To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 921
- compare with another revision
- download diff
- download tarball
- view history from revision 921
- Committer: Teddy Hogeborn
- Date: 2018-02-06 20:03:50 UTC
- Revision ID: teddy@recompile.se-20180206200350-jzvorueb731xkph3
Update Debian Debhelper compatibility version.
* (debian/compat): Change to "10".
* (debian/compat): Change to "10".
added
removed
mandos
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2013 Teddy Hogeborn
15
# Copyright © 2008-2013 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2017 Teddy Hogeborn
15
# Copyright © 2008-2017 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
import SocketServer as socketserver
43
try:
44
import SocketServer as socketserver
45
except ImportError:
46
import socketserver
40
47
import socket
41
48
import argparse
42
49
import datetime
43
50
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
try:
52
import ConfigParser as configparser
53
except ImportError:
54
import configparser
51
55
import sys
52
56
import re
53
57
import os
62
66
import struct
63
67
import fcntl
64
68
import functools
65
import cPickle as pickle
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
71
78
import collections
79
import codecs
72
80
73
81
import dbus
74
82
import dbus.service
75
import gobject
76
import avahi
83
from gi.repository import GLib
77
84
from dbus.mainloop.glib import DBusGMainLoop
78
85
import ctypes
79
86
import ctypes.util
80
87
import xml.dom.minidom
81
88
import inspect
82
89
90
# Try to find the value of SO_BINDTODEVICE:
83
91
try:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
84
94
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
95
except AttributeError:
86
96
try:
97
# This is where SO_BINDTODEVICE was up to and including Python
98
# 2.6, and also 3.2:
87
99
from IN import SO_BINDTODEVICE
88
100
except ImportError:
89
SO_BINDTODEVICE = None
90
91
version = "1.6.1"
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
103
try:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
"/dev/stdin"],
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
112
# No value found
113
SO_BINDTODEVICE = None
114
115
if sys.version_info.major == 2:
116
str = unicode
117
118
version = "1.7.16"
92
119
stored_state_file = "clients.pickle"
93
120
94
121
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
122
syslogger = None
98
123
99
124
try:
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
103
127
except (OSError, AttributeError):
128
104
129
def if_nametoindex(interface):
105
130
"Get an interface index the hard way, i.e. using fcntl()"
106
131
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
132
with contextlib.closing(socket.socket()) as s:
108
133
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
136
return interface_index
114
137
115
138
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
143
func.func_globals,
144
func.func_name,
145
func.func_defaults,
146
func.func_closure)
147
else:
148
return types.FunctionType(func.__code__,
149
func.__globals__,
150
func.__name__,
151
func.__defaults__,
152
func.__closure__)
153
154
116
155
def initlogger(debug, level=logging.WARNING):
117
156
"""init logger and add loglevel"""
118
157
158
global syslogger
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
address="/dev/log"))
119
162
syslogger.setFormatter(logging.Formatter
120
163
('Mandos [%(process)d]: %(levelname)s:'
121
164
' %(message)s'))
122
165
logger.addHandler(syslogger)
123
166
124
167
if debug:
125
168
console = logging.StreamHandler()
126
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
138
181
139
182
class PGPEngine(object):
140
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
184
141
185
def __init__(self):
142
186
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
187
self.gpg = "gpg"
188
try:
189
output = subprocess.check_output(["gpgconf"])
190
for line in output.splitlines():
191
name, text, path = line.split(b":")
192
if name == "gpg":
193
self.gpg = path
194
break
195
except OSError as e:
196
if e.errno != errno.ENOENT:
197
raise
143
198
self.gnupgargs = ['--batch',
144
'--home', self.tempdir,
199
'--homedir', self.tempdir,
145
200
'--force-mdc',
146
'--quiet',
147
'--no-use-agent']
148
201
'--quiet']
202
# Only GPG version 1 has the --no-use-agent option.
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
self.gnupgargs.append("--no-use-agent")
205
149
206
def __enter__(self):
150
207
return self
151
208
152
209
def __exit__(self, exc_type, exc_value, traceback):
153
210
self._cleanup()
154
211
return False
155
212
156
213
def __del__(self):
157
214
self._cleanup()
158
215
159
216
def _cleanup(self):
160
217
if self.tempdir is not None:
161
218
# Delete contents of tempdir
162
219
for root, dirs, files in os.walk(self.tempdir,
163
topdown = False):
220
topdown=False):
164
221
for filename in files:
165
222
os.remove(os.path.join(root, filename))
166
223
for dirname in dirs:
168
225
# Remove tempdir
169
226
os.rmdir(self.tempdir)
170
227
self.tempdir = None
171
228
172
229
def password_encode(self, password):
173
230
# Passphrase can not be empty and can not contain newlines or
174
231
# NUL bytes. So we prefix it and hex encode it.
179
236
.replace(b"\n", b"\\n")
180
237
.replace(b"\0", b"\\x00"))
181
238
return encoded
182
239
183
240
def encrypt(self, data, password):
184
241
passphrase = self.password_encode(password)
185
with tempfile.NamedTemporaryFile(dir=self.tempdir
186
) as passfile:
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
187
244
passfile.write(passphrase)
188
245
passfile.flush()
189
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
190
247
'--passphrase-file',
191
248
passfile.name]
192
249
+ self.gnupgargs,
193
stdin = subprocess.PIPE,
194
stdout = subprocess.PIPE,
195
stderr = subprocess.PIPE)
196
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
197
254
if proc.returncode != 0:
198
255
raise PGPError(err)
199
256
return ciphertext
200
257
201
258
def decrypt(self, data, password):
202
259
passphrase = self.password_encode(password)
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
204
) as passfile:
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
205
262
passfile.write(passphrase)
206
263
passfile.flush()
207
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
208
265
'--passphrase-file',
209
266
passfile.name]
210
267
+ self.gnupgargs,
211
stdin = subprocess.PIPE,
212
stdout = subprocess.PIPE,
213
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
215
= data)
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
216
272
if proc.returncode != 0:
217
273
raise PGPError(err)
218
274
return decrypted_plaintext
219
275
220
276
277
# Pretend that we have an Avahi module
278
class Avahi(object):
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
289
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
avahi = Avahi()
302
303
221
304
class AvahiError(Exception):
222
305
def __init__(self, value, *args, **kwargs):
223
306
self.value = value
224
super(AvahiError, self).__init__(value, *args, **kwargs)
225
def __unicode__(self):
226
return unicode(repr(self.value))
307
return super(AvahiError, self).__init__(value, *args,
308
**kwargs)
309
227
310
228
311
class AvahiServiceError(AvahiError):
229
312
pass
230
313
314
231
315
class AvahiGroupError(AvahiError):
232
316
pass
233
317
234
318
235
319
class AvahiService(object):
236
320
"""An Avahi (Zeroconf) service.
237
321
238
322
Attributes:
239
323
interface: integer; avahi.IF_UNSPEC or an interface index.
240
324
Used to optionally bind to the specified interface.
252
336
server: D-Bus Server
253
337
bus: dbus.SystemBus()
254
338
"""
255
256
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
257
servicetype = None, port = None, TXT = None,
258
domain = "", host = "", max_renames = 32768,
259
protocol = avahi.PROTO_UNSPEC, bus = None):
339
340
def __init__(self,
341
interface=avahi.IF_UNSPEC,
342
name=None,
343
servicetype=None,
344
port=None,
345
TXT=None,
346
domain="",
347
host="",
348
max_renames=32768,
349
protocol=avahi.PROTO_UNSPEC,
350
bus=None):
260
351
self.interface = interface
261
352
self.name = name
262
353
self.type = servicetype
271
362
self.server = None
272
363
self.bus = bus
273
364
self.entry_group_state_changed_match = None
274
275
def rename(self):
365
366
def rename(self, remove=True):
276
367
"""Derived from the Avahi example code"""
277
368
if self.rename_count >= self.max_renames:
278
369
logger.critical("No suitable Zeroconf service name found"
279
370
" after %i retries, exiting.",
280
371
self.rename_count)
281
372
raise AvahiServiceError("Too many renames")
282
self.name = unicode(self.server
283
.GetAlternativeServiceName(self.name))
373
self.name = str(
374
self.server.GetAlternativeServiceName(self.name))
375
self.rename_count += 1
284
376
logger.info("Changing Zeroconf service name to %r ...",
285
377
self.name)
286
self.remove()
378
if remove:
379
self.remove()
287
380
try:
288
381
self.add()
289
382
except dbus.exceptions.DBusException as error:
290
logger.critical("D-Bus Exception", exc_info=error)
291
self.cleanup()
292
os._exit(1)
293
self.rename_count += 1
294
383
if (error.get_dbus_name()
384
== "org.freedesktop.Avahi.CollisionError"):
385
logger.info("Local Zeroconf service name collision.")
386
return self.rename(remove=False)
387
else:
388
logger.critical("D-Bus Exception", exc_info=error)
389
self.cleanup()
390
os._exit(1)
391
295
392
def remove(self):
296
393
"""Derived from the Avahi example code"""
297
394
if self.entry_group_state_changed_match is not None:
299
396
self.entry_group_state_changed_match = None
300
397
if self.group is not None:
301
398
self.group.Reset()
302
399
303
400
def add(self):
304
401
"""Derived from the Avahi example code"""
305
402
self.remove()
322
419
dbus.UInt16(self.port),
323
420
avahi.string_array_to_txt_array(self.TXT))
324
421
self.group.Commit()
325
422
326
423
def entry_group_state_changed(self, state, error):
327
424
"""Derived from the Avahi example code"""
328
425
logger.debug("Avahi entry group state change: %i", state)
329
426
330
427
if state == avahi.ENTRY_GROUP_ESTABLISHED:
331
428
logger.debug("Zeroconf service established.")
332
429
elif state == avahi.ENTRY_GROUP_COLLISION:
334
431
self.rename()
335
432
elif state == avahi.ENTRY_GROUP_FAILURE:
336
433
logger.critical("Avahi: Error in group state changed %s",
337
unicode(error))
338
raise AvahiGroupError("State changed: {0!s}"
339
.format(error))
340
434
str(error))
435
raise AvahiGroupError("State changed: {!s}".format(error))
436
341
437
def cleanup(self):
342
438
"""Derived from the Avahi example code"""
343
439
if self.group is not None:
348
444
pass
349
445
self.group = None
350
446
self.remove()
351
447
352
448
def server_state_changed(self, state, error=None):
353
449
"""Derived from the Avahi example code"""
354
450
logger.debug("Avahi server state change: %i", state)
355
bad_states = { avahi.SERVER_INVALID:
356
"Zeroconf server invalid",
357
avahi.SERVER_REGISTERING: None,
358
avahi.SERVER_COLLISION:
359
"Zeroconf server name collision",
360
avahi.SERVER_FAILURE:
361
"Zeroconf server failure" }
451
bad_states = {
452
avahi.SERVER_INVALID: "Zeroconf server invalid",
453
avahi.SERVER_REGISTERING: None,
454
avahi.SERVER_COLLISION: "Zeroconf server name collision",
455
avahi.SERVER_FAILURE: "Zeroconf server failure",
456
}
362
457
if state in bad_states:
363
458
if bad_states[state] is not None:
364
459
if error is None:
367
462
logger.error(bad_states[state] + ": %r", error)
368
463
self.cleanup()
369
464
elif state == avahi.SERVER_RUNNING:
370
self.add()
465
try:
466
self.add()
467
except dbus.exceptions.DBusException as error:
468
if (error.get_dbus_name()
469
== "org.freedesktop.Avahi.CollisionError"):
470
logger.info("Local Zeroconf service name"
471
" collision.")
472
return self.rename(remove=False)
473
else:
474
logger.critical("D-Bus Exception", exc_info=error)
475
self.cleanup()
476
os._exit(1)
371
477
else:
372
478
if error is None:
373
479
logger.debug("Unknown state: %r", state)
374
480
else:
375
481
logger.debug("Unknown state: %r: %r", state, error)
376
482
377
483
def activate(self):
378
484
"""Derived from the Avahi example code"""
379
485
if self.server is None:
383
489
follow_name_owner_changes=True),
384
490
avahi.DBUS_INTERFACE_SERVER)
385
491
self.server.connect_to_signal("StateChanged",
386
self.server_state_changed)
492
self.server_state_changed)
387
493
self.server_state_changed(self.server.GetState())
388
494
389
495
390
496
class AvahiServiceToSyslog(AvahiService):
391
def rename(self):
497
def rename(self, *args, **kwargs):
392
498
"""Add the new name to the syslog messages"""
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({0}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
397
.format(self.name)))
499
ret = super(AvahiServiceToSyslog, self).rename(self, *args,
500
**kwargs)
501
syslogger.setFormatter(logging.Formatter(
502
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
503
.format(self.name)))
398
504
return ret
399
505
400
506
401
def timedelta_to_milliseconds(td):
402
"Convert a datetime.timedelta() to milliseconds"
403
return ((td.days * 24 * 60 * 60 * 1000)
404
+ (td.seconds * 1000)
405
+ (td.microseconds // 1000))
507
# Pretend that we have a GnuTLS module
508
class GnuTLS(object):
509
"""This isn't so much a class as it is a module-like namespace.
510
It is instantiated once, and simulates having a GnuTLS module."""
511
512
library = ctypes.util.find_library("gnutls")
513
if library is None:
514
library = ctypes.util.find_library("gnutls-deb0")
515
_library = ctypes.cdll.LoadLibrary(library)
516
del library
517
_need_version = b"3.3.0"
518
519
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
525
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
528
529
# Constants
530
E_SUCCESS = 0
531
E_INTERRUPTED = -52
532
E_AGAIN = -28
533
CRT_OPENPGP = 2
534
CLIENT = 2
535
SHUT_RDWR = 0
536
CRD_CERTIFICATE = 1
537
E_NO_CERTIFICATE_FOUND = -49
538
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
539
540
# Types
541
class session_int(ctypes.Structure):
542
_fields_ = []
543
session_t = ctypes.POINTER(session_int)
544
545
class certificate_credentials_st(ctypes.Structure):
546
_fields_ = []
547
certificate_credentials_t = ctypes.POINTER(
548
certificate_credentials_st)
549
certificate_type_t = ctypes.c_int
550
551
class datum_t(ctypes.Structure):
552
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
553
('size', ctypes.c_uint)]
554
555
class openpgp_crt_int(ctypes.Structure):
556
_fields_ = []
557
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
558
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
559
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
560
credentials_type_t = ctypes.c_int
561
transport_ptr_t = ctypes.c_void_p
562
close_request_t = ctypes.c_int
563
564
# Exceptions
565
class Error(Exception):
566
# We need to use the class name "GnuTLS" here, since this
567
# exception might be raised from within GnuTLS.__init__,
568
# which is called before the assignment to the "gnutls"
569
# global variable has happened.
570
def __init__(self, message=None, code=None, args=()):
571
# Default usage is by a message string, but if a return
572
# code is passed, convert it to a string with
573
# gnutls.strerror()
574
self.code = code
575
if message is None and code is not None:
576
message = GnuTLS.strerror(code)
577
return super(GnuTLS.Error, self).__init__(
578
message, *args)
579
580
class CertificateSecurityError(Error):
581
pass
582
583
# Classes
584
class Credentials(object):
585
def __init__(self):
586
self._c_object = gnutls.certificate_credentials_t()
587
gnutls.certificate_allocate_credentials(
588
ctypes.byref(self._c_object))
589
self.type = gnutls.CRD_CERTIFICATE
590
591
def __del__(self):
592
gnutls.certificate_free_credentials(self._c_object)
593
594
class ClientSession(object):
595
def __init__(self, socket, credentials=None):
596
self._c_object = gnutls.session_t()
597
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
598
gnutls.set_default_priority(self._c_object)
599
gnutls.transport_set_ptr(self._c_object, socket.fileno())
600
gnutls.handshake_set_private_extensions(self._c_object,
601
True)
602
self.socket = socket
603
if credentials is None:
604
credentials = gnutls.Credentials()
605
gnutls.credentials_set(self._c_object, credentials.type,
606
ctypes.cast(credentials._c_object,
607
ctypes.c_void_p))
608
self.credentials = credentials
609
610
def __del__(self):
611
gnutls.deinit(self._c_object)
612
613
def handshake(self):
614
return gnutls.handshake(self._c_object)
615
616
def send(self, data):
617
data = bytes(data)
618
data_len = len(data)
619
while data_len > 0:
620
data_len -= gnutls.record_send(self._c_object,
621
data[-data_len:],
622
data_len)
623
624
def bye(self):
625
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
626
627
# Error handling functions
628
def _error_code(result):
629
"""A function to raise exceptions on errors, suitable
630
for the 'restype' attribute on ctypes functions"""
631
if result >= 0:
632
return result
633
if result == gnutls.E_NO_CERTIFICATE_FOUND:
634
raise gnutls.CertificateSecurityError(code=result)
635
raise gnutls.Error(code=result)
636
637
def _retry_on_error(result, func, arguments):
638
"""A function to retry on some errors, suitable
639
for the 'errcheck' attribute on ctypes functions"""
640
while result < 0:
641
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
642
return _error_code(result)
643
result = func(*arguments)
644
return result
645
646
# Unless otherwise indicated, the function declarations below are
647
# all from the gnutls/gnutls.h C header file.
648
649
# Functions
650
priority_set_direct = _library.gnutls_priority_set_direct
651
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
652
ctypes.POINTER(ctypes.c_char_p)]
653
priority_set_direct.restype = _error_code
654
655
init = _library.gnutls_init
656
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
657
init.restype = _error_code
658
659
set_default_priority = _library.gnutls_set_default_priority
660
set_default_priority.argtypes = [session_t]
661
set_default_priority.restype = _error_code
662
663
record_send = _library.gnutls_record_send
664
record_send.argtypes = [session_t, ctypes.c_void_p,
665
ctypes.c_size_t]
666
record_send.restype = ctypes.c_ssize_t
667
record_send.errcheck = _retry_on_error
668
669
certificate_allocate_credentials = (
670
_library.gnutls_certificate_allocate_credentials)
671
certificate_allocate_credentials.argtypes = [
672
ctypes.POINTER(certificate_credentials_t)]
673
certificate_allocate_credentials.restype = _error_code
674
675
certificate_free_credentials = (
676
_library.gnutls_certificate_free_credentials)
677
certificate_free_credentials.argtypes = [
678
certificate_credentials_t]
679
certificate_free_credentials.restype = None
680
681
handshake_set_private_extensions = (
682
_library.gnutls_handshake_set_private_extensions)
683
handshake_set_private_extensions.argtypes = [session_t,
684
ctypes.c_int]
685
handshake_set_private_extensions.restype = None
686
687
credentials_set = _library.gnutls_credentials_set
688
credentials_set.argtypes = [session_t, credentials_type_t,
689
ctypes.c_void_p]
690
credentials_set.restype = _error_code
691
692
strerror = _library.gnutls_strerror
693
strerror.argtypes = [ctypes.c_int]
694
strerror.restype = ctypes.c_char_p
695
696
certificate_type_get = _library.gnutls_certificate_type_get
697
certificate_type_get.argtypes = [session_t]
698
certificate_type_get.restype = _error_code
699
700
certificate_get_peers = _library.gnutls_certificate_get_peers
701
certificate_get_peers.argtypes = [session_t,
702
ctypes.POINTER(ctypes.c_uint)]
703
certificate_get_peers.restype = ctypes.POINTER(datum_t)
704
705
global_set_log_level = _library.gnutls_global_set_log_level
706
global_set_log_level.argtypes = [ctypes.c_int]
707
global_set_log_level.restype = None
708
709
global_set_log_function = _library.gnutls_global_set_log_function
710
global_set_log_function.argtypes = [log_func]
711
global_set_log_function.restype = None
712
713
deinit = _library.gnutls_deinit
714
deinit.argtypes = [session_t]
715
deinit.restype = None
716
717
handshake = _library.gnutls_handshake
718
handshake.argtypes = [session_t]
719
handshake.restype = _error_code
720
handshake.errcheck = _retry_on_error
721
722
transport_set_ptr = _library.gnutls_transport_set_ptr
723
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
724
transport_set_ptr.restype = None
725
726
bye = _library.gnutls_bye
727
bye.argtypes = [session_t, close_request_t]
728
bye.restype = _error_code
729
bye.errcheck = _retry_on_error
730
731
check_version = _library.gnutls_check_version
732
check_version.argtypes = [ctypes.c_char_p]
733
check_version.restype = ctypes.c_char_p
734
735
# All the function declarations below are from gnutls/openpgp.h
736
737
openpgp_crt_init = _library.gnutls_openpgp_crt_init
738
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
739
openpgp_crt_init.restype = _error_code
740
741
openpgp_crt_import = _library.gnutls_openpgp_crt_import
742
openpgp_crt_import.argtypes = [openpgp_crt_t,
743
ctypes.POINTER(datum_t),
744
openpgp_crt_fmt_t]
745
openpgp_crt_import.restype = _error_code
746
747
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
748
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
749
ctypes.POINTER(ctypes.c_uint)]
750
openpgp_crt_verify_self.restype = _error_code
751
752
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
753
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
754
openpgp_crt_deinit.restype = None
755
756
openpgp_crt_get_fingerprint = (
757
_library.gnutls_openpgp_crt_get_fingerprint)
758
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
759
ctypes.c_void_p,
760
ctypes.POINTER(
761
ctypes.c_size_t)]
762
openpgp_crt_get_fingerprint.restype = _error_code
763
764
# Remove non-public functions
765
del _error_code, _retry_on_error
766
# Create the global "gnutls" object, simulating a module
767
gnutls = GnuTLS()
768
769
770
def call_pipe(connection, # : multiprocessing.Connection
771
func, *args, **kwargs):
772
"""This function is meant to be called by multiprocessing.Process
773
774
This function runs func(*args, **kwargs), and writes the resulting
775
return value on the provided multiprocessing.Connection.
776
"""
777
connection.send(func(*args, **kwargs))
778
connection.close()
406
779
407
780
408
781
class Client(object):
409
782
"""A representation of a client host served by this server.
410
783
411
784
Attributes:
412
785
approved: bool(); 'None' if not yet approved/disapproved
413
786
approval_delay: datetime.timedelta(); Time to wait for approval
415
788
checker: subprocess.Popen(); a running checker process used
416
789
to see if the client lives.
417
790
'None' if no process is running.
418
checker_callback_tag: a gobject event source tag, or None
791
checker_callback_tag: a GLib event source tag, or None
419
792
checker_command: string; External command which is run to check
420
793
if client lives. %() expansions are done at
421
794
runtime with vars(self) as dict, so that for
422
795
instance %(name)s can be used in the command.
423
checker_initiator_tag: a gobject event source tag, or None
796
checker_initiator_tag: a GLib event source tag, or None
424
797
created: datetime.datetime(); (UTC) object creation
425
798
client_structure: Object describing what attributes a client has
426
799
and is used for storing the client at exit
427
800
current_checker_command: string; current running checker_command
428
disable_initiator_tag: a gobject event source tag, or None
801
disable_initiator_tag: a GLib event source tag, or None
429
802
enabled: bool()
430
803
fingerprint: string (40 or 32 hexadecimal digits); used to
431
804
uniquely identify the client
436
809
last_checker_status: integer between 0 and 255 reflecting exit
437
810
status of last checker. -1 reflects crashed
438
811
checker, -2 means no checker completed yet.
812
last_checker_signal: The signal which killed the last checker, if
813
last_checker_status is -1
439
814
last_enabled: datetime.datetime(); (UTC) or None
440
815
name: string; from the config file, used in log messages and
441
816
D-Bus identifiers
448
823
disabled, or None
449
824
server_settings: The server_settings dict from main()
450
825
"""
451
826
452
827
runtime_expansions = ("approval_delay", "approval_duration",
453
828
"created", "enabled", "expires",
454
829
"fingerprint", "host", "interval",
455
830
"last_approval_request", "last_checked_ok",
456
831
"last_enabled", "name", "timeout")
457
client_defaults = { "timeout": "PT5M",
458
"extended_timeout": "PT15M",
459
"interval": "PT2M",
460
"checker": "fping -q -- %%(host)s",
461
"host": "",
462
"approval_delay": "PT0S",
463
"approval_duration": "PT1S",
464
"approved_by_default": "True",
465
"enabled": "True",
466
}
467
468
def timeout_milliseconds(self):
469
"Return the 'timeout' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.timeout)
471
472
def extended_timeout_milliseconds(self):
473
"Return the 'extended_timeout' attribute in milliseconds"
474
return timedelta_to_milliseconds(self.extended_timeout)
475
476
def interval_milliseconds(self):
477
"Return the 'interval' attribute in milliseconds"
478
return timedelta_to_milliseconds(self.interval)
479
480
def approval_delay_milliseconds(self):
481
return timedelta_to_milliseconds(self.approval_delay)
482
832
client_defaults = {
833
"timeout": "PT5M",
834
"extended_timeout": "PT15M",
835
"interval": "PT2M",
836
"checker": "fping -q -- %%(host)s",
837
"host": "",
838
"approval_delay": "PT0S",
839
"approval_duration": "PT1S",
840
"approved_by_default": "True",
841
"enabled": "True",
842
}
843
483
844
@staticmethod
484
845
def config_parser(config):
485
846
"""Construct a new dict of client settings of this form:
492
853
for client_name in config.sections():
493
854
section = dict(config.items(client_name))
494
855
client = settings[client_name] = {}
495
856
496
857
client["host"] = section["host"]
497
858
# Reformat values from string types to Python types
498
859
client["approved_by_default"] = config.getboolean(
499
860
client_name, "approved_by_default")
500
861
client["enabled"] = config.getboolean(client_name,
501
862
"enabled")
502
863
864
# Uppercase and remove spaces from fingerprint for later
865
# comparison purposes with return value from the
866
# fingerprint() function
503
867
client["fingerprint"] = (section["fingerprint"].upper()
504
868
.replace(" ", ""))
505
869
if "secret" in section:
506
client["secret"] = section["secret"].decode("base64")
870
client["secret"] = codecs.decode(section["secret"]
871
.encode("utf-8"),
872
"base64")
507
873
elif "secfile" in section:
508
874
with open(os.path.expanduser(os.path.expandvars
509
875
(section["secfile"])),
510
876
"rb") as secfile:
511
877
client["secret"] = secfile.read()
512
878
else:
513
raise TypeError("No secret or secfile for section {0}"
879
raise TypeError("No secret or secfile for section {}"
514
880
.format(section))
515
881
client["timeout"] = string_to_delta(section["timeout"])
516
882
client["extended_timeout"] = string_to_delta(
524
890
client["last_approval_request"] = None
525
891
client["last_checked_ok"] = None
526
892
client["last_checker_status"] = -2
527
893
528
894
return settings
529
530
def __init__(self, settings, name = None, server_settings=None):
895
896
def __init__(self, settings, name=None, server_settings=None):
531
897
self.name = name
532
898
if server_settings is None:
533
899
server_settings = {}
534
900
self.server_settings = server_settings
535
901
# adding all client settings
536
for setting, value in settings.iteritems():
902
for setting, value in settings.items():
537
903
setattr(self, setting, value)
538
904
539
905
if self.enabled:
540
906
if not hasattr(self, "last_enabled"):
541
907
self.last_enabled = datetime.datetime.utcnow()
545
911
else:
546
912
self.last_enabled = None
547
913
self.expires = None
548
914
549
915
logger.debug("Creating client %r", self.name)
550
# Uppercase and remove spaces from fingerprint for later
551
# comparison purposes with return value from the fingerprint()
552
# function
553
916
logger.debug(" Fingerprint: %s", self.fingerprint)
554
917
self.created = settings.get("created",
555
918
datetime.datetime.utcnow())
556
919
557
920
# attributes specific for this server instance
558
921
self.checker = None
559
922
self.checker_initiator_tag = None
562
925
self.current_checker_command = None
563
926
self.approved = None
564
927
self.approvals_pending = 0
565
self.changedstate = (multiprocessing_manager
566
.Condition(multiprocessing_manager
567
.Lock()))
568
self.client_structure = [attr for attr in
569
self.__dict__.iterkeys()
928
self.changedstate = multiprocessing_manager.Condition(
929
multiprocessing_manager.Lock())
930
self.client_structure = [attr
931
for attr in self.__dict__.keys()
570
932
if not attr.startswith("_")]
571
933
self.client_structure.append("client_structure")
572
573
for name, t in inspect.getmembers(type(self),
574
lambda obj:
575
isinstance(obj,
576
property)):
934
935
for name, t in inspect.getmembers(
936
type(self), lambda obj: isinstance(obj, property)):
577
937
if not name.startswith("_"):
578
938
self.client_structure.append(name)
579
939
580
940
# Send notice to process children that client state has changed
581
941
def send_changedstate(self):
582
942
with self.changedstate:
583
943
self.changedstate.notify_all()
584
944
585
945
def enable(self):
586
946
"""Start this client's checker and timeout hooks"""
587
947
if getattr(self, "enabled", False):
592
952
self.last_enabled = datetime.datetime.utcnow()
593
953
self.init_checker()
594
954
self.send_changedstate()
595
955
596
956
def disable(self, quiet=True):
597
957
"""Disable this client."""
598
958
if not getattr(self, "enabled", False):
600
960
if not quiet:
601
961
logger.info("Disabling client %s", self.name)
602
962
if getattr(self, "disable_initiator_tag", None) is not None:
603
gobject.source_remove(self.disable_initiator_tag)
963
GLib.source_remove(self.disable_initiator_tag)
604
964
self.disable_initiator_tag = None
605
965
self.expires = None
606
966
if getattr(self, "checker_initiator_tag", None) is not None:
607
gobject.source_remove(self.checker_initiator_tag)
967
GLib.source_remove(self.checker_initiator_tag)
608
968
self.checker_initiator_tag = None
609
969
self.stop_checker()
610
970
self.enabled = False
611
971
if not quiet:
612
972
self.send_changedstate()
613
# Do not run this again if called by a gobject.timeout_add
973
# Do not run this again if called by a GLib.timeout_add
614
974
return False
615
975
616
976
def __del__(self):
617
977
self.disable()
618
978
619
979
def init_checker(self):
620
980
# Schedule a new checker to be started an 'interval' from now,
621
981
# and every interval from then on.
622
982
if self.checker_initiator_tag is not None:
623
gobject.source_remove(self.checker_initiator_tag)
624
self.checker_initiator_tag = (gobject.timeout_add
625
(self.interval_milliseconds(),
626
self.start_checker))
983
GLib.source_remove(self.checker_initiator_tag)
984
self.checker_initiator_tag = GLib.timeout_add(
985
int(self.interval.total_seconds() * 1000),
986
self.start_checker)
627
987
# Schedule a disable() when 'timeout' has passed
628
988
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
self.disable_initiator_tag = (gobject.timeout_add
631
(self.timeout_milliseconds(),
632
self.disable))
989
GLib.source_remove(self.disable_initiator_tag)
990
self.disable_initiator_tag = GLib.timeout_add(
991
int(self.timeout.total_seconds() * 1000), self.disable)
633
992
# Also start a new checker *right now*.
634
993
self.start_checker()
635
636
def checker_callback(self, pid, condition, command):
994
995
def checker_callback(self, source, condition, connection,
996
command):
637
997
"""The checker has completed, so take appropriate actions."""
638
998
self.checker_callback_tag = None
639
999
self.checker = None
640
if os.WIFEXITED(condition):
641
self.last_checker_status = os.WEXITSTATUS(condition)
1000
# Read return code from connection (see call_pipe)
1001
returncode = connection.recv()
1002
connection.close()
1003
1004
if returncode >= 0:
1005
self.last_checker_status = returncode
1006
self.last_checker_signal = None
642
1007
if self.last_checker_status == 0:
643
1008
logger.info("Checker for %(name)s succeeded",
644
1009
vars(self))
645
1010
self.checked_ok()
646
1011
else:
647
logger.info("Checker for %(name)s failed",
648
vars(self))
1012
logger.info("Checker for %(name)s failed", vars(self))
649
1013
else:
650
1014
self.last_checker_status = -1
1015
self.last_checker_signal = -returncode
651
1016
logger.warning("Checker for %(name)s crashed?",
652
1017
vars(self))
653
1018
return False
1019
654
1020
def checked_ok(self):
655
1021
"""Assert that the client has been seen, alive and well."""
656
1022
self.last_checked_ok = datetime.datetime.utcnow()
657
1023
self.last_checker_status = 0
1024
self.last_checker_signal = None
658
1025
self.bump_timeout()
659
1026
660
1027
def bump_timeout(self, timeout=None):
661
1028
"""Bump up the timeout for this client."""
662
1029
if timeout is None:
663
1030
timeout = self.timeout
664
1031
if self.disable_initiator_tag is not None:
665
gobject.source_remove(self.disable_initiator_tag)
1032
GLib.source_remove(self.disable_initiator_tag)
666
1033
self.disable_initiator_tag = None
667
1034
if getattr(self, "enabled", False):
668
self.disable_initiator_tag = (gobject.timeout_add
669
(timedelta_to_milliseconds
670
(timeout), self.disable))
1035
self.disable_initiator_tag = GLib.timeout_add(
1036
int(timeout.total_seconds() * 1000), self.disable)
671
1037
self.expires = datetime.datetime.utcnow() + timeout
672
1038
673
1039
def need_approval(self):
674
1040
self.last_approval_request = datetime.datetime.utcnow()
675
1041
676
1042
def start_checker(self):
677
1043
"""Start a new checker subprocess if one is not running.
678
1044
679
1045
If a checker already exists, leave it running and do
680
1046
nothing."""
681
1047
# The reason for not killing a running checker is that if we
686
1052
# checkers alone, the checker would have to take more time
687
1053
# than 'timeout' for the client to be disabled, which is as it
688
1054
# should be.
689
690
# If a checker exists, make sure it is not a zombie
691
try:
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except (AttributeError, OSError) as error:
694
if (isinstance(error, OSError)
695
and error.errno != errno.ECHILD):
696
raise error
697
else:
698
if pid:
699
logger.warning("Checker was a zombie")
700
gobject.source_remove(self.checker_callback_tag)
701
self.checker_callback(pid, status,
702
self.current_checker_command)
1055
1056
if self.checker is not None and not self.checker.is_alive():
1057
logger.warning("Checker was not alive; joining")
1058
self.checker.join()
1059
self.checker = None
703
1060
# Start a new checker if needed
704
1061
if self.checker is None:
705
1062
# Escape attributes for the shell
706
escaped_attrs = dict(
707
(attr, re.escape(unicode(getattr(self, attr))))
708
for attr in
709
self.runtime_expansions)
1063
escaped_attrs = {
1064
attr: re.escape(str(getattr(self, attr)))
1065
for attr in self.runtime_expansions}
710
1066
try:
711
1067
command = self.checker_command % escaped_attrs
712
1068
except TypeError as error:
713
1069
logger.error('Could not format string "%s"',
714
self.checker_command, exc_info=error)
715
return True # Try again later
1070
self.checker_command,
1071
exc_info=error)
1072
return True # Try again later
716
1073
self.current_checker_command = command
717
try:
718
logger.info("Starting checker %r for %s",
719
command, self.name)
720
# We don't need to redirect stdout and stderr, since
721
# in normal mode, that is already done by daemon(),
722
# and in debug mode we don't want to. (Stdin is
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
726
# created wnull.
727
popen_args = {}
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
731
"stderr": wnull })
732
self.checker = subprocess.Popen(command,
733
close_fds=True,
734
shell=True, cwd="/",
735
**popen_args)
736
except OSError as error:
737
logger.error("Failed to start subprocess",
738
exc_info=error)
739
return True
740
self.checker_callback_tag = (gobject.child_watch_add
741
(self.checker.pid,
742
self.checker_callback,
743
data=command))
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
746
try:
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
752
exc_info=error)
753
return True
754
raise
755
if pid:
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1074
logger.info("Starting checker %r for %s", command,
1075
self.name)
1076
# We don't need to redirect stdout and stderr, since
1077
# in normal mode, that is already done by daemon(),
1078
# and in debug mode we don't want to. (Stdin is
1079
# always replaced by /dev/null.)
1080
# The exception is when not debugging but nevertheless
1081
# running in the foreground; use the previously
1082
# created wnull.
1083
popen_args = {"close_fds": True,
1084
"shell": True,
1085
"cwd": "/"}
1086
if (not self.server_settings["debug"]
1087
and self.server_settings["foreground"]):
1088
popen_args.update({"stdout": wnull,
1089
"stderr": wnull})
1090
pipe = multiprocessing.Pipe(duplex=False)
1091
self.checker = multiprocessing.Process(
1092
target=call_pipe,
1093
args=(pipe[1], subprocess.call, command),
1094
kwargs=popen_args)
1095
self.checker.start()
1096
self.checker_callback_tag = GLib.io_add_watch(
1097
pipe[0].fileno(), GLib.IO_IN,
1098
self.checker_callback, pipe[0], command)
1099
# Re-run this periodically if run by GLib.timeout_add
759
1100
return True
760
1101
761
1102
def stop_checker(self):
762
1103
"""Force the checker process, if any, to stop."""
763
1104
if self.checker_callback_tag:
764
gobject.source_remove(self.checker_callback_tag)
1105
GLib.source_remove(self.checker_callback_tag)
765
1106
self.checker_callback_tag = None
766
1107
if getattr(self, "checker", None) is None:
767
1108
return
768
1109
logger.debug("Stopping checker for %(name)s", vars(self))
769
try:
770
self.checker.terminate()
771
#time.sleep(0.5)
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
776
raise
1110
self.checker.terminate()
777
1111
self.checker = None
778
1112
779
1113
780
def dbus_service_property(dbus_interface, signature="v",
781
access="readwrite", byte_arrays=False):
1114
def dbus_service_property(dbus_interface,
1115
signature="v",
1116
access="readwrite",
1117
byte_arrays=False):
782
1118
"""Decorators for marking methods of a DBusObjectWithProperties to
783
1119
become properties on the D-Bus.
784
1120
785
1121
The decorated method will be called with no arguments by "Get"
786
1122
and with one argument by "Set".
787
1123
788
1124
The parameters, where they are supported, are the same as
789
1125
dbus.service.method, except there is only "signature", since the
790
1126
type from Get() and the type sent to Set() is the same.
793
1129
# "Set" method, so we fail early here:
794
1130
if byte_arrays and signature != "ay":
795
1131
raise ValueError("Byte arrays not supported for non-'ay'"
796
" signature {0!r}".format(signature))
1132
" signature {!r}".format(signature))
1133
797
1134
def decorator(func):
798
1135
func._dbus_is_property = True
799
1136
func._dbus_interface = dbus_interface
802
1139
func._dbus_name = func.__name__
803
1140
if func._dbus_name.endswith("_dbus_property"):
804
1141
func._dbus_name = func._dbus_name[:-14]
805
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1142
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
806
1143
return func
1144
807
1145
return decorator
808
1146
809
1147
810
1148
def dbus_interface_annotations(dbus_interface):
811
1149
"""Decorator for marking functions returning interface annotations
812
1150
813
1151
Usage:
814
1152
815
1153
@dbus_interface_annotations("org.example.Interface")
816
1154
def _foo(self): # Function name does not matter
817
1155
return {"org.freedesktop.DBus.Deprecated": "true",
818
1156
"org.freedesktop.DBus.Property.EmitsChangedSignal":
819
1157
"false"}
820
1158
"""
1159
821
1160
def decorator(func):
822
1161
func._dbus_is_interface = True
823
1162
func._dbus_interface = dbus_interface
824
1163
func._dbus_name = dbus_interface
825
1164
return func
1165
826
1166
return decorator
827
1167
828
1168
829
1169
def dbus_annotations(annotations):
830
1170
"""Decorator to annotate D-Bus methods, signals or properties
831
1171
Usage:
832
1172
1173
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1174
"org.freedesktop.DBus.Property."
1175
"EmitsChangedSignal": "false"})
833
1176
@dbus_service_property("org.example.Interface", signature="b",
834
1177
access="r")
835
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
836
"org.freedesktop.DBus.Property."
837
"EmitsChangedSignal": "false"})
838
1178
def Property_dbus_property(self):
839
1179
return dbus.Boolean(False)
1180
1181
See also the DBusObjectWithAnnotations class.
840
1182
"""
1183
841
1184
def decorator(func):
842
1185
func._dbus_annotations = annotations
843
1186
return func
1187
844
1188
return decorator
845
1189
846
1190
847
1191
class DBusPropertyException(dbus.exceptions.DBusException):
848
1192
"""A base class for D-Bus property-related exceptions
849
1193
"""
850
def __unicode__(self):
851
return unicode(str(self))
1194
pass
852
1195
853
1196
854
1197
class DBusPropertyAccessException(DBusPropertyException):
863
1206
pass
864
1207
865
1208
866
class DBusObjectWithProperties(dbus.service.Object):
867
"""A D-Bus object with properties.
868
869
Classes inheriting from this can use the dbus_service_property
870
decorator to expose methods as D-Bus properties. It exposes the
871
standard Get(), Set(), and GetAll() methods on the D-Bus.
1209
class DBusObjectWithAnnotations(dbus.service.Object):
1210
"""A D-Bus object with annotations.
1211
1212
Classes inheriting from this can use the dbus_annotations
1213
decorator to add annotations to methods or signals.
872
1214
"""
873
1215
874
1216
@staticmethod
875
1217
def _is_dbus_thing(thing):
876
1218
"""Returns a function testing if an attribute is a D-Bus thing
877
1219
878
1220
If called like _is_dbus_thing("method") it returns a function
879
1221
suitable for use as predicate to inspect.getmembers().
880
1222
"""
881
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1223
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
882
1224
False)
883
1225
884
1226
def _get_all_dbus_things(self, thing):
885
1227
"""Returns a generator of (name, attribute) pairs
886
1228
"""
887
return ((getattr(athing.__get__(self), "_dbus_name",
888
name),
1229
return ((getattr(athing.__get__(self), "_dbus_name", name),
889
1230
athing.__get__(self))
890
1231
for cls in self.__class__.__mro__
891
1232
for name, athing in
892
inspect.getmembers(cls,
893
self._is_dbus_thing(thing)))
894
1233
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1234
1235
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1236
out_signature="s",
1237
path_keyword='object_path',
1238
connection_keyword='connection')
1239
def Introspect(self, object_path, connection):
1240
"""Overloading of standard D-Bus method.
1241
1242
Inserts annotation tags on methods and signals.
1243
"""
1244
xmlstring = dbus.service.Object.Introspect(self, object_path,
1245
connection)
1246
try:
1247
document = xml.dom.minidom.parseString(xmlstring)
1248
1249
for if_tag in document.getElementsByTagName("interface"):
1250
# Add annotation tags
1251
for typ in ("method", "signal"):
1252
for tag in if_tag.getElementsByTagName(typ):
1253
annots = dict()
1254
for name, prop in (self.
1255
_get_all_dbus_things(typ)):
1256
if (name == tag.getAttribute("name")
1257
and prop._dbus_interface
1258
== if_tag.getAttribute("name")):
1259
annots.update(getattr(
1260
prop, "_dbus_annotations", {}))
1261
for name, value in annots.items():
1262
ann_tag = document.createElement(
1263
"annotation")
1264
ann_tag.setAttribute("name", name)
1265
ann_tag.setAttribute("value", value)
1266
tag.appendChild(ann_tag)
1267
# Add interface annotation tags
1268
for annotation, value in dict(
1269
itertools.chain.from_iterable(
1270
annotations().items()
1271
for name, annotations
1272
in self._get_all_dbus_things("interface")
1273
if name == if_tag.getAttribute("name")
1274
)).items():
1275
ann_tag = document.createElement("annotation")
1276
ann_tag.setAttribute("name", annotation)
1277
ann_tag.setAttribute("value", value)
1278
if_tag.appendChild(ann_tag)
1279
# Fix argument name for the Introspect method itself
1280
if (if_tag.getAttribute("name")
1281
== dbus.INTROSPECTABLE_IFACE):
1282
for cn in if_tag.getElementsByTagName("method"):
1283
if cn.getAttribute("name") == "Introspect":
1284
for arg in cn.getElementsByTagName("arg"):
1285
if (arg.getAttribute("direction")
1286
== "out"):
1287
arg.setAttribute("name",
1288
"xml_data")
1289
xmlstring = document.toxml("utf-8")
1290
document.unlink()
1291
except (AttributeError, xml.dom.DOMException,
1292
xml.parsers.expat.ExpatError) as error:
1293
logger.error("Failed to override Introspection method",
1294
exc_info=error)
1295
return xmlstring
1296
1297
1298
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1299
"""A D-Bus object with properties.
1300
1301
Classes inheriting from this can use the dbus_service_property
1302
decorator to expose methods as D-Bus properties. It exposes the
1303
standard Get(), Set(), and GetAll() methods on the D-Bus.
1304
"""
1305
895
1306
def _get_dbus_property(self, interface_name, property_name):
896
1307
"""Returns a bound method if one exists which is a D-Bus
897
1308
property with the specified name and interface.
898
1309
"""
899
for cls in self.__class__.__mro__:
900
for name, value in (inspect.getmembers
901
(cls,
902
self._is_dbus_thing("property"))):
1310
for cls in self.__class__.__mro__:
1311
for name, value in inspect.getmembers(
1312
cls, self._is_dbus_thing("property")):
903
1313
if (value._dbus_name == property_name
904
1314
and value._dbus_interface == interface_name):
905
1315
return value.__get__(self)
906
1316
907
1317
# No such property
908
raise DBusPropertyNotFound(self.dbus_object_path + ":"
909
+ interface_name + "."
910
+ property_name)
911
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1318
raise DBusPropertyNotFound("{}:{}.{}".format(
1319
self.dbus_object_path, interface_name, property_name))
1320
1321
@classmethod
1322
def _get_all_interface_names(cls):
1323
"""Get a sequence of all interfaces supported by an object"""
1324
return (name for name in set(getattr(getattr(x, attr),
1325
"_dbus_interface", None)
1326
for x in (inspect.getmro(cls))
1327
for attr in dir(x))
1328
if name is not None)
1329
1330
@dbus.service.method(dbus.PROPERTIES_IFACE,
1331
in_signature="ss",
913
1332
out_signature="v")
914
1333
def Get(self, interface_name, property_name):
915
1334
"""Standard D-Bus property Get() method, see D-Bus standard.
921
1340
if not hasattr(value, "variant_level"):
922
1341
return value
923
1342
return type(value)(value, variant_level=value.variant_level+1)
924
1343
925
1344
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
926
1345
def Set(self, interface_name, property_name, value):
927
1346
"""Standard D-Bus property Set() method, see D-Bus standard.
933
1352
# The byte_arrays option is not supported yet on
934
1353
# signatures other than "ay".
935
1354
if prop._dbus_signature != "ay":
936
raise ValueError
1355
raise ValueError("Byte arrays not supported for non-"
1356
"'ay' signature {!r}"
1357
.format(prop._dbus_signature))
937
1358
value = dbus.ByteArray(b''.join(chr(byte)
938
1359
for byte in value))
939
1360
prop(value)
940
941
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1361
1362
@dbus.service.method(dbus.PROPERTIES_IFACE,
1363
in_signature="s",
942
1364
out_signature="a{sv}")
943
1365
def GetAll(self, interface_name):
944
1366
"""Standard D-Bus property GetAll() method, see D-Bus
945
1367
standard.
946
1368
947
1369
Note: Will not include properties with access="write".
948
1370
"""
949
1371
properties = {}
959
1381
if not hasattr(value, "variant_level"):
960
1382
properties[name] = value
961
1383
continue
962
properties[name] = type(value)(value, variant_level=
963
value.variant_level+1)
1384
properties[name] = type(value)(
1385
value, variant_level=value.variant_level + 1)
964
1386
return dbus.Dictionary(properties, signature="sv")
965
1387
1388
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1389
def PropertiesChanged(self, interface_name, changed_properties,
1390
invalidated_properties):
1391
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1392
standard.
1393
"""
1394
pass
1395
966
1396
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
967
1397
out_signature="s",
968
1398
path_keyword='object_path',
969
1399
connection_keyword='connection')
970
1400
def Introspect(self, object_path, connection):
971
1401
"""Overloading of standard D-Bus method.
972
1402
973
1403
Inserts property tags and interface annotation tags.
974
1404
"""
975
xmlstring = dbus.service.Object.Introspect(self, object_path,
976
connection)
1405
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1406
object_path,
1407
connection)
977
1408
try:
978
1409
document = xml.dom.minidom.parseString(xmlstring)
1410
979
1411
def make_tag(document, name, prop):
980
1412
e = document.createElement("property")
981
1413
e.setAttribute("name", name)
982
1414
e.setAttribute("type", prop._dbus_signature)
983
1415
e.setAttribute("access", prop._dbus_access)
984
1416
return e
1417
985
1418
for if_tag in document.getElementsByTagName("interface"):
986
1419
# Add property tags
987
1420
for tag in (make_tag(document, name, prop)
990
1423
if prop._dbus_interface
991
1424
== if_tag.getAttribute("name")):
992
1425
if_tag.appendChild(tag)
993
# Add annotation tags
994
for typ in ("method", "signal", "property"):
995
for tag in if_tag.getElementsByTagName(typ):
996
annots = dict()
997
for name, prop in (self.
998
_get_all_dbus_things(typ)):
999
if (name == tag.getAttribute("name")
1000
and prop._dbus_interface
1001
== if_tag.getAttribute("name")):
1002
annots.update(getattr
1003
(prop,
1004
"_dbus_annotations",
1005
{}))
1006
for name, value in annots.iteritems():
1007
ann_tag = document.createElement(
1008
"annotation")
1009
ann_tag.setAttribute("name", name)
1010
ann_tag.setAttribute("value", value)
1011
tag.appendChild(ann_tag)
1012
# Add interface annotation tags
1013
for annotation, value in dict(
1014
itertools.chain.from_iterable(
1015
annotations().iteritems()
1016
for name, annotations in
1017
self._get_all_dbus_things("interface")
1018
if name == if_tag.getAttribute("name")
1019
)).iteritems():
1020
ann_tag = document.createElement("annotation")
1021
ann_tag.setAttribute("name", annotation)
1022
ann_tag.setAttribute("value", value)
1023
if_tag.appendChild(ann_tag)
1426
# Add annotation tags for properties
1427
for tag in if_tag.getElementsByTagName("property"):
1428
annots = dict()
1429
for name, prop in self._get_all_dbus_things(
1430
"property"):
1431
if (name == tag.getAttribute("name")
1432
and prop._dbus_interface
1433
== if_tag.getAttribute("name")):
1434
annots.update(getattr(
1435
prop, "_dbus_annotations", {}))
1436
for name, value in annots.items():
1437
ann_tag = document.createElement(
1438
"annotation")
1439
ann_tag.setAttribute("name", name)
1440
ann_tag.setAttribute("value", value)
1441
tag.appendChild(ann_tag)
1024
1442
# Add the names to the return values for the
1025
1443
# "org.freedesktop.DBus.Properties" methods
1026
1444
if (if_tag.getAttribute("name")
1045
1463
return xmlstring
1046
1464
1047
1465
1466
try:
1467
dbus.OBJECT_MANAGER_IFACE
1468
except AttributeError:
1469
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1470
1471
1472
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1473
"""A D-Bus object with an ObjectManager.
1474
1475
Classes inheriting from this exposes the standard
1476
GetManagedObjects call and the InterfacesAdded and
1477
InterfacesRemoved signals on the standard
1478
"org.freedesktop.DBus.ObjectManager" interface.
1479
1480
Note: No signals are sent automatically; they must be sent
1481
manually.
1482
"""
1483
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1484
out_signature="a{oa{sa{sv}}}")
1485
def GetManagedObjects(self):
1486
"""This function must be overridden"""
1487
raise NotImplementedError()
1488
1489
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1490
signature="oa{sa{sv}}")
1491
def InterfacesAdded(self, object_path, interfaces_and_properties):
1492
pass
1493
1494
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1495
def InterfacesRemoved(self, object_path, interfaces):
1496
pass
1497
1498
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1499
out_signature="s",
1500
path_keyword='object_path',
1501
connection_keyword='connection')
1502
def Introspect(self, object_path, connection):
1503
"""Overloading of standard D-Bus method.
1504
1505
Override return argument name of GetManagedObjects to be
1506
"objpath_interfaces_and_properties"
1507
"""
1508
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1509
object_path,
1510
connection)
1511
try:
1512
document = xml.dom.minidom.parseString(xmlstring)
1513
1514
for if_tag in document.getElementsByTagName("interface"):
1515
# Fix argument name for the GetManagedObjects method
1516
if (if_tag.getAttribute("name")
1517
== dbus.OBJECT_MANAGER_IFACE):
1518
for cn in if_tag.getElementsByTagName("method"):
1519
if (cn.getAttribute("name")
1520
== "GetManagedObjects"):
1521
for arg in cn.getElementsByTagName("arg"):
1522
if (arg.getAttribute("direction")
1523
== "out"):
1524
arg.setAttribute(
1525
"name",
1526
"objpath_interfaces"
1527
"_and_properties")
1528
xmlstring = document.toxml("utf-8")
1529
document.unlink()
1530
except (AttributeError, xml.dom.DOMException,
1531
xml.parsers.expat.ExpatError) as error:
1532
logger.error("Failed to override Introspection method",
1533
exc_info=error)
1534
return xmlstring
1535
1536
1048
1537
def datetime_to_dbus(dt, variant_level=0):
1049
1538
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1050
1539
if dt is None:
1051
return dbus.String("", variant_level = variant_level)
1052
return dbus.String(dt.isoformat(),
1053
variant_level=variant_level)
1540
return dbus.String("", variant_level=variant_level)
1541
return dbus.String(dt.isoformat(), variant_level=variant_level)
1054
1542
1055
1543
1056
1544
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1058
1546
dbus.service.Object, it will add alternate D-Bus attributes with
1059
1547
interface names according to the "alt_interface_names" mapping.
1060
1548
Usage:
1061
1549
1062
1550
@alternate_dbus_interfaces({"org.example.Interface":
1063
1551
"net.example.AlternateInterface"})
1064
1552
class SampleDBusObject(dbus.service.Object):
1065
1553
@dbus.service.method("org.example.Interface")
1066
1554
def SampleDBusMethod():
1067
1555
pass
1068
1556
1069
1557
The above "SampleDBusMethod" on "SampleDBusObject" will be
1070
1558
reachable via two interfaces: "org.example.Interface" and
1071
1559
"net.example.AlternateInterface", the latter of which will have
1072
1560
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1073
1561
"true", unless "deprecate" is passed with a False value.
1074
1562
1075
1563
This works for methods and signals, and also for D-Bus properties
1076
1564
(from DBusObjectWithProperties) and interfaces (from the
1077
1565
dbus_interface_annotations decorator).
1078
1566
"""
1567
1079
1568
def wrapper(cls):
1080
1569
for orig_interface_name, alt_interface_name in (
1081
alt_interface_names.iteritems()):
1570
alt_interface_names.items()):
1082
1571
attr = {}
1083
1572
interface_names = set()
1084
1573
# Go though all attributes of the class
1086
1575
# Ignore non-D-Bus attributes, and D-Bus attributes
1087
1576
# with the wrong interface name
1088
1577
if (not hasattr(attribute, "_dbus_interface")
1089
or not attribute._dbus_interface
1090
.startswith(orig_interface_name)):
1578
or not attribute._dbus_interface.startswith(
1579
orig_interface_name)):
1091
1580
continue
1092
1581
# Create an alternate D-Bus interface name based on
1093
1582
# the current name
1094
alt_interface = (attribute._dbus_interface
1095
.replace(orig_interface_name,
1096
alt_interface_name))
1583
alt_interface = attribute._dbus_interface.replace(
1584
orig_interface_name, alt_interface_name)
1097
1585
interface_names.add(alt_interface)
1098
1586
# Is this a D-Bus signal?
1099
1587
if getattr(attribute, "_dbus_is_signal", False):
1100
1588
# Extract the original non-method undecorated
1101
1589
# function by black magic
1102
nonmethod_func = (dict(
1590
if sys.version_info.major == 2:
1591
nonmethod_func = (dict(
1103
1592
zip(attribute.func_code.co_freevars,
1104
attribute.__closure__))["func"]
1105
.cell_contents)
1593
attribute.__closure__))
1594
["func"].cell_contents)
1595
else:
1596
nonmethod_func = (dict(
1597
zip(attribute.__code__.co_freevars,
1598
attribute.__closure__))
1599
["func"].cell_contents)
1106
1600
# Create a new, but exactly alike, function
1107
1601
# object, and decorate it to be a new D-Bus signal
1108
1602
# with the alternate D-Bus interface name
1109
new_function = (dbus.service.signal
1110
(alt_interface,
1111
attribute._dbus_signature)
1112
(types.FunctionType(
1113
nonmethod_func.func_code,
1114
nonmethod_func.func_globals,
1115
nonmethod_func.func_name,
1116
nonmethod_func.func_defaults,
1117
nonmethod_func.func_closure)))
1603
new_function = copy_function(nonmethod_func)
1604
new_function = (dbus.service.signal(
1605
alt_interface,
1606
attribute._dbus_signature)(new_function))
1118
1607
# Copy annotations, if any
1119
1608
try:
1120
new_function._dbus_annotations = (
1121
dict(attribute._dbus_annotations))
1609
new_function._dbus_annotations = dict(
1610
attribute._dbus_annotations)
1122
1611
except AttributeError:
1123
1612
pass
1613
1124
1614
# Define a creator of a function to call both the
1125
1615
# original and alternate functions, so both the
1126
1616
# original and alternate signals gets sent when
1129
1619
"""This function is a scope container to pass
1130
1620
func1 and func2 to the "call_both" function
1131
1621
outside of its arguments"""
1622
1623
@functools.wraps(func2)
1132
1624
def call_both(*args, **kwargs):
1133
1625
"""This function will emit two D-Bus
1134
1626
signals by calling func1 and func2"""
1135
1627
func1(*args, **kwargs)
1136
1628
func2(*args, **kwargs)
1629
# Make wrapper function look like a D-Bus
1630
# signal
1631
for name, attr in inspect.getmembers(func2):
1632
if name.startswith("_dbus_"):
1633
setattr(call_both, name, attr)
1634
1137
1635
return call_both
1138
1636
# Create the "call_both" function and add it to
1139
1637
# the class
1144
1642
# object. Decorate it to be a new D-Bus method
1145
1643
# with the alternate D-Bus interface name. Add it
1146
1644
# to the class.
1147
attr[attrname] = (dbus.service.method
1148
(alt_interface,
1149
attribute._dbus_in_signature,
1150
attribute._dbus_out_signature)
1151
(types.FunctionType
1152
(attribute.func_code,
1153
attribute.func_globals,
1154
attribute.func_name,
1155
attribute.func_defaults,
1156
attribute.func_closure)))
1645
attr[attrname] = (
1646
dbus.service.method(
1647
alt_interface,
1648
attribute._dbus_in_signature,
1649
attribute._dbus_out_signature)
1650
(copy_function(attribute)))
1157
1651
# Copy annotations, if any
1158
1652
try:
1159
attr[attrname]._dbus_annotations = (
1160
dict(attribute._dbus_annotations))
1653
attr[attrname]._dbus_annotations = dict(
1654
attribute._dbus_annotations)
1161
1655
except AttributeError:
1162
1656
pass
1163
1657
# Is this a D-Bus property?
1166
1660
# object, and decorate it to be a new D-Bus
1167
1661
# property with the alternate D-Bus interface
1168
1662
# name. Add it to the class.
1169
attr[attrname] = (dbus_service_property
1170
(alt_interface,
1171
attribute._dbus_signature,
1172
attribute._dbus_access,
1173
attribute
1174
._dbus_get_args_options
1175
["byte_arrays"])
1176
(types.FunctionType
1177
(attribute.func_code,
1178
attribute.func_globals,
1179
attribute.func_name,
1180
attribute.func_defaults,
1181
attribute.func_closure)))
1663
attr[attrname] = (dbus_service_property(
1664
alt_interface, attribute._dbus_signature,
1665
attribute._dbus_access,
1666
attribute._dbus_get_args_options
1667
["byte_arrays"])
1668
(copy_function(attribute)))
1182
1669
# Copy annotations, if any
1183
1670
try:
1184
attr[attrname]._dbus_annotations = (
1185
dict(attribute._dbus_annotations))
1671
attr[attrname]._dbus_annotations = dict(
1672
attribute._dbus_annotations)
1186
1673
except AttributeError:
1187
1674
pass
1188
1675
# Is this a D-Bus interface?
1191
1678
# object. Decorate it to be a new D-Bus interface
1192
1679
# with the alternate D-Bus interface name. Add it
1193
1680
# to the class.
1194
attr[attrname] = (dbus_interface_annotations
1195
(alt_interface)
1196
(types.FunctionType
1197
(attribute.func_code,
1198
attribute.func_globals,
1199
attribute.func_name,
1200
attribute.func_defaults,
1201
attribute.func_closure)))
1681
attr[attrname] = (
1682
dbus_interface_annotations(alt_interface)
1683
(copy_function(attribute)))
1202
1684
if deprecate:
1203
1685
# Deprecate all alternate interfaces
1204
iname="_AlternateDBusNames_interface_annotation{0}"
1686
iname = "_AlternateDBusNames_interface_annotation{}"
1205
1687
for interface_name in interface_names:
1688
1206
1689
@dbus_interface_annotations(interface_name)
1207
1690
def func(self):
1208
return { "org.freedesktop.DBus.Deprecated":
1209
"true" }
1691
return {"org.freedesktop.DBus.Deprecated":
1692
"true"}
1210
1693
# Find an unused name
1211
1694
for aname in (iname.format(i)
1212
1695
for i in itertools.count()):
1216
1699
if interface_names:
1217
1700
# Replace the class with a new subclass of it with
1218
1701
# methods, signals, etc. as created above.
1219
cls = type(b"{0}Alternate".format(cls.__name__),
1220
(cls,), attr)
1702
if sys.version_info.major == 2:
1703
cls = type(b"{}Alternate".format(cls.__name__),
1704
(cls, ), attr)
1705
else:
1706
cls = type("{}Alternate".format(cls.__name__),
1707
(cls, ), attr)
1221
1708
return cls
1709
1222
1710
return wrapper
1223
1711
1224
1712
1225
1713
@alternate_dbus_interfaces({"se.recompile.Mandos":
1226
"se.bsnet.fukt.Mandos"})
1714
"se.bsnet.fukt.Mandos"})
1227
1715
class ClientDBus(Client, DBusObjectWithProperties):
1228
1716
"""A Client class using D-Bus
1229
1717
1230
1718
Attributes:
1231
1719
dbus_object_path: dbus.ObjectPath
1232
1720
bus: dbus.SystemBus()
1233
1721
"""
1234
1722
1235
1723
runtime_expansions = (Client.runtime_expansions
1236
+ ("dbus_object_path",))
1237
1724
+ ("dbus_object_path", ))
1725
1726
_interface = "se.recompile.Mandos.Client"
1727
1238
1728
# dbus.service.Object doesn't use super(), so we can't either.
1239
1240
def __init__(self, bus = None, *args, **kwargs):
1729
1730
def __init__(self, bus=None, *args, **kwargs):
1241
1731
self.bus = bus
1242
1732
Client.__init__(self, *args, **kwargs)
1243
1733
# Only now, when this client is initialized, can it show up on
1244
1734
# the D-Bus
1245
client_object_name = unicode(self.name).translate(
1735
client_object_name = str(self.name).translate(
1246
1736
{ord("."): ord("_"),
1247
1737
ord("-"): ord("_")})
1248
self.dbus_object_path = (dbus.ObjectPath
1249
("/clients/" + client_object_name))
1738
self.dbus_object_path = dbus.ObjectPath(
1739
"/clients/" + client_object_name)
1250
1740
DBusObjectWithProperties.__init__(self, self.bus,
1251
1741
self.dbus_object_path)
1252
1253
def notifychangeproperty(transform_func,
1254
dbus_name, type_func=lambda x: x,
1255
variant_level=1):
1742
1743
def notifychangeproperty(transform_func, dbus_name,
1744
type_func=lambda x: x,
1745
variant_level=1,
1746
invalidate_only=False,
1747
_interface=_interface):
1256
1748
""" Modify a variable so that it's a property which announces
1257
1749
its changes to DBus.
1258
1750
1259
1751
transform_fun: Function that takes a value and a variant_level
1260
1752
and transforms it to a D-Bus type.
1261
1753
dbus_name: D-Bus name of the variable
1263
1755
to the D-Bus. Default: no transform
1264
1756
variant_level: D-Bus variant level. Default: 1
1265
1757
"""
1266
attrname = "_{0}".format(dbus_name)
1758
attrname = "_{}".format(dbus_name)
1759
1267
1760
def setter(self, value):
1268
1761
if hasattr(self, "dbus_object_path"):
1269
1762
if (not hasattr(self, attrname) or
1270
1763
type_func(getattr(self, attrname, None))
1271
1764
!= type_func(value)):
1272
dbus_value = transform_func(type_func(value),
1273
variant_level
1274
=variant_level)
1275
self.PropertyChanged(dbus.String(dbus_name),
1276
dbus_value)
1765
if invalidate_only:
1766
self.PropertiesChanged(
1767
_interface, dbus.Dictionary(),
1768
dbus.Array((dbus_name, )))
1769
else:
1770
dbus_value = transform_func(
1771
type_func(value),
1772
variant_level=variant_level)
1773
self.PropertyChanged(dbus.String(dbus_name),
1774
dbus_value)
1775
self.PropertiesChanged(
1776
_interface,
1777
dbus.Dictionary({dbus.String(dbus_name):
1778
dbus_value}),
1779
dbus.Array())
1277
1780
setattr(self, attrname, value)
1278
1781
1279
1782
return property(lambda self: getattr(self, attrname), setter)
1280
1783
1281
1784
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1282
1785
approvals_pending = notifychangeproperty(dbus.Boolean,
1283
1786
"ApprovalPending",
1284
type_func = bool)
1787
type_func=bool)
1285
1788
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1286
1789
last_enabled = notifychangeproperty(datetime_to_dbus,
1287
1790
"LastEnabled")
1288
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1289
type_func = lambda checker:
1290
checker is not None)
1791
checker = notifychangeproperty(
1792
dbus.Boolean, "CheckerRunning",
1793
type_func=lambda checker: checker is not None)
1291
1794
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1292
1795
"LastCheckedOK")
1293
1796
last_checker_status = notifychangeproperty(dbus.Int16,
1296
1799
datetime_to_dbus, "LastApprovalRequest")
1297
1800
approved_by_default = notifychangeproperty(dbus.Boolean,
1298
1801
"ApprovedByDefault")
1299
approval_delay = notifychangeproperty(dbus.UInt64,
1300
"ApprovalDelay",
1301
type_func =
1302
timedelta_to_milliseconds)
1802
approval_delay = notifychangeproperty(
1803
dbus.UInt64, "ApprovalDelay",
1804
type_func=lambda td: td.total_seconds() * 1000)
1303
1805
approval_duration = notifychangeproperty(
1304
1806
dbus.UInt64, "ApprovalDuration",
1305
type_func = timedelta_to_milliseconds)
1807
type_func=lambda td: td.total_seconds() * 1000)
1306
1808
host = notifychangeproperty(dbus.String, "Host")
1307
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1308
type_func =
1309
timedelta_to_milliseconds)
1809
timeout = notifychangeproperty(
1810
dbus.UInt64, "Timeout",
1811
type_func=lambda td: td.total_seconds() * 1000)
1310
1812
extended_timeout = notifychangeproperty(
1311
1813
dbus.UInt64, "ExtendedTimeout",
1312
type_func = timedelta_to_milliseconds)
1313
interval = notifychangeproperty(dbus.UInt64,
1314
"Interval",
1315
type_func =
1316
timedelta_to_milliseconds)
1814
type_func=lambda td: td.total_seconds() * 1000)
1815
interval = notifychangeproperty(
1816
dbus.UInt64, "Interval",
1817
type_func=lambda td: td.total_seconds() * 1000)
1317
1818
checker_command = notifychangeproperty(dbus.String, "Checker")
1318
1819
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1820
invalidate_only=True)
1821
1319
1822
del notifychangeproperty
1320
1823
1321
1824
def __del__(self, *args, **kwargs):
1322
1825
try:
1323
1826
self.remove_from_connection()
1326
1829
if hasattr(DBusObjectWithProperties, "__del__"):
1327
1830
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1328
1831
Client.__del__(self, *args, **kwargs)
1329
1330
def checker_callback(self, pid, condition, command,
1331
*args, **kwargs):
1332
self.checker_callback_tag = None
1333
self.checker = None
1334
if os.WIFEXITED(condition):
1335
exitstatus = os.WEXITSTATUS(condition)
1832
1833
def checker_callback(self, source, condition,
1834
connection, command, *args, **kwargs):
1835
ret = Client.checker_callback(self, source, condition,
1836
connection, command, *args,
1837
**kwargs)
1838
exitstatus = self.last_checker_status
1839
if exitstatus >= 0:
1336
1840
# Emit D-Bus signal
1337
1841
self.CheckerCompleted(dbus.Int16(exitstatus),
1338
dbus.Int64(condition),
1842
# This is specific to GNU libC
1843
dbus.Int64(exitstatus << 8),
1339
1844
dbus.String(command))
1340
1845
else:
1341
1846
# Emit D-Bus signal
1342
1847
self.CheckerCompleted(dbus.Int16(-1),
1343
dbus.Int64(condition),
1848
dbus.Int64(
1849
# This is specific to GNU libC
1850
(exitstatus << 8)
1851
| self.last_checker_signal),
1344
1852
dbus.String(command))
1345
1346
return Client.checker_callback(self, pid, condition, command,
1347
*args, **kwargs)
1348
1853
return ret
1854
1349
1855
def start_checker(self, *args, **kwargs):
1350
old_checker = self.checker
1351
if self.checker is not None:
1352
old_checker_pid = self.checker.pid
1353
else:
1354
old_checker_pid = None
1856
old_checker_pid = getattr(self.checker, "pid", None)
1355
1857
r = Client.start_checker(self, *args, **kwargs)
1356
1858
# Only if new checker process was started
1357
1859
if (self.checker is not None
1359
1861
# Emit D-Bus signal
1360
1862
self.CheckerStarted(self.current_checker_command)
1361
1863
return r
1362
1864
1363
1865
def _reset_approved(self):
1364
1866
self.approved = None
1365
1867
return False
1366
1868
1367
1869
def approve(self, value=True):
1368
1870
self.approved = value
1369
gobject.timeout_add(timedelta_to_milliseconds
1370
(self.approval_duration),
1371
self._reset_approved)
1871
GLib.timeout_add(int(self.approval_duration.total_seconds()
1872
* 1000), self._reset_approved)
1372
1873
self.send_changedstate()
1373
1374
## D-Bus methods, signals & properties
1375
_interface = "se.recompile.Mandos.Client"
1376
1377
## Interfaces
1378
1379
@dbus_interface_annotations(_interface)
1380
def _foo(self):
1381
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1382
"false"}
1383
1384
## Signals
1385
1874
1875
# D-Bus methods, signals & properties
1876
1877
# Interfaces
1878
1879
# Signals
1880
1386
1881
# CheckerCompleted - signal
1387
1882
@dbus.service.signal(_interface, signature="nxs")
1388
1883
def CheckerCompleted(self, exitcode, waitstatus, command):
1389
1884
"D-Bus signal"
1390
1885
pass
1391
1886
1392
1887
# CheckerStarted - signal
1393
1888
@dbus.service.signal(_interface, signature="s")
1394
1889
def CheckerStarted(self, command):
1395
1890
"D-Bus signal"
1396
1891
pass
1397
1892
1398
1893
# PropertyChanged - signal
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1399
1895
@dbus.service.signal(_interface, signature="sv")
1400
1896
def PropertyChanged(self, property, value):
1401
1897
"D-Bus signal"
1402
1898
pass
1403
1899
1404
1900
# GotSecret - signal
1405
1901
@dbus.service.signal(_interface)
1406
1902
def GotSecret(self):
1409
1905
server to mandos-client
1410
1906
"""
1411
1907
pass
1412
1908
1413
1909
# Rejected - signal
1414
1910
@dbus.service.signal(_interface, signature="s")
1415
1911
def Rejected(self, reason):
1416
1912
"D-Bus signal"
1417
1913
pass
1418
1914
1419
1915
# NeedApproval - signal
1420
1916
@dbus.service.signal(_interface, signature="tb")
1421
1917
def NeedApproval(self, timeout, default):
1422
1918
"D-Bus signal"
1423
1919
return self.need_approval()
1424
1425
## Methods
1426
1920
1921
# Methods
1922
1427
1923
# Approve - method
1428
1924
@dbus.service.method(_interface, in_signature="b")
1429
1925
def Approve(self, value):
1430
1926
self.approve(value)
1431
1927
1432
1928
# CheckedOK - method
1433
1929
@dbus.service.method(_interface)
1434
1930
def CheckedOK(self):
1435
1931
self.checked_ok()
1436
1932
1437
1933
# Enable - method
1934
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1438
1935
@dbus.service.method(_interface)
1439
1936
def Enable(self):
1440
1937
"D-Bus method"
1441
1938
self.enable()
1442
1939
1443
1940
# StartChecker - method
1941
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
1942
@dbus.service.method(_interface)
1445
1943
def StartChecker(self):
1446
1944
"D-Bus method"
1447
1945
self.start_checker()
1448
1946
1449
1947
# Disable - method
1948
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
1949
@dbus.service.method(_interface)
1451
1950
def Disable(self):
1452
1951
"D-Bus method"
1453
1952
self.disable()
1454
1953
1455
1954
# StopChecker - method
1955
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1456
1956
@dbus.service.method(_interface)
1457
1957
def StopChecker(self):
1458
1958
self.stop_checker()
1459
1460
## Properties
1461
1959
1960
# Properties
1961
1462
1962
# ApprovalPending - property
1463
1963
@dbus_service_property(_interface, signature="b", access="read")
1464
1964
def ApprovalPending_dbus_property(self):
1465
1965
return dbus.Boolean(bool(self.approvals_pending))
1466
1966
1467
1967
# ApprovedByDefault - property
1468
@dbus_service_property(_interface, signature="b",
1968
@dbus_service_property(_interface,
1969
signature="b",
1469
1970
access="readwrite")
1470
1971
def ApprovedByDefault_dbus_property(self, value=None):
1471
1972
if value is None: # get
1472
1973
return dbus.Boolean(self.approved_by_default)
1473
1974
self.approved_by_default = bool(value)
1474
1975
1475
1976
# ApprovalDelay - property
1476
@dbus_service_property(_interface, signature="t",
1977
@dbus_service_property(_interface,
1978
signature="t",
1477
1979
access="readwrite")
1478
1980
def ApprovalDelay_dbus_property(self, value=None):
1479
1981
if value is None: # get
1480
return dbus.UInt64(self.approval_delay_milliseconds())
1982
return dbus.UInt64(self.approval_delay.total_seconds()
1983
* 1000)
1481
1984
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1482
1985
1483
1986
# ApprovalDuration - property
1484
@dbus_service_property(_interface, signature="t",
1987
@dbus_service_property(_interface,
1988
signature="t",
1485
1989
access="readwrite")
1486
1990
def ApprovalDuration_dbus_property(self, value=None):
1487
1991
if value is None: # get
1488
return dbus.UInt64(timedelta_to_milliseconds(
1489
self.approval_duration))
1992
return dbus.UInt64(self.approval_duration.total_seconds()
1993
* 1000)
1490
1994
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1491
1995
1492
1996
# Name - property
1997
@dbus_annotations(
1998
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1493
1999
@dbus_service_property(_interface, signature="s", access="read")
1494
2000
def Name_dbus_property(self):
1495
2001
return dbus.String(self.name)
1496
2002
1497
2003
# Fingerprint - property
2004
@dbus_annotations(
2005
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
2006
@dbus_service_property(_interface, signature="s", access="read")
1499
2007
def Fingerprint_dbus_property(self):
1500
2008
return dbus.String(self.fingerprint)
1501
2009
1502
2010
# Host - property
1503
@dbus_service_property(_interface, signature="s",
2011
@dbus_service_property(_interface,
2012
signature="s",
1504
2013
access="readwrite")
1505
2014
def Host_dbus_property(self, value=None):
1506
2015
if value is None: # get
1507
2016
return dbus.String(self.host)
1508
self.host = unicode(value)
1509
2017
self.host = str(value)
2018
1510
2019
# Created - property
2020
@dbus_annotations(
2021
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1511
2022
@dbus_service_property(_interface, signature="s", access="read")
1512
2023
def Created_dbus_property(self):
1513
2024
return datetime_to_dbus(self.created)
1514
2025
1515
2026
# LastEnabled - property
1516
2027
@dbus_service_property(_interface, signature="s", access="read")
1517
2028
def LastEnabled_dbus_property(self):
1518
2029
return datetime_to_dbus(self.last_enabled)
1519
2030
1520
2031
# Enabled - property
1521
@dbus_service_property(_interface, signature="b",
2032
@dbus_service_property(_interface,
2033
signature="b",
1522
2034
access="readwrite")
1523
2035
def Enabled_dbus_property(self, value=None):
1524
2036
if value is None: # get
1527
2039
self.enable()
1528
2040
else:
1529
2041
self.disable()
1530
2042
1531
2043
# LastCheckedOK - property
1532
@dbus_service_property(_interface, signature="s",
2044
@dbus_service_property(_interface,
2045
signature="s",
1533
2046
access="readwrite")
1534
2047
def LastCheckedOK_dbus_property(self, value=None):
1535
2048
if value is not None:
1536
2049
self.checked_ok()
1537
2050
return
1538
2051
return datetime_to_dbus(self.last_checked_ok)
1539
2052
1540
2053
# LastCheckerStatus - property
1541
@dbus_service_property(_interface, signature="n",
1542
access="read")
2054
@dbus_service_property(_interface, signature="n", access="read")
1543
2055
def LastCheckerStatus_dbus_property(self):
1544
2056
return dbus.Int16(self.last_checker_status)
1545
2057
1546
2058
# Expires - property
1547
2059
@dbus_service_property(_interface, signature="s", access="read")
1548
2060
def Expires_dbus_property(self):
1549
2061
return datetime_to_dbus(self.expires)
1550
2062
1551
2063
# LastApprovalRequest - property
1552
2064
@dbus_service_property(_interface, signature="s", access="read")
1553
2065
def LastApprovalRequest_dbus_property(self):
1554
2066
return datetime_to_dbus(self.last_approval_request)
1555
2067
1556
2068
# Timeout - property
1557
@dbus_service_property(_interface, signature="t",
2069
@dbus_service_property(_interface,
2070
signature="t",
1558
2071
access="readwrite")
1559
2072
def Timeout_dbus_property(self, value=None):
1560
2073
if value is None: # get
1561
return dbus.UInt64(self.timeout_milliseconds())
2074
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1562
2075
old_timeout = self.timeout
1563
2076
self.timeout = datetime.timedelta(0, 0, 0, value)
1564
2077
# Reschedule disabling
1572
2085
if (getattr(self, "disable_initiator_tag", None)
1573
2086
is None):
1574
2087
return
1575
gobject.source_remove(self.disable_initiator_tag)
1576
self.disable_initiator_tag = (
1577
gobject.timeout_add(
1578
timedelta_to_milliseconds(self.expires - now),
1579
self.disable))
1580
2088
GLib.source_remove(self.disable_initiator_tag)
2089
self.disable_initiator_tag = GLib.timeout_add(
2090
int((self.expires - now).total_seconds() * 1000),
2091
self.disable)
2092
1581
2093
# ExtendedTimeout - property
1582
@dbus_service_property(_interface, signature="t",
2094
@dbus_service_property(_interface,
2095
signature="t",
1583
2096
access="readwrite")
1584
2097
def ExtendedTimeout_dbus_property(self, value=None):
1585
2098
if value is None: # get
1586
return dbus.UInt64(self.extended_timeout_milliseconds())
2099
return dbus.UInt64(self.extended_timeout.total_seconds()
2100
* 1000)
1587
2101
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1588
2102
1589
2103
# Interval - property
1590
@dbus_service_property(_interface, signature="t",
2104
@dbus_service_property(_interface,
2105
signature="t",
1591
2106
access="readwrite")
1592
2107
def Interval_dbus_property(self, value=None):
1593
2108
if value is None: # get
1594
return dbus.UInt64(self.interval_milliseconds())
2109
return dbus.UInt64(self.interval.total_seconds() * 1000)
1595
2110
self.interval = datetime.timedelta(0, 0, 0, value)
1596
2111
if getattr(self, "checker_initiator_tag", None) is None:
1597
2112
return
1598
2113
if self.enabled:
1599
2114
# Reschedule checker run
1600
gobject.source_remove(self.checker_initiator_tag)
1601
self.checker_initiator_tag = (gobject.timeout_add
1602
(value, self.start_checker))
1603
self.start_checker() # Start one now, too
1604
2115
GLib.source_remove(self.checker_initiator_tag)
2116
self.checker_initiator_tag = GLib.timeout_add(
2117
value, self.start_checker)
2118
self.start_checker() # Start one now, too
2119
1605
2120
# Checker - property
1606
@dbus_service_property(_interface, signature="s",
2121
@dbus_service_property(_interface,
2122
signature="s",
1607
2123
access="readwrite")
1608
2124
def Checker_dbus_property(self, value=None):
1609
2125
if value is None: # get
1610
2126
return dbus.String(self.checker_command)
1611
self.checker_command = unicode(value)
1612
2127
self.checker_command = str(value)
2128
1613
2129
# CheckerRunning - property
1614
@dbus_service_property(_interface, signature="b",
2130
@dbus_service_property(_interface,
2131
signature="b",
1615
2132
access="readwrite")
1616
2133
def CheckerRunning_dbus_property(self, value=None):
1617
2134
if value is None: # get
1620
2137
self.start_checker()
1621
2138
else:
1622
2139
self.stop_checker()
1623
2140
1624
2141
# ObjectPath - property
2142
@dbus_annotations(
2143
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2144
"org.freedesktop.DBus.Deprecated": "true"})
1625
2145
@dbus_service_property(_interface, signature="o", access="read")
1626
2146
def ObjectPath_dbus_property(self):
1627
return self.dbus_object_path # is already a dbus.ObjectPath
1628
2147
return self.dbus_object_path # is already a dbus.ObjectPath
2148
1629
2149
# Secret = property
1630
@dbus_service_property(_interface, signature="ay",
1631
access="write", byte_arrays=True)
2150
@dbus_annotations(
2151
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2152
"invalidates"})
2153
@dbus_service_property(_interface,
2154
signature="ay",
2155
access="write",
2156
byte_arrays=True)
1632
2157
def Secret_dbus_property(self, value):
1633
self.secret = str(value)
1634
2158
self.secret = bytes(value)
2159
1635
2160
del _interface
1636
2161
1637
2162
1640
2165
self._pipe = child_pipe
1641
2166
self._pipe.send(('init', fpr, address))
1642
2167
if not self._pipe.recv():
1643
raise KeyError()
1644
2168
raise KeyError(fpr)
2169
1645
2170
def __getattribute__(self, name):
1646
2171
if name == '_pipe':
1647
2172
return super(ProxyClient, self).__getattribute__(name)
1650
2175
if data[0] == 'data':
1651
2176
return data[1]
1652
2177
if data[0] == 'function':
2178
1653
2179
def func(*args, **kwargs):
1654
2180
self._pipe.send(('funcall', name, args, kwargs))
1655
2181
return self._pipe.recv()[1]
2182
1656
2183
return func
1657
2184
1658
2185
def __setattr__(self, name, value):
1659
2186
if name == '_pipe':
1660
2187
return super(ProxyClient, self).__setattr__(name, value)
1663
2190
1664
2191
class ClientHandler(socketserver.BaseRequestHandler, object):
1665
2192
"""A class to handle client connections.
1666
2193
1667
2194
Instantiated once for each connection to handle it.
1668
2195
Note: This will run in its own forked process."""
1669
2196
1670
2197
def handle(self):
1671
2198
with contextlib.closing(self.server.child_pipe) as child_pipe:
1672
2199
logger.info("TCP connection from: %s",
1673
unicode(self.client_address))
2200
str(self.client_address))
1674
2201
logger.debug("Pipe FD: %d",
1675
2202
self.server.child_pipe.fileno())
1676
1677
session = (gnutls.connection
1678
.ClientSession(self.request,
1679
gnutls.connection
1680
.X509Credentials()))
1681
1682
# Note: gnutls.connection.X509Credentials is really a
1683
# generic GnuTLS certificate credentials object so long as
1684
# no X.509 keys are added to it. Therefore, we can use it
1685
# here despite using OpenPGP certificates.
1686
1687
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1688
# "+AES-256-CBC", "+SHA1",
1689
# "+COMP-NULL", "+CTYPE-OPENPGP",
1690
# "+DHE-DSS"))
2203
2204
session = gnutls.ClientSession(self.request)
2205
2206
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2207
# "+AES-256-CBC", "+SHA1",
2208
# "+COMP-NULL", "+CTYPE-OPENPGP",
2209
# "+DHE-DSS"))
1691
2210
# Use a fallback default, since this MUST be set.
1692
2211
priority = self.server.gnutls_priority
1693
2212
if priority is None:
1694
2213
priority = "NORMAL"
1695
(gnutls.library.functions
1696
.gnutls_priority_set_direct(session._c_object,
1697
priority, None))
1698
2214
gnutls.priority_set_direct(session._c_object,
2215
priority.encode("utf-8"),
2216
None)
2217
1699
2218
# Start communication using the Mandos protocol
1700
2219
# Get protocol number
1701
2220
line = self.request.makefile().readline()
1702
2221
logger.debug("Protocol version: %r", line)
1703
2222
try:
1704
2223
if int(line.strip().split()[0]) > 1:
1705
raise RuntimeError
2224
raise RuntimeError(line)
1706
2225
except (ValueError, IndexError, RuntimeError) as error:
1707
2226
logger.error("Unknown protocol version: %s", error)
1708
2227
return
1709
2228
1710
2229
# Start GnuTLS connection
1711
2230
try:
1712
2231
session.handshake()
1713
except gnutls.errors.GNUTLSError as error:
2232
except gnutls.Error as error:
1714
2233
logger.warning("Handshake failed: %s", error)
1715
2234
# Do not run session.bye() here: the session is not
1716
2235
# established. Just abandon the request.
1717
2236
return
1718
2237
logger.debug("Handshake succeeded")
1719
2238
1720
2239
approval_required = False
1721
2240
try:
1722
2241
try:
1723
fpr = self.fingerprint(self.peer_certificate
1724
(session))
1725
except (TypeError,
1726
gnutls.errors.GNUTLSError) as error:
2242
fpr = self.fingerprint(
2243
self.peer_certificate(session))
2244
except (TypeError, gnutls.Error) as error:
1727
2245
logger.warning("Bad certificate: %s", error)
1728
2246
return
1729
2247
logger.debug("Fingerprint: %s", fpr)
1730
2248
1731
2249
try:
1732
2250
client = ProxyClient(child_pipe, fpr,
1733
2251
self.client_address)
1734
2252
except KeyError:
1735
2253
return
1736
2254
1737
2255
if client.approval_delay:
1738
2256
delay = client.approval_delay
1739
2257
client.approvals_pending += 1
1740
2258
approval_required = True
1741
2259
1742
2260
while True:
1743
2261
if not client.enabled:
1744
2262
logger.info("Client %s is disabled",
1745
client.name)
2263
client.name)
1746
2264
if self.server.use_dbus:
1747
2265
# Emit D-Bus signal
1748
2266
client.Rejected("Disabled")
1749
2267
return
1750
2268
1751
2269
if client.approved or not client.approval_delay:
1752
#We are approved or approval is disabled
2270
# We are approved or approval is disabled
1753
2271
break
1754
2272
elif client.approved is None:
1755
2273
logger.info("Client %s needs approval",
1757
2275
if self.server.use_dbus:
1758
2276
# Emit D-Bus signal
1759
2277
client.NeedApproval(
1760
client.approval_delay_milliseconds(),
1761
client.approved_by_default)
2278
client.approval_delay.total_seconds()
2279
* 1000, client.approved_by_default)
1762
2280
else:
1763
2281
logger.warning("Client %s was not approved",
1764
2282
client.name)
1766
2284
# Emit D-Bus signal
1767
2285
client.Rejected("Denied")
1768
2286
return
1769
1770
#wait until timeout or approved
2287
2288
# wait until timeout or approved
1771
2289
time = datetime.datetime.now()
1772
2290
client.changedstate.acquire()
1773
client.changedstate.wait(
1774
float(timedelta_to_milliseconds(delay)
1775
/ 1000))
2291
client.changedstate.wait(delay.total_seconds())
1776
2292
client.changedstate.release()
1777
2293
time2 = datetime.datetime.now()
1778
2294
if (time2 - time) >= delay:
1788
2304
break
1789
2305
else:
1790
2306
delay -= time2 - time
1791
1792
sent_size = 0
1793
while sent_size < len(client.secret):
1794
try:
1795
sent = session.send(client.secret[sent_size:])
1796
except gnutls.errors.GNUTLSError as error:
1797
logger.warning("gnutls send failed",
1798
exc_info=error)
1799
return
1800
logger.debug("Sent: %d, remaining: %d",
1801
sent, len(client.secret)
1802
- (sent_size + sent))
1803
sent_size += sent
1804
2307
2308
try:
2309
session.send(client.secret)
2310
except gnutls.Error as error:
2311
logger.warning("gnutls send failed",
2312
exc_info=error)
2313
return
2314
1805
2315
logger.info("Sending secret to %s", client.name)
1806
2316
# bump the timeout using extended_timeout
1807
2317
client.bump_timeout(client.extended_timeout)
1808
2318
if self.server.use_dbus:
1809
2319
# Emit D-Bus signal
1810
2320
client.GotSecret()
1811
2321
1812
2322
finally:
1813
2323
if approval_required:
1814
2324
client.approvals_pending -= 1
1815
2325
try:
1816
2326
session.bye()
1817
except gnutls.errors.GNUTLSError as error:
2327
except gnutls.Error as error:
1818
2328
logger.warning("GnuTLS bye failed",
1819
2329
exc_info=error)
1820
2330
1821
2331
@staticmethod
1822
2332
def peer_certificate(session):
1823
2333
"Return the peer's OpenPGP certificate as a bytestring"
1824
2334
# If not an OpenPGP certificate...
1825
if (gnutls.library.functions
1826
.gnutls_certificate_type_get(session._c_object)
1827
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1828
# ...do the normal thing
1829
return session.peer_certificate
2335
if (gnutls.certificate_type_get(session._c_object)
2336
!= gnutls.CRT_OPENPGP):
2337
# ...return invalid data
2338
return b""
1830
2339
list_size = ctypes.c_uint(1)
1831
cert_list = (gnutls.library.functions
1832
.gnutls_certificate_get_peers
2340
cert_list = (gnutls.certificate_get_peers
1833
2341
(session._c_object, ctypes.byref(list_size)))
1834
2342
if not bool(cert_list) and list_size.value != 0:
1835
raise gnutls.errors.GNUTLSError("error getting peer"
1836
" certificate")
2343
raise gnutls.Error("error getting peer certificate")
1837
2344
if list_size.value == 0:
1838
2345
return None
1839
2346
cert = cert_list[0]
1840
2347
return ctypes.string_at(cert.data, cert.size)
1841
2348
1842
2349
@staticmethod
1843
2350
def fingerprint(openpgp):
1844
2351
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1845
2352
# New GnuTLS "datum" with the OpenPGP public key
1846
datum = (gnutls.library.types
1847
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1848
ctypes.POINTER
1849
(ctypes.c_ubyte)),
1850
ctypes.c_uint(len(openpgp))))
2353
datum = gnutls.datum_t(
2354
ctypes.cast(ctypes.c_char_p(openpgp),
2355
ctypes.POINTER(ctypes.c_ubyte)),
2356
ctypes.c_uint(len(openpgp)))
1851
2357
# New empty GnuTLS certificate
1852
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1853
(gnutls.library.functions
1854
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2358
crt = gnutls.openpgp_crt_t()
2359
gnutls.openpgp_crt_init(ctypes.byref(crt))
1855
2360
# Import the OpenPGP public key into the certificate
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1858
gnutls.library.constants
1859
.GNUTLS_OPENPGP_FMT_RAW))
2361
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2362
gnutls.OPENPGP_FMT_RAW)
1860
2363
# Verify the self signature in the key
1861
2364
crtverify = ctypes.c_uint()
1862
(gnutls.library.functions
1863
.gnutls_openpgp_crt_verify_self(crt, 0,
1864
ctypes.byref(crtverify)))
2365
gnutls.openpgp_crt_verify_self(crt, 0,
2366
ctypes.byref(crtverify))
1865
2367
if crtverify.value != 0:
1866
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1867
raise (gnutls.errors.CertificateSecurityError
1868
("Verify failed"))
2368
gnutls.openpgp_crt_deinit(crt)
2369
raise gnutls.CertificateSecurityError("Verify failed")
1869
2370
# New buffer for the fingerprint
1870
2371
buf = ctypes.create_string_buffer(20)
1871
2372
buf_len = ctypes.c_size_t()
1872
2373
# Get the fingerprint from the certificate into the buffer
1873
(gnutls.library.functions
1874
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1875
ctypes.byref(buf_len)))
2374
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2375
ctypes.byref(buf_len))
1876
2376
# Deinit the certificate
1877
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2377
gnutls.openpgp_crt_deinit(crt)
1878
2378
# Convert the buffer to a Python bytestring
1879
2379
fpr = ctypes.string_at(buf, buf_len.value)
1880
2380
# Convert the bytestring to hexadecimal notation
1884
2384
1885
2385
class MultiprocessingMixIn(object):
1886
2386
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2387
1887
2388
def sub_process_main(self, request, address):
1888
2389
try:
1889
2390
self.finish_request(request, address)
1890
2391
except Exception:
1891
2392
self.handle_error(request, address)
1892
2393
self.close_request(request)
1893
2394
1894
2395
def process_request(self, request, address):
1895
2396
"""Start a new process to process the request."""
1896
proc = multiprocessing.Process(target = self.sub_process_main,
1897
args = (request, address))
2397
proc = multiprocessing.Process(target=self.sub_process_main,
2398
args=(request, address))
1898
2399
proc.start()
1899
2400
return proc
1900
2401
1901
2402
1902
2403
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1903
2404
""" adds a pipe to the MixIn """
2405
1904
2406
def process_request(self, request, client_address):
1905
2407
"""Overrides and wraps the original process_request().
1906
2408
1907
2409
This function creates a new pipe in self.pipe
1908
2410
"""
1909
2411
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1910
2412
1911
2413
proc = MultiprocessingMixIn.process_request(self, request,
1912
2414
client_address)
1913
2415
self.child_pipe.close()
1914
2416
self.add_pipe(parent_pipe, proc)
1915
2417
1916
2418
def add_pipe(self, parent_pipe, proc):
1917
2419
"""Dummy function; override as necessary"""
1918
raise NotImplementedError
2420
raise NotImplementedError()
1919
2421
1920
2422
1921
2423
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1922
2424
socketserver.TCPServer, object):
1923
2425
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1924
2426
1925
2427
Attributes:
1926
2428
enabled: Boolean; whether this server is activated yet
1927
2429
interface: None or a network interface name (string)
1928
2430
use_ipv6: Boolean; to use IPv6 or not
1929
2431
"""
2432
1930
2433
def __init__(self, server_address, RequestHandlerClass,
1931
interface=None, use_ipv6=True, socketfd=None):
2434
interface=None,
2435
use_ipv6=True,
2436
socketfd=None):
1932
2437
"""If socketfd is set, use that file descriptor instead of
1933
2438
creating a new one with socket.socket().
1934
2439
"""
1940
2445
self.socketfd = socketfd
1941
2446
# Save the original socket.socket() function
1942
2447
self.socket_socket = socket.socket
2448
1943
2449
# To implement --socket, we monkey patch socket.socket.
1944
#
2450
#
1945
2451
# (When socketserver.TCPServer is a new-style class, we
1946
2452
# could make self.socket into a property instead of monkey
1947
2453
# patching socket.socket.)
1948
#
2454
#
1949
2455
# Create a one-time-only replacement for socket.socket()
1950
2456
@functools.wraps(socket.socket)
1951
2457
def socket_wrapper(*args, **kwargs):
1963
2469
# socket_wrapper(), if socketfd was set.
1964
2470
socketserver.TCPServer.__init__(self, server_address,
1965
2471
RequestHandlerClass)
1966
2472
1967
2473
def server_bind(self):
1968
2474
"""This overrides the normal server_bind() function
1969
2475
to bind to an interface if one was specified, and also NOT to
1970
2476
bind to an address or port if they were not specified."""
2477
global SO_BINDTODEVICE
1971
2478
if self.interface is not None:
1972
2479
if SO_BINDTODEVICE is None:
1973
logger.error("SO_BINDTODEVICE does not exist;"
1974
" cannot bind to interface %s",
1975
self.interface)
1976
else:
1977
try:
1978
self.socket.setsockopt(socket.SOL_SOCKET,
1979
SO_BINDTODEVICE,
1980
str(self.interface + '\0'))
1981
except socket.error as error:
1982
if error.errno == errno.EPERM:
1983
logger.error("No permission to bind to"
1984
" interface %s", self.interface)
1985
elif error.errno == errno.ENOPROTOOPT:
1986
logger.error("SO_BINDTODEVICE not available;"
1987
" cannot bind to interface %s",
1988
self.interface)
1989
elif error.errno == errno.ENODEV:
1990
logger.error("Interface %s does not exist,"
1991
" cannot bind", self.interface)
1992
else:
1993
raise
2480
# Fall back to a hard-coded value which seems to be
2481
# common enough.
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2483
SO_BINDTODEVICE = 25
2484
try:
2485
self.socket.setsockopt(
2486
socket.SOL_SOCKET, SO_BINDTODEVICE,
2487
(self.interface + "\0").encode("utf-8"))
2488
except socket.error as error:
2489
if error.errno == errno.EPERM:
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2492
elif error.errno == errno.ENOPROTOOPT:
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2495
self.interface)
2496
elif error.errno == errno.ENODEV:
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
2499
else:
2500
raise
1994
2501
# Only bind(2) the socket if we really need to.
1995
2502
if self.server_address[0] or self.server_address[1]:
1996
2503
if not self.server_address[0]:
1997
2504
if self.address_family == socket.AF_INET6:
1998
any_address = "::" # in6addr_any
2505
any_address = "::" # in6addr_any
1999
2506
else:
2000
any_address = "0.0.0.0" # INADDR_ANY
2507
any_address = "0.0.0.0" # INADDR_ANY
2001
2508
self.server_address = (any_address,
2002
2509
self.server_address[1])
2003
2510
elif not self.server_address[1]:
2004
self.server_address = (self.server_address[0],
2005
0)
2511
self.server_address = (self.server_address[0], 0)
2006
2512
# if self.interface:
2007
2513
# self.server_address = (self.server_address[0],
2008
2514
# 0, # port
2014
2520
2015
2521
class MandosServer(IPv6_TCPServer):
2016
2522
"""Mandos server.
2017
2523
2018
2524
Attributes:
2019
2525
clients: set of Client objects
2020
2526
gnutls_priority GnuTLS priority string
2021
2527
use_dbus: Boolean; to emit D-Bus signals or not
2022
2023
Assumes a gobject.MainLoop event loop.
2528
2529
Assumes a GLib.MainLoop event loop.
2024
2530
"""
2531
2025
2532
def __init__(self, server_address, RequestHandlerClass,
2026
interface=None, use_ipv6=True, clients=None,
2027
gnutls_priority=None, use_dbus=True, socketfd=None):
2533
interface=None,
2534
use_ipv6=True,
2535
clients=None,
2536
gnutls_priority=None,
2537
use_dbus=True,
2538
socketfd=None):
2028
2539
self.enabled = False
2029
2540
self.clients = clients
2030
2541
if self.clients is None:
2033
2544
self.gnutls_priority = gnutls_priority
2034
2545
IPv6_TCPServer.__init__(self, server_address,
2035
2546
RequestHandlerClass,
2036
interface = interface,
2037
use_ipv6 = use_ipv6,
2038
socketfd = socketfd)
2547
interface=interface,
2548
use_ipv6=use_ipv6,
2549
socketfd=socketfd)
2550
2039
2551
def server_activate(self):
2040
2552
if self.enabled:
2041
2553
return socketserver.TCPServer.server_activate(self)
2042
2554
2043
2555
def enable(self):
2044
2556
self.enabled = True
2045
2557
2046
2558
def add_pipe(self, parent_pipe, proc):
2047
2559
# Call "handle_ipc" for both data and EOF events
2048
gobject.io_add_watch(parent_pipe.fileno(),
2049
gobject.IO_IN | gobject.IO_HUP,
2050
functools.partial(self.handle_ipc,
2051
parent_pipe =
2052
parent_pipe,
2053
proc = proc))
2054
2055
def handle_ipc(self, source, condition, parent_pipe=None,
2056
proc = None, client_object=None):
2560
GLib.io_add_watch(
2561
parent_pipe.fileno(),
2562
GLib.IO_IN | GLib.IO_HUP,
2563
functools.partial(self.handle_ipc,
2564
parent_pipe=parent_pipe,
2565
proc=proc))
2566
2567
def handle_ipc(self, source, condition,
2568
parent_pipe=None,
2569
proc=None,
2570
client_object=None):
2057
2571
# error, or the other end of multiprocessing.Pipe has closed
2058
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2572
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2059
2573
# Wait for other process to exit
2060
2574
proc.join()
2061
2575
return False
2062
2576
2063
2577
# Read a request from the child
2064
2578
request = parent_pipe.recv()
2065
2579
command = request[0]
2066
2580
2067
2581
if command == 'init':
2068
fpr = request[1]
2582
fpr = request[1].decode("ascii")
2069
2583
address = request[2]
2070
2071
for c in self.clients.itervalues():
2584
2585
for c in self.clients.values():
2072
2586
if c.fingerprint == fpr:
2073
2587
client = c
2074
2588
break
2081
2595
address[0])
2082
2596
parent_pipe.send(False)
2083
2597
return False
2084
2085
gobject.io_add_watch(parent_pipe.fileno(),
2086
gobject.IO_IN | gobject.IO_HUP,
2087
functools.partial(self.handle_ipc,
2088
parent_pipe =
2089
parent_pipe,
2090
proc = proc,
2091
client_object =
2092
client))
2598
2599
GLib.io_add_watch(
2600
parent_pipe.fileno(),
2601
GLib.IO_IN | GLib.IO_HUP,
2602
functools.partial(self.handle_ipc,
2603
parent_pipe=parent_pipe,
2604
proc=proc,
2605
client_object=client))
2093
2606
parent_pipe.send(True)
2094
2607
# remove the old hook in favor of the new above hook on
2095
2608
# same fileno
2098
2611
funcname = request[1]
2099
2612
args = request[2]
2100
2613
kwargs = request[3]
2101
2614
2102
2615
parent_pipe.send(('data', getattr(client_object,
2103
2616
funcname)(*args,
2104
**kwargs)))
2105
2617
**kwargs)))
2618
2106
2619
if command == 'getattr':
2107
2620
attrname = request[1]
2108
if callable(client_object.__getattribute__(attrname)):
2109
parent_pipe.send(('function',))
2621
if isinstance(client_object.__getattribute__(attrname),
2622
collections.Callable):
2623
parent_pipe.send(('function', ))
2110
2624
else:
2111
parent_pipe.send(('data', client_object
2112
.__getattribute__(attrname)))
2113
2625
parent_pipe.send((
2626
'data', client_object.__getattribute__(attrname)))
2627
2114
2628
if command == 'setattr':
2115
2629
attrname = request[1]
2116
2630
value = request[2]
2117
2631
setattr(client_object, attrname, value)
2118
2632
2119
2633
return True
2120
2634
2121
2635
2122
2636
def rfc3339_duration_to_delta(duration):
2123
2637
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2124
2638
2125
2639
>>> rfc3339_duration_to_delta("P7D")
2126
2640
datetime.timedelta(7)
2127
2641
>>> rfc3339_duration_to_delta("PT60S")
2137
2651
>>> rfc3339_duration_to_delta("P1DT3M20S")
2138
2652
datetime.timedelta(1, 200)
2139
2653
"""
2140
2654
2141
2655
# Parsing an RFC 3339 duration with regular expressions is not
2142
2656
# possible - there would have to be multiple places for the same
2143
2657
# values, like seconds. The current code, while more esoteric, is
2144
2658
# cleaner without depending on a parsing library. If Python had a
2145
2659
# built-in library for parsing we would use it, but we'd like to
2146
2660
# avoid excessive use of external libraries.
2147
2661
2148
2662
# New type for defining tokens, syntax, and semantics all-in-one
2149
Token = collections.namedtuple("Token",
2150
("regexp", # To match token; if
2151
# "value" is not None,
2152
# must have a "group"
2153
# containing digits
2154
"value", # datetime.timedelta or
2155
# None
2156
"followers")) # Tokens valid after
2157
# this token
2663
Token = collections.namedtuple("Token", (
2664
"regexp", # To match token; if "value" is not None, must have
2665
# a "group" containing digits
2666
"value", # datetime.timedelta or None
2667
"followers")) # Tokens valid after this token
2158
2668
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2159
2669
# the "duration" ABNF definition in RFC 3339, Appendix A.
2160
2670
token_end = Token(re.compile(r"$"), None, frozenset())
2161
2671
token_second = Token(re.compile(r"(\d+)S"),
2162
2672
datetime.timedelta(seconds=1),
2163
frozenset((token_end,)))
2673
frozenset((token_end, )))
2164
2674
token_minute = Token(re.compile(r"(\d+)M"),
2165
2675
datetime.timedelta(minutes=1),
2166
2676
frozenset((token_second, token_end)))
2182
2692
frozenset((token_month, token_end)))
2183
2693
token_week = Token(re.compile(r"(\d+)W"),
2184
2694
datetime.timedelta(weeks=1),
2185
frozenset((token_end,)))
2695
frozenset((token_end, )))
2186
2696
token_duration = Token(re.compile(r"P"), None,
2187
2697
frozenset((token_year, token_month,
2188
2698
token_day, token_time,
2189
token_week))),
2190
# Define starting values
2191
value = datetime.timedelta() # Value so far
2699
token_week)))
2700
# Define starting values:
2701
# Value so far
2702
value = datetime.timedelta()
2192
2703
found_token = None
2193
followers = frozenset(token_duration,) # Following valid tokens
2194
s = duration # String left to parse
2704
# Following valid tokens
2705
followers = frozenset((token_duration, ))
2706
# String left to parse
2707
s = duration
2195
2708
# Loop until end token is found
2196
2709
while found_token is not token_end:
2197
2710
# Search for any currently valid tokens
2213
2726
break
2214
2727
else:
2215
2728
# No currently valid tokens were found
2216
raise ValueError("Invalid RFC 3339 duration")
2729
raise ValueError("Invalid RFC 3339 duration: {!r}"
2730
.format(duration))
2217
2731
# End token found
2218
2732
return value
2219
2733
2220
2734
2221
2735
def string_to_delta(interval):
2222
2736
"""Parse a string and return a datetime.timedelta
2223
2737
2224
2738
>>> string_to_delta('7d')
2225
2739
datetime.timedelta(7)
2226
2740
>>> string_to_delta('60s')
2234
2748
>>> string_to_delta('5m 30s')
2235
2749
datetime.timedelta(0, 330)
2236
2750
"""
2237
2751
2238
2752
try:
2239
2753
return rfc3339_duration_to_delta(interval)
2240
2754
except ValueError:
2241
2755
pass
2242
2756
2243
2757
timevalue = datetime.timedelta(0)
2244
2758
for s in interval.split():
2245
2759
try:
2246
suffix = unicode(s[-1])
2760
suffix = s[-1]
2247
2761
value = int(s[:-1])
2248
2762
if suffix == "d":
2249
2763
delta = datetime.timedelta(value)
2256
2770
elif suffix == "w":
2257
2771
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2258
2772
else:
2259
raise ValueError("Unknown suffix {0!r}"
2260
.format(suffix))
2261
except (ValueError, IndexError) as e:
2773
raise ValueError("Unknown suffix {!r}".format(suffix))
2774
except IndexError as e:
2262
2775
raise ValueError(*(e.args))
2263
2776
timevalue += delta
2264
2777
return timevalue
2265
2778
2266
2779
2267
def daemon(nochdir = False, noclose = False):
2780
def daemon(nochdir=False, noclose=False):
2268
2781
"""See daemon(3). Standard BSD Unix function.
2269
2782
2270
2783
This should really exist as os.daemon, but it doesn't (yet)."""
2271
2784
if os.fork():
2272
2785
sys.exit()
2280
2793
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2281
2794
if not stat.S_ISCHR(os.fstat(null).st_mode):
2282
2795
raise OSError(errno.ENODEV,
2283
"{0} not a character device"
2796
"{} not a character device"
2284
2797
.format(os.devnull))
2285
2798
os.dup2(null, sys.stdin.fileno())
2286
2799
os.dup2(null, sys.stdout.fileno())
2290
2803
2291
2804
2292
2805
def main():
2293
2806
2294
2807
##################################################################
2295
2808
# Parsing of options, both command line and config file
2296
2809
2297
2810
parser = argparse.ArgumentParser()
2298
2811
parser.add_argument("-v", "--version", action="version",
2299
version = "%(prog)s {0}".format(version),
2812
version="%(prog)s {}".format(version),
2300
2813
help="show version number and exit")
2301
2814
parser.add_argument("-i", "--interface", metavar="IF",
2302
2815
help="Bind to interface IF")
2335
2848
help="Directory to save/restore state in")
2336
2849
parser.add_argument("--foreground", action="store_true",
2337
2850
help="Run in foreground", default=None)
2338
2851
parser.add_argument("--no-zeroconf", action="store_false",
2852
dest="zeroconf", help="Do not use Zeroconf",
2853
default=None)
2854
2339
2855
options = parser.parse_args()
2340
2856
2341
2857
if options.check:
2342
2858
import doctest
2343
doctest.testmod()
2344
sys.exit()
2345
2859
fail_count, test_count = doctest.testmod()
2860
sys.exit(os.EX_OK if fail_count == 0 else 1)
2861
2346
2862
# Default values for config file for server-global settings
2347
server_defaults = { "interface": "",
2348
"address": "",
2349
"port": "",
2350
"debug": "False",
2351
"priority":
2352
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2353
"servicename": "Mandos",
2354
"use_dbus": "True",
2355
"use_ipv6": "True",
2356
"debuglevel": "",
2357
"restore": "True",
2358
"socket": "",
2359
"statedir": "/var/lib/mandos",
2360
"foreground": "False",
2361
}
2362
2863
server_defaults = {"interface": "",
2864
"address": "",
2865
"port": "",
2866
"debug": "False",
2867
"priority":
2868
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2869
":+SIGN-DSA-SHA256",
2870
"servicename": "Mandos",
2871
"use_dbus": "True",
2872
"use_ipv6": "True",
2873
"debuglevel": "",
2874
"restore": "True",
2875
"socket": "",
2876
"statedir": "/var/lib/mandos",
2877
"foreground": "False",
2878
"zeroconf": "True",
2879
}
2880
2363
2881
# Parse config file for server-global settings
2364
2882
server_config = configparser.SafeConfigParser(server_defaults)
2365
2883
del server_defaults
2366
server_config.read(os.path.join(options.configdir,
2367
"mandos.conf"))
2884
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2368
2885
# Convert the SafeConfigParser object to a dict
2369
2886
server_settings = server_config.defaults()
2370
2887
# Use the appropriate methods on the non-string config options
2371
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2888
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2889
"foreground", "zeroconf"):
2372
2890
server_settings[option] = server_config.getboolean("DEFAULT",
2373
2891
option)
2374
2892
if server_settings["port"]:
2384
2902
server_settings["socket"] = os.dup(server_settings
2385
2903
["socket"])
2386
2904
del server_config
2387
2905
2388
2906
# Override the settings from the config file with command line
2389
2907
# options, if set.
2390
2908
for option in ("interface", "address", "port", "debug",
2391
"priority", "servicename", "configdir",
2392
"use_dbus", "use_ipv6", "debuglevel", "restore",
2393
"statedir", "socket", "foreground"):
2909
"priority", "servicename", "configdir", "use_dbus",
2910
"use_ipv6", "debuglevel", "restore", "statedir",
2911
"socket", "foreground", "zeroconf"):
2394
2912
value = getattr(options, option)
2395
2913
if value is not None:
2396
2914
server_settings[option] = value
2397
2915
del options
2398
2916
# Force all strings to be unicode
2399
2917
for option in server_settings.keys():
2400
if type(server_settings[option]) is str:
2401
server_settings[option] = unicode(server_settings[option])
2918
if isinstance(server_settings[option], bytes):
2919
server_settings[option] = (server_settings[option]
2920
.decode("utf-8"))
2402
2921
# Force all boolean options to be boolean
2403
2922
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2404
"foreground"):
2923
"foreground", "zeroconf"):
2405
2924
server_settings[option] = bool(server_settings[option])
2406
2925
# Debug implies foreground
2407
2926
if server_settings["debug"]:
2408
2927
server_settings["foreground"] = True
2409
2928
# Now we have our good server settings in "server_settings"
2410
2929
2411
2930
##################################################################
2412
2931
2932
if (not server_settings["zeroconf"]
2933
and not (server_settings["port"]
2934
or server_settings["socket"] != "")):
2935
parser.error("Needs port or socket to work without Zeroconf")
2936
2413
2937
# For convenience
2414
2938
debug = server_settings["debug"]
2415
2939
debuglevel = server_settings["debuglevel"]
2418
2942
stored_state_path = os.path.join(server_settings["statedir"],
2419
2943
stored_state_file)
2420
2944
foreground = server_settings["foreground"]
2421
2945
zeroconf = server_settings["zeroconf"]
2946
2422
2947
if debug:
2423
2948
initlogger(debug, logging.DEBUG)
2424
2949
else:
2427
2952
else:
2428
2953
level = getattr(logging, debuglevel.upper())
2429
2954
initlogger(debug, level)
2430
2955
2431
2956
if server_settings["servicename"] != "Mandos":
2432
syslogger.setFormatter(logging.Formatter
2433
('Mandos ({0}) [%(process)d]:'
2434
' %(levelname)s: %(message)s'
2435
.format(server_settings
2436
["servicename"])))
2437
2957
syslogger.setFormatter(
2958
logging.Formatter('Mandos ({}) [%(process)d]:'
2959
' %(levelname)s: %(message)s'.format(
2960
server_settings["servicename"])))
2961
2438
2962
# Parse config file with clients
2439
2963
client_config = configparser.SafeConfigParser(Client
2440
2964
.client_defaults)
2441
2965
client_config.read(os.path.join(server_settings["configdir"],
2442
2966
"clients.conf"))
2443
2967
2444
2968
global mandos_dbus_service
2445
2969
mandos_dbus_service = None
2446
2447
tcp_server = MandosServer((server_settings["address"],
2448
server_settings["port"]),
2449
ClientHandler,
2450
interface=(server_settings["interface"]
2451
or None),
2452
use_ipv6=use_ipv6,
2453
gnutls_priority=
2454
server_settings["priority"],
2455
use_dbus=use_dbus,
2456
socketfd=(server_settings["socket"]
2457
or None))
2970
2971
socketfd = None
2972
if server_settings["socket"] != "":
2973
socketfd = server_settings["socket"]
2974
tcp_server = MandosServer(
2975
(server_settings["address"], server_settings["port"]),
2976
ClientHandler,
2977
interface=(server_settings["interface"] or None),
2978
use_ipv6=use_ipv6,
2979
gnutls_priority=server_settings["priority"],
2980
use_dbus=use_dbus,
2981
socketfd=socketfd)
2458
2982
if not foreground:
2459
2983
pidfilename = "/run/mandos.pid"
2984
if not os.path.isdir("/run/."):
2985
pidfilename = "/var/run/mandos.pid"
2460
2986
pidfile = None
2461
2987
try:
2462
pidfile = open(pidfilename, "w")
2988
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2463
2989
except IOError as e:
2464
2990
logger.error("Could not open file %r", pidfilename,
2465
2991
exc_info=e)
2466
2467
for name in ("_mandos", "mandos", "nobody"):
2992
2993
for name, group in (("_mandos", "_mandos"),
2994
("mandos", "mandos"),
2995
("nobody", "nogroup")):
2468
2996
try:
2469
2997
uid = pwd.getpwnam(name).pw_uid
2470
gid = pwd.getpwnam(name).pw_gid
2998
gid = pwd.getpwnam(group).pw_gid
2471
2999
break
2472
3000
except KeyError:
2473
3001
continue
2477
3005
try:
2478
3006
os.setgid(gid)
2479
3007
os.setuid(uid)
3008
if debug:
3009
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3010
gid))
2480
3011
except OSError as error:
3012
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3013
.format(uid, gid, os.strerror(error.errno)))
2481
3014
if error.errno != errno.EPERM:
2482
raise error
2483
3015
raise
3016
2484
3017
if debug:
2485
3018
# Enable all possible GnuTLS debugging
2486
3019
2487
3020
# "Use a log level over 10 to enable all debugging options."
2488
3021
# - GnuTLS manual
2489
gnutls.library.functions.gnutls_global_set_log_level(11)
2490
2491
@gnutls.library.types.gnutls_log_func
3022
gnutls.global_set_log_level(11)
3023
3024
@gnutls.log_func
2492
3025
def debug_gnutls(level, string):
2493
3026
logger.debug("GnuTLS: %s", string[:-1])
2494
2495
(gnutls.library.functions
2496
.gnutls_global_set_log_function(debug_gnutls))
2497
3027
3028
gnutls.global_set_log_function(debug_gnutls)
3029
2498
3030
# Redirect stdin so all checkers get /dev/null
2499
3031
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2500
3032
os.dup2(null, sys.stdin.fileno())
2501
3033
if null > 2:
2502
3034
os.close(null)
2503
3035
2504
3036
# Need to fork before connecting to D-Bus
2505
3037
if not foreground:
2506
3038
# Close all input and output, do double fork, etc.
2507
3039
daemon()
2508
2509
# multiprocessing will use threads, so before we use gobject we
2510
# need to inform gobject that threads will be used.
2511
gobject.threads_init()
2512
3040
3041
# multiprocessing will use threads, so before we use GLib we need
3042
# to inform GLib that threads will be used.
3043
GLib.threads_init()
3044
2513
3045
global main_loop
2514
3046
# From the Avahi example code
2515
3047
DBusGMainLoop(set_as_default=True)
2516
main_loop = gobject.MainLoop()
3048
main_loop = GLib.MainLoop()
2517
3049
bus = dbus.SystemBus()
2518
3050
# End of Avahi example code
2519
3051
if use_dbus:
2520
3052
try:
2521
3053
bus_name = dbus.service.BusName("se.recompile.Mandos",
2522
bus, do_not_queue=True)
2523
old_bus_name = (dbus.service.BusName
2524
("se.bsnet.fukt.Mandos", bus,
2525
do_not_queue=True))
2526
except dbus.exceptions.NameExistsException as e:
3054
bus,
3055
do_not_queue=True)
3056
old_bus_name = dbus.service.BusName(
3057
"se.bsnet.fukt.Mandos", bus,
3058
do_not_queue=True)
3059
except dbus.exceptions.DBusException as e:
2527
3060
logger.error("Disabling D-Bus:", exc_info=e)
2528
3061
use_dbus = False
2529
3062
server_settings["use_dbus"] = False
2530
3063
tcp_server.use_dbus = False
2531
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2532
service = AvahiServiceToSyslog(name =
2533
server_settings["servicename"],
2534
servicetype = "_mandos._tcp",
2535
protocol = protocol, bus = bus)
2536
if server_settings["interface"]:
2537
service.interface = (if_nametoindex
2538
(str(server_settings["interface"])))
2539
3064
if zeroconf:
3065
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3066
service = AvahiServiceToSyslog(
3067
name=server_settings["servicename"],
3068
servicetype="_mandos._tcp",
3069
protocol=protocol,
3070
bus=bus)
3071
if server_settings["interface"]:
3072
service.interface = if_nametoindex(
3073
server_settings["interface"].encode("utf-8"))
3074
2540
3075
global multiprocessing_manager
2541
3076
multiprocessing_manager = multiprocessing.Manager()
2542
3077
2543
3078
client_class = Client
2544
3079
if use_dbus:
2545
client_class = functools.partial(ClientDBus, bus = bus)
2546
3080
client_class = functools.partial(ClientDBus, bus=bus)
3081
2547
3082
client_settings = Client.config_parser(client_config)
2548
3083
old_client_settings = {}
2549
3084
clients_data = {}
2550
3085
2551
3086
# This is used to redirect stdout and stderr for checker processes
2552
3087
global wnull
2553
wnull = open(os.devnull, "w") # A writable /dev/null
3088
wnull = open(os.devnull, "w") # A writable /dev/null
2554
3089
# Only used if server is running in foreground but not in debug
2555
3090
# mode
2556
3091
if debug or not foreground:
2557
3092
wnull.close()
2558
3093
2559
3094
# Get client data and settings from last running state.
2560
3095
if server_settings["restore"]:
2561
3096
try:
2562
3097
with open(stored_state_path, "rb") as stored_state:
2563
clients_data, old_client_settings = (pickle.load
2564
(stored_state))
3098
if sys.version_info.major == 2:
3099
clients_data, old_client_settings = pickle.load(
3100
stored_state)
3101
else:
3102
bytes_clients_data, bytes_old_client_settings = (
3103
pickle.load(stored_state, encoding="bytes"))
3104
# Fix bytes to strings
3105
# clients_data
3106
# .keys()
3107
clients_data = {(key.decode("utf-8")
3108
if isinstance(key, bytes)
3109
else key): value
3110
for key, value in
3111
bytes_clients_data.items()}
3112
del bytes_clients_data
3113
for key in clients_data:
3114
value = {(k.decode("utf-8")
3115
if isinstance(k, bytes) else k): v
3116
for k, v in
3117
clients_data[key].items()}
3118
clients_data[key] = value
3119
# .client_structure
3120
value["client_structure"] = [
3121
(s.decode("utf-8")
3122
if isinstance(s, bytes)
3123
else s) for s in
3124
value["client_structure"]]
3125
# .name & .host
3126
for k in ("name", "host"):
3127
if isinstance(value[k], bytes):
3128
value[k] = value[k].decode("utf-8")
3129
# old_client_settings
3130
# .keys()
3131
old_client_settings = {
3132
(key.decode("utf-8")
3133
if isinstance(key, bytes)
3134
else key): value
3135
for key, value in
3136
bytes_old_client_settings.items()}
3137
del bytes_old_client_settings
3138
# .host
3139
for value in old_client_settings.values():
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
3142
.decode("utf-8"))
2565
3143
os.remove(stored_state_path)
2566
3144
except IOError as e:
2567
3145
if e.errno == errno.ENOENT:
2568
logger.warning("Could not load persistent state: {0}"
2569
.format(os.strerror(e.errno)))
3146
logger.warning("Could not load persistent state:"
3147
" {}".format(os.strerror(e.errno)))
2570
3148
else:
2571
3149
logger.critical("Could not load persistent state:",
2572
3150
exc_info=e)
2573
3151
raise
2574
3152
except EOFError as e:
2575
3153
logger.warning("Could not load persistent state: "
2576
"EOFError:", exc_info=e)
2577
3154
"EOFError:",
3155
exc_info=e)
3156
2578
3157
with PGPEngine() as pgp:
2579
for client_name, client in clients_data.iteritems():
3158
for client_name, client in clients_data.items():
2580
3159
# Skip removed clients
2581
3160
if client_name not in client_settings:
2582
3161
continue
2583
3162
2584
3163
# Decide which value to use after restoring saved state.
2585
3164
# We have three different values: Old config file,
2586
3165
# new config file, and saved state.
2591
3170
# For each value in new config, check if it
2592
3171
# differs from the old config value (Except for
2593
3172
# the "secret" attribute)
2594
if (name != "secret" and
2595
value != old_client_settings[client_name]
2596
[name]):
3173
if (name != "secret"
3174
and (value !=
3175
old_client_settings[client_name][name])):
2597
3176
client[name] = value
2598
3177
except KeyError:
2599
3178
pass
2600
3179
2601
3180
# Clients who has passed its expire date can still be
2602
# enabled if its last checker was successful. Clients
3181
# enabled if its last checker was successful. A Client
2603
3182
# whose checker succeeded before we stored its state is
2604
3183
# assumed to have successfully run all checkers during
2605
3184
# downtime.
2607
3186
if datetime.datetime.utcnow() >= client["expires"]:
2608
3187
if not client["last_checked_ok"]:
2609
3188
logger.warning(
2610
"disabling client {0} - Client never "
2611
"performed a successful checker"
2612
.format(client_name))
3189
"disabling client {} - Client never "
3190
"performed a successful checker".format(
3191
client_name))
2613
3192
client["enabled"] = False
2614
3193
elif client["last_checker_status"] != 0:
2615
3194
logger.warning(
2616
"disabling client {0} - Client "
2617
"last checker failed with error code {1}"
2618
.format(client_name,
2619
client["last_checker_status"]))
3195
"disabling client {} - Client last"
3196
" checker failed with error code"
3197
" {}".format(
3198
client_name,
3199
client["last_checker_status"]))
2620
3200
client["enabled"] = False
2621
3201
else:
2622
client["expires"] = (datetime.datetime
2623
.utcnow()
2624
+ client["timeout"])
3202
client["expires"] = (
3203
datetime.datetime.utcnow()
3204
+ client["timeout"])
2625
3205
logger.debug("Last checker succeeded,"
2626
" keeping {0} enabled"
2627
.format(client_name))
3206
" keeping {} enabled".format(
3207
client_name))
2628
3208
try:
2629
client["secret"] = (
2630
pgp.decrypt(client["encrypted_secret"],
2631
client_settings[client_name]
2632
["secret"]))
3209
client["secret"] = pgp.decrypt(
3210
client["encrypted_secret"],
3211
client_settings[client_name]["secret"])
2633
3212
except PGPError:
2634
3213
# If decryption fails, we use secret from new settings
2635
logger.debug("Failed to decrypt {0} old secret"
2636
.format(client_name))
2637
client["secret"] = (
2638
client_settings[client_name]["secret"])
2639
3214
logger.debug("Failed to decrypt {} old secret".format(
3215
client_name))
3216
client["secret"] = (client_settings[client_name]
3217
["secret"])
3218
2640
3219
# Add/remove clients based on new changes made to config
2641
3220
for client_name in (set(old_client_settings)
2642
3221
- set(client_settings)):
2644
3223
for client_name in (set(client_settings)
2645
3224
- set(old_client_settings)):
2646
3225
clients_data[client_name] = client_settings[client_name]
2647
3226
2648
3227
# Create all client objects
2649
for client_name, client in clients_data.iteritems():
3228
for client_name, client in clients_data.items():
2650
3229
tcp_server.clients[client_name] = client_class(
2651
name = client_name, settings = client,
2652
server_settings = server_settings)
2653
3230
name=client_name,
3231
settings=client,
3232
server_settings=server_settings)
3233
2654
3234
if not tcp_server.clients:
2655
3235
logger.warning("No clients defined")
2656
3236
2657
3237
if not foreground:
2658
3238
if pidfile is not None:
3239
pid = os.getpid()
2659
3240
try:
2660
3241
with pidfile:
2661
pid = os.getpid()
2662
pidfile.write(str(pid) + "\n".encode("utf-8"))
3242
print(pid, file=pidfile)
2663
3243
except IOError:
2664
3244
logger.error("Could not write to file %r with PID %d",
2665
3245
pidfilename, pid)
2666
3246
del pidfile
2667
3247
del pidfilename
2668
2669
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2670
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2671
3248
3249
for termsig in (signal.SIGHUP, signal.SIGTERM):
3250
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3251
lambda: main_loop.quit() and False)
3252
2672
3253
if use_dbus:
2673
@alternate_dbus_interfaces({"se.recompile.Mandos":
2674
"se.bsnet.fukt.Mandos"})
2675
class MandosDBusService(DBusObjectWithProperties):
3254
3255
@alternate_dbus_interfaces(
3256
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3257
class MandosDBusService(DBusObjectWithObjectManager):
2676
3258
"""A D-Bus proxy object"""
3259
2677
3260
def __init__(self):
2678
3261
dbus.service.Object.__init__(self, bus, "/")
3262
2679
3263
_interface = "se.recompile.Mandos"
2680
2681
@dbus_interface_annotations(_interface)
2682
def _foo(self):
2683
return { "org.freedesktop.DBus.Property"
2684
".EmitsChangedSignal":
2685
"false"}
2686
3264
2687
3265
@dbus.service.signal(_interface, signature="o")
2688
3266
def ClientAdded(self, objpath):
2689
3267
"D-Bus signal"
2690
3268
pass
2691
3269
2692
3270
@dbus.service.signal(_interface, signature="ss")
2693
3271
def ClientNotFound(self, fingerprint, address):
2694
3272
"D-Bus signal"
2695
3273
pass
2696
3274
3275
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3276
"true"})
2697
3277
@dbus.service.signal(_interface, signature="os")
2698
3278
def ClientRemoved(self, objpath, name):
2699
3279
"D-Bus signal"
2700
3280
pass
2701
3281
3282
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3283
"true"})
2702
3284
@dbus.service.method(_interface, out_signature="ao")
2703
3285
def GetAllClients(self):
2704
3286
"D-Bus method"
2705
return dbus.Array(c.dbus_object_path
2706
for c in
2707
tcp_server.clients.itervalues())
2708
3287
return dbus.Array(c.dbus_object_path for c in
3288
tcp_server.clients.values())
3289
3290
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3291
"true"})
2709
3292
@dbus.service.method(_interface,
2710
3293
out_signature="a{oa{sv}}")
2711
3294
def GetAllClientsWithProperties(self):
2712
3295
"D-Bus method"
2713
3296
return dbus.Dictionary(
2714
((c.dbus_object_path, c.GetAll(""))
2715
for c in tcp_server.clients.itervalues()),
3297
{c.dbus_object_path: c.GetAll(
3298
"se.recompile.Mandos.Client")
3299
for c in tcp_server.clients.values()},
2716
3300
signature="oa{sv}")
2717
3301
2718
3302
@dbus.service.method(_interface, in_signature="o")
2719
3303
def RemoveClient(self, object_path):
2720
3304
"D-Bus method"
2721
for c in tcp_server.clients.itervalues():
3305
for c in tcp_server.clients.values():
2722
3306
if c.dbus_object_path == object_path:
2723
3307
del tcp_server.clients[c.name]
2724
3308
c.remove_from_connection()
2725
# Don't signal anything except ClientRemoved
3309
# Don't signal the disabling
2726
3310
c.disable(quiet=True)
2727
# Emit D-Bus signal
2728
self.ClientRemoved(object_path, c.name)
3311
# Emit D-Bus signal for removal
3312
self.client_removed_signal(c)
2729
3313
return
2730
3314
raise KeyError(object_path)
2731
3315
2732
3316
del _interface
2733
3317
3318
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3319
out_signature="a{oa{sa{sv}}}")
3320
def GetManagedObjects(self):
3321
"""D-Bus method"""
3322
return dbus.Dictionary(
3323
{client.dbus_object_path:
3324
dbus.Dictionary(
3325
{interface: client.GetAll(interface)
3326
for interface in
3327
client._get_all_interface_names()})
3328
for client in tcp_server.clients.values()})
3329
3330
def client_added_signal(self, client):
3331
"""Send the new standard signal and the old signal"""
3332
if use_dbus:
3333
# New standard signal
3334
self.InterfacesAdded(
3335
client.dbus_object_path,
3336
dbus.Dictionary(
3337
{interface: client.GetAll(interface)
3338
for interface in
3339
client._get_all_interface_names()}))
3340
# Old signal
3341
self.ClientAdded(client.dbus_object_path)
3342
3343
def client_removed_signal(self, client):
3344
"""Send the new standard signal and the old signal"""
3345
if use_dbus:
3346
# New standard signal
3347
self.InterfacesRemoved(
3348
client.dbus_object_path,
3349
client._get_all_interface_names())
3350
# Old signal
3351
self.ClientRemoved(client.dbus_object_path,
3352
client.name)
3353
2734
3354
mandos_dbus_service = MandosDBusService()
2735
3355
3356
# Save modules to variables to exempt the modules from being
3357
# unloaded before the function registered with atexit() is run.
3358
mp = multiprocessing
3359
wn = wnull
3360
2736
3361
def cleanup():
2737
3362
"Cleanup function; run on exit"
2738
service.cleanup()
2739
2740
multiprocessing.active_children()
2741
wnull.close()
3363
if zeroconf:
3364
service.cleanup()
3365
3366
mp.active_children()
3367
wn.close()
2742
3368
if not (tcp_server.clients or client_settings):
2743
3369
return
2744
3370
2745
3371
# Store client before exiting. Secrets are encrypted with key
2746
3372
# based on what config file has. If config file is
2747
3373
# removed/edited, old secret will thus be unrecovable.
2748
3374
clients = {}
2749
3375
with PGPEngine() as pgp:
2750
for client in tcp_server.clients.itervalues():
3376
for client in tcp_server.clients.values():
2751
3377
key = client_settings[client.name]["secret"]
2752
3378
client.encrypted_secret = pgp.encrypt(client.secret,
2753
3379
key)
2754
3380
client_dict = {}
2755
3381
2756
3382
# A list of attributes that can not be pickled
2757
3383
# + secret.
2758
exclude = set(("bus", "changedstate", "secret",
2759
"checker", "server_settings"))
2760
for name, typ in (inspect.getmembers
2761
(dbus.service.Object)):
3384
exclude = {"bus", "changedstate", "secret",
3385
"checker", "server_settings"}
3386
for name, typ in inspect.getmembers(dbus.service
3387
.Object):
2762
3388
exclude.add(name)
2763
3389
2764
3390
client_dict["encrypted_secret"] = (client
2765
3391
.encrypted_secret)
2766
3392
for attr in client.client_structure:
2767
3393
if attr not in exclude:
2768
3394
client_dict[attr] = getattr(client, attr)
2769
3395
2770
3396
clients[client.name] = client_dict
2771
3397
del client_settings[client.name]["secret"]
2772
3398
2773
3399
try:
2774
with (tempfile.NamedTemporaryFile
2775
(mode='wb', suffix=".pickle", prefix='clients-',
2776
dir=os.path.dirname(stored_state_path),
2777
delete=False)) as stored_state:
2778
pickle.dump((clients, client_settings), stored_state)
2779
tempname=stored_state.name
3400
with tempfile.NamedTemporaryFile(
3401
mode='wb',
3402
suffix=".pickle",
3403
prefix='clients-',
3404
dir=os.path.dirname(stored_state_path),
3405
delete=False) as stored_state:
3406
pickle.dump((clients, client_settings), stored_state,
3407
protocol=2)
3408
tempname = stored_state.name
2780
3409
os.rename(tempname, stored_state_path)
2781
3410
except (IOError, OSError) as e:
2782
3411
if not debug:
2785
3414
except NameError:
2786
3415
pass
2787
3416
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2788
logger.warning("Could not save persistent state: {0}"
3417
logger.warning("Could not save persistent state: {}"
2789
3418
.format(os.strerror(e.errno)))
2790
3419
else:
2791
3420
logger.warning("Could not save persistent state:",
2792
3421
exc_info=e)
2793
raise e
2794
3422
raise
3423
2795
3424
# Delete all clients, and settings from config
2796
3425
while tcp_server.clients:
2797
3426
name, client = tcp_server.clients.popitem()
2798
3427
if use_dbus:
2799
3428
client.remove_from_connection()
2800
# Don't signal anything except ClientRemoved
3429
# Don't signal the disabling
2801
3430
client.disable(quiet=True)
3431
# Emit D-Bus signal for removal
2802
3432
if use_dbus:
2803
# Emit D-Bus signal
2804
mandos_dbus_service.ClientRemoved(client
2805
.dbus_object_path,
2806
client.name)
3433
mandos_dbus_service.client_removed_signal(client)
2807
3434
client_settings.clear()
2808
3435
2809
3436
atexit.register(cleanup)
2810
2811
for client in tcp_server.clients.itervalues():
3437
3438
for client in tcp_server.clients.values():
2812
3439
if use_dbus:
2813
# Emit D-Bus signal
2814
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3440
# Emit D-Bus signal for adding
3441
mandos_dbus_service.client_added_signal(client)
2815
3442
# Need to initiate checking of clients
2816
3443
if client.enabled:
2817
3444
client.init_checker()
2818
3445
2819
3446
tcp_server.enable()
2820
3447
tcp_server.server_activate()
2821
3448
2822
3449
# Find out what port we got
2823
service.port = tcp_server.socket.getsockname()[1]
3450
if zeroconf:
3451
service.port = tcp_server.socket.getsockname()[1]
2824
3452
if use_ipv6:
2825
3453
logger.info("Now listening on address %r, port %d,"
2826
3454
" flowinfo %d, scope_id %d",
2828
3456
else: # IPv4
2829
3457
logger.info("Now listening on address %r, port %d",
2830
3458
*tcp_server.socket.getsockname())
2831
2832
#service.interface = tcp_server.socket.getsockname()[3]
2833
3459
3460
# service.interface = tcp_server.socket.getsockname()[3]
3461
2834
3462
try:
2835
# From the Avahi example code
2836
try:
2837
service.activate()
2838
except dbus.exceptions.DBusException as error:
2839
logger.critical("D-Bus Exception", exc_info=error)
2840
cleanup()
2841
sys.exit(1)
2842
# End of Avahi example code
2843
2844
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2845
lambda *args, **kwargs:
2846
(tcp_server.handle_request
2847
(*args[2:], **kwargs) or True))
2848
3463
if zeroconf:
3464
# From the Avahi example code
3465
try:
3466
service.activate()
3467
except dbus.exceptions.DBusException as error:
3468
logger.critical("D-Bus Exception", exc_info=error)
3469
cleanup()
3470
sys.exit(1)
3471
# End of Avahi example code
3472
3473
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3474
lambda *args, **kwargs:
3475
(tcp_server.handle_request
3476
(*args[2:], **kwargs) or True))
3477
2849
3478
logger.debug("Starting main loop")
2850
3479
main_loop.run()
2851
3480
except AvahiError as error:
2860
3489
# Must run before the D-Bus bus name gets deregistered
2861
3490
cleanup()
2862
3491
3492
2863
3493
if __name__ == '__main__':
2864
3494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0