annotations("org.example.Interface")
1123
1152
def _foo(self): # Function name does not matter
1124
1153
return {"org.freedesktop.DBus.Deprecated": "true",
1125
1154
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1126
1155
"false"}
1127
1156
"""
1128
1157
1129
1158
def decorator(func):
1130
1159
func._dbus_is_interface = True
1131
1160
func._dbus_interface = dbus_interface
1132
1161
func._dbus_name = dbus_interface
1133
1162
return func
1134
1163
1135
1164
return decorator
1136
1165
1137
1166
1138
1167
def dbus_annotations(annotations):
1139
1168
"""Decorator to annotate D-Bus methods, signals or properties
1140
1169
Usage:
1141
1170
1142
1171
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1143
1172
"org.freedesktop.DBus.Property."
1144
1173
"EmitsChangedSignal": "false"})
1146
1175
access="r")
1147
1176
def Property_dbus_property(self):
1148
1177
return dbus.Boolean(False)
1149
1178
1150
1179
See also the DBusObjectWithAnnotations class.
1151
1180
"""
1152
1181
1153
1182
def decorator(func):
1154
1183
func._dbus_annotations = annotations
1155
1184
return func
1156
1185
1157
1186
return decorator
1158
1187
1159
1188
1177
1206
1178
1207
class DBusObjectWithAnnotations(dbus.service.Object):
1179
1208
"""A D-Bus object with annotations.
1180
1209
1181
1210
Classes inheriting from this can use the dbus_annotations
1182
1211
decorator to add annotations to methods or signals.
1183
1212
"""
1184
1213
1185
1214
@staticmethod
1186
1215
def _is_dbus_thing(thing):
1187
1216
"""Returns a function testing if an attribute is a D-Bus thing
1188
1217
1189
1218
If called like _is_dbus_thing("method") it returns a function
1190
1219
suitable for use as predicate to inspect.getmembers().
1191
1220
"""
1192
1221
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1193
1222
False)
1194
1223
1195
1224
def _get_all_dbus_things(self, thing):
1196
1225
"""Returns a generator of (name, attribute) pairs
1197
1226
"""
1200
1229
for cls in self.__class__.__mro__
1201
1230
for name, athing in
1202
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1203
1232
1204
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1205
out_signature = "s",
1206
path_keyword = 'object_path',
1207
connection_keyword = 'connection')
1234
out_signature="s",
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1208
1237
def Introspect(self, object_path, connection):
1209
1238
"""Overloading of standard D-Bus method.
1210
1239
1211
1240
Inserts annotation tags on methods and signals.
1212
1241
"""
1213
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1214
1243
connection)
1215
1244
try:
1216
1245
document = xml.dom.minidom.parseString(xmlstring)
1217
1246
1218
1247
for if_tag in document.getElementsByTagName("interface"):
1219
1248
# Add annotation tags
1220
1249
for typ in ("method", "signal"):
1247
1276
if_tag.appendChild(ann_tag)
1248
1277
# Fix argument name for the Introspect method itself
1249
1278
if (if_tag.getAttribute("name")
1250
== dbus.INTROSPECTABLE_IFACE):
1279
== dbus.INTROSPECTABLE_IFACE):
1251
1280
for cn in if_tag.getElementsByTagName("method"):
1252
1281
if cn.getAttribute("name") == "Introspect":
1253
1282
for arg in cn.getElementsByTagName("arg"):
1266
1295
1267
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1268
1297
"""A D-Bus object with properties.
1269
1298
1270
1299
Classes inheriting from this can use the dbus_service_property
1271
1300
decorator to expose methods as D-Bus properties. It exposes the
1272
1301
standard Get(), Set(), and GetAll() methods on the D-Bus.
1273
1302
"""
1274
1303
1275
1304
def _get_dbus_property(self, interface_name, property_name):
1276
1305
"""Returns a bound method if one exists which is a D-Bus
1277
1306
property with the specified name and interface.
1282
1311
if (value._dbus_name == property_name
1283
1312
and value._dbus_interface == interface_name):
1284
1313
return value.__get__(self)
1285
1314
1286
1315
# No such property
1287
1316
raise DBusPropertyNotFound("{}:{}.{}".format(
1288
1317
self.dbus_object_path, interface_name, property_name))
1289
1318
1290
1319
@classmethod
1291
1320
def _get_all_interface_names(cls):
1292
1321
"""Get a sequence of all interfaces supported by an object"""
1295
1324
for x in (inspect.getmro(cls))
1296
1325
for attr in dir(x))
1297
1326
if name is not None)
1298
1327
1299
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
1300
1329
in_signature="ss",
1301
1330
out_signature="v")
1309
1338
if not hasattr(value, "variant_level"):
1310
1339
return value
1311
1340
return type(value)(value, variant_level=value.variant_level+1)
1312
1341
1313
1342
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1314
1343
def Set(self, interface_name, property_name, value):
1315
1344
"""Standard D-Bus property Set() method, see D-Bus standard.
1327
1356
value = dbus.ByteArray(b''.join(chr(byte)
1328
1357
for byte in value))
1329
1358
prop(value)
1330
1359
1331
1360
@dbus.service.method(dbus.PROPERTIES_IFACE,
1332
1361
in_signature="s",
1333
1362
out_signature="a{sv}")
1334
1363
def GetAll(self, interface_name):
1335
1364
"""Standard D-Bus property GetAll() method, see D-Bus
1336
1365
standard.
1337
1366
1338
1367
Note: Will not include properties with access="write".
1339
1368
"""
1340
1369
properties = {}
1351
1380
properties[name] = value
1352
1381
continue
1353
1382
properties[name] = type(value)(
1354
value, variant_level = value.variant_level + 1)
1383
value, variant_level=value.variant_level + 1)
1355
1384
return dbus.Dictionary(properties, signature="sv")
1356
1385
1357
1386
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1358
1387
def PropertiesChanged(self, interface_name, changed_properties,
1359
1388
invalidated_properties):
1361
1390
standard.
1362
1391
"""
1363
1392
pass
1364
1393
1365
1394
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1366
1395
out_signature="s",
1367
1396
path_keyword='object_path',
1368
1397
connection_keyword='connection')
1369
1398
def Introspect(self, object_path, connection):
1370
1399
"""Overloading of standard D-Bus method.
1371
1400
1372
1401
Inserts property tags and interface annotation tags.
1373
1402
"""
1374
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1376
1405
connection)
1377
1406
try:
1378
1407
document = xml.dom.minidom.parseString(xmlstring)
1379
1408
1380
1409
def make_tag(document, name, prop):
1381
1410
e = document.createElement("property")
1382
1411
e.setAttribute("name", name)
1383
1412
e.setAttribute("type", prop._dbus_signature)
1384
1413
e.setAttribute("access", prop._dbus_access)
1385
1414
return e
1386
1415
1387
1416
for if_tag in document.getElementsByTagName("interface"):
1388
1417
# Add property tags
1389
1418
for tag in (make_tag(document, name, prop)
1431
1460
exc_info=error)
1432
1461
return xmlstring
1433
1462
1463
1434
1464
try:
1435
1465
dbus.OBJECT_MANAGER_IFACE
1436
1466
except AttributeError:
1437
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1438
1468
1469
1439
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1440
1471
"""A D-Bus object with an ObjectManager.
1441
1472
1442
1473
Classes inheriting from this exposes the standard
1443
1474
GetManagedObjects call and the InterfacesAdded and
1444
1475
InterfacesRemoved signals on the standard
1445
1476
"org.freedesktop.DBus.ObjectManager" interface.
1446
1477
1447
1478
Note: No signals are sent automatically; they must be sent
1448
1479
manually.
1449
1480
"""
1450
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1451
out_signature = "a{oa{sa{sv}}}")
1482
out_signature="a{oa{sa{sv}}}")
1452
1483
def GetManagedObjects(self):
1453
1484
"""This function must be overridden"""
1454
1485
raise NotImplementedError()
1455
1486
1456
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1457
signature = "oa{sa{sv}}")
1488
signature="oa{sa{sv}}")
1458
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1459
1490
pass
1460
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1491
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1462
1493
def InterfacesRemoved(self, object_path, interfaces):
1463
1494
pass
1464
1495
1465
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1497
out_signature="s",
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1469
1500
def Introspect(self, object_path, connection):
1470
1501
"""Overloading of standard D-Bus method.
1471
1502
1472
1503
Override return argument name of GetManagedObjects to be
1473
1504
"objpath_interfaces_and_properties"
1474
1505
"""
1477
1508
connection)
1478
1509
try:
1479
1510
document = xml.dom.minidom.parseString(xmlstring)
1480
1511
1481
1512
for if_tag in document.getElementsByTagName("interface"):
1482
1513
# Fix argument name for the GetManagedObjects method
1483
1514
if (if_tag.getAttribute("name")
1484
== dbus.OBJECT_MANAGER_IFACE):
1515
== dbus.OBJECT_MANAGER_IFACE):
1485
1516
for cn in if_tag.getElementsByTagName("method"):
1486
1517
if (cn.getAttribute("name")
1487
1518
== "GetManagedObjects"):
1497
1528
except (AttributeError, xml.dom.DOMException,
1498
1529
xml.parsers.expat.ExpatError) as error:
1499
1530
logger.error("Failed to override Introspection method",
1500
exc_info = error)
1531
exc_info=error)
1501
1532
return xmlstring
1502
1533
1534
1503
1535
def datetime_to_dbus(dt, variant_level=0):
1504
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1505
1537
if dt is None:
1506
return dbus.String("", variant_level = variant_level)
1538
return dbus.String("", variant_level=variant_level)
1507
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1508
1540
1509
1541
1512
1544
dbus.service.Object, it will add alternate D-Bus attributes with
1513
1545
interface names according to the "alt_interface_names" mapping.
1514
1546
Usage:
1515
1547
1516
1548
@alternate_dbus_interfaces({"org.example.Interface":
1517
1549
"net.example.AlternateInterface"})
1518
1550
class SampleDBusObject(dbus.service.Object):
1519
1551
@dbus.service.method("org.example.Interface")
1520
1552
def SampleDBusMethod():
1521
1553
pass
1522
1554
1523
1555
The above "SampleDBusMethod" on "SampleDBusObject" will be
1524
1556
reachable via two interfaces: "org.example.Interface" and
1525
1557
"net.example.AlternateInterface", the latter of which will have
1526
1558
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1527
1559
"true", unless "deprecate" is passed with a False value.
1528
1560
1529
1561
This works for methods and signals, and also for D-Bus properties
1530
1562
(from DBusObjectWithProperties) and interfaces (from the
1531
1563
dbus_interface_annotations decorator).
1532
1564
"""
1533
1565
1534
1566
def wrapper(cls):
1535
1567
for orig_interface_name, alt_interface_name in (
1536
1568
alt_interface_names.items()):
1576
1608
attribute._dbus_annotations)
1577
1609
except AttributeError:
1578
1610
pass
1611
1579
1612
# Define a creator of a function to call both the
1580
1613
# original and alternate functions, so both the
1581
1614
# original and alternate signals gets sent when
1584
1617
"""This function is a scope container to pass
1585
1618
func1 and func2 to the "call_both" function
1586
1619
outside of its arguments"""
1587
1620
1588
1621
@functools.wraps(func2)
1589
1622
def call_both(*args, **kwargs):
1590
1623
"""This function will emit two D-Bus
1591
1624
signals by calling func1 and func2"""
1592
1625
func1(*args, **kwargs)
1593
1626
func2(*args, **kwargs)
1594
# Make wrapper function look like a D-Bus signal
1627
# Make wrapper function look like a D-Bus
1628
# signal
1595
1629
for name, attr in inspect.getmembers(func2):
1596
1630
if name.startswith("_dbus_"):
1597
1631
setattr(call_both, name, attr)
1598
1632
1599
1633
return call_both
1600
1634
# Create the "call_both" function and add it to
1601
1635
# the class
1647
1681
(copy_function(attribute)))
1648
1682
if deprecate:
1649
1683
# Deprecate all alternate interfaces
1650
iname="_AlternateDBusNames_interface_annotation{}"
1684
iname = "_AlternateDBusNames_interface_annotation{}"
1651
1685
for interface_name in interface_names:
1652
1686
1653
1687
@dbus_interface_annotations(interface_name)
1654
1688
def func(self):
1655
return { "org.freedesktop.DBus.Deprecated":
1656
"true" }
1689
return {"org.freedesktop.DBus.Deprecated":
1690
"true"}
1657
1691
# Find an unused name
1658
1692
for aname in (iname.format(i)
1659
1693
for i in itertools.count()):
1670
1704
cls = type("{}Alternate".format(cls.__name__),
1671
1705
(cls, ), attr)
1672
1706
return cls
1673
1707
1674
1708
return wrapper
1675
1709
1676
1710
1678
1712
"se.bsnet.fukt.Mandos"})
1679
1713
class ClientDBus(Client, DBusObjectWithProperties):
1680
1714
"""A Client class using D-Bus
1681
1715
1682
1716
Attributes:
1683
1717
dbus_object_path: dbus.ObjectPath
1684
1718
bus: dbus.SystemBus()
1685
1719
"""
1686
1720
1687
1721
runtime_expansions = (Client.runtime_expansions
1688
1722
+ ("dbus_object_path", ))
1689
1723
1690
1724
_interface = "se.recompile.Mandos.Client"
1691
1725
1692
1726
# dbus.service.Object doesn't use super(), so we can't either.
1693
1694
def __init__(self, bus = None, *args, **kwargs):
1727
1728
def __init__(self, bus=None, *args, **kwargs):
1695
1729
self.bus = bus
1696
1730
Client.__init__(self, *args, **kwargs)
1697
1731
# Only now, when this client is initialized, can it show up on
1703
1737
"/clients/" + client_object_name)
1704
1738
DBusObjectWithProperties.__init__(self, self.bus,
1705
1739
self.dbus_object_path)
1706
1740
1707
1741
def notifychangeproperty(transform_func, dbus_name,
1708
1742
type_func=lambda x: x,
1709
1743
variant_level=1,
1711
1745
_interface=_interface):
1712
1746
""" Modify a variable so that it's a property which announces
1713
1747
its changes to DBus.
1714
1748
1715
1749
transform_fun: Function that takes a value and a variant_level
1716
1750
and transforms it to a D-Bus type.
1717
1751
dbus_name: D-Bus name of the variable
1720
1754
variant_level: D-Bus variant level. Default: 1
1721
1755
"""
1722
1756
attrname = "_{}".format(dbus_name)
1723
1757
1724
1758
def setter(self, value):
1725
1759
if hasattr(self, "dbus_object_path"):
1726
1760
if (not hasattr(self, attrname) or
1733
1767
else:
1734
1768
dbus_value = transform_func(
1735
1769
type_func(value),
1736
variant_level = variant_level)
1770
variant_level=variant_level)
1737
1771
self.PropertyChanged(dbus.String(dbus_name),
1738
1772
dbus_value)
1739
1773
self.PropertiesChanged(
1740
1774
_interface,
1741
dbus.Dictionary({ dbus.String(dbus_name):
1742
dbus_value }),
1775
dbus.Dictionary({dbus.String(dbus_name):
1776
dbus_value}),
1743
1777
dbus.Array())
1744
1778
setattr(self, attrname, value)
1745
1779
1746
1780
return property(lambda self: getattr(self, attrname), setter)
1747
1781
1748
1782
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1749
1783
approvals_pending = notifychangeproperty(dbus.Boolean,
1750
1784
"ApprovalPending",
1751
type_func = bool)
1785
type_func=bool)
1752
1786
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1753
1787
last_enabled = notifychangeproperty(datetime_to_dbus,
1754
1788
"LastEnabled")
1755
1789
checker = notifychangeproperty(
1756
1790
dbus.Boolean, "CheckerRunning",
1757
type_func = lambda checker: checker is not None)
1791
type_func=lambda checker: checker is not None)
1758
1792
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1759
1793
"LastCheckedOK")
1760
1794
last_checker_status = notifychangeproperty(dbus.Int16,
1765
1799
"ApprovedByDefault")
1766
1800
approval_delay = notifychangeproperty(
1767
1801
dbus.UInt64, "ApprovalDelay",
1768
type_func = lambda td: td.total_seconds() * 1000)
1802
type_func=lambda td: td.total_seconds() * 1000)
1769
1803
approval_duration = notifychangeproperty(
1770
1804
dbus.UInt64, "ApprovalDuration",
1771
type_func = lambda td: td.total_seconds() * 1000)
1805
type_func=lambda td: td.total_seconds() * 1000)
1772
1806
host = notifychangeproperty(dbus.String, "Host")
1773
1807
timeout = notifychangeproperty(
1774
1808
dbus.UInt64, "Timeout",
1775
type_func = lambda td: td.total_seconds() * 1000)
1809
type_func=lambda td: td.total_seconds() * 1000)
1776
1810
extended_timeout = notifychangeproperty(
1777
1811
dbus.UInt64, "ExtendedTimeout",
1778
type_func = lambda td: td.total_seconds() * 1000)
1812
type_func=lambda td: td.total_seconds() * 1000)
1779
1813
interval = notifychangeproperty(
1780
1814
dbus.UInt64, "Interval",
1781
type_func = lambda td: td.total_seconds() * 1000)
1815
type_func=lambda td: td.total_seconds() * 1000)
1782
1816
checker_command = notifychangeproperty(dbus.String, "Checker")
1783
1817
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1784
1818
invalidate_only=True)
1785
1819
1786
1820
del notifychangeproperty
1787
1821
1788
1822
def __del__(self, *args, **kwargs):
1789
1823
try:
1790
1824
self.remove_from_connection()
1793
1827
if hasattr(DBusObjectWithProperties, "__del__"):
1794
1828
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1795
1829
Client.__del__(self, *args, **kwargs)
1796
1830
1797
1831
def checker_callback(self, source, condition,
1798
1832
connection, command, *args, **kwargs):
1799
1833
ret = Client.checker_callback(self, source, condition,
1815
1849
| self.last_checker_signal),
1816
1850
dbus.String(command))
1817
1851
return ret
1818
1852
1819
1853
def start_checker(self, *args, **kwargs):
1820
1854
old_checker_pid = getattr(self.checker, "pid", None)
1821
1855
r = Client.start_checker(self, *args, **kwargs)
1825
1859
# Emit D-Bus signal
1826
1860
self.CheckerStarted(self.current_checker_command)
1827
1861
return r
1828
1862
1829
1863
def _reset_approved(self):
1830
1864
self.approved = None
1831
1865
return False
1832
1866
1833
1867
def approve(self, value=True):
1834
1868
self.approved = value
1835
GObject.timeout_add(int(self.approval_duration.total_seconds()
1836
* 1000), self._reset_approved)
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
1837
1871
self.send_changedstate()
1838
1839
## D-Bus methods, signals & properties
1840
1841
## Interfaces
1842
1843
## Signals
1844
1872
1873
# D-Bus methods, signals & properties
1874
1875
# Interfaces
1876
1877
# Signals
1878
1845
1879
# CheckerCompleted - signal
1846
1880
@dbus.service.signal(_interface, signature="nxs")
1847
1881
def CheckerCompleted(self, exitcode, waitstatus, command):
1848
1882
"D-Bus signal"
1849
1883
pass
1850
1884
1851
1885
# CheckerStarted - signal
1852
1886
@dbus.service.signal(_interface, signature="s")
1853
1887
def CheckerStarted(self, command):
1854
1888
"D-Bus signal"
1855
1889
pass
1856
1890
1857
1891
# PropertyChanged - signal
1858
1892
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1859
1893
@dbus.service.signal(_interface, signature="sv")
1860
1894
def PropertyChanged(self, property, value):
1861
1895
"D-Bus signal"
1862
1896
pass
1863
1897
1864
1898
# GotSecret - signal
1865
1899
@dbus.service.signal(_interface)
1866
1900
def GotSecret(self):
1869
1903
server to mandos-client
1870
1904
"""
1871
1905
pass
1872
1906
1873
1907
# Rejected - signal
1874
1908
@dbus.service.signal(_interface, signature="s")
1875
1909
def Rejected(self, reason):
1876
1910
"D-Bus signal"
1877
1911
pass
1878
1912
1879
1913
# NeedApproval - signal
1880
1914
@dbus.service.signal(_interface, signature="tb")
1881
1915
def NeedApproval(self, timeout, default):
1882
1916
"D-Bus signal"
1883
1917
return self.need_approval()
1884
1885
## Methods
1886
1918
1919
# Methods
1920
1887
1921
# Approve - method
1888
1922
@dbus.service.method(_interface, in_signature="b")
1889
1923
def Approve(self, value):
1890
1924
self.approve(value)
1891
1925
1892
1926
# CheckedOK - method
1893
1927
@dbus.service.method(_interface)
1894
1928
def CheckedOK(self):
1895
1929
self.checked_ok()
1896
1930
1897
1931
# Enable - method
1898
1932
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1899
1933
@dbus.service.method(_interface)
1900
1934
def Enable(self):
1901
1935
"D-Bus method"
1902
1936
self.enable()
1903
1937
1904
1938
# StartChecker - method
1905
1939
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1906
1940
@dbus.service.method(_interface)
1907
1941
def StartChecker(self):
1908
1942
"D-Bus method"
1909
1943
self.start_checker()
1910
1944
1911
1945
# Disable - method
1912
1946
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1913
1947
@dbus.service.method(_interface)
1914
1948
def Disable(self):
1915
1949
"D-Bus method"
1916
1950
self.disable()
1917
1951
1918
1952
# StopChecker - method
1919
1953
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1920
1954
@dbus.service.method(_interface)
1921
1955
def StopChecker(self):
1922
1956
self.stop_checker()
1923
1924
## Properties
1925
1957
1958
# Properties
1959
1926
1960
# ApprovalPending - property
1927
1961
@dbus_service_property(_interface, signature="b", access="read")
1928
1962
def ApprovalPending_dbus_property(self):
1929
1963
return dbus.Boolean(bool(self.approvals_pending))
1930
1964
1931
1965
# ApprovedByDefault - property
1932
1966
@dbus_service_property(_interface,
1933
1967
signature="b",
1936
1970
if value is None: # get
1937
1971
return dbus.Boolean(self.approved_by_default)
1938
1972
self.approved_by_default = bool(value)
1939
1973
1940
1974
# ApprovalDelay - property
1941
1975
@dbus_service_property(_interface,
1942
1976
signature="t",
1946
1980
return dbus.UInt64(self.approval_delay.total_seconds()
1947
1981
* 1000)
1948
1982
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1949
1983
1950
1984
# ApprovalDuration - property
1951
1985
@dbus_service_property(_interface,
1952
1986
signature="t",
1956
1990
return dbus.UInt64(self.approval_duration.total_seconds()
1957
1991
* 1000)
1958
1992
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1959
1993
1960
1994
# Name - property
1961
1995
@dbus_annotations(
1962
1996
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1963
1997
@dbus_service_property(_interface, signature="s", access="read")
1964
1998
def Name_dbus_property(self):
1965
1999
return dbus.String(self.name)
1966
2000
1967
2001
# Fingerprint - property
1968
2002
@dbus_annotations(
1969
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1970
2004
@dbus_service_property(_interface, signature="s", access="read")
1971
2005
def Fingerprint_dbus_property(self):
1972
2006
return dbus.String(self.fingerprint)
1973
2007
1974
2008
# Host - property
1975
2009
@dbus_service_property(_interface,
1976
2010
signature="s",
1979
2013
if value is None: # get
1980
2014
return dbus.String(self.host)
1981
2015
self.host = str(value)
1982
2016
1983
2017
# Created - property
1984
2018
@dbus_annotations(
1985
2019
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
2020
@dbus_service_property(_interface, signature="s", access="read")
1987
2021
def Created_dbus_property(self):
1988
2022
return datetime_to_dbus(self.created)
1989
2023
1990
2024
# LastEnabled - property
1991
2025
@dbus_service_property(_interface, signature="s", access="read")
1992
2026
def LastEnabled_dbus_property(self):
1993
2027
return datetime_to_dbus(self.last_enabled)
1994
2028
1995
2029
# Enabled - property
1996
2030
@dbus_service_property(_interface,
1997
2031
signature="b",
2003
2037
self.enable()
2004
2038
else:
2005
2039
self.disable()
2006
2040
2007
2041
# LastCheckedOK - property
2008
2042
@dbus_service_property(_interface,
2009
2043
signature="s",
2013
2047
self.checked_ok()
2014
2048
return
2015
2049
return datetime_to_dbus(self.last_checked_ok)
2016
2050
2017
2051
# LastCheckerStatus - property
2018
2052
@dbus_service_property(_interface, signature="n", access="read")
2019
2053
def LastCheckerStatus_dbus_property(self):
2020
2054
return dbus.Int16(self.last_checker_status)
2021
2055
2022
2056
# Expires - property
2023
2057
@dbus_service_property(_interface, signature="s", access="read")
2024
2058
def Expires_dbus_property(self):
2025
2059
return datetime_to_dbus(self.expires)
2026
2060
2027
2061
# LastApprovalRequest - property
2028
2062
@dbus_service_property(_interface, signature="s", access="read")
2029
2063
def LastApprovalRequest_dbus_property(self):
2030
2064
return datetime_to_dbus(self.last_approval_request)
2031
2065
2032
2066
# Timeout - property
2033
2067
@dbus_service_property(_interface,
2034
2068
signature="t",
2049
2083
if (getattr(self, "disable_initiator_tag", None)
2050
2084
is None):
2051
2085
return
2052
GObject.source_remove(self.disable_initiator_tag)
2053
self.disable_initiator_tag = GObject.timeout_add(
2086
GLib.source_remove(self.disable_initiator_tag)
2087
self.disable_initiator_tag = GLib.timeout_add(
2054
2088
int((self.expires - now).total_seconds() * 1000),
2055
2089
self.disable)
2056
2090
2057
2091
# ExtendedTimeout - property
2058
2092
@dbus_service_property(_interface,
2059
2093
signature="t",
2063
2097
return dbus.UInt64(self.extended_timeout.total_seconds()
2064
2098
* 1000)
2065
2099
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2066
2100
2067
2101
# Interval - property
2068
2102
@dbus_service_property(_interface,
2069
2103
signature="t",
2076
2110
return
2077
2111
if self.enabled:
2078
2112
# Reschedule checker run
2079
GObject.source_remove(self.checker_initiator_tag)
2080
self.checker_initiator_tag = GObject.timeout_add(
2113
GLib.source_remove(self.checker_initiator_tag)
2114
self.checker_initiator_tag = GLib.timeout_add(
2081
2115
value, self.start_checker)
2082
self.start_checker() # Start one now, too
2083
2116
self.start_checker() # Start one now, too
2117
2084
2118
# Checker - property
2085
2119
@dbus_service_property(_interface,
2086
2120
signature="s",
2089
2123
if value is None: # get
2090
2124
return dbus.String(self.checker_command)
2091
2125
self.checker_command = str(value)
2092
2126
2093
2127
# CheckerRunning - property
2094
2128
@dbus_service_property(_interface,
2095
2129
signature="b",
2101
2135
self.start_checker()
2102
2136
else:
2103
2137
self.stop_checker()
2104
2138
2105
2139
# ObjectPath - property
2106
2140
@dbus_annotations(
2107
2141
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2108
2142
"org.freedesktop.DBus.Deprecated": "true"})
2109
2143
@dbus_service_property(_interface, signature="o", access="read")
2110
2144
def ObjectPath_dbus_property(self):
2111
return self.dbus_object_path # is already a dbus.ObjectPath
2112
2145
return self.dbus_object_path # is already a dbus.ObjectPath
2146
2113
2147
# Secret = property
2114
2148
@dbus_annotations(
2115
2149
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2120
2154
byte_arrays=True)
2121
2155
def Secret_dbus_property(self, value):
2122
2156
self.secret = bytes(value)
2123
2157
2124
2158
del _interface
2125
2159
2126
2160
2130
2164
self._pipe.send(('init', fpr, address))
2131
2165
if not self._pipe.recv():
2132
2166
raise KeyError(fpr)
2133
2167
2134
2168
def __getattribute__(self, name):
2135
2169
if name == '_pipe':
2136
2170
return super(ProxyClient, self).__getattribute__(name)
2139
2173
if data[0] == 'data':
2140
2174
return data[1]
2141
2175
if data[0] == 'function':
2142
2176
2143
2177
def func(*args, **kwargs):
2144
2178
self._pipe.send(('funcall', name, args, kwargs))
2145
2179
return self._pipe.recv()[1]
2146
2180
2147
2181
return func
2148
2182
2149
2183
def __setattr__(self, name, value):
2150
2184
if name == '_pipe':
2151
2185
return super(ProxyClient, self).__setattr__(name, value)
2154
2188
2155
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
2156
2190
"""A class to handle client connections.
2157
2191
2158
2192
Instantiated once for each connection to handle it.
2159
2193
Note: This will run in its own forked process."""
2160
2194
2161
2195
def handle(self):
2162
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
2163
2197
logger.info("TCP connection from: %s",
2164
2198
str(self.client_address))
2165
2199
logger.debug("Pipe FD: %d",
2166
2200
self.server.child_pipe.fileno())
2167
2201
2168
2202
session = gnutls.ClientSession(self.request)
2169
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2173
# "+DHE-DSS"))
2203
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2207
# "+DHE-DSS"))
2174
2208
# Use a fallback default, since this MUST be set.
2175
2209
priority = self.server.gnutls_priority
2176
2210
if priority is None:
2177
2211
priority = "NORMAL"
2178
gnutls.priority_set_direct(session._c_object, priority,
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
2179
2214
None)
2180
2215
2181
2216
# Start communication using the Mandos protocol
2182
2217
# Get protocol number
2183
2218
line = self.request.makefile().readline()
2188
2223
except (ValueError, IndexError, RuntimeError) as error:
2189
2224
logger.error("Unknown protocol version: %s", error)
2190
2225
return
2191
2226
2192
2227
# Start GnuTLS connection
2193
2228
try:
2194
2229
session.handshake()
2198
2233
# established. Just abandon the request.
2199
2234
return
2200
2235
logger.debug("Handshake succeeded")
2201
2236
2202
2237
approval_required = False
2203
2238
try:
2204
2239
try:
2208
2243
logger.warning("Bad certificate: %s", error)
2209
2244
return
2210
2245
logger.debug("Fingerprint: %s", fpr)
2211
2246
2212
2247
try:
2213
2248
client = ProxyClient(child_pipe, fpr,
2214
2249
self.client_address)
2215
2250
except KeyError:
2216
2251
return
2217
2252
2218
2253
if client.approval_delay:
2219
2254
delay = client.approval_delay
2220
2255
client.approvals_pending += 1
2221
2256
approval_required = True
2222
2257
2223
2258
while True:
2224
2259
if not client.enabled:
2225
2260
logger.info("Client %s is disabled",
2228
2263
# Emit D-Bus signal
2229
2264
client.Rejected("Disabled")
2230
2265
return
2231
2266
2232
2267
if client.approved or not client.approval_delay:
2233
#We are approved or approval is disabled
2268
# We are approved or approval is disabled
2234
2269
break
2235
2270
elif client.approved is None:
2236
2271
logger.info("Client %s needs approval",
2247
2282
# Emit D-Bus signal
2248
2283
client.Rejected("Denied")
2249
2284
return
2250
2251
#wait until timeout or approved
2285
2286
# wait until timeout or approved
2252
2287
time = datetime.datetime.now()
2253
2288
client.changedstate.acquire()
2254
2289
client.changedstate.wait(delay.total_seconds())
2267
2302
break
2268
2303
else:
2269
2304
delay -= time2 - time
2270
2305
2271
2306
try:
2272
2307
session.send(client.secret)
2273
2308
except gnutls.Error as error:
2274
2309
logger.warning("gnutls send failed",
2275
exc_info = error)
2310
exc_info=error)
2276
2311
return
2277
2312
2278
2313
logger.info("Sending secret to %s", client.name)
2279
2314
# bump the timeout using extended_timeout
2280
2315
client.bump_timeout(client.extended_timeout)
2281
2316
if self.server.use_dbus:
2282
2317
# Emit D-Bus signal
2283
2318
client.GotSecret()
2284
2319
2285
2320
finally:
2286
2321
if approval_required:
2287
2322
client.approvals_pending -= 1
2290
2325
except gnutls.Error as error:
2291
2326
logger.warning("GnuTLS bye failed",
2292
2327
exc_info=error)
2293
2328
2294
2329
@staticmethod
2295
2330
def peer_certificate(session):
2296
2331
"Return the peer's OpenPGP certificate as a bytestring"
2308
2343
return None
2309
2344
cert = cert_list[0]
2310
2345
return ctypes.string_at(cert.data, cert.size)
2311
2346
2312
2347
@staticmethod
2313
2348
def fingerprint(openpgp):
2314
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2347
2382
2348
2383
class MultiprocessingMixIn(object):
2349
2384
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2350
2385
2351
2386
def sub_process_main(self, request, address):
2352
2387
try:
2353
2388
self.finish_request(request, address)
2354
2389
except Exception:
2355
2390
self.handle_error(request, address)
2356
2391
self.close_request(request)
2357
2392
2358
2393
def process_request(self, request, address):
2359
2394
"""Start a new process to process the request."""
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
2362
2397
proc.start()
2363
2398
return proc
2364
2399
2365
2400
2366
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2367
2402
""" adds a pipe to the MixIn """
2368
2403
2369
2404
def process_request(self, request, client_address):
2370
2405
"""Overrides and wraps the original process_request().
2371
2406
2372
2407
This function creates a new pipe in self.pipe
2373
2408
"""
2374
2409
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2375
2410
2376
2411
proc = MultiprocessingMixIn.process_request(self, request,
2377
2412
client_address)
2378
2413
self.child_pipe.close()
2379
2414
self.add_pipe(parent_pipe, proc)
2380
2415
2381
2416
def add_pipe(self, parent_pipe, proc):
2382
2417
"""Dummy function; override as necessary"""
2383
2418
raise NotImplementedError()
2386
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2387
2422
socketserver.TCPServer, object):
2388
2423
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2389
2424
2390
2425
Attributes:
2391
2426
enabled: Boolean; whether this server is activated yet
2392
2427
interface: None or a network interface name (string)
2393
2428
use_ipv6: Boolean; to use IPv6 or not
2394
2429
"""
2395
2430
2396
2431
def __init__(self, server_address, RequestHandlerClass,
2397
2432
interface=None,
2398
2433
use_ipv6=True,
2408
2443
self.socketfd = socketfd
2409
2444
# Save the original socket.socket() function
2410
2445
self.socket_socket = socket.socket
2446
2411
2447
# To implement --socket, we monkey patch socket.socket.
2412
#
2448
#
2413
2449
# (When socketserver.TCPServer is a new-style class, we
2414
2450
# could make self.socket into a property instead of monkey
2415
2451
# patching socket.socket.)
2416
#
2452
#
2417
2453
# Create a one-time-only replacement for socket.socket()
2418
2454
@functools.wraps(socket.socket)
2419
2455
def socket_wrapper(*args, **kwargs):
2431
2467
# socket_wrapper(), if socketfd was set.
2432
2468
socketserver.TCPServer.__init__(self, server_address,
2433
2469
RequestHandlerClass)
2434
2470
2435
2471
def server_bind(self):
2436
2472
"""This overrides the normal server_bind() function
2437
2473
to bind to an interface if one was specified, and also NOT to
2438
2474
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2439
2476
if self.interface is not None:
2440
2477
if SO_BINDTODEVICE is None:
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2443
self.interface)
2444
else:
2445
try:
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2456
self.interface)
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2460
else:
2461
raise
2478
# Fall back to a hard-coded value which seems to be
2479
# common enough.
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2482
try:
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2493
self.interface)
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2497
else:
2498
raise
2462
2499
# Only bind(2) the socket if we really need to.
2463
2500
if self.server_address[0] or self.server_address[1]:
2464
2501
if not self.server_address[0]:
2465
2502
if self.address_family == socket.AF_INET6:
2466
any_address = "::" # in6addr_any
2503
any_address = "::" # in6addr_any
2467
2504
else:
2468
any_address = "0.0.0.0" # INADDR_ANY
2505
any_address = "0.0.0.0" # INADDR_ANY
2469
2506
self.server_address = (any_address,
2470
2507
self.server_address[1])
2471
2508
elif not self.server_address[1]:
2481
2518
2482
2519
class MandosServer(IPv6_TCPServer):
2483
2520
"""Mandos server.
2484
2521
2485
2522
Attributes:
2486
2523
clients: set of Client objects
2487
2524
gnutls_priority GnuTLS priority string
2488
2525
use_dbus: Boolean; to emit D-Bus signals or not
2489
2490
Assumes a GObject.MainLoop event loop.
2526
2527
Assumes a GLib.MainLoop event loop.
2491
2528
"""
2492
2529
2493
2530
def __init__(self, server_address, RequestHandlerClass,
2494
2531
interface=None,
2495
2532
use_ipv6=True,
2505
2542
self.gnutls_priority = gnutls_priority
2506
2543
IPv6_TCPServer.__init__(self, server_address,
2507
2544
RequestHandlerClass,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2511
2545
interface=interface,
2546
use_ipv6=use_ipv6,
2547
socketfd=socketfd)
2548
2512
2549
def server_activate(self):
2513
2550
if self.enabled:
2514
2551
return socketserver.TCPServer.server_activate(self)
2515
2552
2516
2553
def enable(self):
2517
2554
self.enabled = True
2518
2555
2519
2556
def add_pipe(self, parent_pipe, proc):
2520
2557
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2558
GLib.io_add_watch(
2522
2559
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2560
GLib.IO_IN | GLib.IO_HUP,
2524
2561
functools.partial(self.handle_ipc,
2525
parent_pipe = parent_pipe,
2526
proc = proc))
2527
2562
parent_pipe=parent_pipe,
2563
proc=proc))
2564
2528
2565
def handle_ipc(self, source, condition,
2529
2566
parent_pipe=None,
2530
proc = None,
2567
proc=None,
2531
2568
client_object=None):
2532
2569
# error, or the other end of multiprocessing.Pipe has closed
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2570
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2534
2571
# Wait for other process to exit
2535
2572
proc.join()
2536
2573
return False
2537
2574
2538
2575
# Read a request from the child
2539
2576
request = parent_pipe.recv()
2540
2577
command = request[0]
2541
2578
2542
2579
if command == 'init':
2543
2580
fpr = request[1]
2544
2581
address = request[2]
2545
2582
2546
2583
for c in self.clients.values():
2547
2584
if c.fingerprint == fpr:
2548
2585
client = c
2556
2593
address[0])
2557
2594
parent_pipe.send(False)
2558
2595
return False
2559
2560
GObject.io_add_watch(
2596
2597
GLib.io_add_watch(
2561
2598
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2599
GLib.IO_IN | GLib.IO_HUP,
2563
2600
functools.partial(self.handle_ipc,
2564
parent_pipe = parent_pipe,
2565
proc = proc,
2566
client_object = client))
2601
parent_pipe=parent_pipe,
2602
proc=proc,
2603
client_object=client))
2567
2604
parent_pipe.send(True)
2568
2605
# remove the old hook in favor of the new above hook on
2569
2606
# same fileno
2572
2609
funcname = request[1]
2573
2610
args = request[2]
2574
2611
kwargs = request[3]
2575
2612
2576
2613
parent_pipe.send(('data', getattr(client_object,
2577
2614
funcname)(*args,
2578
2615
**kwargs)))
2579
2616
2580
2617
if command == 'getattr':
2581
2618
attrname = request[1]
2582
2619
if isinstance(client_object.__getattribute__(attrname),
2585
2622
else:
2586
2623
parent_pipe.send((
2587
2624
'data', client_object.__getattribute__(attrname)))
2588
2625
2589
2626
if command == 'setattr':
2590
2627
attrname = request[1]
2591
2628
value = request[2]
2592
2629
setattr(client_object, attrname, value)
2593
2630
2594
2631
return True
2595
2632
2596
2633
2597
2634
def rfc3339_duration_to_delta(duration):
2598
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2599
2636
2600
2637
>>> rfc3339_duration_to_delta("P7D")
2601
2638
datetime.timedelta(7)
2602
2639
>>> rfc3339_duration_to_delta("PT60S")
2612
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
2650
datetime.timedelta(1, 200)
2614
2651
"""
2615
2652
2616
2653
# Parsing an RFC 3339 duration with regular expressions is not
2617
2654
# possible - there would have to be multiple places for the same
2618
2655
# values, like seconds. The current code, while more esoteric, is
2619
2656
# cleaner without depending on a parsing library. If Python had a
2620
2657
# built-in library for parsing we would use it, but we'd like to
2621
2658
# avoid excessive use of external libraries.
2622
2659
2623
2660
# New type for defining tokens, syntax, and semantics all-in-one
2624
2661
Token = collections.namedtuple("Token", (
2625
2662
"regexp", # To match token; if "value" is not None, must have
2658
2695
frozenset((token_year, token_month,
2659
2696
token_day, token_time,
2660
2697
token_week)))
2661
# Define starting values
2662
value = datetime.timedelta() # Value so far
2698
# Define starting values:
2699
# Value so far
2700
value = datetime.timedelta()
2663
2701
found_token = None
2664
followers = frozenset((token_duration, )) # Following valid tokens
2665
s = duration # String left to parse
2702
# Following valid tokens
2703
followers = frozenset((token_duration, ))
2704
# String left to parse
2705
s = duration
2666
2706
# Loop until end token is found
2667
2707
while found_token is not token_end:
2668
2708
# Search for any currently valid tokens
2692
2732
2693
2733
def string_to_delta(interval):
2694
2734
"""Parse a string and return a datetime.timedelta
2695
2735
2696
2736
>>> string_to_delta('7d')
2697
2737
datetime.timedelta(7)
2698
2738
>>> string_to_delta('60s')
2706
2746
>>> string_to_delta('5m 30s')
2707
2747
datetime.timedelta(0, 330)
2708
2748
"""
2709
2749
2710
2750
try:
2711
2751
return rfc3339_duration_to_delta(interval)
2712
2752
except ValueError:
2713
2753
pass
2714
2754
2715
2755
timevalue = datetime.timedelta(0)
2716
2756
for s in interval.split():
2717
2757
try:
2735
2775
return timevalue
2736
2776
2737
2777
2738
def daemon(nochdir = False, noclose = False):
2778
def daemon(nochdir=False, noclose=False):
2739
2779
"""See daemon(3). Standard BSD Unix function.
2740
2780
2741
2781
This should really exist as os.daemon, but it doesn't (yet)."""
2742
2782
if os.fork():
2743
2783
sys.exit()
2761
2801
2762
2802
2763
2803
def main():
2764
2804
2765
2805
##################################################################
2766
2806
# Parsing of options, both command line and config file
2767
2807
2768
2808
parser = argparse.ArgumentParser()
2769
2809
parser.add_argument("-v", "--version", action="version",
2770
version = "%(prog)s {}".format(version),
2810
version="%(prog)s {}".format(version),
2771
2811
help="show version number and exit")
2772
2812
parser.add_argument("-i", "--interface", metavar="IF",
2773
2813
help="Bind to interface IF")
2809
2849
parser.add_argument("--no-zeroconf", action="store_false",
2810
2850
dest="zeroconf", help="Do not use Zeroconf",
2811
2851
default=None)
2812
2852
2813
2853
options = parser.parse_args()
2814
2854
2815
2855
if options.check:
2816
2856
import doctest
2817
2857
fail_count, test_count = doctest.testmod()
2818
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2819
2859
2820
2860
# Default values for config file for server-global settings
2821
server_defaults = { "interface": "",
2822
"address": "",
2823
"port": "",
2824
"debug": "False",
2825
"priority":
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2829
"use_dbus": "True",
2830
"use_ipv6": "True",
2831
"debuglevel": "",
2832
"restore": "True",
2833
"socket": "",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2836
"zeroconf": "True",
2837
}
2838
2861
server_defaults = {"interface": "",
2862
"address": "",
2863
"port": "",
2864
"debug": "False",
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2869
"use_dbus": "True",
2870
"use_ipv6": "True",
2871
"debuglevel": "",
2872
"restore": "True",
2873
"socket": "",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
2876
"zeroconf": "True",
2877
}
2878
2839
2879
# Parse config file for server-global settings
2840
2880
server_config = configparser.SafeConfigParser(server_defaults)
2841
2881
del server_defaults
2859
2899
server_settings["socket"] = os.dup(server_settings
2860
2900
["socket"])
2861
2901
del server_config
2862
2902
2863
2903
# Override the settings from the config file with command line
2864
2904
# options, if set.
2865
2905
for option in ("interface", "address", "port", "debug",
2883
2923
if server_settings["debug"]:
2884
2924
server_settings["foreground"] = True
2885
2925
# Now we have our good server settings in "server_settings"
2886
2926
2887
2927
##################################################################
2888
2928
2889
2929
if (not server_settings["zeroconf"]
2890
2930
and not (server_settings["port"]
2891
2931
or server_settings["socket"] != "")):
2892
2932
parser.error("Needs port or socket to work without Zeroconf")
2893
2933
2894
2934
# For convenience
2895
2935
debug = server_settings["debug"]
2896
2936
debuglevel = server_settings["debuglevel"]
2900
2940
stored_state_file)
2901
2941
foreground = server_settings["foreground"]
2902
2942
zeroconf = server_settings["zeroconf"]
2903
2943
2904
2944
if debug:
2905
2945
initlogger(debug, logging.DEBUG)
2906
2946
else:
2909
2949
else:
2910
2950
level = getattr(logging, debuglevel.upper())
2911
2951
initlogger(debug, level)
2912
2952
2913
2953
if server_settings["servicename"] != "Mandos":
2914
2954
syslogger.setFormatter(
2915
2955
logging.Formatter('Mandos ({}) [%(process)d]:'
2916
2956
' %(levelname)s: %(message)s'.format(
2917
2957
server_settings["servicename"])))
2918
2958
2919
2959
# Parse config file with clients
2920
2960
client_config = configparser.SafeConfigParser(Client
2921
2961
.client_defaults)
2922
2962
client_config.read(os.path.join(server_settings["configdir"],
2923
2963
"clients.conf"))
2924
2964
2925
2965
global mandos_dbus_service
2926
2966
mandos_dbus_service = None
2927
2967
2928
2968
socketfd = None
2929
2969
if server_settings["socket"] != "":
2930
2970
socketfd = server_settings["socket"]
2946
2986
except IOError as e:
2947
2987
logger.error("Could not open file %r", pidfilename,
2948
2988
exc_info=e)
2949
2989
2950
2990
for name, group in (("_mandos", "_mandos"),
2951
2991
("mandos", "mandos"),
2952
2992
("nobody", "nogroup")):
2970
3010
.format(uid, gid, os.strerror(error.errno)))
2971
3011
if error.errno != errno.EPERM:
2972
3012
raise
2973
3013
2974
3014
if debug:
2975
3015
# Enable all possible GnuTLS debugging
2976
3016
2977
3017
# "Use a log level over 10 to enable all debugging options."
2978
3018
# - GnuTLS manual
2979
3019
gnutls.global_set_log_level(11)
2980
3020
2981
3021
@gnutls.log_func
2982
3022
def debug_gnutls(level, string):
2983
3023
logger.debug("GnuTLS: %s", string[:-1])
2984
3024
2985
3025
gnutls.global_set_log_function(debug_gnutls)
2986
3026
2987
3027
# Redirect stdin so all checkers get /dev/null
2988
3028
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2989
3029
os.dup2(null, sys.stdin.fileno())
2990
3030
if null > 2:
2991
3031
os.close(null)
2992
3032
2993
3033
# Need to fork before connecting to D-Bus
2994
3034
if not foreground:
2995
3035
# Close all input and output, do double fork, etc.
2996
3036
daemon()
2997
2998
# multiprocessing will use threads, so before we use GObject we
2999
# need to inform GObject that threads will be used.
3000
GObject.threads_init()
3001
3037
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
3040
GLib.threads_init()
3041
3002
3042
global main_loop
3003
3043
# From the Avahi example code
3004
3044
DBusGMainLoop(set_as_default=True)
3005
main_loop = GObject.MainLoop()
3045
main_loop = GLib.MainLoop()
3006
3046
bus = dbus.SystemBus()
3007
3047
# End of Avahi example code
3008
3048
if use_dbus:
3021
3061
if zeroconf:
3022
3062
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3023
3063
service = AvahiServiceToSyslog(
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3027
bus = bus)
3064
name=server_settings["servicename"],
3065
servicetype="_mandos._tcp",
3066
protocol=protocol,
3067
bus=bus)
3028
3068
if server_settings["interface"]:
3029
3069
service.interface = if_nametoindex(
3030
3070
server_settings["interface"].encode("utf-8"))
3031
3071
3032
3072
global multiprocessing_manager
3033
3073
multiprocessing_manager = multiprocessing.Manager()
3034
3074
3035
3075
client_class = Client
3036
3076
if use_dbus:
3037
client_class = functools.partial(ClientDBus, bus = bus)
3038
3077
client_class = functools.partial(ClientDBus, bus=bus)
3078
3039
3079
client_settings = Client.config_parser(client_config)
3040
3080
old_client_settings = {}
3041
3081
clients_data = {}
3042
3082
3043
3083
# This is used to redirect stdout and stderr for checker processes
3044
3084
global wnull
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3085
wnull = open(os.devnull, "w") # A writable /dev/null
3046
3086
# Only used if server is running in foreground but not in debug
3047
3087
# mode
3048
3088
if debug or not foreground:
3049
3089
wnull.close()
3050
3090
3051
3091
# Get client data and settings from last running state.
3052
3092
if server_settings["restore"]:
3053
3093
try:
3054
3094
with open(stored_state_path, "rb") as stored_state:
3055
if sys.version_info.major == 2:
3095
if sys.version_info.major == 2:
3056
3096
clients_data, old_client_settings = pickle.load(
3057
3097
stored_state)
3058
3098
else:
3059
3099
bytes_clients_data, bytes_old_client_settings = (
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3062
## clients_data
3100
pickle.load(stored_state, encoding="bytes"))
3101
# Fix bytes to strings
3102
# clients_data
3063
3103
# .keys()
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3066
else key): value
3067
for key, value in
3068
bytes_clients_data.items() }
3104
clients_data = {(key.decode("utf-8")
3105
if isinstance(key, bytes)
3106
else key): value
3107
for key, value in
3108
bytes_clients_data.items()}
3109
del bytes_clients_data
3069
3110
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3111
value = {(k.decode("utf-8")
3112
if isinstance(k, bytes) else k): v
3113
for k, v in
3114
clients_data[key].items()}
3074
3115
clients_data[key] = value
3075
3116
# .client_structure
3076
3117
value["client_structure"] = [
3077
3118
(s.decode("utf-8")
3078
3119
if isinstance(s, bytes)
3079
3120
else s) for s in
3080
value["client_structure"] ]
3121
value["client_structure"]]
3081
3122
# .name & .host
3082
3123
for k in ("name", "host"):
3083
3124
if isinstance(value[k], bytes):
3084
3125
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys
3126
# old_client_settings
3127
# .keys()
3087
3128
old_client_settings = {
3088
3129
(key.decode("utf-8")
3089
3130
if isinstance(key, bytes)
3090
3131
else key): value
3091
3132
for key, value in
3092
bytes_old_client_settings.items() }
3133
bytes_old_client_settings.items()}
3134
del bytes_old_client_settings
3093
3135
# .host
3094
3136
for value in old_client_settings.values():
3095
value["host"] = value["host"].decode("utf-8")
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3139
.decode("utf-8"))
3096
3140
os.remove(stored_state_path)
3097
3141
except IOError as e:
3098
3142
if e.errno == errno.ENOENT:
3106
3150
logger.warning("Could not load persistent state: "
3107
3151
"EOFError:",
3108
3152
exc_info=e)
3109
3153
3110
3154
with PGPEngine() as pgp:
3111
3155
for client_name, client in clients_data.items():
3112
3156
# Skip removed clients
3113
3157
if client_name not in client_settings:
3114
3158
continue
3115
3159
3116
3160
# Decide which value to use after restoring saved state.
3117
3161
# We have three different values: Old config file,
3118
3162
# new config file, and saved state.
3129
3173
client[name] = value
3130
3174
except KeyError:
3131
3175
pass
3132
3176
3133
3177
# Clients who has passed its expire date can still be
3134
3178
# enabled if its last checker was successful. A Client
3135
3179
# whose checker succeeded before we stored its state is
3168
3212
client_name))
3169
3213
client["secret"] = (client_settings[client_name]
3170
3214
["secret"])
3171
3215
3172
3216
# Add/remove clients based on new changes made to config
3173
3217
for client_name in (set(old_client_settings)
3174
3218
- set(client_settings)):
3176
3220
for client_name in (set(client_settings)
3177
3221
- set(old_client_settings)):
3178
3222
clients_data[client_name] = client_settings[client_name]
3179
3223
3180
3224
# Create all client objects
3181
3225
for client_name, client in clients_data.items():
3182
3226
tcp_server.clients[client_name] = client_class(
3183
name = client_name,
3184
settings = client,
3185
server_settings = server_settings)
3186
3227
name=client_name,
3228
settings=client,
3229
server_settings=server_settings)
3230
3187
3231
if not tcp_server.clients:
3188
3232
logger.warning("No clients defined")
3189
3233
3190
3234
if not foreground:
3191
3235
if pidfile is not None:
3192
3236
pid = os.getpid()
3198
3242
pidfilename, pid)
3199
3243
del pidfile
3200
3244
del pidfilename
3201
3202
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3203
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3204
3245
3246
for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
lambda: main_loop.quit() and False)
3249
3205
3250
if use_dbus:
3206
3251
3207
3252
@alternate_dbus_interfaces(
3208
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3253
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3209
3254
class MandosDBusService(DBusObjectWithObjectManager):
3210
3255
"""A D-Bus proxy object"""
3211
3256
3212
3257
def __init__(self):
3213
3258
dbus.service.Object.__init__(self, bus, "/")
3214
3259
3215
3260
_interface = "se.recompile.Mandos"
3216
3261
3217
3262
@dbus.service.signal(_interface, signature="o")
3218
3263
def ClientAdded(self, objpath):
3219
3264
"D-Bus signal"
3220
3265
pass
3221
3266
3222
3267
@dbus.service.signal(_interface, signature="ss")
3223
3268
def ClientNotFound(self, fingerprint, address):
3224
3269
"D-Bus signal"
3225
3270
pass
3226
3271
3227
3272
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3228
3273
"true"})
3229
3274
@dbus.service.signal(_interface, signature="os")
3230
3275
def ClientRemoved(self, objpath, name):
3231
3276
"D-Bus signal"
3232
3277
pass
3233
3278
3234
3279
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3235
3280
"true"})
3236
3281
@dbus.service.method(_interface, out_signature="ao")
3238
3283
"D-Bus method"
3239
3284
return dbus.Array(c.dbus_object_path for c in
3240
3285
tcp_server.clients.values())
3241
3286
3242
3287
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3243
3288
"true"})
3244
3289
@dbus.service.method(_interface,
3246
3291
def GetAllClientsWithProperties(self):
3247
3292
"D-Bus method"
3248
3293
return dbus.Dictionary(
3249
{ c.dbus_object_path: c.GetAll(
3294
{c.dbus_object_path: c.GetAll(
3250
3295
"se.recompile.Mandos.Client")
3251
for c in tcp_server.clients.values() },
3296
for c in tcp_server.clients.values()},
3252
3297
signature="oa{sv}")
3253
3298
3254
3299
@dbus.service.method(_interface, in_signature="o")
3255
3300
def RemoveClient(self, object_path):
3256
3301
"D-Bus method"
3264
3309
self.client_removed_signal(c)
3265
3310
return
3266
3311
raise KeyError(object_path)
3267
3312
3268
3313
del _interface
3269
3314
3270
3315
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3271
out_signature = "a{oa{sa{sv}}}")
3316
out_signature="a{oa{sa{sv}}}")
3272
3317
def GetManagedObjects(self):
3273
3318
"""D-Bus method"""
3274
3319
return dbus.Dictionary(
3275
{ client.dbus_object_path:
3276
dbus.Dictionary(
3277
{ interface: client.GetAll(interface)
3278
for interface in
3279
client._get_all_interface_names()})
3280
for client in tcp_server.clients.values()})
3281
3320
{client.dbus_object_path:
3321
dbus.Dictionary(
3322
{interface: client.GetAll(interface)
3323
for interface in
3324
client._get_all_interface_names()})
3325
for client in tcp_server.clients.values()})
3326
3282
3327
def client_added_signal(self, client):
3283
3328
"""Send the new standard signal and the old signal"""
3284
3329
if use_dbus:
3286
3331
self.InterfacesAdded(
3287
3332
client.dbus_object_path,
3288
3333
dbus.Dictionary(
3289
{ interface: client.GetAll(interface)
3290
for interface in
3291
client._get_all_interface_names()}))
3334
{interface: client.GetAll(interface)
3335
for interface in
3336
client._get_all_interface_names()}))
3292
3337
# Old signal
3293
3338
self.ClientAdded(client.dbus_object_path)
3294
3339
3295
3340
def client_removed_signal(self, client):
3296
3341
"""Send the new standard signal and the old signal"""
3297
3342
if use_dbus:
3302
3347
# Old signal
3303
3348
self.ClientRemoved(client.dbus_object_path,
3304
3349
client.name)
3305
3350
3306
3351
mandos_dbus_service = MandosDBusService()
3307
3352
3353
# Save modules to variables to exempt the modules from being
3354
# unloaded before the function registered with atexit() is run.
3355
mp = multiprocessing
3356
wn = wnull
3357
3308
3358
def cleanup():
3309
3359
"Cleanup function; run on exit"
3310
3360
if zeroconf:
3311
3361
service.cleanup()
3312
3313
multiprocessing.active_children()
3314
wnull.close()
3362
3363
mp.active_children()
3364
wn.close()
3315
3365
if not (tcp_server.clients or client_settings):
3316
3366
return
3317
3367
3318
3368
# Store client before exiting. Secrets are encrypted with key
3319
3369
# based on what config file has. If config file is
3320
3370
# removed/edited, old secret will thus be unrecovable.
3325
3375
client.encrypted_secret = pgp.encrypt(client.secret,
3326
3376
key)
3327
3377
client_dict = {}
3328
3378
3329
3379
# A list of attributes that can not be pickled
3330
3380
# + secret.
3331
exclude = { "bus", "changedstate", "secret",
3332
"checker", "server_settings" }
3381
exclude = {"bus", "changedstate", "secret",
3382
"checker", "server_settings"}
3333
3383
for name, typ in inspect.getmembers(dbus.service
3334
3384
.Object):
3335
3385
exclude.add(name)
3336
3386
3337
3387
client_dict["encrypted_secret"] = (client
3338
3388
.encrypted_secret)
3339
3389
for attr in client.client_structure:
3340
3390
if attr not in exclude:
3341
3391
client_dict[attr] = getattr(client, attr)
3342
3392
3343
3393
clients[client.name] = client_dict
3344
3394
del client_settings[client.name]["secret"]
3345
3395
3346
3396
try:
3347
3397
with tempfile.NamedTemporaryFile(
3348
3398
mode='wb',
3351
3401
dir=os.path.dirname(stored_state_path),
3352
3402
delete=False) as stored_state:
3353
3403
pickle.dump((clients, client_settings), stored_state,
3354
protocol = 2)
3404
protocol=2)
3355
3405
tempname = stored_state.name
3356
3406
os.rename(tempname, stored_state_path)
3357
3407
except (IOError, OSError) as e:
3367
3417
logger.warning("Could not save persistent state:",
3368
3418
exc_info=e)
3369
3419
raise
3370
3420
3371
3421
# Delete all clients, and settings from config
3372
3422
while tcp_server.clients:
3373
3423
name, client = tcp_server.clients.popitem()
3379
3429
if use_dbus:
3380
3430
mandos_dbus_service.client_removed_signal(client)
3381
3431
client_settings.clear()
3382
3432
3383
3433
atexit.register(cleanup)
3384
3434
3385
3435
for client in tcp_server.clients.values():
3386
3436
if use_dbus:
3387
3437
# Emit D-Bus signal for adding
3389
3439
# Need to initiate checking of clients
3390
3440
if client.enabled:
3391
3441
client.init_checker()
3392
3442
3393
3443
tcp_server.enable()
3394
3444
tcp_server.server_activate()
3395
3445
3396
3446
# Find out what port we got
3397
3447
if zeroconf:
3398
3448
service.port = tcp_server.socket.getsockname()[1]
3403
3453
else: # IPv4
3404
3454
logger.info("Now listening on address %r, port %d",
3405
3455
*tcp_server.socket.getsockname())
3406
3407
#service.interface = tcp_server.socket.getsockname()[3]
3408
3456
3457
# service.interface = tcp_server.socket.getsockname()[3]
3458
3409
3459
try:
3410
3460
if zeroconf:
3411
3461
# From the Avahi example code
3416
3466
cleanup()
3417
3467
sys.exit(1)
3418
3468
# End of Avahi example code
3419
3420
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3421
lambda *args, **kwargs:
3422
(tcp_server.handle_request
3423
(*args[2:], **kwargs) or True))
3424
3469
3470
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
lambda *args, **kwargs:
3472
(tcp_server.handle_request
3473
(*args[2:], **kwargs) or True))
3474
3425
3475
logger.debug("Starting main loop")
3426
3476
main_loop.run()
3427
3477
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0