To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 759
- compare with another revision
- download diff
- download tarball
- view history from revision 759
- Committer: Teddy Hogeborn
- Date: 2015-07-06 20:29:34 UTC
- mfrom: (738.1.6 route-external)
- Revision ID: teddy@recompile.se-20150706202934-09j06jm2fiw1bn80
Merge change to add local route when network is "unreachable".
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
37
from future_builtins import *
42
38
43
39
try:
44
40
import SocketServer as socketserver
48
44
import argparse
49
45
import datetime
50
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
51
53
try:
52
54
import ConfigParser as configparser
53
55
except ImportError:
80
82
81
83
import dbus
82
84
import dbus.service
83
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
84
90
from dbus.mainloop.glib import DBusGMainLoop
85
91
import ctypes
86
92
import ctypes.util
87
93
import xml.dom.minidom
88
94
import inspect
89
95
90
# Try to find the value of SO_BINDTODEVICE:
91
96
try:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
94
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
98
except AttributeError:
96
99
try:
97
# This is where SO_BINDTODEVICE was up to and including Python
98
# 2.6, and also 3.2:
99
100
from IN import SO_BINDTODEVICE
100
101
except ImportError:
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
103
try:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
"/dev/stdin"],
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
112
# No value found
113
SO_BINDTODEVICE = None
102
SO_BINDTODEVICE = None
114
103
115
104
if sys.version_info.major == 2:
116
105
str = unicode
117
106
118
version = "1.7.20"
107
version = "1.6.9"
119
108
stored_state_file = "clients.pickle"
120
109
121
110
logger = logging.getLogger()
125
114
if_nametoindex = ctypes.cdll.LoadLibrary(
126
115
ctypes.util.find_library("c")).if_nametoindex
127
116
except (OSError, AttributeError):
128
117
129
118
def if_nametoindex(interface):
130
119
"Get an interface index the hard way, i.e. using fcntl()"
131
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
136
125
return interface_index
137
126
138
127
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
143
func.func_globals,
144
func.func_name,
145
func.func_defaults,
146
func.func_closure)
147
else:
148
return types.FunctionType(func.__code__,
149
func.__globals__,
150
func.__name__,
151
func.__defaults__,
152
func.__closure__)
153
154
155
128
def initlogger(debug, level=logging.WARNING):
156
129
"""init logger and add loglevel"""
157
130
158
131
global syslogger
159
132
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
address="/dev/log"))
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
162
135
syslogger.setFormatter(logging.Formatter
163
136
('Mandos [%(process)d]: %(levelname)s:'
164
137
' %(message)s'))
165
138
logger.addHandler(syslogger)
166
139
167
140
if debug:
168
141
console = logging.StreamHandler()
169
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
181
154
182
155
class PGPEngine(object):
183
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
184
157
185
158
def __init__(self):
186
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
187
self.gpg = "gpg"
188
try:
189
output = subprocess.check_output(["gpgconf"])
190
for line in output.splitlines():
191
name, text, path = line.split(b":")
192
if name == "gpg":
193
self.gpg = path
194
break
195
except OSError as e:
196
if e.errno != errno.ENOENT:
197
raise
198
160
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
161
'--home', self.tempdir,
200
162
'--force-mdc',
201
'--quiet']
202
# Only GPG version 1 has the --no-use-agent option.
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
self.gnupgargs.append("--no-use-agent")
205
163
'--quiet',
164
'--no-use-agent']
165
206
166
def __enter__(self):
207
167
return self
208
168
209
169
def __exit__(self, exc_type, exc_value, traceback):
210
170
self._cleanup()
211
171
return False
212
172
213
173
def __del__(self):
214
174
self._cleanup()
215
175
216
176
def _cleanup(self):
217
177
if self.tempdir is not None:
218
178
# Delete contents of tempdir
219
179
for root, dirs, files in os.walk(self.tempdir,
220
topdown=False):
180
topdown = False):
221
181
for filename in files:
222
182
os.remove(os.path.join(root, filename))
223
183
for dirname in dirs:
225
185
# Remove tempdir
226
186
os.rmdir(self.tempdir)
227
187
self.tempdir = None
228
188
229
189
def password_encode(self, password):
230
190
# Passphrase can not be empty and can not contain newlines or
231
191
# NUL bytes. So we prefix it and hex encode it.
236
196
.replace(b"\n", b"\\n")
237
197
.replace(b"\0", b"\\x00"))
238
198
return encoded
239
199
240
200
def encrypt(self, data, password):
241
201
passphrase = self.password_encode(password)
242
202
with tempfile.NamedTemporaryFile(
243
203
dir=self.tempdir) as passfile:
244
204
passfile.write(passphrase)
245
205
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
247
207
'--passphrase-file',
248
208
passfile.name]
249
209
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
254
214
if proc.returncode != 0:
255
215
raise PGPError(err)
256
216
return ciphertext
257
217
258
218
def decrypt(self, data, password):
259
219
passphrase = self.password_encode(password)
260
220
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
221
dir = self.tempdir) as passfile:
262
222
passfile.write(passphrase)
263
223
passfile.flush()
264
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
265
225
'--passphrase-file',
266
226
passfile.name]
267
227
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
272
232
if proc.returncode != 0:
273
233
raise PGPError(err)
274
234
return decrypted_plaintext
275
235
276
236
277
# Pretend that we have an Avahi module
278
class Avahi(object):
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
289
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
avahi = Avahi()
302
303
304
237
class AvahiError(Exception):
305
238
def __init__(self, value, *args, **kwargs):
306
239
self.value = value
318
251
319
252
class AvahiService(object):
320
253
"""An Avahi (Zeroconf) service.
321
254
322
255
Attributes:
323
256
interface: integer; avahi.IF_UNSPEC or an interface index.
324
257
Used to optionally bind to the specified interface.
336
269
server: D-Bus Server
337
270
bus: dbus.SystemBus()
338
271
"""
339
272
340
273
def __init__(self,
341
interface=avahi.IF_UNSPEC,
342
name=None,
343
servicetype=None,
344
port=None,
345
TXT=None,
346
domain="",
347
host="",
348
max_renames=32768,
349
protocol=avahi.PROTO_UNSPEC,
350
bus=None):
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
351
284
self.interface = interface
352
285
self.name = name
353
286
self.type = servicetype
362
295
self.server = None
363
296
self.bus = bus
364
297
self.entry_group_state_changed_match = None
365
298
366
299
def rename(self, remove=True):
367
300
"""Derived from the Avahi example code"""
368
301
if self.rename_count >= self.max_renames:
388
321
logger.critical("D-Bus Exception", exc_info=error)
389
322
self.cleanup()
390
323
os._exit(1)
391
324
392
325
def remove(self):
393
326
"""Derived from the Avahi example code"""
394
327
if self.entry_group_state_changed_match is not None:
396
329
self.entry_group_state_changed_match = None
397
330
if self.group is not None:
398
331
self.group.Reset()
399
332
400
333
def add(self):
401
334
"""Derived from the Avahi example code"""
402
335
self.remove()
419
352
dbus.UInt16(self.port),
420
353
avahi.string_array_to_txt_array(self.TXT))
421
354
self.group.Commit()
422
355
423
356
def entry_group_state_changed(self, state, error):
424
357
"""Derived from the Avahi example code"""
425
358
logger.debug("Avahi entry group state change: %i", state)
426
359
427
360
if state == avahi.ENTRY_GROUP_ESTABLISHED:
428
361
logger.debug("Zeroconf service established.")
429
362
elif state == avahi.ENTRY_GROUP_COLLISION:
433
366
logger.critical("Avahi: Error in group state changed %s",
434
367
str(error))
435
368
raise AvahiGroupError("State changed: {!s}".format(error))
436
369
437
370
def cleanup(self):
438
371
"""Derived from the Avahi example code"""
439
372
if self.group is not None:
444
377
pass
445
378
self.group = None
446
379
self.remove()
447
380
448
381
def server_state_changed(self, state, error=None):
449
382
"""Derived from the Avahi example code"""
450
383
logger.debug("Avahi server state change: %i", state)
462
395
logger.error(bad_states[state] + ": %r", error)
463
396
self.cleanup()
464
397
elif state == avahi.SERVER_RUNNING:
465
try:
466
self.add()
467
except dbus.exceptions.DBusException as error:
468
if (error.get_dbus_name()
469
== "org.freedesktop.Avahi.CollisionError"):
470
logger.info("Local Zeroconf service name"
471
" collision.")
472
return self.rename(remove=False)
473
else:
474
logger.critical("D-Bus Exception", exc_info=error)
475
self.cleanup()
476
os._exit(1)
398
self.add()
477
399
else:
478
400
if error is None:
479
401
logger.debug("Unknown state: %r", state)
480
402
else:
481
403
logger.debug("Unknown state: %r: %r", state, error)
482
404
483
405
def activate(self):
484
406
"""Derived from the Avahi example code"""
485
407
if self.server is None:
496
418
class AvahiServiceToSyslog(AvahiService):
497
419
def rename(self, *args, **kwargs):
498
420
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
421
ret = AvahiService.rename(self, *args, **kwargs)
500
422
syslogger.setFormatter(logging.Formatter(
501
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
502
424
.format(self.name)))
503
425
return ret
504
426
505
506
# Pretend that we have a GnuTLS module
507
class GnuTLS(object):
508
"""This isn't so much a class as it is a module-like namespace.
509
It is instantiated once, and simulates having a GnuTLS module."""
510
511
library = ctypes.util.find_library("gnutls")
512
if library is None:
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
515
del library
516
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
518
519
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
525
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
528
529
# Constants
530
E_SUCCESS = 0
531
E_INTERRUPTED = -52
532
E_AGAIN = -28
533
CRT_OPENPGP = 2
534
CRT_RAWPK = 3
535
CLIENT = 2
536
SHUT_RDWR = 0
537
CRD_CERTIFICATE = 1
538
E_NO_CERTIFICATE_FOUND = -49
539
X509_FMT_DER = 0
540
NO_TICKETS = 1<<10
541
ENABLE_RAWPK = 1<<18
542
CTYPE_PEERS = 3
543
KEYID_USE_SHA256 = 1 # gnutls/x509.h
544
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
545
546
# Types
547
class session_int(ctypes.Structure):
548
_fields_ = []
549
session_t = ctypes.POINTER(session_int)
550
551
class certificate_credentials_st(ctypes.Structure):
552
_fields_ = []
553
certificate_credentials_t = ctypes.POINTER(
554
certificate_credentials_st)
555
certificate_type_t = ctypes.c_int
556
557
class datum_t(ctypes.Structure):
558
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
('size', ctypes.c_uint)]
560
561
class openpgp_crt_int(ctypes.Structure):
562
_fields_ = []
563
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
565
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
566
credentials_type_t = ctypes.c_int
567
transport_ptr_t = ctypes.c_void_p
568
close_request_t = ctypes.c_int
569
570
# Exceptions
571
class Error(Exception):
572
# We need to use the class name "GnuTLS" here, since this
573
# exception might be raised from within GnuTLS.__init__,
574
# which is called before the assignment to the "gnutls"
575
# global variable has happened.
576
def __init__(self, message=None, code=None, args=()):
577
# Default usage is by a message string, but if a return
578
# code is passed, convert it to a string with
579
# gnutls.strerror()
580
self.code = code
581
if message is None and code is not None:
582
message = GnuTLS.strerror(code)
583
return super(GnuTLS.Error, self).__init__(
584
message, *args)
585
586
class CertificateSecurityError(Error):
587
pass
588
589
# Classes
590
class Credentials(object):
591
def __init__(self):
592
self._c_object = gnutls.certificate_credentials_t()
593
gnutls.certificate_allocate_credentials(
594
ctypes.byref(self._c_object))
595
self.type = gnutls.CRD_CERTIFICATE
596
597
def __del__(self):
598
gnutls.certificate_free_credentials(self._c_object)
599
600
class ClientSession(object):
601
def __init__(self, socket, credentials=None):
602
self._c_object = gnutls.session_t()
603
gnutls_flags = gnutls.CLIENT
604
if gnutls.check_version("3.5.6"):
605
gnutls_flags |= gnutls.NO_TICKETS
606
if gnutls.has_rawpk:
607
gnutls_flags |= gnutls.ENABLE_RAWPK
608
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
609
del gnutls_flags
610
gnutls.set_default_priority(self._c_object)
611
gnutls.transport_set_ptr(self._c_object, socket.fileno())
612
gnutls.handshake_set_private_extensions(self._c_object,
613
True)
614
self.socket = socket
615
if credentials is None:
616
credentials = gnutls.Credentials()
617
gnutls.credentials_set(self._c_object, credentials.type,
618
ctypes.cast(credentials._c_object,
619
ctypes.c_void_p))
620
self.credentials = credentials
621
622
def __del__(self):
623
gnutls.deinit(self._c_object)
624
625
def handshake(self):
626
return gnutls.handshake(self._c_object)
627
628
def send(self, data):
629
data = bytes(data)
630
data_len = len(data)
631
while data_len > 0:
632
data_len -= gnutls.record_send(self._c_object,
633
data[-data_len:],
634
data_len)
635
636
def bye(self):
637
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
638
639
# Error handling functions
640
def _error_code(result):
641
"""A function to raise exceptions on errors, suitable
642
for the 'restype' attribute on ctypes functions"""
643
if result >= 0:
644
return result
645
if result == gnutls.E_NO_CERTIFICATE_FOUND:
646
raise gnutls.CertificateSecurityError(code=result)
647
raise gnutls.Error(code=result)
648
649
def _retry_on_error(result, func, arguments):
650
"""A function to retry on some errors, suitable
651
for the 'errcheck' attribute on ctypes functions"""
652
while result < 0:
653
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
654
return _error_code(result)
655
result = func(*arguments)
656
return result
657
658
# Unless otherwise indicated, the function declarations below are
659
# all from the gnutls/gnutls.h C header file.
660
661
# Functions
662
priority_set_direct = _library.gnutls_priority_set_direct
663
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
664
ctypes.POINTER(ctypes.c_char_p)]
665
priority_set_direct.restype = _error_code
666
667
init = _library.gnutls_init
668
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
669
init.restype = _error_code
670
671
set_default_priority = _library.gnutls_set_default_priority
672
set_default_priority.argtypes = [session_t]
673
set_default_priority.restype = _error_code
674
675
record_send = _library.gnutls_record_send
676
record_send.argtypes = [session_t, ctypes.c_void_p,
677
ctypes.c_size_t]
678
record_send.restype = ctypes.c_ssize_t
679
record_send.errcheck = _retry_on_error
680
681
certificate_allocate_credentials = (
682
_library.gnutls_certificate_allocate_credentials)
683
certificate_allocate_credentials.argtypes = [
684
ctypes.POINTER(certificate_credentials_t)]
685
certificate_allocate_credentials.restype = _error_code
686
687
certificate_free_credentials = (
688
_library.gnutls_certificate_free_credentials)
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
691
certificate_free_credentials.restype = None
692
693
handshake_set_private_extensions = (
694
_library.gnutls_handshake_set_private_extensions)
695
handshake_set_private_extensions.argtypes = [session_t,
696
ctypes.c_int]
697
handshake_set_private_extensions.restype = None
698
699
credentials_set = _library.gnutls_credentials_set
700
credentials_set.argtypes = [session_t, credentials_type_t,
701
ctypes.c_void_p]
702
credentials_set.restype = _error_code
703
704
strerror = _library.gnutls_strerror
705
strerror.argtypes = [ctypes.c_int]
706
strerror.restype = ctypes.c_char_p
707
708
certificate_type_get = _library.gnutls_certificate_type_get
709
certificate_type_get.argtypes = [session_t]
710
certificate_type_get.restype = _error_code
711
712
certificate_get_peers = _library.gnutls_certificate_get_peers
713
certificate_get_peers.argtypes = [session_t,
714
ctypes.POINTER(ctypes.c_uint)]
715
certificate_get_peers.restype = ctypes.POINTER(datum_t)
716
717
global_set_log_level = _library.gnutls_global_set_log_level
718
global_set_log_level.argtypes = [ctypes.c_int]
719
global_set_log_level.restype = None
720
721
global_set_log_function = _library.gnutls_global_set_log_function
722
global_set_log_function.argtypes = [log_func]
723
global_set_log_function.restype = None
724
725
deinit = _library.gnutls_deinit
726
deinit.argtypes = [session_t]
727
deinit.restype = None
728
729
handshake = _library.gnutls_handshake
730
handshake.argtypes = [session_t]
731
handshake.restype = _error_code
732
handshake.errcheck = _retry_on_error
733
734
transport_set_ptr = _library.gnutls_transport_set_ptr
735
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
736
transport_set_ptr.restype = None
737
738
bye = _library.gnutls_bye
739
bye.argtypes = [session_t, close_request_t]
740
bye.restype = _error_code
741
bye.errcheck = _retry_on_error
742
743
check_version = _library.gnutls_check_version
744
check_version.argtypes = [ctypes.c_char_p]
745
check_version.restype = ctypes.c_char_p
746
747
has_rawpk = bool(check_version(_tls_rawpk_version))
748
749
if has_rawpk:
750
# Types
751
class pubkey_st(ctypes.Structure):
752
_fields = []
753
pubkey_t = ctypes.POINTER(pubkey_st)
754
755
x509_crt_fmt_t = ctypes.c_int
756
757
# All the function declarations below are from gnutls/abstract.h
758
pubkey_init = _library.gnutls_pubkey_init
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
pubkey_init.restype = _error_code
761
762
pubkey_import = _library.gnutls_pubkey_import
763
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
764
x509_crt_fmt_t]
765
pubkey_import.restype = _error_code
766
767
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
ctypes.POINTER(ctypes.c_ubyte),
770
ctypes.POINTER(ctypes.c_size_t)]
771
pubkey_get_key_id.restype = _error_code
772
773
pubkey_deinit = _library.gnutls_pubkey_deinit
774
pubkey_deinit.argtypes = [pubkey_t]
775
pubkey_deinit.restype = None
776
else:
777
# All the function declarations below are from gnutls/openpgp.h
778
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
openpgp_crt_init.restype = _error_code
782
783
openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
openpgp_crt_import.argtypes = [openpgp_crt_t,
785
ctypes.POINTER(datum_t),
786
openpgp_crt_fmt_t]
787
openpgp_crt_import.restype = _error_code
788
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
792
openpgp_crt_verify_self.restype = _error_code
793
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
openpgp_crt_deinit.restype = None
797
798
openpgp_crt_get_fingerprint = (
799
_library.gnutls_openpgp_crt_get_fingerprint)
800
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
801
ctypes.c_void_p,
802
ctypes.POINTER(
803
ctypes.c_size_t)]
804
openpgp_crt_get_fingerprint.restype = _error_code
805
806
if check_version("3.6.4"):
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
certificate_type_get2.restype = _error_code
810
811
# Remove non-public functions
812
del _error_code, _retry_on_error
813
# Create the global "gnutls" object, simulating a module
814
gnutls = GnuTLS()
815
816
817
427
def call_pipe(connection, # : multiprocessing.Connection
818
428
func, *args, **kwargs):
819
429
"""This function is meant to be called by multiprocessing.Process
820
430
821
431
This function runs func(*args, **kwargs), and writes the resulting
822
432
return value on the provided multiprocessing.Connection.
823
433
"""
824
434
connection.send(func(*args, **kwargs))
825
435
connection.close()
826
436
827
828
437
class Client(object):
829
438
"""A representation of a client host served by this server.
830
439
831
440
Attributes:
832
441
approved: bool(); 'None' if not yet approved/disapproved
833
442
approval_delay: datetime.timedelta(); Time to wait for approval
835
444
checker: subprocess.Popen(); a running checker process used
836
445
to see if the client lives.
837
446
'None' if no process is running.
838
checker_callback_tag: a GLib event source tag, or None
447
checker_callback_tag: a gobject event source tag, or None
839
448
checker_command: string; External command which is run to check
840
449
if client lives. %() expansions are done at
841
450
runtime with vars(self) as dict, so that for
842
451
instance %(name)s can be used in the command.
843
checker_initiator_tag: a GLib event source tag, or None
452
checker_initiator_tag: a gobject event source tag, or None
844
453
created: datetime.datetime(); (UTC) object creation
845
454
client_structure: Object describing what attributes a client has
846
455
and is used for storing the client at exit
847
456
current_checker_command: string; current running checker_command
848
disable_initiator_tag: a GLib event source tag, or None
457
disable_initiator_tag: a gobject event source tag, or None
849
458
enabled: bool()
850
459
fingerprint: string (40 or 32 hexadecimal digits); used to
851
uniquely identify an OpenPGP client
852
key_id: string (64 hexadecimal digits); used to uniquely identify
853
a client using raw public keys
460
uniquely identify the client
854
461
host: string; available for use by the checker command
855
462
interval: datetime.timedelta(); How often to start a new checker
856
463
last_approval_request: datetime.datetime(); (UTC) or None
872
479
disabled, or None
873
480
server_settings: The server_settings dict from main()
874
481
"""
875
482
876
483
runtime_expansions = ("approval_delay", "approval_duration",
877
"created", "enabled", "expires", "key_id",
484
"created", "enabled", "expires",
878
485
"fingerprint", "host", "interval",
879
486
"last_approval_request", "last_checked_ok",
880
487
"last_enabled", "name", "timeout")
889
496
"approved_by_default": "True",
890
497
"enabled": "True",
891
498
}
892
499
893
500
@staticmethod
894
501
def config_parser(config):
895
502
"""Construct a new dict of client settings of this form:
902
509
for client_name in config.sections():
903
510
section = dict(config.items(client_name))
904
511
client = settings[client_name] = {}
905
512
906
513
client["host"] = section["host"]
907
514
# Reformat values from string types to Python types
908
515
client["approved_by_default"] = config.getboolean(
909
516
client_name, "approved_by_default")
910
517
client["enabled"] = config.getboolean(client_name,
911
518
"enabled")
912
913
# Uppercase and remove spaces from key_id and fingerprint
914
# for later comparison purposes with return value from the
915
# key_id() and fingerprint() functions
916
client["key_id"] = (section.get("key_id", "").upper()
917
.replace(" ", ""))
519
520
# Uppercase and remove spaces from fingerprint for later
521
# comparison purposes with return value from the
522
# fingerprint() function
918
523
client["fingerprint"] = (section["fingerprint"].upper()
919
524
.replace(" ", ""))
920
525
if "secret" in section:
921
client["secret"] = codecs.decode(section["secret"]
922
.encode("utf-8"),
923
"base64")
526
client["secret"] = section["secret"].decode("base64")
924
527
elif "secfile" in section:
925
528
with open(os.path.expanduser(os.path.expandvars
926
529
(section["secfile"])),
941
544
client["last_approval_request"] = None
942
545
client["last_checked_ok"] = None
943
546
client["last_checker_status"] = -2
944
547
945
548
return settings
946
947
def __init__(self, settings, name=None, server_settings=None):
549
550
def __init__(self, settings, name = None, server_settings=None):
948
551
self.name = name
949
552
if server_settings is None:
950
553
server_settings = {}
952
555
# adding all client settings
953
556
for setting, value in settings.items():
954
557
setattr(self, setting, value)
955
558
956
559
if self.enabled:
957
560
if not hasattr(self, "last_enabled"):
958
561
self.last_enabled = datetime.datetime.utcnow()
962
565
else:
963
566
self.last_enabled = None
964
567
self.expires = None
965
568
966
569
logger.debug("Creating client %r", self.name)
967
logger.debug(" Key ID: %s", self.key_id)
968
570
logger.debug(" Fingerprint: %s", self.fingerprint)
969
571
self.created = settings.get("created",
970
572
datetime.datetime.utcnow())
971
573
972
574
# attributes specific for this server instance
973
575
self.checker = None
974
576
self.checker_initiator_tag = None
980
582
self.changedstate = multiprocessing_manager.Condition(
981
583
multiprocessing_manager.Lock())
982
584
self.client_structure = [attr
983
for attr in self.__dict__.keys()
585
for attr in self.__dict__.iterkeys()
984
586
if not attr.startswith("_")]
985
587
self.client_structure.append("client_structure")
986
588
987
589
for name, t in inspect.getmembers(
988
590
type(self), lambda obj: isinstance(obj, property)):
989
591
if not name.startswith("_"):
990
592
self.client_structure.append(name)
991
593
992
594
# Send notice to process children that client state has changed
993
595
def send_changedstate(self):
994
596
with self.changedstate:
995
597
self.changedstate.notify_all()
996
598
997
599
def enable(self):
998
600
"""Start this client's checker and timeout hooks"""
999
601
if getattr(self, "enabled", False):
1004
606
self.last_enabled = datetime.datetime.utcnow()
1005
607
self.init_checker()
1006
608
self.send_changedstate()
1007
609
1008
610
def disable(self, quiet=True):
1009
611
"""Disable this client."""
1010
612
if not getattr(self, "enabled", False):
1012
614
if not quiet:
1013
615
logger.info("Disabling client %s", self.name)
1014
616
if getattr(self, "disable_initiator_tag", None) is not None:
1015
GLib.source_remove(self.disable_initiator_tag)
617
gobject.source_remove(self.disable_initiator_tag)
1016
618
self.disable_initiator_tag = None
1017
619
self.expires = None
1018
620
if getattr(self, "checker_initiator_tag", None) is not None:
1019
GLib.source_remove(self.checker_initiator_tag)
621
gobject.source_remove(self.checker_initiator_tag)
1020
622
self.checker_initiator_tag = None
1021
623
self.stop_checker()
1022
624
self.enabled = False
1023
625
if not quiet:
1024
626
self.send_changedstate()
1025
# Do not run this again if called by a GLib.timeout_add
627
# Do not run this again if called by a gobject.timeout_add
1026
628
return False
1027
629
1028
630
def __del__(self):
1029
631
self.disable()
1030
632
1031
633
def init_checker(self):
1032
634
# Schedule a new checker to be started an 'interval' from now,
1033
635
# and every interval from then on.
1034
636
if self.checker_initiator_tag is not None:
1035
GLib.source_remove(self.checker_initiator_tag)
1036
self.checker_initiator_tag = GLib.timeout_add(
637
gobject.source_remove(self.checker_initiator_tag)
638
self.checker_initiator_tag = gobject.timeout_add(
1037
639
int(self.interval.total_seconds() * 1000),
1038
640
self.start_checker)
1039
641
# Schedule a disable() when 'timeout' has passed
1040
642
if self.disable_initiator_tag is not None:
1041
GLib.source_remove(self.disable_initiator_tag)
1042
self.disable_initiator_tag = GLib.timeout_add(
643
gobject.source_remove(self.disable_initiator_tag)
644
self.disable_initiator_tag = gobject.timeout_add(
1043
645
int(self.timeout.total_seconds() * 1000), self.disable)
1044
646
# Also start a new checker *right now*.
1045
647
self.start_checker()
1046
648
1047
649
def checker_callback(self, source, condition, connection,
1048
650
command):
1049
651
"""The checker has completed, so take appropriate actions."""
1052
654
# Read return code from connection (see call_pipe)
1053
655
returncode = connection.recv()
1054
656
connection.close()
1055
657
1056
658
if returncode >= 0:
1057
659
self.last_checker_status = returncode
1058
660
self.last_checker_signal = None
1068
670
logger.warning("Checker for %(name)s crashed?",
1069
671
vars(self))
1070
672
return False
1071
673
1072
674
def checked_ok(self):
1073
675
"""Assert that the client has been seen, alive and well."""
1074
676
self.last_checked_ok = datetime.datetime.utcnow()
1075
677
self.last_checker_status = 0
1076
678
self.last_checker_signal = None
1077
679
self.bump_timeout()
1078
680
1079
681
def bump_timeout(self, timeout=None):
1080
682
"""Bump up the timeout for this client."""
1081
683
if timeout is None:
1082
684
timeout = self.timeout
1083
685
if self.disable_initiator_tag is not None:
1084
GLib.source_remove(self.disable_initiator_tag)
686
gobject.source_remove(self.disable_initiator_tag)
1085
687
self.disable_initiator_tag = None
1086
688
if getattr(self, "enabled", False):
1087
self.disable_initiator_tag = GLib.timeout_add(
689
self.disable_initiator_tag = gobject.timeout_add(
1088
690
int(timeout.total_seconds() * 1000), self.disable)
1089
691
self.expires = datetime.datetime.utcnow() + timeout
1090
692
1091
693
def need_approval(self):
1092
694
self.last_approval_request = datetime.datetime.utcnow()
1093
695
1094
696
def start_checker(self):
1095
697
"""Start a new checker subprocess if one is not running.
1096
698
1097
699
If a checker already exists, leave it running and do
1098
700
nothing."""
1099
701
# The reason for not killing a running checker is that if we
1104
706
# checkers alone, the checker would have to take more time
1105
707
# than 'timeout' for the client to be disabled, which is as it
1106
708
# should be.
1107
709
1108
710
if self.checker is not None and not self.checker.is_alive():
1109
711
logger.warning("Checker was not alive; joining")
1110
712
self.checker.join()
1114
716
# Escape attributes for the shell
1115
717
escaped_attrs = {
1116
718
attr: re.escape(str(getattr(self, attr)))
1117
for attr in self.runtime_expansions}
719
for attr in self.runtime_expansions }
1118
720
try:
1119
721
command = self.checker_command % escaped_attrs
1120
722
except TypeError as error:
1132
734
# The exception is when not debugging but nevertheless
1133
735
# running in the foreground; use the previously
1134
736
# created wnull.
1135
popen_args = {"close_fds": True,
1136
"shell": True,
1137
"cwd": "/"}
737
popen_args = { "close_fds": True,
738
"shell": True,
739
"cwd": "/" }
1138
740
if (not self.server_settings["debug"]
1139
741
and self.server_settings["foreground"]):
1140
742
popen_args.update({"stdout": wnull,
1141
"stderr": wnull})
1142
pipe = multiprocessing.Pipe(duplex=False)
743
"stderr": wnull })
744
pipe = multiprocessing.Pipe(duplex = False)
1143
745
self.checker = multiprocessing.Process(
1144
target=call_pipe,
1145
args=(pipe[1], subprocess.call, command),
1146
kwargs=popen_args)
746
target = call_pipe,
747
args = (pipe[1], subprocess.call, command),
748
kwargs = popen_args)
1147
749
self.checker.start()
1148
self.checker_callback_tag = GLib.io_add_watch(
1149
pipe[0].fileno(), GLib.IO_IN,
750
self.checker_callback_tag = gobject.io_add_watch(
751
pipe[0].fileno(), gobject.IO_IN,
1150
752
self.checker_callback, pipe[0], command)
1151
# Re-run this periodically if run by GLib.timeout_add
753
# Re-run this periodically if run by gobject.timeout_add
1152
754
return True
1153
755
1154
756
def stop_checker(self):
1155
757
"""Force the checker process, if any, to stop."""
1156
758
if self.checker_callback_tag:
1157
GLib.source_remove(self.checker_callback_tag)
759
gobject.source_remove(self.checker_callback_tag)
1158
760
self.checker_callback_tag = None
1159
761
if getattr(self, "checker", None) is None:
1160
762
return
1169
771
byte_arrays=False):
1170
772
"""Decorators for marking methods of a DBusObjectWithProperties to
1171
773
become properties on the D-Bus.
1172
774
1173
775
The decorated method will be called with no arguments by "Get"
1174
776
and with one argument by "Set".
1175
777
1176
778
The parameters, where they are supported, are the same as
1177
779
dbus.service.method, except there is only "signature", since the
1178
780
type from Get() and the type sent to Set() is the same.
1182
784
if byte_arrays and signature != "ay":
1183
785
raise ValueError("Byte arrays not supported for non-'ay'"
1184
786
" signature {!r}".format(signature))
1185
787
1186
788
def decorator(func):
1187
789
func._dbus_is_property = True
1188
790
func._dbus_interface = dbus_interface
1191
793
func._dbus_name = func.__name__
1192
794
if func._dbus_name.endswith("_dbus_property"):
1193
795
func._dbus_name = func._dbus_name[:-14]
1194
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
796
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1195
797
return func
1196
798
1197
799
return decorator
1198
800
1199
801
1200
802
def dbus_interface_annotations(dbus_interface):
1201
803
"""Decorator for marking functions returning interface annotations
1202
804
1203
805
Usage:
1204
806
1205
807
@dbus_interface_annotations("org.example.Interface")
1206
808
def _foo(self): # Function name does not matter
1207
809
return {"org.freedesktop.DBus.Deprecated": "true",
1208
810
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1209
811
"false"}
1210
812
"""
1211
813
1212
814
def decorator(func):
1213
815
func._dbus_is_interface = True
1214
816
func._dbus_interface = dbus_interface
1215
817
func._dbus_name = dbus_interface
1216
818
return func
1217
819
1218
820
return decorator
1219
821
1220
822
1221
823
def dbus_annotations(annotations):
1222
824
"""Decorator to annotate D-Bus methods, signals or properties
1223
825
Usage:
1224
826
1225
827
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1226
828
"org.freedesktop.DBus.Property."
1227
829
"EmitsChangedSignal": "false"})
1229
831
access="r")
1230
832
def Property_dbus_property(self):
1231
833
return dbus.Boolean(False)
1232
1233
See also the DBusObjectWithAnnotations class.
1234
834
"""
1235
835
1236
836
def decorator(func):
1237
837
func._dbus_annotations = annotations
1238
838
return func
1239
839
1240
840
return decorator
1241
841
1242
842
1258
858
pass
1259
859
1260
860
1261
class DBusObjectWithAnnotations(dbus.service.Object):
1262
"""A D-Bus object with annotations.
1263
1264
Classes inheriting from this can use the dbus_annotations
1265
decorator to add annotations to methods or signals.
861
class DBusObjectWithProperties(dbus.service.Object):
862
"""A D-Bus object with properties.
863
864
Classes inheriting from this can use the dbus_service_property
865
decorator to expose methods as D-Bus properties. It exposes the
866
standard Get(), Set(), and GetAll() methods on the D-Bus.
1266
867
"""
1267
868
1268
869
@staticmethod
1269
870
def _is_dbus_thing(thing):
1270
871
"""Returns a function testing if an attribute is a D-Bus thing
1271
872
1272
873
If called like _is_dbus_thing("method") it returns a function
1273
874
suitable for use as predicate to inspect.getmembers().
1274
875
"""
1275
876
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1276
877
False)
1277
878
1278
879
def _get_all_dbus_things(self, thing):
1279
880
"""Returns a generator of (name, attribute) pairs
1280
881
"""
1283
884
for cls in self.__class__.__mro__
1284
885
for name, athing in
1285
886
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1286
1287
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1288
out_signature="s",
1289
path_keyword='object_path',
1290
connection_keyword='connection')
1291
def Introspect(self, object_path, connection):
1292
"""Overloading of standard D-Bus method.
1293
1294
Inserts annotation tags on methods and signals.
1295
"""
1296
xmlstring = dbus.service.Object.Introspect(self, object_path,
1297
connection)
1298
try:
1299
document = xml.dom.minidom.parseString(xmlstring)
1300
1301
for if_tag in document.getElementsByTagName("interface"):
1302
# Add annotation tags
1303
for typ in ("method", "signal"):
1304
for tag in if_tag.getElementsByTagName(typ):
1305
annots = dict()
1306
for name, prop in (self.
1307
_get_all_dbus_things(typ)):
1308
if (name == tag.getAttribute("name")
1309
and prop._dbus_interface
1310
== if_tag.getAttribute("name")):
1311
annots.update(getattr(
1312
prop, "_dbus_annotations", {}))
1313
for name, value in annots.items():
1314
ann_tag = document.createElement(
1315
"annotation")
1316
ann_tag.setAttribute("name", name)
1317
ann_tag.setAttribute("value", value)
1318
tag.appendChild(ann_tag)
1319
# Add interface annotation tags
1320
for annotation, value in dict(
1321
itertools.chain.from_iterable(
1322
annotations().items()
1323
for name, annotations
1324
in self._get_all_dbus_things("interface")
1325
if name == if_tag.getAttribute("name")
1326
)).items():
1327
ann_tag = document.createElement("annotation")
1328
ann_tag.setAttribute("name", annotation)
1329
ann_tag.setAttribute("value", value)
1330
if_tag.appendChild(ann_tag)
1331
# Fix argument name for the Introspect method itself
1332
if (if_tag.getAttribute("name")
1333
== dbus.INTROSPECTABLE_IFACE):
1334
for cn in if_tag.getElementsByTagName("method"):
1335
if cn.getAttribute("name") == "Introspect":
1336
for arg in cn.getElementsByTagName("arg"):
1337
if (arg.getAttribute("direction")
1338
== "out"):
1339
arg.setAttribute("name",
1340
"xml_data")
1341
xmlstring = document.toxml("utf-8")
1342
document.unlink()
1343
except (AttributeError, xml.dom.DOMException,
1344
xml.parsers.expat.ExpatError) as error:
1345
logger.error("Failed to override Introspection method",
1346
exc_info=error)
1347
return xmlstring
1348
1349
1350
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1351
"""A D-Bus object with properties.
1352
1353
Classes inheriting from this can use the dbus_service_property
1354
decorator to expose methods as D-Bus properties. It exposes the
1355
standard Get(), Set(), and GetAll() methods on the D-Bus.
1356
"""
1357
887
1358
888
def _get_dbus_property(self, interface_name, property_name):
1359
889
"""Returns a bound method if one exists which is a D-Bus
1360
890
property with the specified name and interface.
1365
895
if (value._dbus_name == property_name
1366
896
and value._dbus_interface == interface_name):
1367
897
return value.__get__(self)
1368
898
1369
899
# No such property
1370
900
raise DBusPropertyNotFound("{}:{}.{}".format(
1371
901
self.dbus_object_path, interface_name, property_name))
1372
1373
@classmethod
1374
def _get_all_interface_names(cls):
1375
"""Get a sequence of all interfaces supported by an object"""
1376
return (name for name in set(getattr(getattr(x, attr),
1377
"_dbus_interface", None)
1378
for x in (inspect.getmro(cls))
1379
for attr in dir(x))
1380
if name is not None)
1381
902
1382
903
@dbus.service.method(dbus.PROPERTIES_IFACE,
1383
904
in_signature="ss",
1384
905
out_signature="v")
1392
913
if not hasattr(value, "variant_level"):
1393
914
return value
1394
915
return type(value)(value, variant_level=value.variant_level+1)
1395
916
1396
917
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1397
918
def Set(self, interface_name, property_name, value):
1398
919
"""Standard D-Bus property Set() method, see D-Bus standard.
1410
931
value = dbus.ByteArray(b''.join(chr(byte)
1411
932
for byte in value))
1412
933
prop(value)
1413
934
1414
935
@dbus.service.method(dbus.PROPERTIES_IFACE,
1415
936
in_signature="s",
1416
937
out_signature="a{sv}")
1417
938
def GetAll(self, interface_name):
1418
939
"""Standard D-Bus property GetAll() method, see D-Bus
1419
940
standard.
1420
941
1421
942
Note: Will not include properties with access="write".
1422
943
"""
1423
944
properties = {}
1434
955
properties[name] = value
1435
956
continue
1436
957
properties[name] = type(value)(
1437
value, variant_level=value.variant_level + 1)
958
value, variant_level = value.variant_level + 1)
1438
959
return dbus.Dictionary(properties, signature="sv")
1439
960
1440
961
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1441
962
def PropertiesChanged(self, interface_name, changed_properties,
1442
963
invalidated_properties):
1444
965
standard.
1445
966
"""
1446
967
pass
1447
968
1448
969
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1449
970
out_signature="s",
1450
971
path_keyword='object_path',
1451
972
connection_keyword='connection')
1452
973
def Introspect(self, object_path, connection):
1453
974
"""Overloading of standard D-Bus method.
1454
975
1455
976
Inserts property tags and interface annotation tags.
1456
977
"""
1457
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1458
object_path,
1459
connection)
978
xmlstring = dbus.service.Object.Introspect(self, object_path,
979
connection)
1460
980
try:
1461
981
document = xml.dom.minidom.parseString(xmlstring)
1462
982
1463
983
def make_tag(document, name, prop):
1464
984
e = document.createElement("property")
1465
985
e.setAttribute("name", name)
1466
986
e.setAttribute("type", prop._dbus_signature)
1467
987
e.setAttribute("access", prop._dbus_access)
1468
988
return e
1469
989
1470
990
for if_tag in document.getElementsByTagName("interface"):
1471
991
# Add property tags
1472
992
for tag in (make_tag(document, name, prop)
1475
995
if prop._dbus_interface
1476
996
== if_tag.getAttribute("name")):
1477
997
if_tag.appendChild(tag)
1478
# Add annotation tags for properties
1479
for tag in if_tag.getElementsByTagName("property"):
1480
annots = dict()
1481
for name, prop in self._get_all_dbus_things(
1482
"property"):
1483
if (name == tag.getAttribute("name")
1484
and prop._dbus_interface
1485
== if_tag.getAttribute("name")):
1486
annots.update(getattr(
1487
prop, "_dbus_annotations", {}))
1488
for name, value in annots.items():
1489
ann_tag = document.createElement(
1490
"annotation")
1491
ann_tag.setAttribute("name", name)
1492
ann_tag.setAttribute("value", value)
1493
tag.appendChild(ann_tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr(
1008
prop, "_dbus_annotations", {}))
1009
for name, value in annots.items():
1010
ann_tag = document.createElement(
1011
"annotation")
1012
ann_tag.setAttribute("name", name)
1013
ann_tag.setAttribute("value", value)
1014
tag.appendChild(ann_tag)
1015
# Add interface annotation tags
1016
for annotation, value in dict(
1017
itertools.chain.from_iterable(
1018
annotations().items()
1019
for name, annotations
1020
in self._get_all_dbus_things("interface")
1021
if name == if_tag.getAttribute("name")
1022
)).items():
1023
ann_tag = document.createElement("annotation")
1024
ann_tag.setAttribute("name", annotation)
1025
ann_tag.setAttribute("value", value)
1026
if_tag.appendChild(ann_tag)
1494
1027
# Add the names to the return values for the
1495
1028
# "org.freedesktop.DBus.Properties" methods
1496
1029
if (if_tag.getAttribute("name")
1515
1048
return xmlstring
1516
1049
1517
1050
1518
try:
1519
dbus.OBJECT_MANAGER_IFACE
1520
except AttributeError:
1521
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1522
1523
1524
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1525
"""A D-Bus object with an ObjectManager.
1526
1527
Classes inheriting from this exposes the standard
1528
GetManagedObjects call and the InterfacesAdded and
1529
InterfacesRemoved signals on the standard
1530
"org.freedesktop.DBus.ObjectManager" interface.
1531
1532
Note: No signals are sent automatically; they must be sent
1533
manually.
1534
"""
1535
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1536
out_signature="a{oa{sa{sv}}}")
1537
def GetManagedObjects(self):
1538
"""This function must be overridden"""
1539
raise NotImplementedError()
1540
1541
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1542
signature="oa{sa{sv}}")
1543
def InterfacesAdded(self, object_path, interfaces_and_properties):
1544
pass
1545
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1547
def InterfacesRemoved(self, object_path, interfaces):
1548
pass
1549
1550
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1551
out_signature="s",
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1554
def Introspect(self, object_path, connection):
1555
"""Overloading of standard D-Bus method.
1556
1557
Override return argument name of GetManagedObjects to be
1558
"objpath_interfaces_and_properties"
1559
"""
1560
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1561
object_path,
1562
connection)
1563
try:
1564
document = xml.dom.minidom.parseString(xmlstring)
1565
1566
for if_tag in document.getElementsByTagName("interface"):
1567
# Fix argument name for the GetManagedObjects method
1568
if (if_tag.getAttribute("name")
1569
== dbus.OBJECT_MANAGER_IFACE):
1570
for cn in if_tag.getElementsByTagName("method"):
1571
if (cn.getAttribute("name")
1572
== "GetManagedObjects"):
1573
for arg in cn.getElementsByTagName("arg"):
1574
if (arg.getAttribute("direction")
1575
== "out"):
1576
arg.setAttribute(
1577
"name",
1578
"objpath_interfaces"
1579
"_and_properties")
1580
xmlstring = document.toxml("utf-8")
1581
document.unlink()
1582
except (AttributeError, xml.dom.DOMException,
1583
xml.parsers.expat.ExpatError) as error:
1584
logger.error("Failed to override Introspection method",
1585
exc_info=error)
1586
return xmlstring
1587
1588
1589
1051
def datetime_to_dbus(dt, variant_level=0):
1590
1052
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1591
1053
if dt is None:
1592
return dbus.String("", variant_level=variant_level)
1054
return dbus.String("", variant_level = variant_level)
1593
1055
return dbus.String(dt.isoformat(), variant_level=variant_level)
1594
1056
1595
1057
1598
1060
dbus.service.Object, it will add alternate D-Bus attributes with
1599
1061
interface names according to the "alt_interface_names" mapping.
1600
1062
Usage:
1601
1063
1602
1064
@alternate_dbus_interfaces({"org.example.Interface":
1603
1065
"net.example.AlternateInterface"})
1604
1066
class SampleDBusObject(dbus.service.Object):
1605
1067
@dbus.service.method("org.example.Interface")
1606
1068
def SampleDBusMethod():
1607
1069
pass
1608
1070
1609
1071
The above "SampleDBusMethod" on "SampleDBusObject" will be
1610
1072
reachable via two interfaces: "org.example.Interface" and
1611
1073
"net.example.AlternateInterface", the latter of which will have
1612
1074
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1613
1075
"true", unless "deprecate" is passed with a False value.
1614
1076
1615
1077
This works for methods and signals, and also for D-Bus properties
1616
1078
(from DBusObjectWithProperties) and interfaces (from the
1617
1079
dbus_interface_annotations decorator).
1618
1080
"""
1619
1081
1620
1082
def wrapper(cls):
1621
1083
for orig_interface_name, alt_interface_name in (
1622
1084
alt_interface_names.items()):
1637
1099
interface_names.add(alt_interface)
1638
1100
# Is this a D-Bus signal?
1639
1101
if getattr(attribute, "_dbus_is_signal", False):
1640
# Extract the original non-method undecorated
1641
# function by black magic
1642
1102
if sys.version_info.major == 2:
1103
# Extract the original non-method undecorated
1104
# function by black magic
1643
1105
nonmethod_func = (dict(
1644
1106
zip(attribute.func_code.co_freevars,
1645
1107
attribute.__closure__))
1646
1108
["func"].cell_contents)
1647
1109
else:
1648
nonmethod_func = (dict(
1649
zip(attribute.__code__.co_freevars,
1650
attribute.__closure__))
1651
["func"].cell_contents)
1110
nonmethod_func = attribute
1652
1111
# Create a new, but exactly alike, function
1653
1112
# object, and decorate it to be a new D-Bus signal
1654
1113
# with the alternate D-Bus interface name
1655
new_function = copy_function(nonmethod_func)
1114
if sys.version_info.major == 2:
1115
new_function = types.FunctionType(
1116
nonmethod_func.func_code,
1117
nonmethod_func.func_globals,
1118
nonmethod_func.func_name,
1119
nonmethod_func.func_defaults,
1120
nonmethod_func.func_closure)
1121
else:
1122
new_function = types.FunctionType(
1123
nonmethod_func.__code__,
1124
nonmethod_func.__globals__,
1125
nonmethod_func.__name__,
1126
nonmethod_func.__defaults__,
1127
nonmethod_func.__closure__)
1656
1128
new_function = (dbus.service.signal(
1657
1129
alt_interface,
1658
1130
attribute._dbus_signature)(new_function))
1662
1134
attribute._dbus_annotations)
1663
1135
except AttributeError:
1664
1136
pass
1665
1666
1137
# Define a creator of a function to call both the
1667
1138
# original and alternate functions, so both the
1668
1139
# original and alternate signals gets sent when
1671
1142
"""This function is a scope container to pass
1672
1143
func1 and func2 to the "call_both" function
1673
1144
outside of its arguments"""
1674
1675
@functools.wraps(func2)
1145
1676
1146
def call_both(*args, **kwargs):
1677
1147
"""This function will emit two D-Bus
1678
1148
signals by calling func1 and func2"""
1679
1149
func1(*args, **kwargs)
1680
1150
func2(*args, **kwargs)
1681
# Make wrapper function look like a D-Bus
1682
# signal
1683
for name, attr in inspect.getmembers(func2):
1684
if name.startswith("_dbus_"):
1685
setattr(call_both, name, attr)
1686
1151
1687
1152
return call_both
1688
1153
# Create the "call_both" function and add it to
1689
1154
# the class
1699
1164
alt_interface,
1700
1165
attribute._dbus_in_signature,
1701
1166
attribute._dbus_out_signature)
1702
(copy_function(attribute)))
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1703
1172
# Copy annotations, if any
1704
1173
try:
1705
1174
attr[attrname]._dbus_annotations = dict(
1717
1186
attribute._dbus_access,
1718
1187
attribute._dbus_get_args_options
1719
1188
["byte_arrays"])
1720
(copy_function(attribute)))
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1721
1195
# Copy annotations, if any
1722
1196
try:
1723
1197
attr[attrname]._dbus_annotations = dict(
1732
1206
# to the class.
1733
1207
attr[attrname] = (
1734
1208
dbus_interface_annotations(alt_interface)
1735
(copy_function(attribute)))
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1736
1214
if deprecate:
1737
1215
# Deprecate all alternate interfaces
1738
iname = "_AlternateDBusNames_interface_annotation{}"
1216
iname="_AlternateDBusNames_interface_annotation{}"
1739
1217
for interface_name in interface_names:
1740
1218
1741
1219
@dbus_interface_annotations(interface_name)
1742
1220
def func(self):
1743
return {"org.freedesktop.DBus.Deprecated":
1744
"true"}
1221
return { "org.freedesktop.DBus.Deprecated":
1222
"true" }
1745
1223
# Find an unused name
1746
1224
for aname in (iname.format(i)
1747
1225
for i in itertools.count()):
1751
1229
if interface_names:
1752
1230
# Replace the class with a new subclass of it with
1753
1231
# methods, signals, etc. as created above.
1754
if sys.version_info.major == 2:
1755
cls = type(b"{}Alternate".format(cls.__name__),
1756
(cls, ), attr)
1757
else:
1758
cls = type("{}Alternate".format(cls.__name__),
1759
(cls, ), attr)
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1760
1234
return cls
1761
1235
1762
1236
return wrapper
1763
1237
1764
1238
1766
1240
"se.bsnet.fukt.Mandos"})
1767
1241
class ClientDBus(Client, DBusObjectWithProperties):
1768
1242
"""A Client class using D-Bus
1769
1243
1770
1244
Attributes:
1771
1245
dbus_object_path: dbus.ObjectPath
1772
1246
bus: dbus.SystemBus()
1773
1247
"""
1774
1248
1775
1249
runtime_expansions = (Client.runtime_expansions
1776
1250
+ ("dbus_object_path", ))
1777
1251
1778
1252
_interface = "se.recompile.Mandos.Client"
1779
1253
1780
1254
# dbus.service.Object doesn't use super(), so we can't either.
1781
1782
def __init__(self, bus=None, *args, **kwargs):
1255
1256
def __init__(self, bus = None, *args, **kwargs):
1783
1257
self.bus = bus
1784
1258
Client.__init__(self, *args, **kwargs)
1785
1259
# Only now, when this client is initialized, can it show up on
1791
1265
"/clients/" + client_object_name)
1792
1266
DBusObjectWithProperties.__init__(self, self.bus,
1793
1267
self.dbus_object_path)
1794
1268
1795
1269
def notifychangeproperty(transform_func, dbus_name,
1796
1270
type_func=lambda x: x,
1797
1271
variant_level=1,
1799
1273
_interface=_interface):
1800
1274
""" Modify a variable so that it's a property which announces
1801
1275
its changes to DBus.
1802
1276
1803
1277
transform_fun: Function that takes a value and a variant_level
1804
1278
and transforms it to a D-Bus type.
1805
1279
dbus_name: D-Bus name of the variable
1808
1282
variant_level: D-Bus variant level. Default: 1
1809
1283
"""
1810
1284
attrname = "_{}".format(dbus_name)
1811
1285
1812
1286
def setter(self, value):
1813
1287
if hasattr(self, "dbus_object_path"):
1814
1288
if (not hasattr(self, attrname) or
1821
1295
else:
1822
1296
dbus_value = transform_func(
1823
1297
type_func(value),
1824
variant_level=variant_level)
1298
variant_level = variant_level)
1825
1299
self.PropertyChanged(dbus.String(dbus_name),
1826
1300
dbus_value)
1827
1301
self.PropertiesChanged(
1828
1302
_interface,
1829
dbus.Dictionary({dbus.String(dbus_name):
1830
dbus_value}),
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1831
1305
dbus.Array())
1832
1306
setattr(self, attrname, value)
1833
1307
1834
1308
return property(lambda self: getattr(self, attrname), setter)
1835
1309
1836
1310
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1837
1311
approvals_pending = notifychangeproperty(dbus.Boolean,
1838
1312
"ApprovalPending",
1839
type_func=bool)
1313
type_func = bool)
1840
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1841
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1842
1316
"LastEnabled")
1843
1317
checker = notifychangeproperty(
1844
1318
dbus.Boolean, "CheckerRunning",
1845
type_func=lambda checker: checker is not None)
1319
type_func = lambda checker: checker is not None)
1846
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1847
1321
"LastCheckedOK")
1848
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1853
1327
"ApprovedByDefault")
1854
1328
approval_delay = notifychangeproperty(
1855
1329
dbus.UInt64, "ApprovalDelay",
1856
type_func=lambda td: td.total_seconds() * 1000)
1330
type_func = lambda td: td.total_seconds() * 1000)
1857
1331
approval_duration = notifychangeproperty(
1858
1332
dbus.UInt64, "ApprovalDuration",
1859
type_func=lambda td: td.total_seconds() * 1000)
1333
type_func = lambda td: td.total_seconds() * 1000)
1860
1334
host = notifychangeproperty(dbus.String, "Host")
1861
1335
timeout = notifychangeproperty(
1862
1336
dbus.UInt64, "Timeout",
1863
type_func=lambda td: td.total_seconds() * 1000)
1337
type_func = lambda td: td.total_seconds() * 1000)
1864
1338
extended_timeout = notifychangeproperty(
1865
1339
dbus.UInt64, "ExtendedTimeout",
1866
type_func=lambda td: td.total_seconds() * 1000)
1340
type_func = lambda td: td.total_seconds() * 1000)
1867
1341
interval = notifychangeproperty(
1868
1342
dbus.UInt64, "Interval",
1869
type_func=lambda td: td.total_seconds() * 1000)
1343
type_func = lambda td: td.total_seconds() * 1000)
1870
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1871
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1872
1346
invalidate_only=True)
1873
1347
1874
1348
del notifychangeproperty
1875
1349
1876
1350
def __del__(self, *args, **kwargs):
1877
1351
try:
1878
1352
self.remove_from_connection()
1881
1355
if hasattr(DBusObjectWithProperties, "__del__"):
1882
1356
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1883
1357
Client.__del__(self, *args, **kwargs)
1884
1358
1885
1359
def checker_callback(self, source, condition,
1886
1360
connection, command, *args, **kwargs):
1887
1361
ret = Client.checker_callback(self, source, condition,
1891
1365
if exitstatus >= 0:
1892
1366
# Emit D-Bus signal
1893
1367
self.CheckerCompleted(dbus.Int16(exitstatus),
1894
# This is specific to GNU libC
1895
dbus.Int64(exitstatus << 8),
1368
dbus.Int64(0),
1896
1369
dbus.String(command))
1897
1370
else:
1898
1371
# Emit D-Bus signal
1899
1372
self.CheckerCompleted(dbus.Int16(-1),
1900
1373
dbus.Int64(
1901
# This is specific to GNU libC
1902
(exitstatus << 8)
1903
| self.last_checker_signal),
1374
self.last_checker_signal),
1904
1375
dbus.String(command))
1905
1376
return ret
1906
1377
1907
1378
def start_checker(self, *args, **kwargs):
1908
1379
old_checker_pid = getattr(self.checker, "pid", None)
1909
1380
r = Client.start_checker(self, *args, **kwargs)
1913
1384
# Emit D-Bus signal
1914
1385
self.CheckerStarted(self.current_checker_command)
1915
1386
return r
1916
1387
1917
1388
def _reset_approved(self):
1918
1389
self.approved = None
1919
1390
return False
1920
1391
1921
1392
def approve(self, value=True):
1922
1393
self.approved = value
1923
GLib.timeout_add(int(self.approval_duration.total_seconds()
1924
* 1000), self._reset_approved)
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1925
1396
self.send_changedstate()
1926
1927
# D-Bus methods, signals & properties
1928
1929
# Interfaces
1930
1931
# Signals
1932
1397
1398
## D-Bus methods, signals & properties
1399
1400
## Interfaces
1401
1402
## Signals
1403
1933
1404
# CheckerCompleted - signal
1934
1405
@dbus.service.signal(_interface, signature="nxs")
1935
1406
def CheckerCompleted(self, exitcode, waitstatus, command):
1936
1407
"D-Bus signal"
1937
1408
pass
1938
1409
1939
1410
# CheckerStarted - signal
1940
1411
@dbus.service.signal(_interface, signature="s")
1941
1412
def CheckerStarted(self, command):
1942
1413
"D-Bus signal"
1943
1414
pass
1944
1415
1945
1416
# PropertyChanged - signal
1946
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1947
1418
@dbus.service.signal(_interface, signature="sv")
1948
1419
def PropertyChanged(self, property, value):
1949
1420
"D-Bus signal"
1950
1421
pass
1951
1422
1952
1423
# GotSecret - signal
1953
1424
@dbus.service.signal(_interface)
1954
1425
def GotSecret(self):
1957
1428
server to mandos-client
1958
1429
"""
1959
1430
pass
1960
1431
1961
1432
# Rejected - signal
1962
1433
@dbus.service.signal(_interface, signature="s")
1963
1434
def Rejected(self, reason):
1964
1435
"D-Bus signal"
1965
1436
pass
1966
1437
1967
1438
# NeedApproval - signal
1968
1439
@dbus.service.signal(_interface, signature="tb")
1969
1440
def NeedApproval(self, timeout, default):
1970
1441
"D-Bus signal"
1971
1442
return self.need_approval()
1972
1973
# Methods
1974
1443
1444
## Methods
1445
1975
1446
# Approve - method
1976
1447
@dbus.service.method(_interface, in_signature="b")
1977
1448
def Approve(self, value):
1978
1449
self.approve(value)
1979
1450
1980
1451
# CheckedOK - method
1981
1452
@dbus.service.method(_interface)
1982
1453
def CheckedOK(self):
1983
1454
self.checked_ok()
1984
1455
1985
1456
# Enable - method
1986
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1987
1457
@dbus.service.method(_interface)
1988
1458
def Enable(self):
1989
1459
"D-Bus method"
1990
1460
self.enable()
1991
1461
1992
1462
# StartChecker - method
1993
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1994
1463
@dbus.service.method(_interface)
1995
1464
def StartChecker(self):
1996
1465
"D-Bus method"
1997
1466
self.start_checker()
1998
1467
1999
1468
# Disable - method
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2001
1469
@dbus.service.method(_interface)
2002
1470
def Disable(self):
2003
1471
"D-Bus method"
2004
1472
self.disable()
2005
1473
2006
1474
# StopChecker - method
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2008
1475
@dbus.service.method(_interface)
2009
1476
def StopChecker(self):
2010
1477
self.stop_checker()
2011
2012
# Properties
2013
1478
1479
## Properties
1480
2014
1481
# ApprovalPending - property
2015
1482
@dbus_service_property(_interface, signature="b", access="read")
2016
1483
def ApprovalPending_dbus_property(self):
2017
1484
return dbus.Boolean(bool(self.approvals_pending))
2018
1485
2019
1486
# ApprovedByDefault - property
2020
1487
@dbus_service_property(_interface,
2021
1488
signature="b",
2024
1491
if value is None: # get
2025
1492
return dbus.Boolean(self.approved_by_default)
2026
1493
self.approved_by_default = bool(value)
2027
1494
2028
1495
# ApprovalDelay - property
2029
1496
@dbus_service_property(_interface,
2030
1497
signature="t",
2034
1501
return dbus.UInt64(self.approval_delay.total_seconds()
2035
1502
* 1000)
2036
1503
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2037
1504
2038
1505
# ApprovalDuration - property
2039
1506
@dbus_service_property(_interface,
2040
1507
signature="t",
2044
1511
return dbus.UInt64(self.approval_duration.total_seconds()
2045
1512
* 1000)
2046
1513
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2047
1514
2048
1515
# Name - property
2049
@dbus_annotations(
2050
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2051
1516
@dbus_service_property(_interface, signature="s", access="read")
2052
1517
def Name_dbus_property(self):
2053
1518
return dbus.String(self.name)
2054
2055
# KeyID - property
2056
@dbus_annotations(
2057
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2058
@dbus_service_property(_interface, signature="s", access="read")
2059
def KeyID_dbus_property(self):
2060
return dbus.String(self.key_id)
2061
1519
2062
1520
# Fingerprint - property
2063
@dbus_annotations(
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2065
1521
@dbus_service_property(_interface, signature="s", access="read")
2066
1522
def Fingerprint_dbus_property(self):
2067
1523
return dbus.String(self.fingerprint)
2068
1524
2069
1525
# Host - property
2070
1526
@dbus_service_property(_interface,
2071
1527
signature="s",
2074
1530
if value is None: # get
2075
1531
return dbus.String(self.host)
2076
1532
self.host = str(value)
2077
1533
2078
1534
# Created - property
2079
@dbus_annotations(
2080
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2081
1535
@dbus_service_property(_interface, signature="s", access="read")
2082
1536
def Created_dbus_property(self):
2083
1537
return datetime_to_dbus(self.created)
2084
1538
2085
1539
# LastEnabled - property
2086
1540
@dbus_service_property(_interface, signature="s", access="read")
2087
1541
def LastEnabled_dbus_property(self):
2088
1542
return datetime_to_dbus(self.last_enabled)
2089
1543
2090
1544
# Enabled - property
2091
1545
@dbus_service_property(_interface,
2092
1546
signature="b",
2098
1552
self.enable()
2099
1553
else:
2100
1554
self.disable()
2101
1555
2102
1556
# LastCheckedOK - property
2103
1557
@dbus_service_property(_interface,
2104
1558
signature="s",
2108
1562
self.checked_ok()
2109
1563
return
2110
1564
return datetime_to_dbus(self.last_checked_ok)
2111
1565
2112
1566
# LastCheckerStatus - property
2113
1567
@dbus_service_property(_interface, signature="n", access="read")
2114
1568
def LastCheckerStatus_dbus_property(self):
2115
1569
return dbus.Int16(self.last_checker_status)
2116
1570
2117
1571
# Expires - property
2118
1572
@dbus_service_property(_interface, signature="s", access="read")
2119
1573
def Expires_dbus_property(self):
2120
1574
return datetime_to_dbus(self.expires)
2121
1575
2122
1576
# LastApprovalRequest - property
2123
1577
@dbus_service_property(_interface, signature="s", access="read")
2124
1578
def LastApprovalRequest_dbus_property(self):
2125
1579
return datetime_to_dbus(self.last_approval_request)
2126
1580
2127
1581
# Timeout - property
2128
1582
@dbus_service_property(_interface,
2129
1583
signature="t",
2144
1598
if (getattr(self, "disable_initiator_tag", None)
2145
1599
is None):
2146
1600
return
2147
GLib.source_remove(self.disable_initiator_tag)
2148
self.disable_initiator_tag = GLib.timeout_add(
1601
gobject.source_remove(self.disable_initiator_tag)
1602
self.disable_initiator_tag = gobject.timeout_add(
2149
1603
int((self.expires - now).total_seconds() * 1000),
2150
1604
self.disable)
2151
1605
2152
1606
# ExtendedTimeout - property
2153
1607
@dbus_service_property(_interface,
2154
1608
signature="t",
2158
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
2159
1613
* 1000)
2160
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2161
1615
2162
1616
# Interval - property
2163
1617
@dbus_service_property(_interface,
2164
1618
signature="t",
2171
1625
return
2172
1626
if self.enabled:
2173
1627
# Reschedule checker run
2174
GLib.source_remove(self.checker_initiator_tag)
2175
self.checker_initiator_tag = GLib.timeout_add(
1628
gobject.source_remove(self.checker_initiator_tag)
1629
self.checker_initiator_tag = gobject.timeout_add(
2176
1630
value, self.start_checker)
2177
self.start_checker() # Start one now, too
2178
1631
self.start_checker() # Start one now, too
1632
2179
1633
# Checker - property
2180
1634
@dbus_service_property(_interface,
2181
1635
signature="s",
2184
1638
if value is None: # get
2185
1639
return dbus.String(self.checker_command)
2186
1640
self.checker_command = str(value)
2187
1641
2188
1642
# CheckerRunning - property
2189
1643
@dbus_service_property(_interface,
2190
1644
signature="b",
2196
1650
self.start_checker()
2197
1651
else:
2198
1652
self.stop_checker()
2199
1653
2200
1654
# ObjectPath - property
2201
@dbus_annotations(
2202
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2203
"org.freedesktop.DBus.Deprecated": "true"})
2204
1655
@dbus_service_property(_interface, signature="o", access="read")
2205
1656
def ObjectPath_dbus_property(self):
2206
return self.dbus_object_path # is already a dbus.ObjectPath
2207
1657
return self.dbus_object_path # is already a dbus.ObjectPath
1658
2208
1659
# Secret = property
2209
@dbus_annotations(
2210
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2211
"invalidates"})
2212
1660
@dbus_service_property(_interface,
2213
1661
signature="ay",
2214
1662
access="write",
2215
1663
byte_arrays=True)
2216
1664
def Secret_dbus_property(self, value):
2217
1665
self.secret = bytes(value)
2218
1666
2219
1667
del _interface
2220
1668
2221
1669
2222
1670
class ProxyClient(object):
2223
def __init__(self, child_pipe, key_id, fpr, address):
1671
def __init__(self, child_pipe, fpr, address):
2224
1672
self._pipe = child_pipe
2225
self._pipe.send(('init', key_id, fpr, address))
1673
self._pipe.send(('init', fpr, address))
2226
1674
if not self._pipe.recv():
2227
raise KeyError(key_id or fpr)
2228
1675
raise KeyError(fpr)
1676
2229
1677
def __getattribute__(self, name):
2230
1678
if name == '_pipe':
2231
1679
return super(ProxyClient, self).__getattribute__(name)
2234
1682
if data[0] == 'data':
2235
1683
return data[1]
2236
1684
if data[0] == 'function':
2237
1685
2238
1686
def func(*args, **kwargs):
2239
1687
self._pipe.send(('funcall', name, args, kwargs))
2240
1688
return self._pipe.recv()[1]
2241
1689
2242
1690
return func
2243
1691
2244
1692
def __setattr__(self, name, value):
2245
1693
if name == '_pipe':
2246
1694
return super(ProxyClient, self).__setattr__(name, value)
2249
1697
2250
1698
class ClientHandler(socketserver.BaseRequestHandler, object):
2251
1699
"""A class to handle client connections.
2252
1700
2253
1701
Instantiated once for each connection to handle it.
2254
1702
Note: This will run in its own forked process."""
2255
1703
2256
1704
def handle(self):
2257
1705
with contextlib.closing(self.server.child_pipe) as child_pipe:
2258
1706
logger.info("TCP connection from: %s",
2259
1707
str(self.client_address))
2260
1708
logger.debug("Pipe FD: %d",
2261
1709
self.server.child_pipe.fileno())
2262
2263
session = gnutls.ClientSession(self.request)
2264
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
# "+AES-256-CBC", "+SHA1",
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
2268
# "+DHE-DSS"))
1710
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1713
1714
# Note: gnutls.connection.X509Credentials is really a
1715
# generic GnuTLS certificate credentials object so long as
1716
# no X.509 keys are added to it. Therefore, we can use it
1717
# here despite using OpenPGP certificates.
1718
1719
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
# "+AES-256-CBC", "+SHA1",
1721
# "+COMP-NULL", "+CTYPE-OPENPGP",
1722
# "+DHE-DSS"))
2269
1723
# Use a fallback default, since this MUST be set.
2270
1724
priority = self.server.gnutls_priority
2271
1725
if priority is None:
2272
1726
priority = "NORMAL"
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
2275
None)
2276
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1729
2277
1730
# Start communication using the Mandos protocol
2278
1731
# Get protocol number
2279
1732
line = self.request.makefile().readline()
2284
1737
except (ValueError, IndexError, RuntimeError) as error:
2285
1738
logger.error("Unknown protocol version: %s", error)
2286
1739
return
2287
1740
2288
1741
# Start GnuTLS connection
2289
1742
try:
2290
1743
session.handshake()
2291
except gnutls.Error as error:
1744
except gnutls.errors.GNUTLSError as error:
2292
1745
logger.warning("Handshake failed: %s", error)
2293
1746
# Do not run session.bye() here: the session is not
2294
1747
# established. Just abandon the request.
2295
1748
return
2296
1749
logger.debug("Handshake succeeded")
2297
1750
2298
1751
approval_required = False
2299
1752
try:
2300
if gnutls.has_rawpk:
2301
fpr = ""
2302
try:
2303
key_id = self.key_id(
2304
self.peer_certificate(session))
2305
except (TypeError, gnutls.Error) as error:
2306
logger.warning("Bad certificate: %s", error)
2307
return
2308
logger.debug("Key ID: %s", key_id)
2309
2310
else:
2311
key_id = ""
2312
try:
2313
fpr = self.fingerprint(
2314
self.peer_certificate(session))
2315
except (TypeError, gnutls.Error) as error:
2316
logger.warning("Bad certificate: %s", error)
2317
return
2318
logger.debug("Fingerprint: %s", fpr)
2319
2320
try:
2321
client = ProxyClient(child_pipe, key_id, fpr,
1753
try:
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1756
except (TypeError,
1757
gnutls.errors.GNUTLSError) as error:
1758
logger.warning("Bad certificate: %s", error)
1759
return
1760
logger.debug("Fingerprint: %s", fpr)
1761
1762
try:
1763
client = ProxyClient(child_pipe, fpr,
2322
1764
self.client_address)
2323
1765
except KeyError:
2324
1766
return
2325
1767
2326
1768
if client.approval_delay:
2327
1769
delay = client.approval_delay
2328
1770
client.approvals_pending += 1
2329
1771
approval_required = True
2330
1772
2331
1773
while True:
2332
1774
if not client.enabled:
2333
1775
logger.info("Client %s is disabled",
2336
1778
# Emit D-Bus signal
2337
1779
client.Rejected("Disabled")
2338
1780
return
2339
1781
2340
1782
if client.approved or not client.approval_delay:
2341
# We are approved or approval is disabled
1783
#We are approved or approval is disabled
2342
1784
break
2343
1785
elif client.approved is None:
2344
1786
logger.info("Client %s needs approval",
2355
1797
# Emit D-Bus signal
2356
1798
client.Rejected("Denied")
2357
1799
return
2358
2359
# wait until timeout or approved
1800
1801
#wait until timeout or approved
2360
1802
time = datetime.datetime.now()
2361
1803
client.changedstate.acquire()
2362
1804
client.changedstate.wait(delay.total_seconds())
2375
1817
break
2376
1818
else:
2377
1819
delay -= time2 - time
2378
2379
try:
2380
session.send(client.secret)
2381
except gnutls.Error as error:
2382
logger.warning("gnutls send failed",
2383
exc_info=error)
2384
return
2385
1820
1821
sent_size = 0
1822
while sent_size < len(client.secret):
1823
try:
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1827
exc_info=error)
1828
return
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1832
sent_size += sent
1833
2386
1834
logger.info("Sending secret to %s", client.name)
2387
1835
# bump the timeout using extended_timeout
2388
1836
client.bump_timeout(client.extended_timeout)
2389
1837
if self.server.use_dbus:
2390
1838
# Emit D-Bus signal
2391
1839
client.GotSecret()
2392
1840
2393
1841
finally:
2394
1842
if approval_required:
2395
1843
client.approvals_pending -= 1
2396
1844
try:
2397
1845
session.bye()
2398
except gnutls.Error as error:
1846
except gnutls.errors.GNUTLSError as error:
2399
1847
logger.warning("GnuTLS bye failed",
2400
1848
exc_info=error)
2401
1849
2402
1850
@staticmethod
2403
1851
def peer_certificate(session):
2404
"Return the peer's certificate as a bytestring"
2405
try:
2406
cert_type = gnutls.certificate_type_get2(session._c_object,
2407
gnutls.CTYPE_PEERS)
2408
except AttributeError:
2409
cert_type = gnutls.certificate_type_get(session._c_object)
2410
if gnutls.has_rawpk:
2411
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2412
else:
2413
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2414
# If not a valid certificate type...
2415
if cert_type not in valid_cert_types:
2416
logger.info("Cert type %r not in %r", cert_type,
2417
valid_cert_types)
2418
# ...return invalid data
2419
return b""
1852
"Return the peer's OpenPGP certificate as a bytestring"
1853
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2420
1859
list_size = ctypes.c_uint(1)
2421
cert_list = (gnutls.certificate_get_peers
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2422
1862
(session._c_object, ctypes.byref(list_size)))
2423
1863
if not bool(cert_list) and list_size.value != 0:
2424
raise gnutls.Error("error getting peer certificate")
1864
raise gnutls.errors.GNUTLSError("error getting peer"
1865
" certificate")
2425
1866
if list_size.value == 0:
2426
1867
return None
2427
1868
cert = cert_list[0]
2428
1869
return ctypes.string_at(cert.data, cert.size)
2429
2430
@staticmethod
2431
def key_id(certificate):
2432
"Convert a certificate bytestring to a hexdigit key ID"
2433
# New GnuTLS "datum" with the public key
2434
datum = gnutls.datum_t(
2435
ctypes.cast(ctypes.c_char_p(certificate),
2436
ctypes.POINTER(ctypes.c_ubyte)),
2437
ctypes.c_uint(len(certificate)))
2438
# XXX all these need to be created in the gnutls "module"
2439
# New empty GnuTLS certificate
2440
pubkey = gnutls.pubkey_t()
2441
gnutls.pubkey_init(ctypes.byref(pubkey))
2442
# Import the raw public key into the certificate
2443
gnutls.pubkey_import(pubkey,
2444
ctypes.byref(datum),
2445
gnutls.X509_FMT_DER)
2446
# New buffer for the key ID
2447
buf = ctypes.create_string_buffer(32)
2448
buf_len = ctypes.c_size_t(len(buf))
2449
# Get the key ID from the raw public key into the buffer
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2455
# Deinit the certificate
2456
gnutls.pubkey_deinit(pubkey)
2457
2458
# Convert the buffer to a Python bytestring
2459
key_id = ctypes.string_at(buf, buf_len.value)
2460
# Convert the bytestring to hexadecimal notation
2461
hex_key_id = binascii.hexlify(key_id).upper()
2462
return hex_key_id
2463
1870
2464
1871
@staticmethod
2465
1872
def fingerprint(openpgp):
2466
1873
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2467
1874
# New GnuTLS "datum" with the OpenPGP public key
2468
datum = gnutls.datum_t(
1875
datum = gnutls.library.types.gnutls_datum_t(
2469
1876
ctypes.cast(ctypes.c_char_p(openpgp),
2470
1877
ctypes.POINTER(ctypes.c_ubyte)),
2471
1878
ctypes.c_uint(len(openpgp)))
2472
1879
# New empty GnuTLS certificate
2473
crt = gnutls.openpgp_crt_t()
2474
gnutls.openpgp_crt_init(ctypes.byref(crt))
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
2475
1883
# Import the OpenPGP public key into the certificate
2476
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2477
gnutls.OPENPGP_FMT_RAW)
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2478
1887
# Verify the self signature in the key
2479
1888
crtverify = ctypes.c_uint()
2480
gnutls.openpgp_crt_verify_self(crt, 0,
2481
ctypes.byref(crtverify))
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2482
1891
if crtverify.value != 0:
2483
gnutls.openpgp_crt_deinit(crt)
2484
raise gnutls.CertificateSecurityError(code
2485
=crtverify.value)
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
2486
1895
# New buffer for the fingerprint
2487
1896
buf = ctypes.create_string_buffer(20)
2488
1897
buf_len = ctypes.c_size_t()
2489
1898
# Get the fingerprint from the certificate into the buffer
2490
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2491
ctypes.byref(buf_len))
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2492
1901
# Deinit the certificate
2493
gnutls.openpgp_crt_deinit(crt)
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2494
1903
# Convert the buffer to a Python bytestring
2495
1904
fpr = ctypes.string_at(buf, buf_len.value)
2496
1905
# Convert the bytestring to hexadecimal notation
2500
1909
2501
1910
class MultiprocessingMixIn(object):
2502
1911
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2503
1912
2504
1913
def sub_process_main(self, request, address):
2505
1914
try:
2506
1915
self.finish_request(request, address)
2507
1916
except Exception:
2508
1917
self.handle_error(request, address)
2509
1918
self.close_request(request)
2510
1919
2511
1920
def process_request(self, request, address):
2512
1921
"""Start a new process to process the request."""
2513
proc = multiprocessing.Process(target=self.sub_process_main,
2514
args=(request, address))
1922
proc = multiprocessing.Process(target = self.sub_process_main,
1923
args = (request, address))
2515
1924
proc.start()
2516
1925
return proc
2517
1926
2518
1927
2519
1928
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2520
1929
""" adds a pipe to the MixIn """
2521
1930
2522
1931
def process_request(self, request, client_address):
2523
1932
"""Overrides and wraps the original process_request().
2524
1933
2525
1934
This function creates a new pipe in self.pipe
2526
1935
"""
2527
1936
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2528
1937
2529
1938
proc = MultiprocessingMixIn.process_request(self, request,
2530
1939
client_address)
2531
1940
self.child_pipe.close()
2532
1941
self.add_pipe(parent_pipe, proc)
2533
1942
2534
1943
def add_pipe(self, parent_pipe, proc):
2535
1944
"""Dummy function; override as necessary"""
2536
1945
raise NotImplementedError()
2539
1948
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2540
1949
socketserver.TCPServer, object):
2541
1950
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2542
1951
2543
1952
Attributes:
2544
1953
enabled: Boolean; whether this server is activated yet
2545
1954
interface: None or a network interface name (string)
2546
1955
use_ipv6: Boolean; to use IPv6 or not
2547
1956
"""
2548
1957
2549
1958
def __init__(self, server_address, RequestHandlerClass,
2550
1959
interface=None,
2551
1960
use_ipv6=True,
2561
1970
self.socketfd = socketfd
2562
1971
# Save the original socket.socket() function
2563
1972
self.socket_socket = socket.socket
2564
2565
1973
# To implement --socket, we monkey patch socket.socket.
2566
#
1974
#
2567
1975
# (When socketserver.TCPServer is a new-style class, we
2568
1976
# could make self.socket into a property instead of monkey
2569
1977
# patching socket.socket.)
2570
#
1978
#
2571
1979
# Create a one-time-only replacement for socket.socket()
2572
1980
@functools.wraps(socket.socket)
2573
1981
def socket_wrapper(*args, **kwargs):
2585
1993
# socket_wrapper(), if socketfd was set.
2586
1994
socketserver.TCPServer.__init__(self, server_address,
2587
1995
RequestHandlerClass)
2588
1996
2589
1997
def server_bind(self):
2590
1998
"""This overrides the normal server_bind() function
2591
1999
to bind to an interface if one was specified, and also NOT to
2592
2000
bind to an address or port if they were not specified."""
2593
global SO_BINDTODEVICE
2594
2001
if self.interface is not None:
2595
2002
if SO_BINDTODEVICE is None:
2596
# Fall back to a hard-coded value which seems to be
2597
# common enough.
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
SO_BINDTODEVICE = 25
2600
try:
2601
self.socket.setsockopt(
2602
socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
(self.interface + "\0").encode("utf-8"))
2604
except socket.error as error:
2605
if error.errno == errno.EPERM:
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2608
elif error.errno == errno.ENOPROTOOPT:
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2611
self.interface)
2612
elif error.errno == errno.ENODEV:
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
2615
else:
2616
raise
2003
logger.error("SO_BINDTODEVICE does not exist;"
2004
" cannot bind to interface %s",
2005
self.interface)
2006
else:
2007
try:
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
2011
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
2016
logger.error("SO_BINDTODEVICE not available;"
2017
" cannot bind to interface %s",
2018
self.interface)
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2022
else:
2023
raise
2617
2024
# Only bind(2) the socket if we really need to.
2618
2025
if self.server_address[0] or self.server_address[1]:
2619
2026
if not self.server_address[0]:
2620
2027
if self.address_family == socket.AF_INET6:
2621
any_address = "::" # in6addr_any
2028
any_address = "::" # in6addr_any
2622
2029
else:
2623
any_address = "0.0.0.0" # INADDR_ANY
2030
any_address = "0.0.0.0" # INADDR_ANY
2624
2031
self.server_address = (any_address,
2625
2032
self.server_address[1])
2626
2033
elif not self.server_address[1]:
2636
2043
2637
2044
class MandosServer(IPv6_TCPServer):
2638
2045
"""Mandos server.
2639
2046
2640
2047
Attributes:
2641
2048
clients: set of Client objects
2642
2049
gnutls_priority GnuTLS priority string
2643
2050
use_dbus: Boolean; to emit D-Bus signals or not
2644
2645
Assumes a GLib.MainLoop event loop.
2051
2052
Assumes a gobject.MainLoop event loop.
2646
2053
"""
2647
2054
2648
2055
def __init__(self, server_address, RequestHandlerClass,
2649
2056
interface=None,
2650
2057
use_ipv6=True,
2660
2067
self.gnutls_priority = gnutls_priority
2661
2068
IPv6_TCPServer.__init__(self, server_address,
2662
2069
RequestHandlerClass,
2663
interface=interface,
2664
use_ipv6=use_ipv6,
2665
socketfd=socketfd)
2666
2070
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2073
2667
2074
def server_activate(self):
2668
2075
if self.enabled:
2669
2076
return socketserver.TCPServer.server_activate(self)
2670
2077
2671
2078
def enable(self):
2672
2079
self.enabled = True
2673
2080
2674
2081
def add_pipe(self, parent_pipe, proc):
2675
2082
# Call "handle_ipc" for both data and EOF events
2676
GLib.io_add_watch(
2083
gobject.io_add_watch(
2677
2084
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2085
gobject.IO_IN | gobject.IO_HUP,
2679
2086
functools.partial(self.handle_ipc,
2680
parent_pipe=parent_pipe,
2681
proc=proc))
2682
2087
parent_pipe = parent_pipe,
2088
proc = proc))
2089
2683
2090
def handle_ipc(self, source, condition,
2684
2091
parent_pipe=None,
2685
proc=None,
2092
proc = None,
2686
2093
client_object=None):
2687
2094
# error, or the other end of multiprocessing.Pipe has closed
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2689
2096
# Wait for other process to exit
2690
2097
proc.join()
2691
2098
return False
2692
2099
2693
2100
# Read a request from the child
2694
2101
request = parent_pipe.recv()
2695
2102
command = request[0]
2696
2103
2697
2104
if command == 'init':
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2701
2702
for c in self.clients.values():
2703
if key_id and c.key_id == key_id:
2704
client = c
2705
break
2706
if fpr and c.fingerprint == fpr:
2105
fpr = request[1]
2106
address = request[2]
2107
2108
for c in self.clients.itervalues():
2109
if c.fingerprint == fpr:
2707
2110
client = c
2708
2111
break
2709
2112
else:
2710
logger.info("Client not found for key ID: %s, address"
2711
": %s", key_id or fpr, address)
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
2712
2115
if self.use_dbus:
2713
2116
# Emit D-Bus signal
2714
mandos_dbus_service.ClientNotFound(key_id or fpr,
2117
mandos_dbus_service.ClientNotFound(fpr,
2715
2118
address[0])
2716
2119
parent_pipe.send(False)
2717
2120
return False
2718
2719
GLib.io_add_watch(
2121
2122
gobject.io_add_watch(
2720
2123
parent_pipe.fileno(),
2721
GLib.IO_IN | GLib.IO_HUP,
2124
gobject.IO_IN | gobject.IO_HUP,
2722
2125
functools.partial(self.handle_ipc,
2723
parent_pipe=parent_pipe,
2724
proc=proc,
2725
client_object=client))
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
2726
2129
parent_pipe.send(True)
2727
2130
# remove the old hook in favor of the new above hook on
2728
2131
# same fileno
2731
2134
funcname = request[1]
2732
2135
args = request[2]
2733
2136
kwargs = request[3]
2734
2137
2735
2138
parent_pipe.send(('data', getattr(client_object,
2736
2139
funcname)(*args,
2737
2140
**kwargs)))
2738
2141
2739
2142
if command == 'getattr':
2740
2143
attrname = request[1]
2741
2144
if isinstance(client_object.__getattribute__(attrname),
2744
2147
else:
2745
2148
parent_pipe.send((
2746
2149
'data', client_object.__getattribute__(attrname)))
2747
2150
2748
2151
if command == 'setattr':
2749
2152
attrname = request[1]
2750
2153
value = request[2]
2751
2154
setattr(client_object, attrname, value)
2752
2155
2753
2156
return True
2754
2157
2755
2158
2756
2159
def rfc3339_duration_to_delta(duration):
2757
2160
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2758
2161
2759
2162
>>> rfc3339_duration_to_delta("P7D")
2760
2163
datetime.timedelta(7)
2761
2164
>>> rfc3339_duration_to_delta("PT60S")
2771
2174
>>> rfc3339_duration_to_delta("P1DT3M20S")
2772
2175
datetime.timedelta(1, 200)
2773
2176
"""
2774
2177
2775
2178
# Parsing an RFC 3339 duration with regular expressions is not
2776
2179
# possible - there would have to be multiple places for the same
2777
2180
# values, like seconds. The current code, while more esoteric, is
2778
2181
# cleaner without depending on a parsing library. If Python had a
2779
2182
# built-in library for parsing we would use it, but we'd like to
2780
2183
# avoid excessive use of external libraries.
2781
2184
2782
2185
# New type for defining tokens, syntax, and semantics all-in-one
2783
2186
Token = collections.namedtuple("Token", (
2784
2187
"regexp", # To match token; if "value" is not None, must have
2817
2220
frozenset((token_year, token_month,
2818
2221
token_day, token_time,
2819
2222
token_week)))
2820
# Define starting values:
2821
# Value so far
2822
value = datetime.timedelta()
2223
# Define starting values
2224
value = datetime.timedelta() # Value so far
2823
2225
found_token = None
2824
# Following valid tokens
2825
followers = frozenset((token_duration, ))
2826
# String left to parse
2827
s = duration
2226
followers = frozenset((token_duration, )) # Following valid tokens
2227
s = duration # String left to parse
2828
2228
# Loop until end token is found
2829
2229
while found_token is not token_end:
2830
2230
# Search for any currently valid tokens
2854
2254
2855
2255
def string_to_delta(interval):
2856
2256
"""Parse a string and return a datetime.timedelta
2857
2257
2858
2258
>>> string_to_delta('7d')
2859
2259
datetime.timedelta(7)
2860
2260
>>> string_to_delta('60s')
2868
2268
>>> string_to_delta('5m 30s')
2869
2269
datetime.timedelta(0, 330)
2870
2270
"""
2871
2271
2872
2272
try:
2873
2273
return rfc3339_duration_to_delta(interval)
2874
2274
except ValueError:
2875
2275
pass
2876
2276
2877
2277
timevalue = datetime.timedelta(0)
2878
2278
for s in interval.split():
2879
2279
try:
2897
2297
return timevalue
2898
2298
2899
2299
2900
def daemon(nochdir=False, noclose=False):
2300
def daemon(nochdir = False, noclose = False):
2901
2301
"""See daemon(3). Standard BSD Unix function.
2902
2302
2903
2303
This should really exist as os.daemon, but it doesn't (yet)."""
2904
2304
if os.fork():
2905
2305
sys.exit()
2923
2323
2924
2324
2925
2325
def main():
2926
2326
2927
2327
##################################################################
2928
2328
# Parsing of options, both command line and config file
2929
2329
2930
2330
parser = argparse.ArgumentParser()
2931
2331
parser.add_argument("-v", "--version", action="version",
2932
version="%(prog)s {}".format(version),
2332
version = "%(prog)s {}".format(version),
2933
2333
help="show version number and exit")
2934
2334
parser.add_argument("-i", "--interface", metavar="IF",
2935
2335
help="Bind to interface IF")
2971
2371
parser.add_argument("--no-zeroconf", action="store_false",
2972
2372
dest="zeroconf", help="Do not use Zeroconf",
2973
2373
default=None)
2974
2374
2975
2375
options = parser.parse_args()
2976
2376
2977
2377
if options.check:
2978
2378
import doctest
2979
2379
fail_count, test_count = doctest.testmod()
2980
2380
sys.exit(os.EX_OK if fail_count == 0 else 1)
2981
2381
2982
2382
# Default values for config file for server-global settings
2983
if gnutls.has_rawpk:
2984
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2985
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2986
else:
2987
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2988
":+SIGN-DSA-SHA256")
2989
server_defaults = {"interface": "",
2990
"address": "",
2991
"port": "",
2992
"debug": "False",
2993
"priority": priority,
2994
"servicename": "Mandos",
2995
"use_dbus": "True",
2996
"use_ipv6": "True",
2997
"debuglevel": "",
2998
"restore": "True",
2999
"socket": "",
3000
"statedir": "/var/lib/mandos",
3001
"foreground": "False",
3002
"zeroconf": "True",
3003
}
3004
del priority
3005
2383
server_defaults = { "interface": "",
2384
"address": "",
2385
"port": "",
2386
"debug": "False",
2387
"priority":
2388
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2389
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2390
"servicename": "Mandos",
2391
"use_dbus": "True",
2392
"use_ipv6": "True",
2393
"debuglevel": "",
2394
"restore": "True",
2395
"socket": "",
2396
"statedir": "/var/lib/mandos",
2397
"foreground": "False",
2398
"zeroconf": "True",
2399
}
2400
3006
2401
# Parse config file for server-global settings
3007
2402
server_config = configparser.SafeConfigParser(server_defaults)
3008
2403
del server_defaults
3010
2405
# Convert the SafeConfigParser object to a dict
3011
2406
server_settings = server_config.defaults()
3012
2407
# Use the appropriate methods on the non-string config options
3013
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3014
"foreground", "zeroconf"):
2408
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3015
2409
server_settings[option] = server_config.getboolean("DEFAULT",
3016
2410
option)
3017
2411
if server_settings["port"]:
3027
2421
server_settings["socket"] = os.dup(server_settings
3028
2422
["socket"])
3029
2423
del server_config
3030
2424
3031
2425
# Override the settings from the config file with command line
3032
2426
# options, if set.
3033
2427
for option in ("interface", "address", "port", "debug",
3051
2445
if server_settings["debug"]:
3052
2446
server_settings["foreground"] = True
3053
2447
# Now we have our good server settings in "server_settings"
3054
2448
3055
2449
##################################################################
3056
2450
3057
2451
if (not server_settings["zeroconf"]
3058
2452
and not (server_settings["port"]
3059
2453
or server_settings["socket"] != "")):
3060
2454
parser.error("Needs port or socket to work without Zeroconf")
3061
2455
3062
2456
# For convenience
3063
2457
debug = server_settings["debug"]
3064
2458
debuglevel = server_settings["debuglevel"]
3068
2462
stored_state_file)
3069
2463
foreground = server_settings["foreground"]
3070
2464
zeroconf = server_settings["zeroconf"]
3071
2465
3072
2466
if debug:
3073
2467
initlogger(debug, logging.DEBUG)
3074
2468
else:
3077
2471
else:
3078
2472
level = getattr(logging, debuglevel.upper())
3079
2473
initlogger(debug, level)
3080
2474
3081
2475
if server_settings["servicename"] != "Mandos":
3082
2476
syslogger.setFormatter(
3083
2477
logging.Formatter('Mandos ({}) [%(process)d]:'
3084
2478
' %(levelname)s: %(message)s'.format(
3085
2479
server_settings["servicename"])))
3086
2480
3087
2481
# Parse config file with clients
3088
2482
client_config = configparser.SafeConfigParser(Client
3089
2483
.client_defaults)
3090
2484
client_config.read(os.path.join(server_settings["configdir"],
3091
2485
"clients.conf"))
3092
2486
3093
2487
global mandos_dbus_service
3094
2488
mandos_dbus_service = None
3095
2489
3096
2490
socketfd = None
3097
2491
if server_settings["socket"] != "":
3098
2492
socketfd = server_settings["socket"]
3114
2508
except IOError as e:
3115
2509
logger.error("Could not open file %r", pidfilename,
3116
2510
exc_info=e)
3117
3118
for name, group in (("_mandos", "_mandos"),
3119
("mandos", "mandos"),
3120
("nobody", "nogroup")):
2511
2512
for name in ("_mandos", "mandos", "nobody"):
3121
2513
try:
3122
2514
uid = pwd.getpwnam(name).pw_uid
3123
gid = pwd.getpwnam(group).pw_gid
2515
gid = pwd.getpwnam(name).pw_gid
3124
2516
break
3125
2517
except KeyError:
3126
2518
continue
3130
2522
try:
3131
2523
os.setgid(gid)
3132
2524
os.setuid(uid)
3133
if debug:
3134
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3135
gid))
3136
2525
except OSError as error:
3137
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3138
.format(uid, gid, os.strerror(error.errno)))
3139
2526
if error.errno != errno.EPERM:
3140
2527
raise
3141
2528
3142
2529
if debug:
3143
2530
# Enable all possible GnuTLS debugging
3144
2531
3145
2532
# "Use a log level over 10 to enable all debugging options."
3146
2533
# - GnuTLS manual
3147
gnutls.global_set_log_level(11)
3148
3149
@gnutls.log_func
2534
gnutls.library.functions.gnutls_global_set_log_level(11)
2535
2536
@gnutls.library.types.gnutls_log_func
3150
2537
def debug_gnutls(level, string):
3151
2538
logger.debug("GnuTLS: %s", string[:-1])
3152
3153
gnutls.global_set_log_function(debug_gnutls)
3154
2539
2540
gnutls.library.functions.gnutls_global_set_log_function(
2541
debug_gnutls)
2542
3155
2543
# Redirect stdin so all checkers get /dev/null
3156
2544
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3157
2545
os.dup2(null, sys.stdin.fileno())
3158
2546
if null > 2:
3159
2547
os.close(null)
3160
2548
3161
2549
# Need to fork before connecting to D-Bus
3162
2550
if not foreground:
3163
2551
# Close all input and output, do double fork, etc.
3164
2552
daemon()
3165
3166
# multiprocessing will use threads, so before we use GLib we need
3167
# to inform GLib that threads will be used.
3168
GLib.threads_init()
3169
2553
2554
# multiprocessing will use threads, so before we use gobject we
2555
# need to inform gobject that threads will be used.
2556
gobject.threads_init()
2557
3170
2558
global main_loop
3171
2559
# From the Avahi example code
3172
2560
DBusGMainLoop(set_as_default=True)
3173
main_loop = GLib.MainLoop()
2561
main_loop = gobject.MainLoop()
3174
2562
bus = dbus.SystemBus()
3175
2563
# End of Avahi example code
3176
2564
if use_dbus:
3189
2577
if zeroconf:
3190
2578
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3191
2579
service = AvahiServiceToSyslog(
3192
name=server_settings["servicename"],
3193
servicetype="_mandos._tcp",
3194
protocol=protocol,
3195
bus=bus)
2580
name = server_settings["servicename"],
2581
servicetype = "_mandos._tcp",
2582
protocol = protocol,
2583
bus = bus)
3196
2584
if server_settings["interface"]:
3197
2585
service.interface = if_nametoindex(
3198
2586
server_settings["interface"].encode("utf-8"))
3199
2587
3200
2588
global multiprocessing_manager
3201
2589
multiprocessing_manager = multiprocessing.Manager()
3202
2590
3203
2591
client_class = Client
3204
2592
if use_dbus:
3205
client_class = functools.partial(ClientDBus, bus=bus)
3206
2593
client_class = functools.partial(ClientDBus, bus = bus)
2594
3207
2595
client_settings = Client.config_parser(client_config)
3208
2596
old_client_settings = {}
3209
2597
clients_data = {}
3210
2598
3211
2599
# This is used to redirect stdout and stderr for checker processes
3212
2600
global wnull
3213
wnull = open(os.devnull, "w") # A writable /dev/null
2601
wnull = open(os.devnull, "w") # A writable /dev/null
3214
2602
# Only used if server is running in foreground but not in debug
3215
2603
# mode
3216
2604
if debug or not foreground:
3217
2605
wnull.close()
3218
2606
3219
2607
# Get client data and settings from last running state.
3220
2608
if server_settings["restore"]:
3221
2609
try:
3222
2610
with open(stored_state_path, "rb") as stored_state:
3223
if sys.version_info.major == 2:
3224
clients_data, old_client_settings = pickle.load(
3225
stored_state)
3226
else:
3227
bytes_clients_data, bytes_old_client_settings = (
3228
pickle.load(stored_state, encoding="bytes"))
3229
# Fix bytes to strings
3230
# clients_data
3231
# .keys()
3232
clients_data = {(key.decode("utf-8")
3233
if isinstance(key, bytes)
3234
else key): value
3235
for key, value in
3236
bytes_clients_data.items()}
3237
del bytes_clients_data
3238
for key in clients_data:
3239
value = {(k.decode("utf-8")
3240
if isinstance(k, bytes) else k): v
3241
for k, v in
3242
clients_data[key].items()}
3243
clients_data[key] = value
3244
# .client_structure
3245
value["client_structure"] = [
3246
(s.decode("utf-8")
3247
if isinstance(s, bytes)
3248
else s) for s in
3249
value["client_structure"]]
3250
# .name & .host
3251
for k in ("name", "host"):
3252
if isinstance(value[k], bytes):
3253
value[k] = value[k].decode("utf-8")
3254
if not value.has_key("key_id"):
3255
value["key_id"] = ""
3256
elif not value.has_key("fingerprint"):
3257
value["fingerprint"] = ""
3258
# old_client_settings
3259
# .keys()
3260
old_client_settings = {
3261
(key.decode("utf-8")
3262
if isinstance(key, bytes)
3263
else key): value
3264
for key, value in
3265
bytes_old_client_settings.items()}
3266
del bytes_old_client_settings
3267
# .host
3268
for value in old_client_settings.values():
3269
if isinstance(value["host"], bytes):
3270
value["host"] = (value["host"]
3271
.decode("utf-8"))
2611
clients_data, old_client_settings = pickle.load(
2612
stored_state)
3272
2613
os.remove(stored_state_path)
3273
2614
except IOError as e:
3274
2615
if e.errno == errno.ENOENT:
3282
2623
logger.warning("Could not load persistent state: "
3283
2624
"EOFError:",
3284
2625
exc_info=e)
3285
2626
3286
2627
with PGPEngine() as pgp:
3287
2628
for client_name, client in clients_data.items():
3288
2629
# Skip removed clients
3289
2630
if client_name not in client_settings:
3290
2631
continue
3291
2632
3292
2633
# Decide which value to use after restoring saved state.
3293
2634
# We have three different values: Old config file,
3294
2635
# new config file, and saved state.
3305
2646
client[name] = value
3306
2647
except KeyError:
3307
2648
pass
3308
2649
3309
2650
# Clients who has passed its expire date can still be
3310
2651
# enabled if its last checker was successful. A Client
3311
2652
# whose checker succeeded before we stored its state is
3344
2685
client_name))
3345
2686
client["secret"] = (client_settings[client_name]
3346
2687
["secret"])
3347
2688
3348
2689
# Add/remove clients based on new changes made to config
3349
2690
for client_name in (set(old_client_settings)
3350
2691
- set(client_settings)):
3352
2693
for client_name in (set(client_settings)
3353
2694
- set(old_client_settings)):
3354
2695
clients_data[client_name] = client_settings[client_name]
3355
2696
3356
2697
# Create all client objects
3357
2698
for client_name, client in clients_data.items():
3358
2699
tcp_server.clients[client_name] = client_class(
3359
name=client_name,
3360
settings=client,
3361
server_settings=server_settings)
3362
2700
name = client_name,
2701
settings = client,
2702
server_settings = server_settings)
2703
3363
2704
if not tcp_server.clients:
3364
2705
logger.warning("No clients defined")
3365
2706
3366
2707
if not foreground:
3367
2708
if pidfile is not None:
3368
2709
pid = os.getpid()
3374
2715
pidfilename, pid)
3375
2716
del pidfile
3376
2717
del pidfilename
3377
3378
for termsig in (signal.SIGHUP, signal.SIGTERM):
3379
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3380
lambda: main_loop.quit() and False)
3381
2718
2719
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2720
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2721
3382
2722
if use_dbus:
3383
2723
3384
2724
@alternate_dbus_interfaces(
3385
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3386
class MandosDBusService(DBusObjectWithObjectManager):
2725
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2726
class MandosDBusService(DBusObjectWithProperties):
3387
2727
"""A D-Bus proxy object"""
3388
2728
3389
2729
def __init__(self):
3390
2730
dbus.service.Object.__init__(self, bus, "/")
3391
2731
3392
2732
_interface = "se.recompile.Mandos"
3393
2733
2734
@dbus_interface_annotations(_interface)
2735
def _foo(self):
2736
return {
2737
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2738
"false" }
2739
3394
2740
@dbus.service.signal(_interface, signature="o")
3395
2741
def ClientAdded(self, objpath):
3396
2742
"D-Bus signal"
3397
2743
pass
3398
2744
3399
2745
@dbus.service.signal(_interface, signature="ss")
3400
def ClientNotFound(self, key_id, address):
2746
def ClientNotFound(self, fingerprint, address):
3401
2747
"D-Bus signal"
3402
2748
pass
3403
3404
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3405
"true"})
2749
3406
2750
@dbus.service.signal(_interface, signature="os")
3407
2751
def ClientRemoved(self, objpath, name):
3408
2752
"D-Bus signal"
3409
2753
pass
3410
3411
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3412
"true"})
2754
3413
2755
@dbus.service.method(_interface, out_signature="ao")
3414
2756
def GetAllClients(self):
3415
2757
"D-Bus method"
3416
2758
return dbus.Array(c.dbus_object_path for c in
3417
tcp_server.clients.values())
3418
3419
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3420
"true"})
2759
tcp_server.clients.itervalues())
2760
3421
2761
@dbus.service.method(_interface,
3422
2762
out_signature="a{oa{sv}}")
3423
2763
def GetAllClientsWithProperties(self):
3424
2764
"D-Bus method"
3425
2765
return dbus.Dictionary(
3426
{c.dbus_object_path: c.GetAll(
3427
"se.recompile.Mandos.Client")
3428
for c in tcp_server.clients.values()},
2766
{ c.dbus_object_path: c.GetAll("")
2767
for c in tcp_server.clients.itervalues() },
3429
2768
signature="oa{sv}")
3430
2769
3431
2770
@dbus.service.method(_interface, in_signature="o")
3432
2771
def RemoveClient(self, object_path):
3433
2772
"D-Bus method"
3434
for c in tcp_server.clients.values():
2773
for c in tcp_server.clients.itervalues():
3435
2774
if c.dbus_object_path == object_path:
3436
2775
del tcp_server.clients[c.name]
3437
2776
c.remove_from_connection()
3438
# Don't signal the disabling
2777
# Don't signal anything except ClientRemoved
3439
2778
c.disable(quiet=True)
3440
# Emit D-Bus signal for removal
3441
self.client_removed_signal(c)
2779
# Emit D-Bus signal
2780
self.ClientRemoved(object_path, c.name)
3442
2781
return
3443
2782
raise KeyError(object_path)
3444
2783
3445
2784
del _interface
3446
3447
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3448
out_signature="a{oa{sa{sv}}}")
3449
def GetManagedObjects(self):
3450
"""D-Bus method"""
3451
return dbus.Dictionary(
3452
{client.dbus_object_path:
3453
dbus.Dictionary(
3454
{interface: client.GetAll(interface)
3455
for interface in
3456
client._get_all_interface_names()})
3457
for client in tcp_server.clients.values()})
3458
3459
def client_added_signal(self, client):
3460
"""Send the new standard signal and the old signal"""
3461
if use_dbus:
3462
# New standard signal
3463
self.InterfacesAdded(
3464
client.dbus_object_path,
3465
dbus.Dictionary(
3466
{interface: client.GetAll(interface)
3467
for interface in
3468
client._get_all_interface_names()}))
3469
# Old signal
3470
self.ClientAdded(client.dbus_object_path)
3471
3472
def client_removed_signal(self, client):
3473
"""Send the new standard signal and the old signal"""
3474
if use_dbus:
3475
# New standard signal
3476
self.InterfacesRemoved(
3477
client.dbus_object_path,
3478
client._get_all_interface_names())
3479
# Old signal
3480
self.ClientRemoved(client.dbus_object_path,
3481
client.name)
3482
2785
3483
2786
mandos_dbus_service = MandosDBusService()
3484
3485
# Save modules to variables to exempt the modules from being
3486
# unloaded before the function registered with atexit() is run.
3487
mp = multiprocessing
3488
wn = wnull
3489
2787
3490
2788
def cleanup():
3491
2789
"Cleanup function; run on exit"
3492
2790
if zeroconf:
3493
2791
service.cleanup()
3494
3495
mp.active_children()
3496
wn.close()
2792
2793
multiprocessing.active_children()
2794
wnull.close()
3497
2795
if not (tcp_server.clients or client_settings):
3498
2796
return
3499
2797
3500
2798
# Store client before exiting. Secrets are encrypted with key
3501
2799
# based on what config file has. If config file is
3502
2800
# removed/edited, old secret will thus be unrecovable.
3503
2801
clients = {}
3504
2802
with PGPEngine() as pgp:
3505
for client in tcp_server.clients.values():
2803
for client in tcp_server.clients.itervalues():
3506
2804
key = client_settings[client.name]["secret"]
3507
2805
client.encrypted_secret = pgp.encrypt(client.secret,
3508
2806
key)
3509
2807
client_dict = {}
3510
2808
3511
2809
# A list of attributes that can not be pickled
3512
2810
# + secret.
3513
exclude = {"bus", "changedstate", "secret",
3514
"checker", "server_settings"}
2811
exclude = { "bus", "changedstate", "secret",
2812
"checker", "server_settings" }
3515
2813
for name, typ in inspect.getmembers(dbus.service
3516
2814
.Object):
3517
2815
exclude.add(name)
3518
2816
3519
2817
client_dict["encrypted_secret"] = (client
3520
2818
.encrypted_secret)
3521
2819
for attr in client.client_structure:
3522
2820
if attr not in exclude:
3523
2821
client_dict[attr] = getattr(client, attr)
3524
2822
3525
2823
clients[client.name] = client_dict
3526
2824
del client_settings[client.name]["secret"]
3527
2825
3528
2826
try:
3529
2827
with tempfile.NamedTemporaryFile(
3530
2828
mode='wb',
3532
2830
prefix='clients-',
3533
2831
dir=os.path.dirname(stored_state_path),
3534
2832
delete=False) as stored_state:
3535
pickle.dump((clients, client_settings), stored_state,
3536
protocol=2)
2833
pickle.dump((clients, client_settings), stored_state)
3537
2834
tempname = stored_state.name
3538
2835
os.rename(tempname, stored_state_path)
3539
2836
except (IOError, OSError) as e:
3549
2846
logger.warning("Could not save persistent state:",
3550
2847
exc_info=e)
3551
2848
raise
3552
2849
3553
2850
# Delete all clients, and settings from config
3554
2851
while tcp_server.clients:
3555
2852
name, client = tcp_server.clients.popitem()
3556
2853
if use_dbus:
3557
2854
client.remove_from_connection()
3558
# Don't signal the disabling
2855
# Don't signal anything except ClientRemoved
3559
2856
client.disable(quiet=True)
3560
# Emit D-Bus signal for removal
3561
2857
if use_dbus:
3562
mandos_dbus_service.client_removed_signal(client)
2858
# Emit D-Bus signal
2859
mandos_dbus_service.ClientRemoved(
2860
client.dbus_object_path, client.name)
3563
2861
client_settings.clear()
3564
2862
3565
2863
atexit.register(cleanup)
3566
3567
for client in tcp_server.clients.values():
2864
2865
for client in tcp_server.clients.itervalues():
3568
2866
if use_dbus:
3569
# Emit D-Bus signal for adding
3570
mandos_dbus_service.client_added_signal(client)
2867
# Emit D-Bus signal
2868
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3571
2869
# Need to initiate checking of clients
3572
2870
if client.enabled:
3573
2871
client.init_checker()
3574
2872
3575
2873
tcp_server.enable()
3576
2874
tcp_server.server_activate()
3577
2875
3578
2876
# Find out what port we got
3579
2877
if zeroconf:
3580
2878
service.port = tcp_server.socket.getsockname()[1]
3585
2883
else: # IPv4
3586
2884
logger.info("Now listening on address %r, port %d",
3587
2885
*tcp_server.socket.getsockname())
3588
3589
# service.interface = tcp_server.socket.getsockname()[3]
3590
2886
2887
#service.interface = tcp_server.socket.getsockname()[3]
2888
3591
2889
try:
3592
2890
if zeroconf:
3593
2891
# From the Avahi example code
3598
2896
cleanup()
3599
2897
sys.exit(1)
3600
2898
# End of Avahi example code
3601
3602
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3603
lambda *args, **kwargs:
3604
(tcp_server.handle_request
3605
(*args[2:], **kwargs) or True))
3606
2899
2900
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2901
lambda *args, **kwargs:
2902
(tcp_server.handle_request
2903
(*args[2:], **kwargs) or True))
2904
3607
2905
logger.debug("Starting main loop")
3608
2906
main_loop.run()
3609
2907
except AvahiError as error:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0