196
235
.replace(b"\n", b"\\n")
197
236
.replace(b"\0", b"\\x00"))
200
239
def encrypt(self, data, password):
201
240
passphrase = self.password_encode(password)
202
241
with tempfile.NamedTemporaryFile(
203
242
dir=self.tempdir) as passfile:
204
243
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
245
proc = subprocess.Popen([self.gpg, '--symmetric',
207
246
'--passphrase-file',
209
248
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
214
253
if proc.returncode != 0:
215
254
raise PGPError(err)
216
255
return ciphertext
218
257
def decrypt(self, data, password):
219
258
passphrase = self.password_encode(password)
220
259
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
260
dir=self.tempdir) as passfile:
222
261
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
263
proc = subprocess.Popen([self.gpg, '--decrypt',
225
264
'--passphrase-file',
227
266
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
232
271
if proc.returncode != 0:
233
272
raise PGPError(err)
234
273
return decrypted_plaintext
276
# Pretend that we have an Avahi module
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
237
303
class AvahiError(Exception):
238
304
def __init__(self, value, *args, **kwargs):
239
305
self.value = value
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
510
library = ctypes.util.find_library("gnutls")
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
515
_need_version = b"3.3.0"
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
524
# Unless otherwise indicated, the constants and types below are
525
# all from the gnutls/gnutls.h C header file.
535
E_NO_CERTIFICATE_FOUND = -49
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
539
class session_int(ctypes.Structure):
541
session_t = ctypes.POINTER(session_int)
543
class certificate_credentials_st(ctypes.Structure):
545
certificate_credentials_t = ctypes.POINTER(
546
certificate_credentials_st)
547
certificate_type_t = ctypes.c_int
549
class datum_t(ctypes.Structure):
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
('size', ctypes.c_uint)]
553
class openpgp_crt_int(ctypes.Structure):
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
credentials_type_t = ctypes.c_int
559
transport_ptr_t = ctypes.c_void_p
560
close_request_t = ctypes.c_int
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
573
if message is None and code is not None:
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
578
class CertificateSecurityError(Error):
582
class Credentials(object):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
590
gnutls.certificate_free_credentials(self._c_object)
592
class ClientSession(object):
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
gnutls.set_default_priority(self._c_object)
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
598
gnutls.handshake_set_private_extensions(self._c_object,
601
if credentials is None:
602
credentials = gnutls.Credentials()
603
gnutls.credentials_set(self._c_object, credentials.type,
604
ctypes.cast(credentials._c_object,
606
self.credentials = credentials
609
gnutls.deinit(self._c_object)
612
return gnutls.handshake(self._c_object)
614
def send(self, data):
618
data_len -= gnutls.record_send(self._c_object,
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
625
# Error handling functions
626
def _error_code(result):
627
"""A function to raise exceptions on errors, suitable
628
for the 'restype' attribute on ctypes functions"""
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
635
def _retry_on_error(result, func, arguments):
636
"""A function to retry on some errors, suitable
637
for the 'errcheck' attribute on ctypes functions"""
639
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
640
return _error_code(result)
641
result = func(*arguments)
644
# Unless otherwise indicated, the function declarations below are
645
# all from the gnutls/gnutls.h C header file.
648
priority_set_direct = _library.gnutls_priority_set_direct
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
ctypes.POINTER(ctypes.c_char_p)]
651
priority_set_direct.restype = _error_code
653
init = _library.gnutls_init
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
init.restype = _error_code
657
set_default_priority = _library.gnutls_set_default_priority
658
set_default_priority.argtypes = [session_t]
659
set_default_priority.restype = _error_code
661
record_send = _library.gnutls_record_send
662
record_send.argtypes = [session_t, ctypes.c_void_p,
664
record_send.restype = ctypes.c_ssize_t
665
record_send.errcheck = _retry_on_error
667
certificate_allocate_credentials = (
668
_library.gnutls_certificate_allocate_credentials)
669
certificate_allocate_credentials.argtypes = [
670
ctypes.POINTER(certificate_credentials_t)]
671
certificate_allocate_credentials.restype = _error_code
673
certificate_free_credentials = (
674
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
677
certificate_free_credentials.restype = None
679
handshake_set_private_extensions = (
680
_library.gnutls_handshake_set_private_extensions)
681
handshake_set_private_extensions.argtypes = [session_t,
683
handshake_set_private_extensions.restype = None
685
credentials_set = _library.gnutls_credentials_set
686
credentials_set.argtypes = [session_t, credentials_type_t,
688
credentials_set.restype = _error_code
690
strerror = _library.gnutls_strerror
691
strerror.argtypes = [ctypes.c_int]
692
strerror.restype = ctypes.c_char_p
694
certificate_type_get = _library.gnutls_certificate_type_get
695
certificate_type_get.argtypes = [session_t]
696
certificate_type_get.restype = _error_code
698
certificate_get_peers = _library.gnutls_certificate_get_peers
699
certificate_get_peers.argtypes = [session_t,
700
ctypes.POINTER(ctypes.c_uint)]
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
global_set_log_level = _library.gnutls_global_set_log_level
704
global_set_log_level.argtypes = [ctypes.c_int]
705
global_set_log_level.restype = None
707
global_set_log_function = _library.gnutls_global_set_log_function
708
global_set_log_function.argtypes = [log_func]
709
global_set_log_function.restype = None
711
deinit = _library.gnutls_deinit
712
deinit.argtypes = [session_t]
713
deinit.restype = None
715
handshake = _library.gnutls_handshake
716
handshake.argtypes = [session_t]
717
handshake.restype = _error_code
718
handshake.errcheck = _retry_on_error
720
transport_set_ptr = _library.gnutls_transport_set_ptr
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
transport_set_ptr.restype = None
724
bye = _library.gnutls_bye
725
bye.argtypes = [session_t, close_request_t]
726
bye.restype = _error_code
727
bye.errcheck = _retry_on_error
729
check_version = _library.gnutls_check_version
730
check_version.argtypes = [ctypes.c_char_p]
731
check_version.restype = ctypes.c_char_p
733
# All the function declarations below are from gnutls/openpgp.h
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
743
openpgp_crt_import.restype = _error_code
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
760
openpgp_crt_get_fingerprint.restype = _error_code
762
# Remove non-public functions
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
768
def call_pipe(connection, # : multiprocessing.Connection
769
func, *args, **kwargs):
770
"""This function is meant to be called by multiprocessing.Process
772
This function runs func(*args, **kwargs), and writes the resulting
773
return value on the provided multiprocessing.Connection.
775
connection.send(func(*args, **kwargs))
428
779
class Client(object):
429
780
"""A representation of a client host served by this server.
432
783
approved: bool(); 'None' if not yet approved/disapproved
433
784
approval_delay: datetime.timedelta(); Time to wait for approval
604
959
logger.info("Disabling client %s", self.name)
605
960
if getattr(self, "disable_initiator_tag", None) is not None:
606
gobject.source_remove(self.disable_initiator_tag)
961
GLib.source_remove(self.disable_initiator_tag)
607
962
self.disable_initiator_tag = None
608
963
self.expires = None
609
964
if getattr(self, "checker_initiator_tag", None) is not None:
610
gobject.source_remove(self.checker_initiator_tag)
965
GLib.source_remove(self.checker_initiator_tag)
611
966
self.checker_initiator_tag = None
612
967
self.stop_checker()
613
968
self.enabled = False
615
970
self.send_changedstate()
616
# Do not run this again if called by a gobject.timeout_add
971
# Do not run this again if called by a GLib.timeout_add
619
974
def __del__(self):
622
977
def init_checker(self):
623
978
# Schedule a new checker to be started an 'interval' from now,
624
979
# and every interval from then on.
625
980
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
628
983
int(self.interval.total_seconds() * 1000),
629
984
self.start_checker)
630
985
# Schedule a disable() when 'timeout' has passed
631
986
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
634
989
int(self.timeout.total_seconds() * 1000), self.disable)
635
990
# Also start a new checker *right now*.
636
991
self.start_checker()
638
def checker_callback(self, pid, condition, command):
993
def checker_callback(self, source, condition, connection,
639
995
"""The checker has completed, so take appropriate actions."""
640
996
self.checker_callback_tag = None
641
997
self.checker = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
998
# Read return code from connection (see call_pipe)
999
returncode = connection.recv()
1003
self.last_checker_status = returncode
1004
self.last_checker_signal = None
644
1005
if self.last_checker_status == 0:
645
1006
logger.info("Checker for %(name)s succeeded",
716
1070
return True # Try again later
717
1071
self.current_checker_command = command
719
logger.info("Starting checker %r for %s", command,
721
# We don't need to redirect stdout and stderr, since
722
# in normal mode, that is already done by daemon(),
723
# and in debug mode we don't want to. (Stdin is
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
733
self.checker = subprocess.Popen(command,
738
except OSError as error:
739
logger.error("Failed to start subprocess",
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1072
logger.info("Starting checker %r for %s", command,
1074
# We don't need to redirect stdout and stderr, since
1075
# in normal mode, that is already done by daemon(),
1076
# and in debug mode we don't want to. (Stdin is
1077
# always replaced by /dev/null.)
1078
# The exception is when not debugging but nevertheless
1079
# running in the foreground; use the previously
1081
popen_args = {"close_fds": True,
1084
if (not self.server_settings["debug"]
1085
and self.server_settings["foreground"]):
1086
popen_args.update({"stdout": wnull,
1088
pipe = multiprocessing.Pipe(duplex=False)
1089
self.checker = multiprocessing.Process(
1091
args=(pipe[1], subprocess.call, command),
1093
self.checker.start()
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1096
self.checker_callback, pipe[0], command)
1097
# Re-run this periodically if run by GLib.timeout_add
761
1100
def stop_checker(self):
762
1101
"""Force the checker process, if any, to stop."""
763
1102
if self.checker_callback_tag:
764
gobject.source_remove(self.checker_callback_tag)
1103
GLib.source_remove(self.checker_callback_tag)
765
1104
self.checker_callback_tag = None
766
1105
if getattr(self, "checker", None) is None:
768
1107
logger.debug("Stopping checker for %(name)s", vars(self))
770
self.checker.terminate()
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
1108
self.checker.terminate()
777
1109
self.checker = None
896
1229
for cls in self.__class__.__mro__
897
1230
for name, athing in
898
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1237
def Introspect(self, object_path, connection):
1238
"""Overloading of standard D-Bus method.
1240
Inserts annotation tags on methods and signals.
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1245
document = xml.dom.minidom.parseString(xmlstring)
1247
for if_tag in document.getElementsByTagName("interface"):
1248
# Add annotation tags
1249
for typ in ("method", "signal"):
1250
for tag in if_tag.getElementsByTagName(typ):
1252
for name, prop in (self.
1253
_get_all_dbus_things(typ)):
1254
if (name == tag.getAttribute("name")
1255
and prop._dbus_interface
1256
== if_tag.getAttribute("name")):
1257
annots.update(getattr(
1258
prop, "_dbus_annotations", {}))
1259
for name, value in annots.items():
1260
ann_tag = document.createElement(
1262
ann_tag.setAttribute("name", name)
1263
ann_tag.setAttribute("value", value)
1264
tag.appendChild(ann_tag)
1265
# Add interface annotation tags
1266
for annotation, value in dict(
1267
itertools.chain.from_iterable(
1268
annotations().items()
1269
for name, annotations
1270
in self._get_all_dbus_things("interface")
1271
if name == if_tag.getAttribute("name")
1273
ann_tag = document.createElement("annotation")
1274
ann_tag.setAttribute("name", annotation)
1275
ann_tag.setAttribute("value", value)
1276
if_tag.appendChild(ann_tag)
1277
# Fix argument name for the Introspect method itself
1278
if (if_tag.getAttribute("name")
1279
== dbus.INTROSPECTABLE_IFACE):
1280
for cn in if_tag.getElementsByTagName("method"):
1281
if cn.getAttribute("name") == "Introspect":
1282
for arg in cn.getElementsByTagName("arg"):
1283
if (arg.getAttribute("direction")
1285
arg.setAttribute("name",
1287
xmlstring = document.toxml("utf-8")
1289
except (AttributeError, xml.dom.DOMException,
1290
xml.parsers.expat.ExpatError) as error:
1291
logger.error("Failed to override Introspection method",
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1297
"""A D-Bus object with properties.
1299
Classes inheriting from this can use the dbus_service_property
1300
decorator to expose methods as D-Bus properties. It exposes the
1301
standard Get(), Set(), and GetAll() methods on the D-Bus.
900
1304
def _get_dbus_property(self, interface_name, property_name):
901
1305
"""Returns a bound method if one exists which is a D-Bus
902
1306
property with the specified name and interface.
1007
1421
if prop._dbus_interface
1008
1422
== if_tag.getAttribute("name")):
1009
1423
if_tag.appendChild(tag)
1010
# Add annotation tags
1011
for typ in ("method", "signal", "property"):
1012
for tag in if_tag.getElementsByTagName(typ):
1014
for name, prop in (self.
1015
_get_all_dbus_things(typ)):
1016
if (name == tag.getAttribute("name")
1017
and prop._dbus_interface
1018
== if_tag.getAttribute("name")):
1019
annots.update(getattr(
1020
prop, "_dbus_annotations", {}))
1021
for name, value in annots.items():
1022
ann_tag = document.createElement(
1024
ann_tag.setAttribute("name", name)
1025
ann_tag.setAttribute("value", value)
1026
tag.appendChild(ann_tag)
1027
# Add interface annotation tags
1028
for annotation, value in dict(
1029
itertools.chain.from_iterable(
1030
annotations().items()
1031
for name, annotations
1032
in self._get_all_dbus_things("interface")
1033
if name == if_tag.getAttribute("name")
1035
ann_tag = document.createElement("annotation")
1036
ann_tag.setAttribute("name", annotation)
1037
ann_tag.setAttribute("value", value)
1038
if_tag.appendChild(ann_tag)
1424
# Add annotation tags for properties
1425
for tag in if_tag.getElementsByTagName("property"):
1427
for name, prop in self._get_all_dbus_things(
1429
if (name == tag.getAttribute("name")
1430
and prop._dbus_interface
1431
== if_tag.getAttribute("name")):
1432
annots.update(getattr(
1433
prop, "_dbus_annotations", {}))
1434
for name, value in annots.items():
1435
ann_tag = document.createElement(
1437
ann_tag.setAttribute("name", name)
1438
ann_tag.setAttribute("value", value)
1439
tag.appendChild(ann_tag)
1039
1440
# Add the names to the return values for the
1040
1441
# "org.freedesktop.DBus.Properties" methods
1041
1442
if (if_tag.getAttribute("name")
1060
1461
return xmlstring
1465
dbus.OBJECT_MANAGER_IFACE
1466
except AttributeError:
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
"""A D-Bus object with an ObjectManager.
1473
Classes inheriting from this exposes the standard
1474
GetManagedObjects call and the InterfacesAdded and
1475
InterfacesRemoved signals on the standard
1476
"org.freedesktop.DBus.ObjectManager" interface.
1478
Note: No signals are sent automatically; they must be sent
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1483
def GetManagedObjects(self):
1484
"""This function must be overridden"""
1485
raise NotImplementedError()
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1493
def InterfacesRemoved(self, object_path, interfaces):
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1500
def Introspect(self, object_path, connection):
1501
"""Overloading of standard D-Bus method.
1503
Override return argument name of GetManagedObjects to be
1504
"objpath_interfaces_and_properties"
1506
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1510
document = xml.dom.minidom.parseString(xmlstring)
1512
for if_tag in document.getElementsByTagName("interface"):
1513
# Fix argument name for the GetManagedObjects method
1514
if (if_tag.getAttribute("name")
1515
== dbus.OBJECT_MANAGER_IFACE):
1516
for cn in if_tag.getElementsByTagName("method"):
1517
if (cn.getAttribute("name")
1518
== "GetManagedObjects"):
1519
for arg in cn.getElementsByTagName("arg"):
1520
if (arg.getAttribute("direction")
1524
"objpath_interfaces"
1526
xmlstring = document.toxml("utf-8")
1528
except (AttributeError, xml.dom.DOMException,
1529
xml.parsers.expat.ExpatError) as error:
1530
logger.error("Failed to override Introspection method",
1063
1535
def datetime_to_dbus(dt, variant_level=0):
1064
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1066
return dbus.String("", variant_level = variant_level)
1538
return dbus.String("", variant_level=variant_level)
1067
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1355
1827
if hasattr(DBusObjectWithProperties, "__del__"):
1356
1828
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1357
1829
Client.__del__(self, *args, **kwargs)
1359
def checker_callback(self, pid, condition, command,
1361
self.checker_callback_tag = None
1363
if os.WIFEXITED(condition):
1364
exitstatus = os.WEXITSTATUS(condition)
1831
def checker_callback(self, source, condition,
1832
connection, command, *args, **kwargs):
1833
ret = Client.checker_callback(self, source, condition,
1834
connection, command, *args,
1836
exitstatus = self.last_checker_status
1365
1838
# Emit D-Bus signal
1366
1839
self.CheckerCompleted(dbus.Int16(exitstatus),
1367
dbus.Int64(condition),
1840
# This is specific to GNU libC
1841
dbus.Int64(exitstatus << 8),
1368
1842
dbus.String(command))
1370
1844
# Emit D-Bus signal
1371
1845
self.CheckerCompleted(dbus.Int16(-1),
1372
dbus.Int64(condition),
1847
# This is specific to GNU libC
1849
| self.last_checker_signal),
1373
1850
dbus.String(command))
1375
return Client.checker_callback(self, pid, condition, command,
1378
1853
def start_checker(self, *args, **kwargs):
1379
1854
old_checker_pid = getattr(self.checker, "pid", None)
1380
1855
r = Client.start_checker(self, *args, **kwargs)
1698
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
1699
2190
"""A class to handle client connections.
1701
2192
Instantiated once for each connection to handle it.
1702
2193
Note: This will run in its own forked process."""
1704
2195
def handle(self):
1705
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
1706
2197
logger.info("TCP connection from: %s",
1707
2198
str(self.client_address))
1708
2199
logger.debug("Pipe FD: %d",
1709
2200
self.server.child_pipe.fileno())
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1714
# Note: gnutls.connection.X509Credentials is really a
1715
# generic GnuTLS certificate credentials object so long as
1716
# no X.509 keys are added to it. Therefore, we can use it
1717
# here despite using OpenPGP certificates.
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
# "+AES-256-CBC", "+SHA1",
1721
# "+COMP-NULL", "+CTYPE-OPENPGP",
2202
session = gnutls.ClientSession(self.request)
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
1723
2208
# Use a fallback default, since this MUST be set.
1724
2209
priority = self.server.gnutls_priority
1725
2210
if priority is None:
1726
2211
priority = "NORMAL"
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
1730
2216
# Start communication using the Mandos protocol
1731
2217
# Get protocol number
1732
2218
line = self.request.makefile().readline()
1819
2304
delay -= time2 - time
1822
while sent_size < len(client.secret):
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
2307
session.send(client.secret)
2308
except gnutls.Error as error:
2309
logger.warning("gnutls send failed",
1834
2313
logger.info("Sending secret to %s", client.name)
1835
2314
# bump the timeout using extended_timeout
1836
2315
client.bump_timeout(client.extended_timeout)
1837
2316
if self.server.use_dbus:
1838
2317
# Emit D-Bus signal
1839
2318
client.GotSecret()
1842
2321
if approval_required:
1843
2322
client.approvals_pending -= 1
1846
except gnutls.errors.GNUTLSError as error:
2325
except gnutls.Error as error:
1847
2326
logger.warning("GnuTLS bye failed",
1848
2327
exc_info=error)
1851
2330
def peer_certificate(session):
1852
2331
"Return the peer's OpenPGP certificate as a bytestring"
1853
2332
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2335
# ...return invalid data
1859
2337
list_size = ctypes.c_uint(1)
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2338
cert_list = (gnutls.certificate_get_peers
1862
2339
(session._c_object, ctypes.byref(list_size)))
1863
2340
if not bool(cert_list) and list_size.value != 0:
1864
raise gnutls.errors.GNUTLSError("error getting peer"
2341
raise gnutls.Error("error getting peer certificate")
1866
2342
if list_size.value == 0:
1868
2344
cert = cert_list[0]
1869
2345
return ctypes.string_at(cert.data, cert.size)
1872
2348
def fingerprint(openpgp):
1873
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1874
2350
# New GnuTLS "datum" with the OpenPGP public key
1875
datum = gnutls.library.types.gnutls_datum_t(
2351
datum = gnutls.datum_t(
1876
2352
ctypes.cast(ctypes.c_char_p(openpgp),
1877
2353
ctypes.POINTER(ctypes.c_ubyte)),
1878
2354
ctypes.c_uint(len(openpgp)))
1879
2355
# New empty GnuTLS certificate
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
2356
crt = gnutls.openpgp_crt_t()
2357
gnutls.openpgp_crt_init(ctypes.byref(crt))
1883
2358
# Import the OpenPGP public key into the certificate
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2359
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2360
gnutls.OPENPGP_FMT_RAW)
1887
2361
# Verify the self signature in the key
1888
2362
crtverify = ctypes.c_uint()
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2363
gnutls.openpgp_crt_verify_self(crt, 0,
2364
ctypes.byref(crtverify))
1891
2365
if crtverify.value != 0:
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
2366
gnutls.openpgp_crt_deinit(crt)
2367
raise gnutls.CertificateSecurityError("Verify failed")
1895
2368
# New buffer for the fingerprint
1896
2369
buf = ctypes.create_string_buffer(20)
1897
2370
buf_len = ctypes.c_size_t()
1898
2371
# Get the fingerprint from the certificate into the buffer
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2372
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2373
ctypes.byref(buf_len))
1901
2374
# Deinit the certificate
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2375
gnutls.openpgp_crt_deinit(crt)
1903
2376
# Convert the buffer to a Python bytestring
1904
2377
fpr = ctypes.string_at(buf, buf_len.value)
1905
2378
# Convert the bytestring to hexadecimal notation
1993
2467
# socket_wrapper(), if socketfd was set.
1994
2468
socketserver.TCPServer.__init__(self, server_address,
1995
2469
RequestHandlerClass)
1997
2471
def server_bind(self):
1998
2472
"""This overrides the normal server_bind() function
1999
2473
to bind to an interface if one was specified, and also NOT to
2000
2474
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2001
2476
if self.interface is not None:
2002
2477
if SO_BINDTODEVICE is None:
2003
logger.error("SO_BINDTODEVICE does not exist;"
2004
" cannot bind to interface %s",
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
2011
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
2016
logger.error("SO_BINDTODEVICE not available;"
2017
" cannot bind to interface %s",
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2478
# Fall back to a hard-coded value which seems to be
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2024
2499
# Only bind(2) the socket if we really need to.
2025
2500
if self.server_address[0] or self.server_address[1]:
2026
2501
if not self.server_address[0]:
2027
2502
if self.address_family == socket.AF_INET6:
2028
any_address = "::" # in6addr_any
2503
any_address = "::" # in6addr_any
2030
any_address = "0.0.0.0" # INADDR_ANY
2505
any_address = "0.0.0.0" # INADDR_ANY
2031
2506
self.server_address = (any_address,
2032
2507
self.server_address[1])
2033
2508
elif not self.server_address[1]:
2585
3063
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2586
3064
service = AvahiServiceToSyslog(
2587
name = server_settings["servicename"],
2588
servicetype = "_mandos._tcp",
2589
protocol = protocol,
3065
name=server_settings["servicename"],
3066
servicetype="_mandos._tcp",
2591
3069
if server_settings["interface"]:
2592
3070
service.interface = if_nametoindex(
2593
3071
server_settings["interface"].encode("utf-8"))
2595
3073
global multiprocessing_manager
2596
3074
multiprocessing_manager = multiprocessing.Manager()
2598
3076
client_class = Client
2600
client_class = functools.partial(ClientDBus, bus = bus)
3078
client_class = functools.partial(ClientDBus, bus=bus)
2602
3080
client_settings = Client.config_parser(client_config)
2603
3081
old_client_settings = {}
2604
3082
clients_data = {}
2606
3084
# This is used to redirect stdout and stderr for checker processes
2608
wnull = open(os.devnull, "w") # A writable /dev/null
3086
wnull = open(os.devnull, "w") # A writable /dev/null
2609
3087
# Only used if server is running in foreground but not in debug
2611
3089
if debug or not foreground:
2614
3092
# Get client data and settings from last running state.
2615
3093
if server_settings["restore"]:
2617
3095
with open(stored_state_path, "rb") as stored_state:
2618
clients_data, old_client_settings = pickle.load(
3096
if sys.version_info.major == 2:
3097
clients_data, old_client_settings = pickle.load(
3100
bytes_clients_data, bytes_old_client_settings = (
3101
pickle.load(stored_state, encoding="bytes"))
3102
# Fix bytes to strings
3105
clients_data = {(key.decode("utf-8")
3106
if isinstance(key, bytes)
3109
bytes_clients_data.items()}
3110
del bytes_clients_data
3111
for key in clients_data:
3112
value = {(k.decode("utf-8")
3113
if isinstance(k, bytes) else k): v
3115
clients_data[key].items()}
3116
clients_data[key] = value
3118
value["client_structure"] = [
3120
if isinstance(s, bytes)
3122
value["client_structure"]]
3124
for k in ("name", "host"):
3125
if isinstance(value[k], bytes):
3126
value[k] = value[k].decode("utf-8")
3127
# old_client_settings
3129
old_client_settings = {
3130
(key.decode("utf-8")
3131
if isinstance(key, bytes)
3134
bytes_old_client_settings.items()}
3135
del bytes_old_client_settings
3137
for value in old_client_settings.values():
3138
if isinstance(value["host"], bytes):
3139
value["host"] = (value["host"]
2620
3141
os.remove(stored_state_path)
2621
3142
except IOError as e:
2622
3143
if e.errno == errno.ENOENT:
2722
3243
pidfilename, pid)
2724
3245
del pidfilename
2726
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2727
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3247
for termsig in (signal.SIGHUP, signal.SIGTERM):
3248
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3249
lambda: main_loop.quit() and False)
2731
3253
@alternate_dbus_interfaces(
2732
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2733
class MandosDBusService(DBusObjectWithProperties):
3254
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3255
class MandosDBusService(DBusObjectWithObjectManager):
2734
3256
"""A D-Bus proxy object"""
2736
3258
def __init__(self):
2737
3259
dbus.service.Object.__init__(self, bus, "/")
2739
3261
_interface = "se.recompile.Mandos"
2741
@dbus_interface_annotations(_interface)
2744
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2747
3263
@dbus.service.signal(_interface, signature="o")
2748
3264
def ClientAdded(self, objpath):
2752
3268
@dbus.service.signal(_interface, signature="ss")
2753
3269
def ClientNotFound(self, fingerprint, address):
3273
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2757
3275
@dbus.service.signal(_interface, signature="os")
2758
3276
def ClientRemoved(self, objpath, name):
3280
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2762
3282
@dbus.service.method(_interface, out_signature="ao")
2763
3283
def GetAllClients(self):
2765
3285
return dbus.Array(c.dbus_object_path for c in
2766
tcp_server.clients.itervalues())
3286
tcp_server.clients.values())
3288
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2768
3290
@dbus.service.method(_interface,
2769
3291
out_signature="a{oa{sv}}")
2770
3292
def GetAllClientsWithProperties(self):
2772
3294
return dbus.Dictionary(
2773
{ c.dbus_object_path: c.GetAll("")
2774
for c in tcp_server.clients.itervalues() },
3295
{c.dbus_object_path: c.GetAll(
3296
"se.recompile.Mandos.Client")
3297
for c in tcp_server.clients.values()},
2775
3298
signature="oa{sv}")
2777
3300
@dbus.service.method(_interface, in_signature="o")
2778
3301
def RemoveClient(self, object_path):
2780
for c in tcp_server.clients.itervalues():
3303
for c in tcp_server.clients.values():
2781
3304
if c.dbus_object_path == object_path:
2782
3305
del tcp_server.clients[c.name]
2783
3306
c.remove_from_connection()
2784
# Don't signal anything except ClientRemoved
3307
# Don't signal the disabling
2785
3308
c.disable(quiet=True)
2787
self.ClientRemoved(object_path, c.name)
3309
# Emit D-Bus signal for removal
3310
self.client_removed_signal(c)
2789
3312
raise KeyError(object_path)
3316
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3317
out_signature="a{oa{sa{sv}}}")
3318
def GetManagedObjects(self):
3320
return dbus.Dictionary(
3321
{client.dbus_object_path:
3323
{interface: client.GetAll(interface)
3325
client._get_all_interface_names()})
3326
for client in tcp_server.clients.values()})
3328
def client_added_signal(self, client):
3329
"""Send the new standard signal and the old signal"""
3331
# New standard signal
3332
self.InterfacesAdded(
3333
client.dbus_object_path,
3335
{interface: client.GetAll(interface)
3337
client._get_all_interface_names()}))
3339
self.ClientAdded(client.dbus_object_path)
3341
def client_removed_signal(self, client):
3342
"""Send the new standard signal and the old signal"""
3344
# New standard signal
3345
self.InterfacesRemoved(
3346
client.dbus_object_path,
3347
client._get_all_interface_names())
3349
self.ClientRemoved(client.dbus_object_path,
2793
3352
mandos_dbus_service = MandosDBusService()
3354
# Save modules to variables to exempt the modules from being
3355
# unloaded before the function registered with atexit() is run.
3356
mp = multiprocessing
2796
3360
"Cleanup function; run on exit"
2798
3362
service.cleanup()
2800
multiprocessing.active_children()
3364
mp.active_children()
2802
3366
if not (tcp_server.clients or client_settings):
2805
3369
# Store client before exiting. Secrets are encrypted with key
2806
3370
# based on what config file has. If config file is
2807
3371
# removed/edited, old secret will thus be unrecovable.
2809
3373
with PGPEngine() as pgp:
2810
for client in tcp_server.clients.itervalues():
3374
for client in tcp_server.clients.values():
2811
3375
key = client_settings[client.name]["secret"]
2812
3376
client.encrypted_secret = pgp.encrypt(client.secret,
2814
3378
client_dict = {}
2816
3380
# A list of attributes that can not be pickled
2818
exclude = { "bus", "changedstate", "secret",
2819
"checker", "server_settings" }
3382
exclude = {"bus", "changedstate", "secret",
3383
"checker", "server_settings"}
2820
3384
for name, typ in inspect.getmembers(dbus.service
2822
3386
exclude.add(name)
2824
3388
client_dict["encrypted_secret"] = (client
2825
3389
.encrypted_secret)
2826
3390
for attr in client.client_structure:
2827
3391
if attr not in exclude:
2828
3392
client_dict[attr] = getattr(client, attr)
2830
3394
clients[client.name] = client_dict
2831
3395
del client_settings[client.name]["secret"]
2834
3398
with tempfile.NamedTemporaryFile(