/mandos/release

#!/usr/bin/python3 -bI

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

#

#

#

# Copyright © 2008-2020 Teddy Hogeborn

# Copyright © 2008-2020 Björn Påhlsson

#

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

#

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

#

#

try:

    from future_builtins import *

except ImportError:

    pass

try:

    import SocketServer as socketserver

except ImportError:

    import socketserver

try:

    import ConfigParser as configparser

except ImportError:

    import configparser

try:

    import cPickle as pickle

except ImportError:

    import pickle

import codecs

import unittest

import random

import shlex

import gi

from gi.repository import GLib

if sys.version_info.major == 2:

    __metaclass__ = type

    str = unicode

 

# Add collections.abc.Callable if it does not exist

try:

    collections.abc.Callable

except AttributeError:

    class abc:

        Callable = collections.Callable

    collections.abc = abc

    del abc

 

# Add shlex.quote if it does not exist

try:

    shlex.quote

except AttributeError:

    shlex.quote = re.escape

 

# Show warnings by default

if not sys.warnoptions:

    import warnings

    warnings.simplefilter("default")

 

# Try to find the value of SO_BINDTODEVICE:

try:

    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

    # newer, and it is also the most natural place for it:

        # This is where SO_BINDTODEVICE was up to and including Python

        # 2.6, and also 3.2:

        # In Python 2.7 it seems to have been removed entirely.

        # Try running the C preprocessor:

        try:

            cc = subprocess.Popen(["cc", "--language=c", "-E",

                                   "/dev/stdin"],

                                  stdin=subprocess.PIPE,

                                  stdout=subprocess.PIPE)

            stdout = cc.communicate(

                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

            SO_BINDTODEVICE = int(stdout.splitlines()[-1])

        except (OSError, ValueError, IndexError):

            # No value found

            SO_BINDTODEVICE = None

 

if sys.version_info < (3, 2):

    configparser.Configparser = configparser.SafeConfigParser

 

version = "1.8.12"

logging.captureWarnings(True)   # Show warnings via the logging system

    if_nametoindex = ctypes.cdll.LoadLibrary(

        ctypes.util.find_library("c")).if_nametoindex

 

def copy_function(func):

    """Make a copy of a function"""

    if sys.version_info.major == 2:

        return types.FunctionType(func.func_code,

                                  func.func_globals,

                                  func.func_name,

                                  func.func_defaults,

                                  func.func_closure)

    else:

        return types.FunctionType(func.__code__,

                                  func.__globals__,

                                  func.__name__,

                                  func.__defaults__,

                                  func.__closure__)

 

 

 

    syslogger = (logging.handlers.SysLogHandler(

        facility=logging.handlers.SysLogHandler.LOG_DAEMON,

        address="/dev/log"))

 

class PGPEngine:

 

        self.gpg = "gpg"

        try:

            output = subprocess.check_output(["gpgconf"])

            for line in output.splitlines():

                name, text, path = line.split(b":")

                if name == b"gpg":

                    self.gpg = path

                    break

        except OSError as e:

            if e.errno != errno.ENOENT:

                raise

                          '--homedir', self.tempdir,

                          '--quiet']

        # Only GPG version 1 has the --no-use-agent option.

        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

            self.gnupgargs.append("--no-use-agent")

 

 

 

 

                                             topdown=False):

 

 

        with tempfile.NamedTemporaryFile(

                dir=self.tempdir) as passfile:

            proc = subprocess.Popen([self.gpg, '--symmetric',

                                    stdin=subprocess.PIPE,

                                    stdout=subprocess.PIPE,

                                    stderr=subprocess.PIPE)

            ciphertext, err = proc.communicate(input=data)

 

        with tempfile.NamedTemporaryFile(

                dir=self.tempdir) as passfile:

            proc = subprocess.Popen([self.gpg, '--decrypt',

                                    stdin=subprocess.PIPE,

                                    stdout=subprocess.PIPE,

                                    stderr=subprocess.PIPE)

            decrypted_plaintext, err = proc.communicate(input=data)

# Pretend that we have an Avahi module

class avahi:

    """This isn't so much a class as it is a module-like namespace."""

    IF_UNSPEC = -1               # avahi-common/address.h

    PROTO_UNSPEC = -1            # avahi-common/address.h

    PROTO_INET = 0               # avahi-common/address.h

    PROTO_INET6 = 1              # avahi-common/address.h

    DBUS_NAME = "org.freedesktop.Avahi"

    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

    DBUS_PATH_SERVER = "/"

 

    @staticmethod

    def string_array_to_txt_array(t):

        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

                           for s in t), signature="ay")

    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h

    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h

    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h

    SERVER_INVALID = 0           # avahi-common/defs.h

    SERVER_REGISTERING = 1       # avahi-common/defs.h

    SERVER_RUNNING = 2           # avahi-common/defs.h

    SERVER_COLLISION = 3         # avahi-common/defs.h

    SERVER_FAILURE = 4           # avahi-common/defs.h

 

 

 

 

class AvahiService:

 

 

    def __init__(self,

                 interface=avahi.IF_UNSPEC,

                 name=None,

                 servicetype=None,

                 port=None,

                 TXT=None,

                 domain="",

                 host="",

                 max_renames=32768,

                 protocol=avahi.PROTO_UNSPEC,

                 bus=None):

 

        self.name = str(

            self.server.GetAlternativeServiceName(self.name))

 

 

 

 

            raise AvahiGroupError("State changed: {!s}".format(error))

 

 

        bad_states = {

            avahi.SERVER_INVALID: "Zeroconf server invalid",

            avahi.SERVER_REGISTERING: None,

            avahi.SERVER_COLLISION: "Zeroconf server name collision",

            avahi.SERVER_FAILURE: "Zeroconf server failure",

        }

            try:

                self.add()

            except dbus.exceptions.DBusException as error:

                if (error.get_dbus_name()

                    == "org.freedesktop.Avahi.CollisionError"):

                    logger.info("Local Zeroconf service name"

                                " collision.")

                    return self.rename(remove=False)

                else:

                    logger.critical("D-Bus Exception", exc_info=error)

                    self.cleanup()

                    os._exit(1)

 

                                      self.server_state_changed)

        ret = super(AvahiServiceToSyslog, self).rename(*args,

                                                       **kwargs)

        syslogger.setFormatter(logging.Formatter(

            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

            .format(self.name)))

# Pretend that we have a GnuTLS module

class gnutls:

    """This isn't so much a class as it is a module-like namespace."""

 

    library = ctypes.util.find_library("gnutls")

    if library is None:

        library = ctypes.util.find_library("gnutls-deb0")

    _library = ctypes.cdll.LoadLibrary(library)

    del library

 

    # Unless otherwise indicated, the constants and types below are

    # all from the gnutls/gnutls.h C header file.

 

    # Constants

    E_SUCCESS = 0

    E_INTERRUPTED = -52

    E_AGAIN = -28

    CRT_OPENPGP = 2

    CRT_RAWPK = 3

    CLIENT = 2

    SHUT_RDWR = 0

    CRD_CERTIFICATE = 1

    E_NO_CERTIFICATE_FOUND = -49

    X509_FMT_DER = 0

    NO_TICKETS = 1<<10

    ENABLE_RAWPK = 1<<18

    CTYPE_PEERS = 3

    KEYID_USE_SHA256 = 1        # gnutls/x509.h

    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h

 

    # Types

    class session_int(ctypes.Structure):

        _fields_ = []

    session_t = ctypes.POINTER(session_int)

 

    class certificate_credentials_st(ctypes.Structure):

        _fields_ = []

    certificate_credentials_t = ctypes.POINTER(

        certificate_credentials_st)

    certificate_type_t = ctypes.c_int

 

    class datum_t(ctypes.Structure):

        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

                    ('size', ctypes.c_uint)]

 

    class openpgp_crt_int(ctypes.Structure):

        _fields_ = []

    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h

    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

    credentials_type_t = ctypes.c_int

    transport_ptr_t = ctypes.c_void_p

    close_request_t = ctypes.c_int

 

    # Exceptions

    class Error(Exception):

        def __init__(self, message=None, code=None, args=()):

            # Default usage is by a message string, but if a return

            # code is passed, convert it to a string with

            # gnutls.strerror()

            self.code = code

            if message is None and code is not None:

                message = gnutls.strerror(code)

            return super(gnutls.Error, self).__init__(

                message, *args)

 

    class CertificateSecurityError(Error):

        pass

 

    # Classes

    class Credentials:

        def __init__(self):

            self._c_object = gnutls.certificate_credentials_t()

            gnutls.certificate_allocate_credentials(

                ctypes.byref(self._c_object))

            self.type = gnutls.CRD_CERTIFICATE

 

        def __del__(self):

            gnutls.certificate_free_credentials(self._c_object)

 

    class ClientSession:

        def __init__(self, socket, credentials=None):

            self._c_object = gnutls.session_t()

            gnutls_flags = gnutls.CLIENT

            if gnutls.check_version(b"3.5.6"):

                gnutls_flags |= gnutls.NO_TICKETS

            if gnutls.has_rawpk:

                gnutls_flags |= gnutls.ENABLE_RAWPK

            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

            del gnutls_flags

            gnutls.set_default_priority(self._c_object)

            gnutls.transport_set_ptr(self._c_object, socket.fileno())

            gnutls.handshake_set_private_extensions(self._c_object,

                                                    True)

            self.socket = socket

            if credentials is None:

                credentials = gnutls.Credentials()

            gnutls.credentials_set(self._c_object, credentials.type,

                                   ctypes.cast(credentials._c_object,

                                               ctypes.c_void_p))

            self.credentials = credentials

 

        def __del__(self):

            gnutls.deinit(self._c_object)

 

        def handshake(self):

            return gnutls.handshake(self._c_object)

 

        def send(self, data):

            data = bytes(data)

            data_len = len(data)

            while data_len > 0:

                data_len -= gnutls.record_send(self._c_object,

                                               data[-data_len:],

                                               data_len)

 

        def bye(self):

            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

 

    # Error handling functions

    def _error_code(result):

        """A function to raise exceptions on errors, suitable

        for the 'restype' attribute on ctypes functions"""

        if result >= 0:

            return result

        if result == gnutls.E_NO_CERTIFICATE_FOUND:

            raise gnutls.CertificateSecurityError(code=result)

        raise gnutls.Error(code=result)

 

    def _retry_on_error(result, func, arguments):

        """A function to retry on some errors, suitable

        for the 'errcheck' attribute on ctypes functions"""

        while result < 0:

            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

                return _error_code(result)

            result = func(*arguments)

        return result

 

    # Unless otherwise indicated, the function declarations below are

    # all from the gnutls/gnutls.h C header file.

 

    # Functions

    priority_set_direct = _library.gnutls_priority_set_direct

    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

                                    ctypes.POINTER(ctypes.c_char_p)]

    priority_set_direct.restype = _error_code

 

    init = _library.gnutls_init

    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

    init.restype = _error_code

 

    set_default_priority = _library.gnutls_set_default_priority

    set_default_priority.argtypes = [session_t]

    set_default_priority.restype = _error_code

 

    record_send = _library.gnutls_record_send

    record_send.argtypes = [session_t, ctypes.c_void_p,

                            ctypes.c_size_t]

    record_send.restype = ctypes.c_ssize_t

    record_send.errcheck = _retry_on_error

 

    certificate_allocate_credentials = (

        _library.gnutls_certificate_allocate_credentials)

    certificate_allocate_credentials.argtypes = [

        ctypes.POINTER(certificate_credentials_t)]

    certificate_allocate_credentials.restype = _error_code

 

    certificate_free_credentials = (

        _library.gnutls_certificate_free_credentials)

    certificate_free_credentials.argtypes = [

        certificate_credentials_t]

    certificate_free_credentials.restype = None

 

    handshake_set_private_extensions = (

        _library.gnutls_handshake_set_private_extensions)

    handshake_set_private_extensions.argtypes = [session_t,

                                                 ctypes.c_int]

    handshake_set_private_extensions.restype = None

 

    credentials_set = _library.gnutls_credentials_set

    credentials_set.argtypes = [session_t, credentials_type_t,

                                ctypes.c_void_p]

    credentials_set.restype = _error_code

 

    strerror = _library.gnutls_strerror

    strerror.argtypes = [ctypes.c_int]

    strerror.restype = ctypes.c_char_p

 

    certificate_type_get = _library.gnutls_certificate_type_get

    certificate_type_get.argtypes = [session_t]

    certificate_type_get.restype = _error_code

 

    certificate_get_peers = _library.gnutls_certificate_get_peers

    certificate_get_peers.argtypes = [session_t,

                                      ctypes.POINTER(ctypes.c_uint)]

    certificate_get_peers.restype = ctypes.POINTER(datum_t)

 

    global_set_log_level = _library.gnutls_global_set_log_level

    global_set_log_level.argtypes = [ctypes.c_int]

    global_set_log_level.restype = None

 

    global_set_log_function = _library.gnutls_global_set_log_function

    global_set_log_function.argtypes = [log_func]

    global_set_log_function.restype = None

 

    deinit = _library.gnutls_deinit

    deinit.argtypes = [session_t]

    deinit.restype = None

 

    handshake = _library.gnutls_handshake

    handshake.argtypes = [session_t]

    handshake.restype = _error_code

    handshake.errcheck = _retry_on_error

 

    transport_set_ptr = _library.gnutls_transport_set_ptr

    transport_set_ptr.argtypes = [session_t, transport_ptr_t]

    transport_set_ptr.restype = None

 

    bye = _library.gnutls_bye

    bye.argtypes = [session_t, close_request_t]

    bye.restype = _error_code

    bye.errcheck = _retry_on_error

 

    check_version = _library.gnutls_check_version

    check_version.argtypes = [ctypes.c_char_p]

    check_version.restype = ctypes.c_char_p

 

    _need_version = b"3.3.0"

    if check_version(_need_version) is None:

        raise self.Error("Needs GnuTLS {} or later"

                         .format(_need_version))

 

    _tls_rawpk_version = b"3.6.6"

    has_rawpk = bool(check_version(_tls_rawpk_version))

 

    if has_rawpk:

        # Types

        class pubkey_st(ctypes.Structure):

            _fields = []

        pubkey_t = ctypes.POINTER(pubkey_st)

 

        x509_crt_fmt_t = ctypes.c_int

 

        # All the function declarations below are from

        # gnutls/abstract.h

        pubkey_init = _library.gnutls_pubkey_init

        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

        pubkey_init.restype = _error_code

 

        pubkey_import = _library.gnutls_pubkey_import

        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

                                  x509_crt_fmt_t]

        pubkey_import.restype = _error_code

 

        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

                                      ctypes.POINTER(ctypes.c_ubyte),

                                      ctypes.POINTER(ctypes.c_size_t)]

        pubkey_get_key_id.restype = _error_code

 

        pubkey_deinit = _library.gnutls_pubkey_deinit

        pubkey_deinit.argtypes = [pubkey_t]

        pubkey_deinit.restype = None

    else:

        # All the function declarations below are from

        # gnutls/openpgp.h

 

        openpgp_crt_init = _library.gnutls_openpgp_crt_init

        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

        openpgp_crt_init.restype = _error_code

 

        openpgp_crt_import = _library.gnutls_openpgp_crt_import

        openpgp_crt_import.argtypes = [openpgp_crt_t,

                                       ctypes.POINTER(datum_t),

                                       openpgp_crt_fmt_t]

        openpgp_crt_import.restype = _error_code

 

        openpgp_crt_verify_self = \

            _library.gnutls_openpgp_crt_verify_self

        openpgp_crt_verify_self.argtypes = [

            openpgp_crt_t,

            ctypes.c_uint,

            ctypes.POINTER(ctypes.c_uint),

        ]

        openpgp_crt_verify_self.restype = _error_code

 

        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

        openpgp_crt_deinit.argtypes = [openpgp_crt_t]

        openpgp_crt_deinit.restype = None

 

        openpgp_crt_get_fingerprint = (

            _library.gnutls_openpgp_crt_get_fingerprint)

        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

                                                ctypes.c_void_p,

                                                ctypes.POINTER(

                                                    ctypes.c_size_t)]

        openpgp_crt_get_fingerprint.restype = _error_code

 

    if check_version(b"3.6.4"):

        certificate_type_get2 = _library.gnutls_certificate_type_get2

        certificate_type_get2.argtypes = [session_t, ctypes.c_int]

        certificate_type_get2.restype = _error_code

 

    # Remove non-public functions

    del _error_code, _retry_on_error

 

 

def call_pipe(connection,       # : multiprocessing.Connection

              func, *args, **kwargs):

    """This function is meant to be called by multiprocessing.Process

 

    This function runs func(*args, **kwargs), and writes the resulting

    return value on the provided multiprocessing.Connection.

    """

    connection.send(func(*args, **kwargs))

    connection.close()

 

 

class Client:

 

    checker: multiprocessing.Process(); a running checker process used

             to see if the client lives. 'None' if no process is

             running.

    checker_callback_tag: a GLib event source tag, or None

    checker_initiator_tag: a GLib event source tag, or None

    disable_initiator_tag: a GLib event source tag, or None

                 uniquely identify an OpenPGP client

    key_id: string (64 hexadecimal digits); used to uniquely identify

            a client using raw public keys

    last_checker_signal: The signal which killed the last checker, if

                         last_checker_status is -1

 

                          "created", "enabled", "expires", "key_id",

    client_defaults = {

        "timeout": "PT5M",

        "extended_timeout": "PT15M",

        "interval": "PT2M",

        "checker": "fping -q -- %%(host)s",

        "host": "",

        "approval_delay": "PT0S",

        "approval_duration": "PT1S",

        "approved_by_default": "True",

        "enabled": "True",

    }

 

 

 

            # Uppercase and remove spaces from key_id and fingerprint

            # for later comparison purposes with return value from the

            # key_id() and fingerprint() functions

            client["key_id"] = (section.get("key_id", "").upper()

                                .replace(" ", ""))

                client["secret"] = codecs.decode(section["secret"]

                                                 .encode("utf-8"),

                                                 "base64")

 

 

    def __init__(self, settings, name=None, server_settings=None):

 

 

        logger.debug("  Key ID: %s", self.key_id)

 

        self.changedstate = multiprocessing_manager.Condition(

            multiprocessing_manager.Lock())

        self.client_structure = [attr

                                 for attr in self.__dict__.keys()

 

        for name, t in inspect.getmembers(

                type(self), lambda obj: isinstance(obj, property)):

 

 

 

            GLib.source_remove(self.disable_initiator_tag)

            GLib.source_remove(self.checker_initiator_tag)

        # Do not run this again if called by a GLib.timeout_add

 

 

            GLib.source_remove(self.checker_initiator_tag)

        self.checker_initiator_tag = GLib.timeout_add(

            random.randrange(int(self.interval.total_seconds() * 1000

                                 + 1)),

            self.start_checker)

            GLib.source_remove(self.disable_initiator_tag)

        self.disable_initiator_tag = GLib.timeout_add(

            int(self.timeout.total_seconds() * 1000), self.disable)

 

    def checker_callback(self, source, condition, connection,

                         command):

        # Read return code from connection (see call_pipe)

        returncode = connection.recv()

        connection.close()

        if self.checker is not None:

            self.checker.join()

 

        if returncode >= 0:

            self.last_checker_status = returncode

            self.last_checker_signal = None

                logger.info("Checker for %(name)s failed", vars(self))

            self.last_checker_signal = -returncode

        return False

 

        self.last_checker_signal = None

 

            GLib.source_remove(self.disable_initiator_tag)

            self.disable_initiator_tag = GLib.timeout_add(

                int(timeout.total_seconds() * 1000), self.disable)

 

 

 

 

        if self.checker is not None and not self.checker.is_alive():

            logger.warning("Checker was not alive; joining")

            self.checker.join()

            self.checker = None

            escaped_attrs = {

                attr: shlex.quote(str(getattr(self, attr)))

                for attr in self.runtime_expansions}

                             self.checker_command,

                return True     # Try again later

            self.current_checker_command = command

            logger.info("Starting checker %r for %s", command,

                        self.name)

            # We don't need to redirect stdout and stderr, since

            # in normal mode, that is already done by daemon(),

            # and in debug mode we don't want to.  (Stdin is

            # always replaced by /dev/null.)

            # The exception is when not debugging but nevertheless

            # running in the foreground; use the previously

            # created wnull.

            popen_args = {"close_fds": True,

                          "shell": True,

                          "cwd": "/"}

            if (not self.server_settings["debug"]

                and self.server_settings["foreground"]):

                popen_args.update({"stdout": wnull,

                                   "stderr": wnull})

            pipe = multiprocessing.Pipe(duplex=False)

            self.checker = multiprocessing.Process(

                target=call_pipe,

                args=(pipe[1], subprocess.call, command),

                kwargs=popen_args)

            self.checker.start()

            self.checker_callback_tag = GLib.io_add_watch(

                GLib.IOChannel.unix_new(pipe[0].fileno()),

                GLib.PRIORITY_DEFAULT, GLib.IO_IN,

                self.checker_callback, pipe[0], command)

        # Re-run this periodically if run by GLib.timeout_add

 

            GLib.source_remove(self.checker_callback_tag)

        self.checker.terminate()

def dbus_service_property(dbus_interface,

                          signature="v",

                          access="readwrite",

                          byte_arrays=False):

 

 

 

        func._dbus_get_args_options = {'byte_arrays': byte_arrays}

 

 

 

 

 

 

 

    See also the DBusObjectWithAnnotations class.

 

 

 

class DBusObjectWithAnnotations(dbus.service.Object):

    """A D-Bus object with annotations.

 

    Classes inheriting from this can use the dbus_annotations

    decorator to add annotations to methods or signals.

 

 

 

        return ((getattr(athing.__get__(self), "_dbus_name", name),

                inspect.getmembers(cls, self._is_dbus_thing(thing)))

 

    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,

                         out_signature="s",

                         path_keyword='object_path',

                         connection_keyword='connection')

    def Introspect(self, object_path, connection):

        """Overloading of standard D-Bus method.

 

        Inserts annotation tags on methods and signals.

        """

        xmlstring = dbus.service.Object.Introspect(self, object_path,

                                                   connection)

        try:

            document = xml.dom.minidom.parseString(xmlstring)

 

            for if_tag in document.getElementsByTagName("interface"):

                # Add annotation tags

                for typ in ("method", "signal"):

                    for tag in if_tag.getElementsByTagName(typ):

                        annots = dict()

                        for name, prop in (self.

                                           _get_all_dbus_things(typ)):

                            if (name == tag.getAttribute("name")

                                and prop._dbus_interface

                                == if_tag.getAttribute("name")):

                                annots.update(getattr(

                                    prop, "_dbus_annotations", {}))

                        for name, value in annots.items():

                            ann_tag = document.createElement(

                                "annotation")

                            ann_tag.setAttribute("name", name)

                            ann_tag.setAttribute("value", value)

                            tag.appendChild(ann_tag)

                # Add interface annotation tags

                for annotation, value in dict(

                    itertools.chain.from_iterable(

                        annotations().items()

                        for name, annotations

                        in self._get_all_dbus_things("interface")

                        if name == if_tag.getAttribute("name")

                        )).items():

                    ann_tag = document.createElement("annotation")

                    ann_tag.setAttribute("name", annotation)

                    ann_tag.setAttribute("value", value)