To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1178
- compare with another revision
- download diff
- download tarball
- view history from revision 1178
- Committer: Teddy Hogeborn
- Date: 2019-09-04 05:31:20 UTC
- Revision ID: teddy@recompile.se-20190904053120-b85b56a5kdrnxhbx
Fix server Debian package test
* debian/tests/control (mandos-check/Restrictions): Add
"allow-stderr".
* debian/tests/control (mandos-check/Restrictions): Add
"allow-stderr".
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
1
#!/usr/bin/python3 -b
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
26
#
28
#
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
#
33
#
33
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
37
from future_builtins import *
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
38
42
39
43
try:
40
44
import SocketServer as socketserver
73
77
import itertools
74
78
import collections
75
79
import codecs
80
import unittest
76
81
77
82
import dbus
78
83
import dbus.service
79
try:
80
from gi.repository import GObject
81
except ImportError:
82
import gobject as GObject
83
import avahi
84
import gi
85
from gi.repository import GLib
84
86
from dbus.mainloop.glib import DBusGMainLoop
85
87
import ctypes
86
88
import ctypes.util
87
89
import xml.dom.minidom
88
90
import inspect
89
91
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
95
# Show warnings by default
96
if not sys.warnoptions:
97
import warnings
98
warnings.simplefilter("default")
99
100
# Try to find the value of SO_BINDTODEVICE:
90
101
try:
102
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
103
# newer, and it is also the most natural place for it:
91
104
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
92
105
except AttributeError:
93
106
try:
107
# This is where SO_BINDTODEVICE was up to and including Python
108
# 2.6, and also 3.2:
94
109
from IN import SO_BINDTODEVICE
95
110
except ImportError:
96
SO_BINDTODEVICE = None
111
# In Python 2.7 it seems to have been removed entirely.
112
# Try running the C preprocessor:
113
try:
114
cc = subprocess.Popen(["cc", "--language=c", "-E",
115
"/dev/stdin"],
116
stdin=subprocess.PIPE,
117
stdout=subprocess.PIPE)
118
stdout = cc.communicate(
119
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
120
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
121
except (OSError, ValueError, IndexError):
122
# No value found
123
SO_BINDTODEVICE = None
97
124
98
125
if sys.version_info.major == 2:
99
126
str = unicode
100
127
101
version = "1.7.3"
128
if sys.version_info < (3, 2):
129
configparser.Configparser = configparser.SafeConfigParser
130
131
version = "1.8.9"
102
132
stored_state_file = "clients.pickle"
103
133
104
134
logger = logging.getLogger()
135
logging.captureWarnings(True) # Show warnings via the logging system
105
136
syslogger = None
106
137
107
138
try:
108
139
if_nametoindex = ctypes.cdll.LoadLibrary(
109
140
ctypes.util.find_library("c")).if_nametoindex
110
141
except (OSError, AttributeError):
111
142
112
143
def if_nametoindex(interface):
113
144
"Get an interface index the hard way, i.e. using fcntl()"
114
145
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
119
150
return interface_index
120
151
121
152
153
def copy_function(func):
154
"""Make a copy of a function"""
155
if sys.version_info.major == 2:
156
return types.FunctionType(func.func_code,
157
func.func_globals,
158
func.func_name,
159
func.func_defaults,
160
func.func_closure)
161
else:
162
return types.FunctionType(func.__code__,
163
func.__globals__,
164
func.__name__,
165
func.__defaults__,
166
func.__closure__)
167
168
122
169
def initlogger(debug, level=logging.WARNING):
123
170
"""init logger and add loglevel"""
124
171
125
172
global syslogger
126
173
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
174
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
address="/dev/log"))
129
176
syslogger.setFormatter(logging.Formatter
130
177
('Mandos [%(process)d]: %(levelname)s:'
131
178
' %(message)s'))
132
179
logger.addHandler(syslogger)
133
180
134
181
if debug:
135
182
console = logging.StreamHandler()
136
183
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
146
193
pass
147
194
148
195
149
class PGPEngine(object):
196
class PGPEngine:
150
197
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
198
152
199
def __init__(self):
153
200
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
201
self.gpg = "gpg"
155
202
try:
156
203
output = subprocess.check_output(["gpgconf"])
157
204
for line in output.splitlines():
158
name, text, path = line.split(":")
159
if name == "gpg":
205
name, text, path = line.split(b":")
206
if name == b"gpg":
160
207
self.gpg = path
161
208
break
162
209
except OSError as e:
165
212
self.gnupgargs = ['--batch',
166
213
'--homedir', self.tempdir,
167
214
'--force-mdc',
168
'--quiet',
169
'--no-use-agent']
170
215
'--quiet']
216
# Only GPG version 1 has the --no-use-agent option.
217
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
218
self.gnupgargs.append("--no-use-agent")
219
171
220
def __enter__(self):
172
221
return self
173
222
174
223
def __exit__(self, exc_type, exc_value, traceback):
175
224
self._cleanup()
176
225
return False
177
226
178
227
def __del__(self):
179
228
self._cleanup()
180
229
181
230
def _cleanup(self):
182
231
if self.tempdir is not None:
183
232
# Delete contents of tempdir
184
233
for root, dirs, files in os.walk(self.tempdir,
185
topdown = False):
234
topdown=False):
186
235
for filename in files:
187
236
os.remove(os.path.join(root, filename))
188
237
for dirname in dirs:
190
239
# Remove tempdir
191
240
os.rmdir(self.tempdir)
192
241
self.tempdir = None
193
242
194
243
def password_encode(self, password):
195
244
# Passphrase can not be empty and can not contain newlines or
196
245
# NUL bytes. So we prefix it and hex encode it.
201
250
.replace(b"\n", b"\\n")
202
251
.replace(b"\0", b"\\x00"))
203
252
return encoded
204
253
205
254
def encrypt(self, data, password):
206
255
passphrase = self.password_encode(password)
207
256
with tempfile.NamedTemporaryFile(
212
261
'--passphrase-file',
213
262
passfile.name]
214
263
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
219
268
if proc.returncode != 0:
220
269
raise PGPError(err)
221
270
return ciphertext
222
271
223
272
def decrypt(self, data, password):
224
273
passphrase = self.password_encode(password)
225
274
with tempfile.NamedTemporaryFile(
226
dir = self.tempdir) as passfile:
275
dir=self.tempdir) as passfile:
227
276
passfile.write(passphrase)
228
277
passfile.flush()
229
278
proc = subprocess.Popen([self.gpg, '--decrypt',
230
279
'--passphrase-file',
231
280
passfile.name]
232
281
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
237
286
if proc.returncode != 0:
238
287
raise PGPError(err)
239
288
return decrypted_plaintext
240
289
241
290
291
# Pretend that we have an Avahi module
292
class avahi:
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
298
DBUS_NAME = "org.freedesktop.Avahi"
299
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
DBUS_PATH_SERVER = "/"
302
303
@staticmethod
304
def string_array_to_txt_array(t):
305
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
for s in t), signature="ay")
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
315
316
242
317
class AvahiError(Exception):
243
318
def __init__(self, value, *args, **kwargs):
244
319
self.value = value
254
329
pass
255
330
256
331
257
class AvahiService(object):
332
class AvahiService:
258
333
"""An Avahi (Zeroconf) service.
259
334
260
335
Attributes:
261
336
interface: integer; avahi.IF_UNSPEC or an interface index.
262
337
Used to optionally bind to the specified interface.
274
349
server: D-Bus Server
275
350
bus: dbus.SystemBus()
276
351
"""
277
352
278
353
def __init__(self,
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
354
interface=avahi.IF_UNSPEC,
355
name=None,
356
servicetype=None,
357
port=None,
358
TXT=None,
359
domain="",
360
host="",
361
max_renames=32768,
362
protocol=avahi.PROTO_UNSPEC,
363
bus=None):
289
364
self.interface = interface
290
365
self.name = name
291
366
self.type = servicetype
300
375
self.server = None
301
376
self.bus = bus
302
377
self.entry_group_state_changed_match = None
303
378
304
379
def rename(self, remove=True):
305
380
"""Derived from the Avahi example code"""
306
381
if self.rename_count >= self.max_renames:
326
401
logger.critical("D-Bus Exception", exc_info=error)
327
402
self.cleanup()
328
403
os._exit(1)
329
404
330
405
def remove(self):
331
406
"""Derived from the Avahi example code"""
332
407
if self.entry_group_state_changed_match is not None:
334
409
self.entry_group_state_changed_match = None
335
410
if self.group is not None:
336
411
self.group.Reset()
337
412
338
413
def add(self):
339
414
"""Derived from the Avahi example code"""
340
415
self.remove()
357
432
dbus.UInt16(self.port),
358
433
avahi.string_array_to_txt_array(self.TXT))
359
434
self.group.Commit()
360
435
361
436
def entry_group_state_changed(self, state, error):
362
437
"""Derived from the Avahi example code"""
363
438
logger.debug("Avahi entry group state change: %i", state)
364
439
365
440
if state == avahi.ENTRY_GROUP_ESTABLISHED:
366
441
logger.debug("Zeroconf service established.")
367
442
elif state == avahi.ENTRY_GROUP_COLLISION:
371
446
logger.critical("Avahi: Error in group state changed %s",
372
447
str(error))
373
448
raise AvahiGroupError("State changed: {!s}".format(error))
374
449
375
450
def cleanup(self):
376
451
"""Derived from the Avahi example code"""
377
452
if self.group is not None:
382
457
pass
383
458
self.group = None
384
459
self.remove()
385
460
386
461
def server_state_changed(self, state, error=None):
387
462
"""Derived from the Avahi example code"""
388
463
logger.debug("Avahi server state change: %i", state)
417
492
logger.debug("Unknown state: %r", state)
418
493
else:
419
494
logger.debug("Unknown state: %r: %r", state, error)
420
495
421
496
def activate(self):
422
497
"""Derived from the Avahi example code"""
423
498
if self.server is None:
434
509
class AvahiServiceToSyslog(AvahiService):
435
510
def rename(self, *args, **kwargs):
436
511
"""Add the new name to the syslog messages"""
437
ret = AvahiService.rename(self, *args, **kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
438
513
syslogger.setFormatter(logging.Formatter(
439
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
440
515
.format(self.name)))
441
516
return ret
442
517
518
443
519
# Pretend that we have a GnuTLS module
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
520
class gnutls:
521
"""This isn't so much a class as it is a module-like namespace."""
522
523
library = ctypes.util.find_library("gnutls")
524
if library is None:
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
527
del library
528
459
529
# Unless otherwise indicated, the constants and types below are
460
530
# all from the gnutls/gnutls.h C header file.
461
531
462
532
# Constants
463
533
E_SUCCESS = 0
464
534
E_INTERRUPTED = -52
465
535
E_AGAIN = -28
466
536
CRT_OPENPGP = 2
537
CRT_RAWPK = 3
467
538
CLIENT = 2
468
539
SHUT_RDWR = 0
469
540
CRD_CERTIFICATE = 1
470
541
E_NO_CERTIFICATE_FOUND = -49
542
X509_FMT_DER = 0
543
NO_TICKETS = 1<<10
544
ENABLE_RAWPK = 1<<18
545
CTYPE_PEERS = 3
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
471
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
472
548
473
549
# Types
474
550
class session_int(ctypes.Structure):
475
551
_fields_ = []
476
552
session_t = ctypes.POINTER(session_int)
553
477
554
class certificate_credentials_st(ctypes.Structure):
478
555
_fields_ = []
479
556
certificate_credentials_t = ctypes.POINTER(
480
557
certificate_credentials_st)
481
558
certificate_type_t = ctypes.c_int
559
482
560
class datum_t(ctypes.Structure):
483
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
562
('size', ctypes.c_uint)]
563
485
564
class openpgp_crt_int(ctypes.Structure):
486
565
_fields_ = []
487
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
credentials_type_t = ctypes.c_int #
569
credentials_type_t = ctypes.c_int
491
570
transport_ptr_t = ctypes.c_void_p
492
571
close_request_t = ctypes.c_int
493
572
494
573
# Exceptions
495
574
class Error(Exception):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
575
def __init__(self, message=None, code=None, args=()):
501
576
# Default usage is by a message string, but if a return
502
577
# code is passed, convert it to a string with
503
578
# gnutls.strerror()
504
579
self.code = code
505
580
if message is None and code is not None:
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
508
583
message, *args)
509
584
510
585
class CertificateSecurityError(Error):
511
586
pass
512
587
513
588
# Classes
514
class Credentials(object):
589
class Credentials:
515
590
def __init__(self):
516
591
self._c_object = gnutls.certificate_credentials_t()
517
592
gnutls.certificate_allocate_credentials(
518
593
ctypes.byref(self._c_object))
519
594
self.type = gnutls.CRD_CERTIFICATE
520
595
521
596
def __del__(self):
522
597
gnutls.certificate_free_credentials(self._c_object)
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
598
599
class ClientSession:
600
def __init__(self, socket, credentials=None):
526
601
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
605
if gnutls.has_rawpk:
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
608
del gnutls_flags
528
609
gnutls.set_default_priority(self._c_object)
529
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
611
gnutls.handshake_set_private_extensions(self._c_object,
536
617
ctypes.cast(credentials._c_object,
537
618
ctypes.c_void_p))
538
619
self.credentials = credentials
539
620
540
621
def __del__(self):
541
622
gnutls.deinit(self._c_object)
542
623
543
624
def handshake(self):
544
625
return gnutls.handshake(self._c_object)
545
626
546
627
def send(self, data):
547
628
data = bytes(data)
548
629
data_len = len(data)
550
631
data_len -= gnutls.record_send(self._c_object,
551
632
data[-data_len:],
552
633
data_len)
553
634
554
635
def bye(self):
555
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
637
557
638
# Error handling functions
558
639
def _error_code(result):
559
640
"""A function to raise exceptions on errors, suitable
561
642
if result >= 0:
562
643
return result
563
644
if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
645
raise gnutls.CertificateSecurityError(code=result)
646
raise gnutls.Error(code=result)
647
567
648
def _retry_on_error(result, func, arguments):
568
649
"""A function to retry on some errors, suitable
569
650
for the 'errcheck' attribute on ctypes functions"""
572
653
return _error_code(result)
573
654
result = func(*arguments)
574
655
return result
575
656
576
657
# Unless otherwise indicated, the function declarations below are
577
658
# all from the gnutls/gnutls.h C header file.
578
659
579
660
# Functions
580
661
priority_set_direct = _library.gnutls_priority_set_direct
581
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
663
ctypes.POINTER(ctypes.c_char_p)]
583
664
priority_set_direct.restype = _error_code
584
665
585
666
init = _library.gnutls_init
586
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
668
init.restype = _error_code
588
669
589
670
set_default_priority = _library.gnutls_set_default_priority
590
671
set_default_priority.argtypes = [session_t]
591
672
set_default_priority.restype = _error_code
592
673
593
674
record_send = _library.gnutls_record_send
594
675
record_send.argtypes = [session_t, ctypes.c_void_p,
595
676
ctypes.c_size_t]
596
677
record_send.restype = ctypes.c_ssize_t
597
678
record_send.errcheck = _retry_on_error
598
679
599
680
certificate_allocate_credentials = (
600
681
_library.gnutls_certificate_allocate_credentials)
601
682
certificate_allocate_credentials.argtypes = [
602
683
ctypes.POINTER(certificate_credentials_t)]
603
684
certificate_allocate_credentials.restype = _error_code
604
685
605
686
certificate_free_credentials = (
606
687
_library.gnutls_certificate_free_credentials)
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
608
690
certificate_free_credentials.restype = None
609
691
610
692
handshake_set_private_extensions = (
611
693
_library.gnutls_handshake_set_private_extensions)
612
694
handshake_set_private_extensions.argtypes = [session_t,
613
695
ctypes.c_int]
614
696
handshake_set_private_extensions.restype = None
615
697
616
698
credentials_set = _library.gnutls_credentials_set
617
699
credentials_set.argtypes = [session_t, credentials_type_t,
618
700
ctypes.c_void_p]
619
701
credentials_set.restype = _error_code
620
702
621
703
strerror = _library.gnutls_strerror
622
704
strerror.argtypes = [ctypes.c_int]
623
705
strerror.restype = ctypes.c_char_p
624
706
625
707
certificate_type_get = _library.gnutls_certificate_type_get
626
708
certificate_type_get.argtypes = [session_t]
627
709
certificate_type_get.restype = _error_code
628
710
629
711
certificate_get_peers = _library.gnutls_certificate_get_peers
630
712
certificate_get_peers.argtypes = [session_t,
631
713
ctypes.POINTER(ctypes.c_uint)]
632
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
715
634
716
global_set_log_level = _library.gnutls_global_set_log_level
635
717
global_set_log_level.argtypes = [ctypes.c_int]
636
718
global_set_log_level.restype = None
637
719
638
720
global_set_log_function = _library.gnutls_global_set_log_function
639
721
global_set_log_function.argtypes = [log_func]
640
722
global_set_log_function.restype = None
641
723
642
724
deinit = _library.gnutls_deinit
643
725
deinit.argtypes = [session_t]
644
726
deinit.restype = None
645
727
646
728
handshake = _library.gnutls_handshake
647
729
handshake.argtypes = [session_t]
648
730
handshake.restype = _error_code
649
731
handshake.errcheck = _retry_on_error
650
732
651
733
transport_set_ptr = _library.gnutls_transport_set_ptr
652
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
735
transport_set_ptr.restype = None
654
736
655
737
bye = _library.gnutls_bye
656
738
bye.argtypes = [session_t, close_request_t]
657
739
bye.restype = _error_code
658
740
bye.errcheck = _retry_on_error
659
741
660
742
check_version = _library.gnutls_check_version
661
743
check_version.argtypes = [ctypes.c_char_p]
662
744
check_version.restype = ctypes.c_char_p
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
745
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
750
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
753
754
if has_rawpk:
755
# Types
756
class pubkey_st(ctypes.Structure):
757
_fields = []
758
pubkey_t = ctypes.POINTER(pubkey_st)
759
760
x509_crt_fmt_t = ctypes.c_int
761
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
766
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
769
x509_crt_fmt_t]
770
pubkey_import.restype = _error_code
771
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
777
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
781
else:
782
# All the function declarations below are from gnutls/openpgp.h
783
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
787
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
791
openpgp_crt_fmt_t]
792
openpgp_crt_import.restype = _error_code
793
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
798
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
802
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
806
ctypes.c_void_p,
807
ctypes.POINTER(
808
ctypes.c_size_t)]
809
openpgp_crt_get_fingerprint.restype = _error_code
810
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
815
693
816
# Remove non-public functions
694
817
del _error_code, _retry_on_error
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
818
697
819
698
820
def call_pipe(connection, # : multiprocessing.Connection
699
821
func, *args, **kwargs):
700
822
"""This function is meant to be called by multiprocessing.Process
701
823
702
824
This function runs func(*args, **kwargs), and writes the resulting
703
825
return value on the provided multiprocessing.Connection.
704
826
"""
705
827
connection.send(func(*args, **kwargs))
706
828
connection.close()
707
829
708
class Client(object):
830
831
class Client:
709
832
"""A representation of a client host served by this server.
710
833
711
834
Attributes:
712
835
approved: bool(); 'None' if not yet approved/disapproved
713
836
approval_delay: datetime.timedelta(); Time to wait for approval
714
837
approval_duration: datetime.timedelta(); Duration of one approval
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a GObject event source tag, or None
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
840
running.
841
checker_callback_tag: a GLib event source tag, or None
719
842
checker_command: string; External command which is run to check
720
843
if client lives. %() expansions are done at
721
844
runtime with vars(self) as dict, so that for
722
845
instance %(name)s can be used in the command.
723
checker_initiator_tag: a GObject event source tag, or None
846
checker_initiator_tag: a GLib event source tag, or None
724
847
created: datetime.datetime(); (UTC) object creation
725
848
client_structure: Object describing what attributes a client has
726
849
and is used for storing the client at exit
727
850
current_checker_command: string; current running checker_command
728
disable_initiator_tag: a GObject event source tag, or None
851
disable_initiator_tag: a GLib event source tag, or None
729
852
enabled: bool()
730
853
fingerprint: string (40 or 32 hexadecimal digits); used to
731
uniquely identify the client
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
732
857
host: string; available for use by the checker command
733
858
interval: datetime.timedelta(); How often to start a new checker
734
859
last_approval_request: datetime.datetime(); (UTC) or None
750
875
disabled, or None
751
876
server_settings: The server_settings dict from main()
752
877
"""
753
878
754
879
runtime_expansions = ("approval_delay", "approval_duration",
755
"created", "enabled", "expires",
880
"created", "enabled", "expires", "key_id",
756
881
"fingerprint", "host", "interval",
757
882
"last_approval_request", "last_checked_ok",
758
883
"last_enabled", "name", "timeout")
767
892
"approved_by_default": "True",
768
893
"enabled": "True",
769
894
}
770
895
771
896
@staticmethod
772
897
def config_parser(config):
773
898
"""Construct a new dict of client settings of this form:
780
905
for client_name in config.sections():
781
906
section = dict(config.items(client_name))
782
907
client = settings[client_name] = {}
783
908
784
909
client["host"] = section["host"]
785
910
# Reformat values from string types to Python types
786
911
client["approved_by_default"] = config.getboolean(
787
912
client_name, "approved_by_default")
788
913
client["enabled"] = config.getboolean(client_name,
789
914
"enabled")
790
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
915
916
# Uppercase and remove spaces from key_id and fingerprint
917
# for later comparison purposes with return value from the
918
# key_id() and fingerprint() functions
919
client["key_id"] = (section.get("key_id", "").upper()
920
.replace(" ", ""))
794
921
client["fingerprint"] = (section["fingerprint"].upper()
795
922
.replace(" ", ""))
796
923
if "secret" in section:
797
client["secret"] = section["secret"].decode("base64")
924
client["secret"] = codecs.decode(section["secret"]
925
.encode("utf-8"),
926
"base64")
798
927
elif "secfile" in section:
799
928
with open(os.path.expanduser(os.path.expandvars
800
929
(section["secfile"])),
815
944
client["last_approval_request"] = None
816
945
client["last_checked_ok"] = None
817
946
client["last_checker_status"] = -2
818
947
819
948
return settings
820
821
def __init__(self, settings, name = None, server_settings=None):
949
950
def __init__(self, settings, name=None, server_settings=None):
822
951
self.name = name
823
952
if server_settings is None:
824
953
server_settings = {}
826
955
# adding all client settings
827
956
for setting, value in settings.items():
828
957
setattr(self, setting, value)
829
958
830
959
if self.enabled:
831
960
if not hasattr(self, "last_enabled"):
832
961
self.last_enabled = datetime.datetime.utcnow()
836
965
else:
837
966
self.last_enabled = None
838
967
self.expires = None
839
968
840
969
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
841
971
logger.debug(" Fingerprint: %s", self.fingerprint)
842
972
self.created = settings.get("created",
843
973
datetime.datetime.utcnow())
844
974
845
975
# attributes specific for this server instance
846
976
self.checker = None
847
977
self.checker_initiator_tag = None
853
983
self.changedstate = multiprocessing_manager.Condition(
854
984
multiprocessing_manager.Lock())
855
985
self.client_structure = [attr
856
for attr in self.__dict__.iterkeys()
986
for attr in self.__dict__.keys()
857
987
if not attr.startswith("_")]
858
988
self.client_structure.append("client_structure")
859
989
860
990
for name, t in inspect.getmembers(
861
991
type(self), lambda obj: isinstance(obj, property)):
862
992
if not name.startswith("_"):
863
993
self.client_structure.append(name)
864
994
865
995
# Send notice to process children that client state has changed
866
996
def send_changedstate(self):
867
997
with self.changedstate:
868
998
self.changedstate.notify_all()
869
999
870
1000
def enable(self):
871
1001
"""Start this client's checker and timeout hooks"""
872
1002
if getattr(self, "enabled", False):
877
1007
self.last_enabled = datetime.datetime.utcnow()
878
1008
self.init_checker()
879
1009
self.send_changedstate()
880
1010
881
1011
def disable(self, quiet=True):
882
1012
"""Disable this client."""
883
1013
if not getattr(self, "enabled", False):
885
1015
if not quiet:
886
1016
logger.info("Disabling client %s", self.name)
887
1017
if getattr(self, "disable_initiator_tag", None) is not None:
888
GObject.source_remove(self.disable_initiator_tag)
1018
GLib.source_remove(self.disable_initiator_tag)
889
1019
self.disable_initiator_tag = None
890
1020
self.expires = None
891
1021
if getattr(self, "checker_initiator_tag", None) is not None:
892
GObject.source_remove(self.checker_initiator_tag)
1022
GLib.source_remove(self.checker_initiator_tag)
893
1023
self.checker_initiator_tag = None
894
1024
self.stop_checker()
895
1025
self.enabled = False
896
1026
if not quiet:
897
1027
self.send_changedstate()
898
# Do not run this again if called by a GObject.timeout_add
1028
# Do not run this again if called by a GLib.timeout_add
899
1029
return False
900
1030
901
1031
def __del__(self):
902
1032
self.disable()
903
1033
904
1034
def init_checker(self):
905
1035
# Schedule a new checker to be started an 'interval' from now,
906
1036
# and every interval from then on.
907
1037
if self.checker_initiator_tag is not None:
908
GObject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = GObject.timeout_add(
1038
GLib.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = GLib.timeout_add(
910
1040
int(self.interval.total_seconds() * 1000),
911
1041
self.start_checker)
912
1042
# Schedule a disable() when 'timeout' has passed
913
1043
if self.disable_initiator_tag is not None:
914
GObject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = GObject.timeout_add(
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
916
1046
int(self.timeout.total_seconds() * 1000), self.disable)
917
1047
# Also start a new checker *right now*.
918
1048
self.start_checker()
919
1049
920
1050
def checker_callback(self, source, condition, connection,
921
1051
command):
922
1052
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
924
self.checker = None
925
1053
# Read return code from connection (see call_pipe)
926
1054
returncode = connection.recv()
927
1055
connection.close()
928
1056
if self.checker is not None:
1057
self.checker.join()
1058
self.checker_callback_tag = None
1059
self.checker = None
1060
929
1061
if returncode >= 0:
930
1062
self.last_checker_status = returncode
931
1063
self.last_checker_signal = None
941
1073
logger.warning("Checker for %(name)s crashed?",
942
1074
vars(self))
943
1075
return False
944
1076
945
1077
def checked_ok(self):
946
1078
"""Assert that the client has been seen, alive and well."""
947
1079
self.last_checked_ok = datetime.datetime.utcnow()
948
1080
self.last_checker_status = 0
949
1081
self.last_checker_signal = None
950
1082
self.bump_timeout()
951
1083
952
1084
def bump_timeout(self, timeout=None):
953
1085
"""Bump up the timeout for this client."""
954
1086
if timeout is None:
955
1087
timeout = self.timeout
956
1088
if self.disable_initiator_tag is not None:
957
GObject.source_remove(self.disable_initiator_tag)
1089
GLib.source_remove(self.disable_initiator_tag)
958
1090
self.disable_initiator_tag = None
959
1091
if getattr(self, "enabled", False):
960
self.disable_initiator_tag = GObject.timeout_add(
1092
self.disable_initiator_tag = GLib.timeout_add(
961
1093
int(timeout.total_seconds() * 1000), self.disable)
962
1094
self.expires = datetime.datetime.utcnow() + timeout
963
1095
964
1096
def need_approval(self):
965
1097
self.last_approval_request = datetime.datetime.utcnow()
966
1098
967
1099
def start_checker(self):
968
1100
"""Start a new checker subprocess if one is not running.
969
1101
970
1102
If a checker already exists, leave it running and do
971
1103
nothing."""
972
1104
# The reason for not killing a running checker is that if we
977
1109
# checkers alone, the checker would have to take more time
978
1110
# than 'timeout' for the client to be disabled, which is as it
979
1111
# should be.
980
1112
981
1113
if self.checker is not None and not self.checker.is_alive():
982
1114
logger.warning("Checker was not alive; joining")
983
1115
self.checker.join()
987
1119
# Escape attributes for the shell
988
1120
escaped_attrs = {
989
1121
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
1122
for attr in self.runtime_expansions}
991
1123
try:
992
1124
command = self.checker_command % escaped_attrs
993
1125
except TypeError as error:
1005
1137
# The exception is when not debugging but nevertheless
1006
1138
# running in the foreground; use the previously
1007
1139
# created wnull.
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1140
popen_args = {"close_fds": True,
1141
"shell": True,
1142
"cwd": "/"}
1011
1143
if (not self.server_settings["debug"]
1012
1144
and self.server_settings["foreground"]):
1013
1145
popen_args.update({"stdout": wnull,
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1146
"stderr": wnull})
1147
pipe = multiprocessing.Pipe(duplex=False)
1016
1148
self.checker = multiprocessing.Process(
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1149
target=call_pipe,
1150
args=(pipe[1], subprocess.call, command),
1151
kwargs=popen_args)
1020
1152
self.checker.start()
1021
self.checker_callback_tag = GObject.io_add_watch(
1022
pipe[0].fileno(), GObject.IO_IN,
1153
self.checker_callback_tag = GLib.io_add_watch(
1154
GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1023
1156
self.checker_callback, pipe[0], command)
1024
# Re-run this periodically if run by GObject.timeout_add
1157
# Re-run this periodically if run by GLib.timeout_add
1025
1158
return True
1026
1159
1027
1160
def stop_checker(self):
1028
1161
"""Force the checker process, if any, to stop."""
1029
1162
if self.checker_callback_tag:
1030
GObject.source_remove(self.checker_callback_tag)
1163
GLib.source_remove(self.checker_callback_tag)
1031
1164
self.checker_callback_tag = None
1032
1165
if getattr(self, "checker", None) is None:
1033
1166
return
1042
1175
byte_arrays=False):
1043
1176
"""Decorators for marking methods of a DBusObjectWithProperties to
1044
1177
become properties on the D-Bus.
1045
1178
1046
1179
The decorated method will be called with no arguments by "Get"
1047
1180
and with one argument by "Set".
1048
1181
1049
1182
The parameters, where they are supported, are the same as
1050
1183
dbus.service.method, except there is only "signature", since the
1051
1184
type from Get() and the type sent to Set() is the same.
1055
1188
if byte_arrays and signature != "ay":
1056
1189
raise ValueError("Byte arrays not supported for non-'ay'"
1057
1190
" signature {!r}".format(signature))
1058
1191
1059
1192
def decorator(func):
1060
1193
func._dbus_is_property = True
1061
1194
func._dbus_interface = dbus_interface
1064
1197
func._dbus_name = func.__name__
1065
1198
if func._dbus_name.endswith("_dbus_property"):
1066
1199
func._dbus_name = func._dbus_name[:-14]
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1200
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1068
1201
return func
1069
1202
1070
1203
return decorator
1071
1204
1072
1205
1073
1206
def dbus_interface_annotations(dbus_interface):
1074
1207
"""Decorator for marking functions returning interface annotations
1075
1208
1076
1209
Usage:
1077
1210
1078
1211
@dbus_interface_annotations("org.example.Interface")
1079
1212
def _foo(self): # Function name does not matter
1080
1213
return {"org.freedesktop.DBus.Deprecated": "true",
1081
1214
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1082
1215
"false"}
1083
1216
"""
1084
1217
1085
1218
def decorator(func):
1086
1219
func._dbus_is_interface = True
1087
1220
func._dbus_interface = dbus_interface
1088
1221
func._dbus_name = dbus_interface
1089
1222
return func
1090
1223
1091
1224
return decorator
1092
1225
1093
1226
1094
1227
def dbus_annotations(annotations):
1095
1228
"""Decorator to annotate D-Bus methods, signals or properties
1096
1229
Usage:
1097
1230
1098
1231
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1099
1232
"org.freedesktop.DBus.Property."
1100
1233
"EmitsChangedSignal": "false"})
1102
1235
access="r")
1103
1236
def Property_dbus_property(self):
1104
1237
return dbus.Boolean(False)
1105
1238
1106
1239
See also the DBusObjectWithAnnotations class.
1107
1240
"""
1108
1241
1109
1242
def decorator(func):
1110
1243
func._dbus_annotations = annotations
1111
1244
return func
1112
1245
1113
1246
return decorator
1114
1247
1115
1248
1133
1266
1134
1267
class DBusObjectWithAnnotations(dbus.service.Object):
1135
1268
"""A D-Bus object with annotations.
1136
1269
1137
1270
Classes inheriting from this can use the dbus_annotations
1138
1271
decorator to add annotations to methods or signals.
1139
1272
"""
1140
1273
1141
1274
@staticmethod
1142
1275
def _is_dbus_thing(thing):
1143
1276
"""Returns a function testing if an attribute is a D-Bus thing
1144
1277
1145
1278
If called like _is_dbus_thing("method") it returns a function
1146
1279
suitable for use as predicate to inspect.getmembers().
1147
1280
"""
1148
1281
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1149
1282
False)
1150
1283
1151
1284
def _get_all_dbus_things(self, thing):
1152
1285
"""Returns a generator of (name, attribute) pairs
1153
1286
"""
1156
1289
for cls in self.__class__.__mro__
1157
1290
for name, athing in
1158
1291
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
1292
1160
1293
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1294
out_signature="s",
1295
path_keyword='object_path',
1296
connection_keyword='connection')
1164
1297
def Introspect(self, object_path, connection):
1165
1298
"""Overloading of standard D-Bus method.
1166
1299
1167
1300
Inserts annotation tags on methods and signals.
1168
1301
"""
1169
1302
xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
1303
connection)
1171
1304
try:
1172
1305
document = xml.dom.minidom.parseString(xmlstring)
1173
1306
1174
1307
for if_tag in document.getElementsByTagName("interface"):
1175
1308
# Add annotation tags
1176
1309
for typ in ("method", "signal"):
1203
1336
if_tag.appendChild(ann_tag)
1204
1337
# Fix argument name for the Introspect method itself
1205
1338
if (if_tag.getAttribute("name")
1206
== dbus.INTROSPECTABLE_IFACE):
1339
== dbus.INTROSPECTABLE_IFACE):
1207
1340
for cn in if_tag.getElementsByTagName("method"):
1208
1341
if cn.getAttribute("name") == "Introspect":
1209
1342
for arg in cn.getElementsByTagName("arg"):
1222
1355
1223
1356
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
1357
"""A D-Bus object with properties.
1225
1358
1226
1359
Classes inheriting from this can use the dbus_service_property
1227
1360
decorator to expose methods as D-Bus properties. It exposes the
1228
1361
standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
1362
"""
1230
1363
1231
1364
def _get_dbus_property(self, interface_name, property_name):
1232
1365
"""Returns a bound method if one exists which is a D-Bus
1233
1366
property with the specified name and interface.
1238
1371
if (value._dbus_name == property_name
1239
1372
and value._dbus_interface == interface_name):
1240
1373
return value.__get__(self)
1241
1374
1242
1375
# No such property
1243
1376
raise DBusPropertyNotFound("{}:{}.{}".format(
1244
1377
self.dbus_object_path, interface_name, property_name))
1245
1378
1246
1379
@classmethod
1247
1380
def _get_all_interface_names(cls):
1248
1381
"""Get a sequence of all interfaces supported by an object"""
1251
1384
for x in (inspect.getmro(cls))
1252
1385
for attr in dir(x))
1253
1386
if name is not None)
1254
1387
1255
1388
@dbus.service.method(dbus.PROPERTIES_IFACE,
1256
1389
in_signature="ss",
1257
1390
out_signature="v")
1265
1398
if not hasattr(value, "variant_level"):
1266
1399
return value
1267
1400
return type(value)(value, variant_level=value.variant_level+1)
1268
1401
1269
1402
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1270
1403
def Set(self, interface_name, property_name, value):
1271
1404
"""Standard D-Bus property Set() method, see D-Bus standard.
1283
1416
value = dbus.ByteArray(b''.join(chr(byte)
1284
1417
for byte in value))
1285
1418
prop(value)
1286
1419
1287
1420
@dbus.service.method(dbus.PROPERTIES_IFACE,
1288
1421
in_signature="s",
1289
1422
out_signature="a{sv}")
1290
1423
def GetAll(self, interface_name):
1291
1424
"""Standard D-Bus property GetAll() method, see D-Bus
1292
1425
standard.
1293
1426
1294
1427
Note: Will not include properties with access="write".
1295
1428
"""
1296
1429
properties = {}
1307
1440
properties[name] = value
1308
1441
continue
1309
1442
properties[name] = type(value)(
1310
value, variant_level = value.variant_level + 1)
1443
value, variant_level=value.variant_level + 1)
1311
1444
return dbus.Dictionary(properties, signature="sv")
1312
1445
1313
1446
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1314
1447
def PropertiesChanged(self, interface_name, changed_properties,
1315
1448
invalidated_properties):
1317
1450
standard.
1318
1451
"""
1319
1452
pass
1320
1453
1321
1454
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1322
1455
out_signature="s",
1323
1456
path_keyword='object_path',
1324
1457
connection_keyword='connection')
1325
1458
def Introspect(self, object_path, connection):
1326
1459
"""Overloading of standard D-Bus method.
1327
1460
1328
1461
Inserts property tags and interface annotation tags.
1329
1462
"""
1330
1463
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1332
1465
connection)
1333
1466
try:
1334
1467
document = xml.dom.minidom.parseString(xmlstring)
1335
1468
1336
1469
def make_tag(document, name, prop):
1337
1470
e = document.createElement("property")
1338
1471
e.setAttribute("name", name)
1339
1472
e.setAttribute("type", prop._dbus_signature)
1340
1473
e.setAttribute("access", prop._dbus_access)
1341
1474
return e
1342
1475
1343
1476
for if_tag in document.getElementsByTagName("interface"):
1344
1477
# Add property tags
1345
1478
for tag in (make_tag(document, name, prop)
1387
1520
exc_info=error)
1388
1521
return xmlstring
1389
1522
1523
1390
1524
try:
1391
1525
dbus.OBJECT_MANAGER_IFACE
1392
1526
except AttributeError:
1393
1527
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
1528
1529
1395
1530
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
1531
"""A D-Bus object with an ObjectManager.
1397
1532
1398
1533
Classes inheriting from this exposes the standard
1399
1534
GetManagedObjects call and the InterfacesAdded and
1400
1535
InterfacesRemoved signals on the standard
1401
1536
"org.freedesktop.DBus.ObjectManager" interface.
1402
1537
1403
1538
Note: No signals are sent automatically; they must be sent
1404
1539
manually.
1405
1540
"""
1406
1541
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
out_signature = "a{oa{sa{sv}}}")
1542
out_signature="a{oa{sa{sv}}}")
1408
1543
def GetManagedObjects(self):
1409
1544
"""This function must be overridden"""
1410
1545
raise NotImplementedError()
1411
1546
1412
1547
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
signature = "oa{sa{sv}}")
1548
signature="oa{sa{sv}}")
1414
1549
def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
1550
pass
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1551
1552
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1418
1553
def InterfacesRemoved(self, object_path, interfaces):
1419
1554
pass
1420
1555
1421
1556
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1557
out_signature="s",
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1425
1560
def Introspect(self, object_path, connection):
1426
1561
"""Overloading of standard D-Bus method.
1427
1562
1428
1563
Override return argument name of GetManagedObjects to be
1429
1564
"objpath_interfaces_and_properties"
1430
1565
"""
1433
1568
connection)
1434
1569
try:
1435
1570
document = xml.dom.minidom.parseString(xmlstring)
1436
1571
1437
1572
for if_tag in document.getElementsByTagName("interface"):
1438
1573
# Fix argument name for the GetManagedObjects method
1439
1574
if (if_tag.getAttribute("name")
1440
== dbus.OBJECT_MANAGER_IFACE):
1575
== dbus.OBJECT_MANAGER_IFACE):
1441
1576
for cn in if_tag.getElementsByTagName("method"):
1442
1577
if (cn.getAttribute("name")
1443
1578
== "GetManagedObjects"):
1453
1588
except (AttributeError, xml.dom.DOMException,
1454
1589
xml.parsers.expat.ExpatError) as error:
1455
1590
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1591
exc_info=error)
1457
1592
return xmlstring
1458
1593
1594
1459
1595
def datetime_to_dbus(dt, variant_level=0):
1460
1596
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1461
1597
if dt is None:
1462
return dbus.String("", variant_level = variant_level)
1598
return dbus.String("", variant_level=variant_level)
1463
1599
return dbus.String(dt.isoformat(), variant_level=variant_level)
1464
1600
1465
1601
1468
1604
dbus.service.Object, it will add alternate D-Bus attributes with
1469
1605
interface names according to the "alt_interface_names" mapping.
1470
1606
Usage:
1471
1607
1472
1608
@alternate_dbus_interfaces({"org.example.Interface":
1473
1609
"net.example.AlternateInterface"})
1474
1610
class SampleDBusObject(dbus.service.Object):
1475
1611
@dbus.service.method("org.example.Interface")
1476
1612
def SampleDBusMethod():
1477
1613
pass
1478
1614
1479
1615
The above "SampleDBusMethod" on "SampleDBusObject" will be
1480
1616
reachable via two interfaces: "org.example.Interface" and
1481
1617
"net.example.AlternateInterface", the latter of which will have
1482
1618
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1483
1619
"true", unless "deprecate" is passed with a False value.
1484
1620
1485
1621
This works for methods and signals, and also for D-Bus properties
1486
1622
(from DBusObjectWithProperties) and interfaces (from the
1487
1623
dbus_interface_annotations decorator).
1488
1624
"""
1489
1625
1490
1626
def wrapper(cls):
1491
1627
for orig_interface_name, alt_interface_name in (
1492
1628
alt_interface_names.items()):
1507
1643
interface_names.add(alt_interface)
1508
1644
# Is this a D-Bus signal?
1509
1645
if getattr(attribute, "_dbus_is_signal", False):
1646
# Extract the original non-method undecorated
1647
# function by black magic
1510
1648
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1513
1649
nonmethod_func = (dict(
1514
1650
zip(attribute.func_code.co_freevars,
1515
1651
attribute.__closure__))
1516
1652
["func"].cell_contents)
1517
1653
else:
1518
nonmethod_func = attribute
1654
nonmethod_func = (dict(
1655
zip(attribute.__code__.co_freevars,
1656
attribute.__closure__))
1657
["func"].cell_contents)
1519
1658
# Create a new, but exactly alike, function
1520
1659
# object, and decorate it to be a new D-Bus signal
1521
1660
# with the alternate D-Bus interface name
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1661
new_function = copy_function(nonmethod_func)
1536
1662
new_function = (dbus.service.signal(
1537
1663
alt_interface,
1538
1664
attribute._dbus_signature)(new_function))
1542
1668
attribute._dbus_annotations)
1543
1669
except AttributeError:
1544
1670
pass
1671
1545
1672
# Define a creator of a function to call both the
1546
1673
# original and alternate functions, so both the
1547
1674
# original and alternate signals gets sent when
1550
1677
"""This function is a scope container to pass
1551
1678
func1 and func2 to the "call_both" function
1552
1679
outside of its arguments"""
1553
1680
1554
1681
@functools.wraps(func2)
1555
1682
def call_both(*args, **kwargs):
1556
1683
"""This function will emit two D-Bus
1557
1684
signals by calling func1 and func2"""
1558
1685
func1(*args, **kwargs)
1559
1686
func2(*args, **kwargs)
1560
# Make wrapper function look like a D-Bus signal
1687
# Make wrapper function look like a D-Bus
1688
# signal
1561
1689
for name, attr in inspect.getmembers(func2):
1562
1690
if name.startswith("_dbus_"):
1563
1691
setattr(call_both, name, attr)
1564
1692
1565
1693
return call_both
1566
1694
# Create the "call_both" function and add it to
1567
1695
# the class
1577
1705
alt_interface,
1578
1706
attribute._dbus_in_signature,
1579
1707
attribute._dbus_out_signature)
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1708
(copy_function(attribute)))
1585
1709
# Copy annotations, if any
1586
1710
try:
1587
1711
attr[attrname]._dbus_annotations = dict(
1599
1723
attribute._dbus_access,
1600
1724
attribute._dbus_get_args_options
1601
1725
["byte_arrays"])
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1726
(copy_function(attribute)))
1608
1727
# Copy annotations, if any
1609
1728
try:
1610
1729
attr[attrname]._dbus_annotations = dict(
1619
1738
# to the class.
1620
1739
attr[attrname] = (
1621
1740
dbus_interface_annotations(alt_interface)
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1741
(copy_function(attribute)))
1627
1742
if deprecate:
1628
1743
# Deprecate all alternate interfaces
1629
iname="_AlternateDBusNames_interface_annotation{}"
1744
iname = "_AlternateDBusNames_interface_annotation{}"
1630
1745
for interface_name in interface_names:
1631
1746
1632
1747
@dbus_interface_annotations(interface_name)
1633
1748
def func(self):
1634
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1749
return {"org.freedesktop.DBus.Deprecated":
1750
"true"}
1636
1751
# Find an unused name
1637
1752
for aname in (iname.format(i)
1638
1753
for i in itertools.count()):
1642
1757
if interface_names:
1643
1758
# Replace the class with a new subclass of it with
1644
1759
# methods, signals, etc. as created above.
1645
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1760
if sys.version_info.major == 2:
1761
cls = type(b"{}Alternate".format(cls.__name__),
1762
(cls, ), attr)
1763
else:
1764
cls = type("{}Alternate".format(cls.__name__),
1765
(cls, ), attr)
1647
1766
return cls
1648
1767
1649
1768
return wrapper
1650
1769
1651
1770
1653
1772
"se.bsnet.fukt.Mandos"})
1654
1773
class ClientDBus(Client, DBusObjectWithProperties):
1655
1774
"""A Client class using D-Bus
1656
1775
1657
1776
Attributes:
1658
1777
dbus_object_path: dbus.ObjectPath
1659
1778
bus: dbus.SystemBus()
1660
1779
"""
1661
1780
1662
1781
runtime_expansions = (Client.runtime_expansions
1663
1782
+ ("dbus_object_path", ))
1664
1783
1665
1784
_interface = "se.recompile.Mandos.Client"
1666
1785
1667
1786
# dbus.service.Object doesn't use super(), so we can't either.
1668
1669
def __init__(self, bus = None, *args, **kwargs):
1787
1788
def __init__(self, bus=None, *args, **kwargs):
1670
1789
self.bus = bus
1671
1790
Client.__init__(self, *args, **kwargs)
1672
1791
# Only now, when this client is initialized, can it show up on
1678
1797
"/clients/" + client_object_name)
1679
1798
DBusObjectWithProperties.__init__(self, self.bus,
1680
1799
self.dbus_object_path)
1681
1800
1682
1801
def notifychangeproperty(transform_func, dbus_name,
1683
1802
type_func=lambda x: x,
1684
1803
variant_level=1,
1686
1805
_interface=_interface):
1687
1806
""" Modify a variable so that it's a property which announces
1688
1807
its changes to DBus.
1689
1808
1690
1809
transform_fun: Function that takes a value and a variant_level
1691
1810
and transforms it to a D-Bus type.
1692
1811
dbus_name: D-Bus name of the variable
1695
1814
variant_level: D-Bus variant level. Default: 1
1696
1815
"""
1697
1816
attrname = "_{}".format(dbus_name)
1698
1817
1699
1818
def setter(self, value):
1700
1819
if hasattr(self, "dbus_object_path"):
1701
1820
if (not hasattr(self, attrname) or
1708
1827
else:
1709
1828
dbus_value = transform_func(
1710
1829
type_func(value),
1711
variant_level = variant_level)
1830
variant_level=variant_level)
1712
1831
self.PropertyChanged(dbus.String(dbus_name),
1713
1832
dbus_value)
1714
1833
self.PropertiesChanged(
1715
1834
_interface,
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1835
dbus.Dictionary({dbus.String(dbus_name):
1836
dbus_value}),
1718
1837
dbus.Array())
1719
1838
setattr(self, attrname, value)
1720
1839
1721
1840
return property(lambda self: getattr(self, attrname), setter)
1722
1841
1723
1842
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1724
1843
approvals_pending = notifychangeproperty(dbus.Boolean,
1725
1844
"ApprovalPending",
1726
type_func = bool)
1845
type_func=bool)
1727
1846
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1728
1847
last_enabled = notifychangeproperty(datetime_to_dbus,
1729
1848
"LastEnabled")
1730
1849
checker = notifychangeproperty(
1731
1850
dbus.Boolean, "CheckerRunning",
1732
type_func = lambda checker: checker is not None)
1851
type_func=lambda checker: checker is not None)
1733
1852
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1734
1853
"LastCheckedOK")
1735
1854
last_checker_status = notifychangeproperty(dbus.Int16,
1740
1859
"ApprovedByDefault")
1741
1860
approval_delay = notifychangeproperty(
1742
1861
dbus.UInt64, "ApprovalDelay",
1743
type_func = lambda td: td.total_seconds() * 1000)
1862
type_func=lambda td: td.total_seconds() * 1000)
1744
1863
approval_duration = notifychangeproperty(
1745
1864
dbus.UInt64, "ApprovalDuration",
1746
type_func = lambda td: td.total_seconds() * 1000)
1865
type_func=lambda td: td.total_seconds() * 1000)
1747
1866
host = notifychangeproperty(dbus.String, "Host")
1748
1867
timeout = notifychangeproperty(
1749
1868
dbus.UInt64, "Timeout",
1750
type_func = lambda td: td.total_seconds() * 1000)
1869
type_func=lambda td: td.total_seconds() * 1000)
1751
1870
extended_timeout = notifychangeproperty(
1752
1871
dbus.UInt64, "ExtendedTimeout",
1753
type_func = lambda td: td.total_seconds() * 1000)
1872
type_func=lambda td: td.total_seconds() * 1000)
1754
1873
interval = notifychangeproperty(
1755
1874
dbus.UInt64, "Interval",
1756
type_func = lambda td: td.total_seconds() * 1000)
1875
type_func=lambda td: td.total_seconds() * 1000)
1757
1876
checker_command = notifychangeproperty(dbus.String, "Checker")
1758
1877
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1759
1878
invalidate_only=True)
1760
1879
1761
1880
del notifychangeproperty
1762
1881
1763
1882
def __del__(self, *args, **kwargs):
1764
1883
try:
1765
1884
self.remove_from_connection()
1768
1887
if hasattr(DBusObjectWithProperties, "__del__"):
1769
1888
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1770
1889
Client.__del__(self, *args, **kwargs)
1771
1890
1772
1891
def checker_callback(self, source, condition,
1773
1892
connection, command, *args, **kwargs):
1774
1893
ret = Client.checker_callback(self, source, condition,
1790
1909
| self.last_checker_signal),
1791
1910
dbus.String(command))
1792
1911
return ret
1793
1912
1794
1913
def start_checker(self, *args, **kwargs):
1795
1914
old_checker_pid = getattr(self.checker, "pid", None)
1796
1915
r = Client.start_checker(self, *args, **kwargs)
1800
1919
# Emit D-Bus signal
1801
1920
self.CheckerStarted(self.current_checker_command)
1802
1921
return r
1803
1922
1804
1923
def _reset_approved(self):
1805
1924
self.approved = None
1806
1925
return False
1807
1926
1808
1927
def approve(self, value=True):
1809
1928
self.approved = value
1810
GObject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1929
GLib.timeout_add(int(self.approval_duration.total_seconds()
1930
* 1000), self._reset_approved)
1812
1931
self.send_changedstate()
1813
1814
## D-Bus methods, signals & properties
1815
1816
## Interfaces
1817
1818
## Signals
1819
1932
1933
# D-Bus methods, signals & properties
1934
1935
# Interfaces
1936
1937
# Signals
1938
1820
1939
# CheckerCompleted - signal
1821
1940
@dbus.service.signal(_interface, signature="nxs")
1822
1941
def CheckerCompleted(self, exitcode, waitstatus, command):
1823
1942
"D-Bus signal"
1824
1943
pass
1825
1944
1826
1945
# CheckerStarted - signal
1827
1946
@dbus.service.signal(_interface, signature="s")
1828
1947
def CheckerStarted(self, command):
1829
1948
"D-Bus signal"
1830
1949
pass
1831
1950
1832
1951
# PropertyChanged - signal
1833
1952
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1834
1953
@dbus.service.signal(_interface, signature="sv")
1835
1954
def PropertyChanged(self, property, value):
1836
1955
"D-Bus signal"
1837
1956
pass
1838
1957
1839
1958
# GotSecret - signal
1840
1959
@dbus.service.signal(_interface)
1841
1960
def GotSecret(self):
1844
1963
server to mandos-client
1845
1964
"""
1846
1965
pass
1847
1966
1848
1967
# Rejected - signal
1849
1968
@dbus.service.signal(_interface, signature="s")
1850
1969
def Rejected(self, reason):
1851
1970
"D-Bus signal"
1852
1971
pass
1853
1972
1854
1973
# NeedApproval - signal
1855
1974
@dbus.service.signal(_interface, signature="tb")
1856
1975
def NeedApproval(self, timeout, default):
1857
1976
"D-Bus signal"
1858
1977
return self.need_approval()
1859
1860
## Methods
1861
1978
1979
# Methods
1980
1862
1981
# Approve - method
1863
1982
@dbus.service.method(_interface, in_signature="b")
1864
1983
def Approve(self, value):
1865
1984
self.approve(value)
1866
1985
1867
1986
# CheckedOK - method
1868
1987
@dbus.service.method(_interface)
1869
1988
def CheckedOK(self):
1870
1989
self.checked_ok()
1871
1990
1872
1991
# Enable - method
1873
1992
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
1993
@dbus.service.method(_interface)
1875
1994
def Enable(self):
1876
1995
"D-Bus method"
1877
1996
self.enable()
1878
1997
1879
1998
# StartChecker - method
1880
1999
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
2000
@dbus.service.method(_interface)
1882
2001
def StartChecker(self):
1883
2002
"D-Bus method"
1884
2003
self.start_checker()
1885
2004
1886
2005
# Disable - method
1887
2006
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
2007
@dbus.service.method(_interface)
1889
2008
def Disable(self):
1890
2009
"D-Bus method"
1891
2010
self.disable()
1892
2011
1893
2012
# StopChecker - method
1894
2013
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
2014
@dbus.service.method(_interface)
1896
2015
def StopChecker(self):
1897
2016
self.stop_checker()
1898
1899
## Properties
1900
2017
2018
# Properties
2019
1901
2020
# ApprovalPending - property
1902
2021
@dbus_service_property(_interface, signature="b", access="read")
1903
2022
def ApprovalPending_dbus_property(self):
1904
2023
return dbus.Boolean(bool(self.approvals_pending))
1905
2024
1906
2025
# ApprovedByDefault - property
1907
2026
@dbus_service_property(_interface,
1908
2027
signature="b",
1911
2030
if value is None: # get
1912
2031
return dbus.Boolean(self.approved_by_default)
1913
2032
self.approved_by_default = bool(value)
1914
2033
1915
2034
# ApprovalDelay - property
1916
2035
@dbus_service_property(_interface,
1917
2036
signature="t",
1921
2040
return dbus.UInt64(self.approval_delay.total_seconds()
1922
2041
* 1000)
1923
2042
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1924
2043
1925
2044
# ApprovalDuration - property
1926
2045
@dbus_service_property(_interface,
1927
2046
signature="t",
1931
2050
return dbus.UInt64(self.approval_duration.total_seconds()
1932
2051
* 1000)
1933
2052
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
2053
1935
2054
# Name - property
1936
2055
@dbus_annotations(
1937
2056
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
2057
@dbus_service_property(_interface, signature="s", access="read")
1939
2058
def Name_dbus_property(self):
1940
2059
return dbus.String(self.name)
1941
2060
2061
# KeyID - property
2062
@dbus_annotations(
2063
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2064
@dbus_service_property(_interface, signature="s", access="read")
2065
def KeyID_dbus_property(self):
2066
return dbus.String(self.key_id)
2067
1942
2068
# Fingerprint - property
1943
2069
@dbus_annotations(
1944
2070
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
2071
@dbus_service_property(_interface, signature="s", access="read")
1946
2072
def Fingerprint_dbus_property(self):
1947
2073
return dbus.String(self.fingerprint)
1948
2074
1949
2075
# Host - property
1950
2076
@dbus_service_property(_interface,
1951
2077
signature="s",
1954
2080
if value is None: # get
1955
2081
return dbus.String(self.host)
1956
2082
self.host = str(value)
1957
2083
1958
2084
# Created - property
1959
2085
@dbus_annotations(
1960
2086
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
2087
@dbus_service_property(_interface, signature="s", access="read")
1962
2088
def Created_dbus_property(self):
1963
2089
return datetime_to_dbus(self.created)
1964
2090
1965
2091
# LastEnabled - property
1966
2092
@dbus_service_property(_interface, signature="s", access="read")
1967
2093
def LastEnabled_dbus_property(self):
1968
2094
return datetime_to_dbus(self.last_enabled)
1969
2095
1970
2096
# Enabled - property
1971
2097
@dbus_service_property(_interface,
1972
2098
signature="b",
1978
2104
self.enable()
1979
2105
else:
1980
2106
self.disable()
1981
2107
1982
2108
# LastCheckedOK - property
1983
2109
@dbus_service_property(_interface,
1984
2110
signature="s",
1988
2114
self.checked_ok()
1989
2115
return
1990
2116
return datetime_to_dbus(self.last_checked_ok)
1991
2117
1992
2118
# LastCheckerStatus - property
1993
2119
@dbus_service_property(_interface, signature="n", access="read")
1994
2120
def LastCheckerStatus_dbus_property(self):
1995
2121
return dbus.Int16(self.last_checker_status)
1996
2122
1997
2123
# Expires - property
1998
2124
@dbus_service_property(_interface, signature="s", access="read")
1999
2125
def Expires_dbus_property(self):
2000
2126
return datetime_to_dbus(self.expires)
2001
2127
2002
2128
# LastApprovalRequest - property
2003
2129
@dbus_service_property(_interface, signature="s", access="read")
2004
2130
def LastApprovalRequest_dbus_property(self):
2005
2131
return datetime_to_dbus(self.last_approval_request)
2006
2132
2007
2133
# Timeout - property
2008
2134
@dbus_service_property(_interface,
2009
2135
signature="t",
2024
2150
if (getattr(self, "disable_initiator_tag", None)
2025
2151
is None):
2026
2152
return
2027
GObject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = GObject.timeout_add(
2153
GLib.source_remove(self.disable_initiator_tag)
2154
self.disable_initiator_tag = GLib.timeout_add(
2029
2155
int((self.expires - now).total_seconds() * 1000),
2030
2156
self.disable)
2031
2157
2032
2158
# ExtendedTimeout - property
2033
2159
@dbus_service_property(_interface,
2034
2160
signature="t",
2038
2164
return dbus.UInt64(self.extended_timeout.total_seconds()
2039
2165
* 1000)
2040
2166
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2041
2167
2042
2168
# Interval - property
2043
2169
@dbus_service_property(_interface,
2044
2170
signature="t",
2051
2177
return
2052
2178
if self.enabled:
2053
2179
# Reschedule checker run
2054
GObject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = GObject.timeout_add(
2180
GLib.source_remove(self.checker_initiator_tag)
2181
self.checker_initiator_tag = GLib.timeout_add(
2056
2182
value, self.start_checker)
2057
self.start_checker() # Start one now, too
2058
2183
self.start_checker() # Start one now, too
2184
2059
2185
# Checker - property
2060
2186
@dbus_service_property(_interface,
2061
2187
signature="s",
2064
2190
if value is None: # get
2065
2191
return dbus.String(self.checker_command)
2066
2192
self.checker_command = str(value)
2067
2193
2068
2194
# CheckerRunning - property
2069
2195
@dbus_service_property(_interface,
2070
2196
signature="b",
2076
2202
self.start_checker()
2077
2203
else:
2078
2204
self.stop_checker()
2079
2205
2080
2206
# ObjectPath - property
2081
2207
@dbus_annotations(
2082
2208
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
2209
"org.freedesktop.DBus.Deprecated": "true"})
2084
2210
@dbus_service_property(_interface, signature="o", access="read")
2085
2211
def ObjectPath_dbus_property(self):
2086
return self.dbus_object_path # is already a dbus.ObjectPath
2087
2212
return self.dbus_object_path # is already a dbus.ObjectPath
2213
2088
2214
# Secret = property
2089
2215
@dbus_annotations(
2090
2216
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2095
2221
byte_arrays=True)
2096
2222
def Secret_dbus_property(self, value):
2097
2223
self.secret = bytes(value)
2098
2224
2099
2225
del _interface
2100
2226
2101
2227
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2228
class ProxyClient:
2229
def __init__(self, child_pipe, key_id, fpr, address):
2104
2230
self._pipe = child_pipe
2105
self._pipe.send(('init', fpr, address))
2231
self._pipe.send(('init', key_id, fpr, address))
2106
2232
if not self._pipe.recv():
2107
raise KeyError(fpr)
2108
2233
raise KeyError(key_id or fpr)
2234
2109
2235
def __getattribute__(self, name):
2110
2236
if name == '_pipe':
2111
2237
return super(ProxyClient, self).__getattribute__(name)
2114
2240
if data[0] == 'data':
2115
2241
return data[1]
2116
2242
if data[0] == 'function':
2117
2243
2118
2244
def func(*args, **kwargs):
2119
2245
self._pipe.send(('funcall', name, args, kwargs))
2120
2246
return self._pipe.recv()[1]
2121
2247
2122
2248
return func
2123
2249
2124
2250
def __setattr__(self, name, value):
2125
2251
if name == '_pipe':
2126
2252
return super(ProxyClient, self).__setattr__(name, value)
2129
2255
2130
2256
class ClientHandler(socketserver.BaseRequestHandler, object):
2131
2257
"""A class to handle client connections.
2132
2258
2133
2259
Instantiated once for each connection to handle it.
2134
2260
Note: This will run in its own forked process."""
2135
2261
2136
2262
def handle(self):
2137
2263
with contextlib.closing(self.server.child_pipe) as child_pipe:
2138
2264
logger.info("TCP connection from: %s",
2139
2265
str(self.client_address))
2140
2266
logger.debug("Pipe FD: %d",
2141
2267
self.server.child_pipe.fileno())
2142
2268
2143
2269
session = gnutls.ClientSession(self.request)
2144
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2148
# "+DHE-DSS"))
2270
2271
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2272
# "+AES-256-CBC", "+SHA1",
2273
# "+COMP-NULL", "+CTYPE-OPENPGP",
2274
# "+DHE-DSS"))
2149
2275
# Use a fallback default, since this MUST be set.
2150
2276
priority = self.server.gnutls_priority
2151
2277
if priority is None:
2152
2278
priority = "NORMAL"
2153
gnutls.priority_set_direct(session._c_object, priority,
2279
gnutls.priority_set_direct(session._c_object,
2280
priority.encode("utf-8"),
2154
2281
None)
2155
2282
2156
2283
# Start communication using the Mandos protocol
2157
2284
# Get protocol number
2158
2285
line = self.request.makefile().readline()
2163
2290
except (ValueError, IndexError, RuntimeError) as error:
2164
2291
logger.error("Unknown protocol version: %s", error)
2165
2292
return
2166
2293
2167
2294
# Start GnuTLS connection
2168
2295
try:
2169
2296
session.handshake()
2173
2300
# established. Just abandon the request.
2174
2301
return
2175
2302
logger.debug("Handshake succeeded")
2176
2303
2177
2304
approval_required = False
2178
2305
try:
2179
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2184
return
2185
logger.debug("Fingerprint: %s", fpr)
2186
2187
try:
2188
client = ProxyClient(child_pipe, fpr,
2306
if gnutls.has_rawpk:
2307
fpr = b""
2308
try:
2309
key_id = self.key_id(
2310
self.peer_certificate(session))
2311
except (TypeError, gnutls.Error) as error:
2312
logger.warning("Bad certificate: %s", error)
2313
return
2314
logger.debug("Key ID: %s", key_id)
2315
2316
else:
2317
key_id = b""
2318
try:
2319
fpr = self.fingerprint(
2320
self.peer_certificate(session))
2321
except (TypeError, gnutls.Error) as error:
2322
logger.warning("Bad certificate: %s", error)
2323
return
2324
logger.debug("Fingerprint: %s", fpr)
2325
2326
try:
2327
client = ProxyClient(child_pipe, key_id, fpr,
2189
2328
self.client_address)
2190
2329
except KeyError:
2191
2330
return
2192
2331
2193
2332
if client.approval_delay:
2194
2333
delay = client.approval_delay
2195
2334
client.approvals_pending += 1
2196
2335
approval_required = True
2197
2336
2198
2337
while True:
2199
2338
if not client.enabled:
2200
2339
logger.info("Client %s is disabled",
2203
2342
# Emit D-Bus signal
2204
2343
client.Rejected("Disabled")
2205
2344
return
2206
2345
2207
2346
if client.approved or not client.approval_delay:
2208
#We are approved or approval is disabled
2347
# We are approved or approval is disabled
2209
2348
break
2210
2349
elif client.approved is None:
2211
2350
logger.info("Client %s needs approval",
2222
2361
# Emit D-Bus signal
2223
2362
client.Rejected("Denied")
2224
2363
return
2225
2226
#wait until timeout or approved
2364
2365
# wait until timeout or approved
2227
2366
time = datetime.datetime.now()
2228
2367
client.changedstate.acquire()
2229
2368
client.changedstate.wait(delay.total_seconds())
2242
2381
break
2243
2382
else:
2244
2383
delay -= time2 - time
2245
2384
2246
2385
try:
2247
2386
session.send(client.secret)
2248
2387
except gnutls.Error as error:
2249
2388
logger.warning("gnutls send failed",
2250
exc_info = error)
2389
exc_info=error)
2251
2390
return
2252
2391
2253
2392
logger.info("Sending secret to %s", client.name)
2254
2393
# bump the timeout using extended_timeout
2255
2394
client.bump_timeout(client.extended_timeout)
2256
2395
if self.server.use_dbus:
2257
2396
# Emit D-Bus signal
2258
2397
client.GotSecret()
2259
2398
2260
2399
finally:
2261
2400
if approval_required:
2262
2401
client.approvals_pending -= 1
2265
2404
except gnutls.Error as error:
2266
2405
logger.warning("GnuTLS bye failed",
2267
2406
exc_info=error)
2268
2407
2269
2408
@staticmethod
2270
2409
def peer_certificate(session):
2271
"Return the peer's OpenPGP certificate as a bytestring"
2272
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2410
"Return the peer's certificate as a bytestring"
2411
try:
2412
cert_type = gnutls.certificate_type_get2(session._c_object,
2413
gnutls.CTYPE_PEERS)
2414
except AttributeError:
2415
cert_type = gnutls.certificate_type_get(session._c_object)
2416
if gnutls.has_rawpk:
2417
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2418
else:
2419
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2420
# If not a valid certificate type...
2421
if cert_type not in valid_cert_types:
2422
logger.info("Cert type %r not in %r", cert_type,
2423
valid_cert_types)
2275
2424
# ...return invalid data
2276
2425
return b""
2277
2426
list_size = ctypes.c_uint(1)
2283
2432
return None
2284
2433
cert = cert_list[0]
2285
2434
return ctypes.string_at(cert.data, cert.size)
2286
2435
2436
@staticmethod
2437
def key_id(certificate):
2438
"Convert a certificate bytestring to a hexdigit key ID"
2439
# New GnuTLS "datum" with the public key
2440
datum = gnutls.datum_t(
2441
ctypes.cast(ctypes.c_char_p(certificate),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.c_uint(len(certificate)))
2444
# XXX all these need to be created in the gnutls "module"
2445
# New empty GnuTLS certificate
2446
pubkey = gnutls.pubkey_t()
2447
gnutls.pubkey_init(ctypes.byref(pubkey))
2448
# Import the raw public key into the certificate
2449
gnutls.pubkey_import(pubkey,
2450
ctypes.byref(datum),
2451
gnutls.X509_FMT_DER)
2452
# New buffer for the key ID
2453
buf = ctypes.create_string_buffer(32)
2454
buf_len = ctypes.c_size_t(len(buf))
2455
# Get the key ID from the raw public key into the buffer
2456
gnutls.pubkey_get_key_id(pubkey,
2457
gnutls.KEYID_USE_SHA256,
2458
ctypes.cast(ctypes.byref(buf),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.byref(buf_len))
2461
# Deinit the certificate
2462
gnutls.pubkey_deinit(pubkey)
2463
2464
# Convert the buffer to a Python bytestring
2465
key_id = ctypes.string_at(buf, buf_len.value)
2466
# Convert the bytestring to hexadecimal notation
2467
hex_key_id = binascii.hexlify(key_id).upper()
2468
return hex_key_id
2469
2287
2470
@staticmethod
2288
2471
def fingerprint(openpgp):
2289
2472
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2304
2487
ctypes.byref(crtverify))
2305
2488
if crtverify.value != 0:
2306
2489
gnutls.openpgp_crt_deinit(crt)
2307
raise gnutls.CertificateSecurityError("Verify failed")
2490
raise gnutls.CertificateSecurityError(code
2491
=crtverify.value)
2308
2492
# New buffer for the fingerprint
2309
2493
buf = ctypes.create_string_buffer(20)
2310
2494
buf_len = ctypes.c_size_t()
2320
2504
return hex_fpr
2321
2505
2322
2506
2323
class MultiprocessingMixIn(object):
2507
class MultiprocessingMixIn:
2324
2508
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2325
2509
2326
2510
def sub_process_main(self, request, address):
2327
2511
try:
2328
2512
self.finish_request(request, address)
2329
2513
except Exception:
2330
2514
self.handle_error(request, address)
2331
2515
self.close_request(request)
2332
2516
2333
2517
def process_request(self, request, address):
2334
2518
"""Start a new process to process the request."""
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2519
proc = multiprocessing.Process(target=self.sub_process_main,
2520
args=(request, address))
2337
2521
proc.start()
2338
2522
return proc
2339
2523
2340
2524
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2342
2526
""" adds a pipe to the MixIn """
2343
2527
2344
2528
def process_request(self, request, client_address):
2345
2529
"""Overrides and wraps the original process_request().
2346
2530
2347
2531
This function creates a new pipe in self.pipe
2348
2532
"""
2349
2533
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2350
2534
2351
2535
proc = MultiprocessingMixIn.process_request(self, request,
2352
2536
client_address)
2353
2537
self.child_pipe.close()
2354
2538
self.add_pipe(parent_pipe, proc)
2355
2539
2356
2540
def add_pipe(self, parent_pipe, proc):
2357
2541
"""Dummy function; override as necessary"""
2358
2542
raise NotImplementedError()
2359
2543
2360
2544
2361
2545
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2362
socketserver.TCPServer, object):
2546
socketserver.TCPServer):
2363
2547
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2364
2548
2365
2549
Attributes:
2366
2550
enabled: Boolean; whether this server is activated yet
2367
2551
interface: None or a network interface name (string)
2368
2552
use_ipv6: Boolean; to use IPv6 or not
2369
2553
"""
2370
2554
2371
2555
def __init__(self, server_address, RequestHandlerClass,
2372
2556
interface=None,
2373
2557
use_ipv6=True,
2383
2567
self.socketfd = socketfd
2384
2568
# Save the original socket.socket() function
2385
2569
self.socket_socket = socket.socket
2570
2386
2571
# To implement --socket, we monkey patch socket.socket.
2387
#
2572
#
2388
2573
# (When socketserver.TCPServer is a new-style class, we
2389
2574
# could make self.socket into a property instead of monkey
2390
2575
# patching socket.socket.)
2391
#
2576
#
2392
2577
# Create a one-time-only replacement for socket.socket()
2393
2578
@functools.wraps(socket.socket)
2394
2579
def socket_wrapper(*args, **kwargs):
2406
2591
# socket_wrapper(), if socketfd was set.
2407
2592
socketserver.TCPServer.__init__(self, server_address,
2408
2593
RequestHandlerClass)
2409
2594
2410
2595
def server_bind(self):
2411
2596
"""This overrides the normal server_bind() function
2412
2597
to bind to an interface if one was specified, and also NOT to
2413
2598
bind to an address or port if they were not specified."""
2599
global SO_BINDTODEVICE
2414
2600
if self.interface is not None:
2415
2601
if SO_BINDTODEVICE is None:
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2418
self.interface)
2419
else:
2420
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2431
self.interface)
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2435
else:
2436
raise
2602
# Fall back to a hard-coded value which seems to be
2603
# common enough.
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2605
SO_BINDTODEVICE = 25
2606
try:
2607
self.socket.setsockopt(
2608
socket.SOL_SOCKET, SO_BINDTODEVICE,
2609
(self.interface + "\0").encode("utf-8"))
2610
except socket.error as error:
2611
if error.errno == errno.EPERM:
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2614
elif error.errno == errno.ENOPROTOOPT:
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2617
self.interface)
2618
elif error.errno == errno.ENODEV:
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2621
else:
2622
raise
2437
2623
# Only bind(2) the socket if we really need to.
2438
2624
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2439
2627
if not self.server_address[0]:
2440
2628
if self.address_family == socket.AF_INET6:
2441
any_address = "::" # in6addr_any
2629
any_address = "::" # in6addr_any
2442
2630
else:
2443
any_address = "0.0.0.0" # INADDR_ANY
2631
any_address = "0.0.0.0" # INADDR_ANY
2444
2632
self.server_address = (any_address,
2445
2633
self.server_address[1])
2446
2634
elif not self.server_address[1]:
2456
2644
2457
2645
class MandosServer(IPv6_TCPServer):
2458
2646
"""Mandos server.
2459
2647
2460
2648
Attributes:
2461
2649
clients: set of Client objects
2462
2650
gnutls_priority GnuTLS priority string
2463
2651
use_dbus: Boolean; to emit D-Bus signals or not
2464
2465
Assumes a GObject.MainLoop event loop.
2652
2653
Assumes a GLib.MainLoop event loop.
2466
2654
"""
2467
2655
2468
2656
def __init__(self, server_address, RequestHandlerClass,
2469
2657
interface=None,
2470
2658
use_ipv6=True,
2480
2668
self.gnutls_priority = gnutls_priority
2481
2669
IPv6_TCPServer.__init__(self, server_address,
2482
2670
RequestHandlerClass,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2486
2671
interface=interface,
2672
use_ipv6=use_ipv6,
2673
socketfd=socketfd)
2674
2487
2675
def server_activate(self):
2488
2676
if self.enabled:
2489
2677
return socketserver.TCPServer.server_activate(self)
2490
2678
2491
2679
def enable(self):
2492
2680
self.enabled = True
2493
2681
2494
2682
def add_pipe(self, parent_pipe, proc):
2495
2683
# Call "handle_ipc" for both data and EOF events
2496
GObject.io_add_watch(
2497
parent_pipe.fileno(),
2498
GObject.IO_IN | GObject.IO_HUP,
2684
GLib.io_add_watch(
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2499
2687
functools.partial(self.handle_ipc,
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2502
2688
parent_pipe=parent_pipe,
2689
proc=proc))
2690
2503
2691
def handle_ipc(self, source, condition,
2504
2692
parent_pipe=None,
2505
proc = None,
2693
proc=None,
2506
2694
client_object=None):
2507
2695
# error, or the other end of multiprocessing.Pipe has closed
2508
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2696
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2509
2697
# Wait for other process to exit
2510
2698
proc.join()
2511
2699
return False
2512
2700
2513
2701
# Read a request from the child
2514
2702
request = parent_pipe.recv()
2515
2703
command = request[0]
2516
2704
2517
2705
if command == 'init':
2518
fpr = request[1]
2519
address = request[2]
2520
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2709
2710
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2712
continue
2713
if key_id and c.key_id == key_id:
2714
client = c
2715
break
2716
if fpr and c.fingerprint == fpr:
2523
2717
client = c
2524
2718
break
2525
2719
else:
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2528
2722
if self.use_dbus:
2529
2723
# Emit D-Bus signal
2530
mandos_dbus_service.ClientNotFound(fpr,
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2531
2725
address[0])
2532
2726
parent_pipe.send(False)
2533
2727
return False
2534
2535
GObject.io_add_watch(
2536
parent_pipe.fileno(),
2537
GObject.IO_IN | GObject.IO_HUP,
2728
2729
GLib.io_add_watch(
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2538
2732
functools.partial(self.handle_ipc,
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2733
parent_pipe=parent_pipe,
2734
proc=proc,
2735
client_object=client))
2542
2736
parent_pipe.send(True)
2543
2737
# remove the old hook in favor of the new above hook on
2544
2738
# same fileno
2547
2741
funcname = request[1]
2548
2742
args = request[2]
2549
2743
kwargs = request[3]
2550
2744
2551
2745
parent_pipe.send(('data', getattr(client_object,
2552
2746
funcname)(*args,
2553
2747
**kwargs)))
2554
2748
2555
2749
if command == 'getattr':
2556
2750
attrname = request[1]
2557
2751
if isinstance(client_object.__getattribute__(attrname),
2560
2754
else:
2561
2755
parent_pipe.send((
2562
2756
'data', client_object.__getattribute__(attrname)))
2563
2757
2564
2758
if command == 'setattr':
2565
2759
attrname = request[1]
2566
2760
value = request[2]
2567
2761
setattr(client_object, attrname, value)
2568
2762
2569
2763
return True
2570
2764
2571
2765
2572
2766
def rfc3339_duration_to_delta(duration):
2573
2767
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2574
2575
>>> rfc3339_duration_to_delta("P7D")
2576
datetime.timedelta(7)
2577
>>> rfc3339_duration_to_delta("PT60S")
2578
datetime.timedelta(0, 60)
2579
>>> rfc3339_duration_to_delta("PT60M")
2580
datetime.timedelta(0, 3600)
2581
>>> rfc3339_duration_to_delta("PT24H")
2582
datetime.timedelta(1)
2583
>>> rfc3339_duration_to_delta("P1W")
2584
datetime.timedelta(7)
2585
>>> rfc3339_duration_to_delta("PT5M30S")
2586
datetime.timedelta(0, 330)
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
datetime.timedelta(1, 200)
2768
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
True
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
True
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
True
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
True
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
True
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
True
2589
2783
"""
2590
2784
2591
2785
# Parsing an RFC 3339 duration with regular expressions is not
2592
2786
# possible - there would have to be multiple places for the same
2593
2787
# values, like seconds. The current code, while more esoteric, is
2594
2788
# cleaner without depending on a parsing library. If Python had a
2595
2789
# built-in library for parsing we would use it, but we'd like to
2596
2790
# avoid excessive use of external libraries.
2597
2791
2598
2792
# New type for defining tokens, syntax, and semantics all-in-one
2599
2793
Token = collections.namedtuple("Token", (
2600
2794
"regexp", # To match token; if "value" is not None, must have
2633
2827
frozenset((token_year, token_month,
2634
2828
token_day, token_time,
2635
2829
token_week)))
2636
# Define starting values
2637
value = datetime.timedelta() # Value so far
2830
# Define starting values:
2831
# Value so far
2832
value = datetime.timedelta()
2638
2833
found_token = None
2639
followers = frozenset((token_duration, )) # Following valid tokens
2640
s = duration # String left to parse
2834
# Following valid tokens
2835
followers = frozenset((token_duration, ))
2836
# String left to parse
2837
s = duration
2641
2838
# Loop until end token is found
2642
2839
while found_token is not token_end:
2643
2840
# Search for any currently valid tokens
2667
2864
2668
2865
def string_to_delta(interval):
2669
2866
"""Parse a string and return a datetime.timedelta
2670
2671
>>> string_to_delta('7d')
2672
datetime.timedelta(7)
2673
>>> string_to_delta('60s')
2674
datetime.timedelta(0, 60)
2675
>>> string_to_delta('60m')
2676
datetime.timedelta(0, 3600)
2677
>>> string_to_delta('24h')
2678
datetime.timedelta(1)
2679
>>> string_to_delta('1w')
2680
datetime.timedelta(7)
2681
>>> string_to_delta('5m 30s')
2682
datetime.timedelta(0, 330)
2867
2868
>>> string_to_delta('7d') == datetime.timedelta(7)
2869
True
2870
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
True
2872
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
True
2874
>>> string_to_delta('24h') == datetime.timedelta(1)
2875
True
2876
>>> string_to_delta('1w') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2879
True
2683
2880
"""
2684
2881
2685
2882
try:
2686
2883
return rfc3339_duration_to_delta(interval)
2687
2884
except ValueError:
2688
2885
pass
2689
2886
2690
2887
timevalue = datetime.timedelta(0)
2691
2888
for s in interval.split():
2692
2889
try:
2710
2907
return timevalue
2711
2908
2712
2909
2713
def daemon(nochdir = False, noclose = False):
2910
def daemon(nochdir=False, noclose=False):
2714
2911
"""See daemon(3). Standard BSD Unix function.
2715
2912
2716
2913
This should really exist as os.daemon, but it doesn't (yet)."""
2717
2914
if os.fork():
2718
2915
sys.exit()
2736
2933
2737
2934
2738
2935
def main():
2739
2936
2740
2937
##################################################################
2741
2938
# Parsing of options, both command line and config file
2742
2939
2743
2940
parser = argparse.ArgumentParser()
2744
2941
parser.add_argument("-v", "--version", action="version",
2745
version = "%(prog)s {}".format(version),
2942
version="%(prog)s {}".format(version),
2746
2943
help="show version number and exit")
2747
2944
parser.add_argument("-i", "--interface", metavar="IF",
2748
2945
help="Bind to interface IF")
2784
2981
parser.add_argument("--no-zeroconf", action="store_false",
2785
2982
dest="zeroconf", help="Do not use Zeroconf",
2786
2983
default=None)
2787
2984
2788
2985
options = parser.parse_args()
2789
2790
if options.check:
2791
import doctest
2792
fail_count, test_count = doctest.testmod()
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2794
2986
2795
2987
# Default values for config file for server-global settings
2796
server_defaults = { "interface": "",
2797
"address": "",
2798
"port": "",
2799
"debug": "False",
2800
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2804
"use_dbus": "True",
2805
"use_ipv6": "True",
2806
"debuglevel": "",
2807
"restore": "True",
2808
"socket": "",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2811
"zeroconf": "True",
2812
}
2813
2988
if gnutls.has_rawpk:
2989
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2990
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2991
else:
2992
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2993
":+SIGN-DSA-SHA256")
2994
server_defaults = {"interface": "",
2995
"address": "",
2996
"port": "",
2997
"debug": "False",
2998
"priority": priority,
2999
"servicename": "Mandos",
3000
"use_dbus": "True",
3001
"use_ipv6": "True",
3002
"debuglevel": "",
3003
"restore": "True",
3004
"socket": "",
3005
"statedir": "/var/lib/mandos",
3006
"foreground": "False",
3007
"zeroconf": "True",
3008
}
3009
del priority
3010
2814
3011
# Parse config file for server-global settings
2815
server_config = configparser.SafeConfigParser(server_defaults)
3012
server_config = configparser.ConfigParser(server_defaults)
2816
3013
del server_defaults
2817
3014
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2818
# Convert the SafeConfigParser object to a dict
3015
# Convert the ConfigParser object to a dict
2819
3016
server_settings = server_config.defaults()
2820
3017
# Use the appropriate methods on the non-string config options
2821
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3018
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3019
"foreground", "zeroconf"):
2822
3020
server_settings[option] = server_config.getboolean("DEFAULT",
2823
3021
option)
2824
3022
if server_settings["port"]:
2834
3032
server_settings["socket"] = os.dup(server_settings
2835
3033
["socket"])
2836
3034
del server_config
2837
3035
2838
3036
# Override the settings from the config file with command line
2839
3037
# options, if set.
2840
3038
for option in ("interface", "address", "port", "debug",
2858
3056
if server_settings["debug"]:
2859
3057
server_settings["foreground"] = True
2860
3058
# Now we have our good server settings in "server_settings"
2861
3059
2862
3060
##################################################################
2863
3061
2864
3062
if (not server_settings["zeroconf"]
2865
3063
and not (server_settings["port"]
2866
3064
or server_settings["socket"] != "")):
2867
3065
parser.error("Needs port or socket to work without Zeroconf")
2868
3066
2869
3067
# For convenience
2870
3068
debug = server_settings["debug"]
2871
3069
debuglevel = server_settings["debuglevel"]
2875
3073
stored_state_file)
2876
3074
foreground = server_settings["foreground"]
2877
3075
zeroconf = server_settings["zeroconf"]
2878
3076
2879
3077
if debug:
2880
3078
initlogger(debug, logging.DEBUG)
2881
3079
else:
2884
3082
else:
2885
3083
level = getattr(logging, debuglevel.upper())
2886
3084
initlogger(debug, level)
2887
3085
2888
3086
if server_settings["servicename"] != "Mandos":
2889
3087
syslogger.setFormatter(
2890
3088
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
3089
' %(levelname)s: %(message)s'.format(
2892
3090
server_settings["servicename"])))
2893
3091
2894
3092
# Parse config file with clients
2895
client_config = configparser.SafeConfigParser(Client
2896
.client_defaults)
3093
client_config = configparser.ConfigParser(Client.client_defaults)
2897
3094
client_config.read(os.path.join(server_settings["configdir"],
2898
3095
"clients.conf"))
2899
3096
2900
3097
global mandos_dbus_service
2901
3098
mandos_dbus_service = None
2902
3099
2903
3100
socketfd = None
2904
3101
if server_settings["socket"] != "":
2905
3102
socketfd = server_settings["socket"]
2921
3118
except IOError as e:
2922
3119
logger.error("Could not open file %r", pidfilename,
2923
3120
exc_info=e)
2924
3121
2925
3122
for name, group in (("_mandos", "_mandos"),
2926
3123
("mandos", "mandos"),
2927
3124
("nobody", "nogroup")):
2937
3134
try:
2938
3135
os.setgid(gid)
2939
3136
os.setuid(uid)
3137
if debug:
3138
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3139
gid))
2940
3140
except OSError as error:
3141
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3142
.format(uid, gid, os.strerror(error.errno)))
2941
3143
if error.errno != errno.EPERM:
2942
3144
raise
2943
3145
2944
3146
if debug:
2945
3147
# Enable all possible GnuTLS debugging
2946
3148
2947
3149
# "Use a log level over 10 to enable all debugging options."
2948
3150
# - GnuTLS manual
2949
3151
gnutls.global_set_log_level(11)
2950
3152
2951
3153
@gnutls.log_func
2952
3154
def debug_gnutls(level, string):
2953
3155
logger.debug("GnuTLS: %s", string[:-1])
2954
3156
2955
3157
gnutls.global_set_log_function(debug_gnutls)
2956
3158
2957
3159
# Redirect stdin so all checkers get /dev/null
2958
3160
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2959
3161
os.dup2(null, sys.stdin.fileno())
2960
3162
if null > 2:
2961
3163
os.close(null)
2962
3164
2963
3165
# Need to fork before connecting to D-Bus
2964
3166
if not foreground:
2965
3167
# Close all input and output, do double fork, etc.
2966
3168
daemon()
2967
2968
# multiprocessing will use threads, so before we use GObject we
2969
# need to inform GObject that threads will be used.
2970
GObject.threads_init()
2971
3169
3170
if gi.version_info < (3, 10, 2):
3171
# multiprocessing will use threads, so before we use GLib we
3172
# need to inform GLib that threads will be used.
3173
GLib.threads_init()
3174
2972
3175
global main_loop
2973
3176
# From the Avahi example code
2974
3177
DBusGMainLoop(set_as_default=True)
2975
main_loop = GObject.MainLoop()
3178
main_loop = GLib.MainLoop()
2976
3179
bus = dbus.SystemBus()
2977
3180
# End of Avahi example code
2978
3181
if use_dbus:
2991
3194
if zeroconf:
2992
3195
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2993
3196
service = AvahiServiceToSyslog(
2994
name = server_settings["servicename"],
2995
servicetype = "_mandos._tcp",
2996
protocol = protocol,
2997
bus = bus)
3197
name=server_settings["servicename"],
3198
servicetype="_mandos._tcp",
3199
protocol=protocol,
3200
bus=bus)
2998
3201
if server_settings["interface"]:
2999
3202
service.interface = if_nametoindex(
3000
3203
server_settings["interface"].encode("utf-8"))
3001
3204
3002
3205
global multiprocessing_manager
3003
3206
multiprocessing_manager = multiprocessing.Manager()
3004
3207
3005
3208
client_class = Client
3006
3209
if use_dbus:
3007
client_class = functools.partial(ClientDBus, bus = bus)
3008
3210
client_class = functools.partial(ClientDBus, bus=bus)
3211
3009
3212
client_settings = Client.config_parser(client_config)
3010
3213
old_client_settings = {}
3011
3214
clients_data = {}
3012
3215
3013
3216
# This is used to redirect stdout and stderr for checker processes
3014
3217
global wnull
3015
wnull = open(os.devnull, "w") # A writable /dev/null
3218
wnull = open(os.devnull, "w") # A writable /dev/null
3016
3219
# Only used if server is running in foreground but not in debug
3017
3220
# mode
3018
3221
if debug or not foreground:
3019
3222
wnull.close()
3020
3223
3021
3224
# Get client data and settings from last running state.
3022
3225
if server_settings["restore"]:
3023
3226
try:
3024
3227
with open(stored_state_path, "rb") as stored_state:
3025
clients_data, old_client_settings = pickle.load(
3026
stored_state)
3228
if sys.version_info.major == 2:
3229
clients_data, old_client_settings = pickle.load(
3230
stored_state)
3231
else:
3232
bytes_clients_data, bytes_old_client_settings = (
3233
pickle.load(stored_state, encoding="bytes"))
3234
# Fix bytes to strings
3235
# clients_data
3236
# .keys()
3237
clients_data = {(key.decode("utf-8")
3238
if isinstance(key, bytes)
3239
else key): value
3240
for key, value in
3241
bytes_clients_data.items()}
3242
del bytes_clients_data
3243
for key in clients_data:
3244
value = {(k.decode("utf-8")
3245
if isinstance(k, bytes) else k): v
3246
for k, v in
3247
clients_data[key].items()}
3248
clients_data[key] = value
3249
# .client_structure
3250
value["client_structure"] = [
3251
(s.decode("utf-8")
3252
if isinstance(s, bytes)
3253
else s) for s in
3254
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3257
if isinstance(value[k], bytes):
3258
value[k] = value[k].decode("utf-8")
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
# old_client_settings
3264
# .keys()
3265
old_client_settings = {
3266
(key.decode("utf-8")
3267
if isinstance(key, bytes)
3268
else key): value
3269
for key, value in
3270
bytes_old_client_settings.items()}
3271
del bytes_old_client_settings
3272
# .host and .checker_command
3273
for value in old_client_settings.values():
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3277
.decode("utf-8"))
3027
3278
os.remove(stored_state_path)
3028
3279
except IOError as e:
3029
3280
if e.errno == errno.ENOENT:
3037
3288
logger.warning("Could not load persistent state: "
3038
3289
"EOFError:",
3039
3290
exc_info=e)
3040
3291
3041
3292
with PGPEngine() as pgp:
3042
3293
for client_name, client in clients_data.items():
3043
3294
# Skip removed clients
3044
3295
if client_name not in client_settings:
3045
3296
continue
3046
3297
3047
3298
# Decide which value to use after restoring saved state.
3048
3299
# We have three different values: Old config file,
3049
3300
# new config file, and saved state.
3060
3311
client[name] = value
3061
3312
except KeyError:
3062
3313
pass
3063
3314
3064
3315
# Clients who has passed its expire date can still be
3065
3316
# enabled if its last checker was successful. A Client
3066
3317
# whose checker succeeded before we stored its state is
3099
3350
client_name))
3100
3351
client["secret"] = (client_settings[client_name]
3101
3352
["secret"])
3102
3353
3103
3354
# Add/remove clients based on new changes made to config
3104
3355
for client_name in (set(old_client_settings)
3105
3356
- set(client_settings)):
3107
3358
for client_name in (set(client_settings)
3108
3359
- set(old_client_settings)):
3109
3360
clients_data[client_name] = client_settings[client_name]
3110
3361
3111
3362
# Create all client objects
3112
3363
for client_name, client in clients_data.items():
3113
3364
tcp_server.clients[client_name] = client_class(
3114
name = client_name,
3115
settings = client,
3116
server_settings = server_settings)
3117
3365
name=client_name,
3366
settings=client,
3367
server_settings=server_settings)
3368
3118
3369
if not tcp_server.clients:
3119
3370
logger.warning("No clients defined")
3120
3371
3121
3372
if not foreground:
3122
3373
if pidfile is not None:
3123
3374
pid = os.getpid()
3129
3380
pidfilename, pid)
3130
3381
del pidfile
3131
3382
del pidfilename
3132
3133
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3134
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3135
3383
3384
for termsig in (signal.SIGHUP, signal.SIGTERM):
3385
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3386
lambda: main_loop.quit() and False)
3387
3136
3388
if use_dbus:
3137
3389
3138
3390
@alternate_dbus_interfaces(
3139
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3391
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3140
3392
class MandosDBusService(DBusObjectWithObjectManager):
3141
3393
"""A D-Bus proxy object"""
3142
3394
3143
3395
def __init__(self):
3144
3396
dbus.service.Object.__init__(self, bus, "/")
3145
3397
3146
3398
_interface = "se.recompile.Mandos"
3147
3399
3148
3400
@dbus.service.signal(_interface, signature="o")
3149
3401
def ClientAdded(self, objpath):
3150
3402
"D-Bus signal"
3151
3403
pass
3152
3404
3153
3405
@dbus.service.signal(_interface, signature="ss")
3154
def ClientNotFound(self, fingerprint, address):
3406
def ClientNotFound(self, key_id, address):
3155
3407
"D-Bus signal"
3156
3408
pass
3157
3409
3158
3410
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3159
3411
"true"})
3160
3412
@dbus.service.signal(_interface, signature="os")
3161
3413
def ClientRemoved(self, objpath, name):
3162
3414
"D-Bus signal"
3163
3415
pass
3164
3416
3165
3417
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3166
3418
"true"})
3167
3419
@dbus.service.method(_interface, out_signature="ao")
3168
3420
def GetAllClients(self):
3169
3421
"D-Bus method"
3170
3422
return dbus.Array(c.dbus_object_path for c in
3171
tcp_server.clients.itervalues())
3172
3423
tcp_server.clients.values())
3424
3173
3425
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3174
3426
"true"})
3175
3427
@dbus.service.method(_interface,
3177
3429
def GetAllClientsWithProperties(self):
3178
3430
"D-Bus method"
3179
3431
return dbus.Dictionary(
3180
{ c.dbus_object_path: c.GetAll(
3432
{c.dbus_object_path: c.GetAll(
3181
3433
"se.recompile.Mandos.Client")
3182
for c in tcp_server.clients.itervalues() },
3434
for c in tcp_server.clients.values()},
3183
3435
signature="oa{sv}")
3184
3436
3185
3437
@dbus.service.method(_interface, in_signature="o")
3186
3438
def RemoveClient(self, object_path):
3187
3439
"D-Bus method"
3188
for c in tcp_server.clients.itervalues():
3440
for c in tcp_server.clients.values():
3189
3441
if c.dbus_object_path == object_path:
3190
3442
del tcp_server.clients[c.name]
3191
3443
c.remove_from_connection()
3195
3447
self.client_removed_signal(c)
3196
3448
return
3197
3449
raise KeyError(object_path)
3198
3450
3199
3451
del _interface
3200
3452
3201
3453
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3202
out_signature = "a{oa{sa{sv}}}")
3454
out_signature="a{oa{sa{sv}}}")
3203
3455
def GetManagedObjects(self):
3204
3456
"""D-Bus method"""
3205
3457
return dbus.Dictionary(
3206
{ client.dbus_object_path:
3207
dbus.Dictionary(
3208
{ interface: client.GetAll(interface)
3209
for interface in
3210
client._get_all_interface_names()})
3211
for client in tcp_server.clients.values()})
3212
3458
{client.dbus_object_path:
3459
dbus.Dictionary(
3460
{interface: client.GetAll(interface)
3461
for interface in
3462
client._get_all_interface_names()})
3463
for client in tcp_server.clients.values()})
3464
3213
3465
def client_added_signal(self, client):
3214
3466
"""Send the new standard signal and the old signal"""
3215
3467
if use_dbus:
3217
3469
self.InterfacesAdded(
3218
3470
client.dbus_object_path,
3219
3471
dbus.Dictionary(
3220
{ interface: client.GetAll(interface)
3221
for interface in
3222
client._get_all_interface_names()}))
3472
{interface: client.GetAll(interface)
3473
for interface in
3474
client._get_all_interface_names()}))
3223
3475
# Old signal
3224
3476
self.ClientAdded(client.dbus_object_path)
3225
3477
3226
3478
def client_removed_signal(self, client):
3227
3479
"""Send the new standard signal and the old signal"""
3228
3480
if use_dbus:
3233
3485
# Old signal
3234
3486
self.ClientRemoved(client.dbus_object_path,
3235
3487
client.name)
3236
3488
3237
3489
mandos_dbus_service = MandosDBusService()
3238
3490
3491
# Save modules to variables to exempt the modules from being
3492
# unloaded before the function registered with atexit() is run.
3493
mp = multiprocessing
3494
wn = wnull
3495
3239
3496
def cleanup():
3240
3497
"Cleanup function; run on exit"
3241
3498
if zeroconf:
3242
3499
service.cleanup()
3243
3244
multiprocessing.active_children()
3245
wnull.close()
3500
3501
mp.active_children()
3502
wn.close()
3246
3503
if not (tcp_server.clients or client_settings):
3247
3504
return
3248
3505
3249
3506
# Store client before exiting. Secrets are encrypted with key
3250
3507
# based on what config file has. If config file is
3251
3508
# removed/edited, old secret will thus be unrecovable.
3252
3509
clients = {}
3253
3510
with PGPEngine() as pgp:
3254
for client in tcp_server.clients.itervalues():
3511
for client in tcp_server.clients.values():
3255
3512
key = client_settings[client.name]["secret"]
3256
3513
client.encrypted_secret = pgp.encrypt(client.secret,
3257
3514
key)
3258
3515
client_dict = {}
3259
3516
3260
3517
# A list of attributes that can not be pickled
3261
3518
# + secret.
3262
exclude = { "bus", "changedstate", "secret",
3263
"checker", "server_settings" }
3519
exclude = {"bus", "changedstate", "secret",
3520
"checker", "server_settings"}
3264
3521
for name, typ in inspect.getmembers(dbus.service
3265
3522
.Object):
3266
3523
exclude.add(name)
3267
3524
3268
3525
client_dict["encrypted_secret"] = (client
3269
3526
.encrypted_secret)
3270
3527
for attr in client.client_structure:
3271
3528
if attr not in exclude:
3272
3529
client_dict[attr] = getattr(client, attr)
3273
3530
3274
3531
clients[client.name] = client_dict
3275
3532
del client_settings[client.name]["secret"]
3276
3533
3277
3534
try:
3278
3535
with tempfile.NamedTemporaryFile(
3279
3536
mode='wb',
3281
3538
prefix='clients-',
3282
3539
dir=os.path.dirname(stored_state_path),
3283
3540
delete=False) as stored_state:
3284
pickle.dump((clients, client_settings), stored_state)
3541
pickle.dump((clients, client_settings), stored_state,
3542
protocol=2)
3285
3543
tempname = stored_state.name
3286
3544
os.rename(tempname, stored_state_path)
3287
3545
except (IOError, OSError) as e:
3297
3555
logger.warning("Could not save persistent state:",
3298
3556
exc_info=e)
3299
3557
raise
3300
3558
3301
3559
# Delete all clients, and settings from config
3302
3560
while tcp_server.clients:
3303
3561
name, client = tcp_server.clients.popitem()
3309
3567
if use_dbus:
3310
3568
mandos_dbus_service.client_removed_signal(client)
3311
3569
client_settings.clear()
3312
3570
3313
3571
atexit.register(cleanup)
3314
3315
for client in tcp_server.clients.itervalues():
3572
3573
for client in tcp_server.clients.values():
3316
3574
if use_dbus:
3317
3575
# Emit D-Bus signal for adding
3318
3576
mandos_dbus_service.client_added_signal(client)
3319
3577
# Need to initiate checking of clients
3320
3578
if client.enabled:
3321
3579
client.init_checker()
3322
3580
3323
3581
tcp_server.enable()
3324
3582
tcp_server.server_activate()
3325
3583
3326
3584
# Find out what port we got
3327
3585
if zeroconf:
3328
3586
service.port = tcp_server.socket.getsockname()[1]
3333
3591
else: # IPv4
3334
3592
logger.info("Now listening on address %r, port %d",
3335
3593
*tcp_server.socket.getsockname())
3336
3337
#service.interface = tcp_server.socket.getsockname()[3]
3338
3594
3595
# service.interface = tcp_server.socket.getsockname()[3]
3596
3339
3597
try:
3340
3598
if zeroconf:
3341
3599
# From the Avahi example code
3346
3604
cleanup()
3347
3605
sys.exit(1)
3348
3606
# End of Avahi example code
3349
3350
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3351
lambda *args, **kwargs:
3352
(tcp_server.handle_request
3353
(*args[2:], **kwargs) or True))
3354
3607
3608
GLib.io_add_watch(
3609
GLib.IOChannel.unix_new(tcp_server.fileno()),
3610
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3611
lambda *args, **kwargs: (tcp_server.handle_request
3612
(*args[2:], **kwargs) or True))
3613
3355
3614
logger.debug("Starting main loop")
3356
3615
main_loop.run()
3357
3616
except AvahiError as error:
3366
3625
# Must run before the D-Bus bus name gets deregistered
3367
3626
cleanup()
3368
3627
3628
3629
def should_only_run_tests():
3630
parser = argparse.ArgumentParser(add_help=False)
3631
parser.add_argument("--check", action='store_true')
3632
args, unknown_args = parser.parse_known_args()
3633
run_tests = args.check
3634
if run_tests:
3635
# Remove --check argument from sys.argv
3636
sys.argv[1:] = unknown_args
3637
return run_tests
3638
3639
# Add all tests from doctest strings
3640
def load_tests(loader, tests, none):
3641
import doctest
3642
tests.addTests(doctest.DocTestSuite())
3643
return tests
3369
3644
3370
3645
if __name__ == '__main__':
3371
main()
3646
try:
3647
if should_only_run_tests():
3648
# Call using ./mandos --check [--verbose]
3649
unittest.main()
3650
else:
3651
main()
3652
finally:
3653
logging.shutdown()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0