To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.174
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.174
- Committer: Teddy Hogeborn
- Date: 2013-10-20 15:25:09 UTC
- mto: (237.7.272 trunk)
- mto: This revision was merged to the branch mainline in revision 305.
- Revision ID: teddy@recompile.se-20131020152509-zkhuy2yse76w10hg
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
(purge-server): PID file changed to "/run/mandos.pid".
* debian/compat: Changed to "9".
* debian/control (Standards-Version): Updated to "3.9.4".
(DM-Upload-Allowed): Removed.
(mandos/Depends): Add "initscripts (>= 2.88dsf-13.3)" to be able to
use the "/run" directory (for mandos.pid).
* debian/copyright (Copyright): Update year.
* init.d-mandos (PIDFILE): Changed to "/run/mandos.pid".
* mandos: Update copyright year.
(pidfilename): Changed to "/run/mandos.pid".
* mandos-clients.conf.xml (OPTIONS/approval_delay): Bug fix: default
is "PT0S" - using
the new RFC 3339
duration syntax.
* mandos-keygen: Update copyright year.
* mandos-monitor: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
(FILES): PID file changed to "/run/mandos.pid".
* plugin-runner.c: Update copyright year.
* plugins.d/mandos-client.c: - '' -
* plugins.d/mandos-client.xml: - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/plymouth.c: - '' -
(purge-server): PID file changed to "/run/mandos.pid".
* debian/compat: Changed to "9".
* debian/control (Standards-Version): Updated to "3.9.4".
(DM-Upload-Allowed): Removed.
(mandos/Depends): Add "initscripts (>= 2.88dsf-13.3)" to be able to
use the "/run" directory (for mandos.pid).
* debian/copyright (Copyright): Update year.
* init.d-mandos (PIDFILE): Changed to "/run/mandos.pid".
* mandos: Update copyright year.
(pidfilename): Changed to "/run/mandos.pid".
* mandos-clients.conf.xml (OPTIONS/approval_delay): Bug fix: default
is "PT0S" - using
the new RFC 3339
duration syntax.
* mandos-keygen: Update copyright year.
* mandos-monitor: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
(FILES): PID file changed to "/run/mandos.pid".
* plugin-runner.c: Update copyright year.
* plugins.d/mandos-client.c: - '' -
* plugins.d/mandos-client.xml: - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/plymouth.c: - '' -
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2013 Teddy Hogeborn
15
# Copyright © 2008-2013 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
try:
43
import SocketServer as socketserver
44
except ImportError:
45
import socketserver
39
import SocketServer as socketserver
46
40
import socket
47
41
import argparse
48
42
import datetime
49
43
import errno
50
try:
51
import ConfigParser as configparser
52
except ImportError:
53
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
54
51
import sys
55
52
import re
56
53
import os
65
62
import struct
66
63
import fcntl
67
64
import functools
68
try:
69
import cPickle as pickle
70
except ImportError:
71
import pickle
65
import cPickle as pickle
72
66
import multiprocessing
73
67
import types
74
68
import binascii
75
69
import tempfile
76
70
import itertools
77
71
import collections
78
import codecs
79
72
80
73
import dbus
81
74
import dbus.service
82
from gi.repository import GLib
75
import gobject
76
import avahi
83
77
from dbus.mainloop.glib import DBusGMainLoop
84
78
import ctypes
85
79
import ctypes.util
94
88
except ImportError:
95
89
SO_BINDTODEVICE = None
96
90
97
if sys.version_info.major == 2:
98
str = unicode
99
100
version = "1.7.7"
91
version = "1.6.1"
101
92
stored_state_file = "clients.pickle"
102
93
103
94
logger = logging.getLogger()
104
syslogger = None
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
105
98
106
99
try:
107
if_nametoindex = ctypes.cdll.LoadLibrary(
108
ctypes.util.find_library("c")).if_nametoindex
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
109
103
except (OSError, AttributeError):
110
111
104
def if_nametoindex(interface):
112
105
"Get an interface index the hard way, i.e. using fcntl()"
113
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
114
107
with contextlib.closing(socket.socket()) as s:
115
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
116
struct.pack(b"16s16x", interface))
117
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
118
113
return interface_index
119
114
120
115
121
def copy_function(func):
122
"""Make a copy of a function"""
123
if sys.version_info.major == 2:
124
return types.FunctionType(func.func_code,
125
func.func_globals,
126
func.func_name,
127
func.func_defaults,
128
func.func_closure)
129
else:
130
return types.FunctionType(func.__code__,
131
func.__globals__,
132
func.__name__,
133
func.__defaults__,
134
func.__closure__)
135
136
137
116
def initlogger(debug, level=logging.WARNING):
138
117
"""init logger and add loglevel"""
139
118
140
global syslogger
141
syslogger = (logging.handlers.SysLogHandler(
142
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
143
address = "/dev/log"))
144
119
syslogger.setFormatter(logging.Formatter
145
120
('Mandos [%(process)d]: %(levelname)s:'
146
121
' %(message)s'))
163
138
164
139
class PGPEngine(object):
165
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
166
167
141
def __init__(self):
168
142
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
169
self.gpg = "gpg"
170
try:
171
output = subprocess.check_output(["gpgconf"])
172
for line in output.splitlines():
173
name, text, path = line.split(b":")
174
if name == "gpg":
175
self.gpg = path
176
break
177
except OSError as e:
178
if e.errno != errno.ENOENT:
179
raise
180
143
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
144
'--home', self.tempdir,
182
145
'--force-mdc',
183
'--quiet']
184
# Only GPG version 1 has the --no-use-agent option.
185
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
186
self.gnupgargs.append("--no-use-agent")
146
'--quiet',
147
'--no-use-agent']
187
148
188
149
def __enter__(self):
189
150
return self
211
172
def password_encode(self, password):
212
173
# Passphrase can not be empty and can not contain newlines or
213
174
# NUL bytes. So we prefix it and hex encode it.
214
encoded = b"mandos" + binascii.hexlify(password)
215
if len(encoded) > 2048:
216
# GnuPG can't handle long passwords, so encode differently
217
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
218
.replace(b"\n", b"\\n")
219
.replace(b"\0", b"\\x00"))
220
return encoded
175
return b"mandos" + binascii.hexlify(password)
221
176
222
177
def encrypt(self, data, password):
223
178
passphrase = self.password_encode(password)
224
with tempfile.NamedTemporaryFile(
225
dir=self.tempdir) as passfile:
179
with tempfile.NamedTemporaryFile(dir=self.tempdir
180
) as passfile:
226
181
passfile.write(passphrase)
227
182
passfile.flush()
228
proc = subprocess.Popen([self.gpg, '--symmetric',
183
proc = subprocess.Popen(['gpg', '--symmetric',
229
184
'--passphrase-file',
230
185
passfile.name]
231
186
+ self.gnupgargs,
239
194
240
195
def decrypt(self, data, password):
241
196
passphrase = self.password_encode(password)
242
with tempfile.NamedTemporaryFile(
243
dir = self.tempdir) as passfile:
197
with tempfile.NamedTemporaryFile(dir = self.tempdir
198
) as passfile:
244
199
passfile.write(passphrase)
245
200
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--decrypt',
201
proc = subprocess.Popen(['gpg', '--decrypt',
247
202
'--passphrase-file',
248
203
passfile.name]
249
204
+ self.gnupgargs,
250
205
stdin = subprocess.PIPE,
251
206
stdout = subprocess.PIPE,
252
207
stderr = subprocess.PIPE)
253
decrypted_plaintext, err = proc.communicate(input = data)
208
decrypted_plaintext, err = proc.communicate(input
209
= data)
254
210
if proc.returncode != 0:
255
211
raise PGPError(err)
256
212
return decrypted_plaintext
257
213
258
# Pretend that we have an Avahi module
259
class Avahi(object):
260
"""This isn't so much a class as it is a module-like namespace.
261
It is instantiated once, and simulates having an Avahi module."""
262
IF_UNSPEC = -1 # avahi-common/address.h
263
PROTO_UNSPEC = -1 # avahi-common/address.h
264
PROTO_INET = 0 # avahi-common/address.h
265
PROTO_INET6 = 1 # avahi-common/address.h
266
DBUS_NAME = "org.freedesktop.Avahi"
267
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
268
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
269
DBUS_PATH_SERVER = "/"
270
def string_array_to_txt_array(self, t):
271
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
272
for s in t), signature="ay")
273
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
274
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
275
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
276
SERVER_INVALID = 0 # avahi-common/defs.h
277
SERVER_REGISTERING = 1 # avahi-common/defs.h
278
SERVER_RUNNING = 2 # avahi-common/defs.h
279
SERVER_COLLISION = 3 # avahi-common/defs.h
280
SERVER_FAILURE = 4 # avahi-common/defs.h
281
avahi = Avahi()
282
214
283
215
class AvahiError(Exception):
284
216
def __init__(self, value, *args, **kwargs):
285
217
self.value = value
286
return super(AvahiError, self).__init__(value, *args,
287
**kwargs)
288
218
super(AvahiError, self).__init__(value, *args, **kwargs)
219
def __unicode__(self):
220
return unicode(repr(self.value))
289
221
290
222
class AvahiServiceError(AvahiError):
291
223
pass
292
224
293
294
225
class AvahiGroupError(AvahiError):
295
226
pass
296
227
316
247
bus: dbus.SystemBus()
317
248
"""
318
249
319
def __init__(self,
320
interface = avahi.IF_UNSPEC,
321
name = None,
322
servicetype = None,
323
port = None,
324
TXT = None,
325
domain = "",
326
host = "",
327
max_renames = 32768,
328
protocol = avahi.PROTO_UNSPEC,
329
bus = None):
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
253
protocol = avahi.PROTO_UNSPEC, bus = None):
330
254
self.interface = interface
331
255
self.name = name
332
256
self.type = servicetype
342
266
self.bus = bus
343
267
self.entry_group_state_changed_match = None
344
268
345
def rename(self, remove=True):
269
def rename(self):
346
270
"""Derived from the Avahi example code"""
347
271
if self.rename_count >= self.max_renames:
348
272
logger.critical("No suitable Zeroconf service name found"
349
273
" after %i retries, exiting.",
350
274
self.rename_count)
351
275
raise AvahiServiceError("Too many renames")
352
self.name = str(
353
self.server.GetAlternativeServiceName(self.name))
354
self.rename_count += 1
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
355
278
logger.info("Changing Zeroconf service name to %r ...",
356
279
self.name)
357
if remove:
358
self.remove()
280
self.remove()
359
281
try:
360
282
self.add()
361
283
except dbus.exceptions.DBusException as error:
362
if (error.get_dbus_name()
363
== "org.freedesktop.Avahi.CollisionError"):
364
logger.info("Local Zeroconf service name collision.")
365
return self.rename(remove=False)
366
else:
367
logger.critical("D-Bus Exception", exc_info=error)
368
self.cleanup()
369
os._exit(1)
284
logger.critical("D-Bus Exception", exc_info=error)
285
self.cleanup()
286
os._exit(1)
287
self.rename_count += 1
370
288
371
289
def remove(self):
372
290
"""Derived from the Avahi example code"""
410
328
self.rename()
411
329
elif state == avahi.ENTRY_GROUP_FAILURE:
412
330
logger.critical("Avahi: Error in group state changed %s",
413
str(error))
414
raise AvahiGroupError("State changed: {!s}".format(error))
331
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
415
334
416
335
def cleanup(self):
417
336
"""Derived from the Avahi example code"""
427
346
def server_state_changed(self, state, error=None):
428
347
"""Derived from the Avahi example code"""
429
348
logger.debug("Avahi server state change: %i", state)
430
bad_states = {
431
avahi.SERVER_INVALID: "Zeroconf server invalid",
432
avahi.SERVER_REGISTERING: None,
433
avahi.SERVER_COLLISION: "Zeroconf server name collision",
434
avahi.SERVER_FAILURE: "Zeroconf server failure",
435
}
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
436
356
if state in bad_states:
437
357
if bad_states[state] is not None:
438
358
if error is None:
441
361
logger.error(bad_states[state] + ": %r", error)
442
362
self.cleanup()
443
363
elif state == avahi.SERVER_RUNNING:
444
try:
445
self.add()
446
except dbus.exceptions.DBusException as error:
447
if (error.get_dbus_name()
448
== "org.freedesktop.Avahi.CollisionError"):
449
logger.info("Local Zeroconf service name"
450
" collision.")
451
return self.rename(remove=False)
452
else:
453
logger.critical("D-Bus Exception", exc_info=error)
454
self.cleanup()
455
os._exit(1)
364
self.add()
456
365
else:
457
366
if error is None:
458
367
logger.debug("Unknown state: %r", state)
468
377
follow_name_owner_changes=True),
469
378
avahi.DBUS_INTERFACE_SERVER)
470
379
self.server.connect_to_signal("StateChanged",
471
self.server_state_changed)
380
self.server_state_changed)
472
381
self.server_state_changed(self.server.GetState())
473
382
474
383
475
384
class AvahiServiceToSyslog(AvahiService):
476
def rename(self, *args, **kwargs):
385
def rename(self):
477
386
"""Add the new name to the syslog messages"""
478
ret = AvahiService.rename(self, *args, **kwargs)
479
syslogger.setFormatter(logging.Formatter(
480
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
481
.format(self.name)))
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
482
392
return ret
483
393
484
# Pretend that we have a GnuTLS module
485
class GnuTLS(object):
486
"""This isn't so much a class as it is a module-like namespace.
487
It is instantiated once, and simulates having a GnuTLS module."""
488
489
_library = ctypes.cdll.LoadLibrary(
490
ctypes.util.find_library("gnutls"))
491
_need_version = b"3.3.0"
492
def __init__(self):
493
# Need to use class name "GnuTLS" here, since this method is
494
# called before the assignment to the "gnutls" global variable
495
# happens.
496
if GnuTLS.check_version(self._need_version) is None:
497
raise GnuTLS.Error("Needs GnuTLS {} or later"
498
.format(self._need_version))
499
500
# Unless otherwise indicated, the constants and types below are
501
# all from the gnutls/gnutls.h C header file.
502
503
# Constants
504
E_SUCCESS = 0
505
E_INTERRUPTED = -52
506
E_AGAIN = -28
507
CRT_OPENPGP = 2
508
CLIENT = 2
509
SHUT_RDWR = 0
510
CRD_CERTIFICATE = 1
511
E_NO_CERTIFICATE_FOUND = -49
512
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
513
514
# Types
515
class session_int(ctypes.Structure):
516
_fields_ = []
517
session_t = ctypes.POINTER(session_int)
518
class certificate_credentials_st(ctypes.Structure):
519
_fields_ = []
520
certificate_credentials_t = ctypes.POINTER(
521
certificate_credentials_st)
522
certificate_type_t = ctypes.c_int
523
class datum_t(ctypes.Structure):
524
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
525
('size', ctypes.c_uint)]
526
class openpgp_crt_int(ctypes.Structure):
527
_fields_ = []
528
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
529
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
531
credentials_type_t = ctypes.c_int
532
transport_ptr_t = ctypes.c_void_p
533
close_request_t = ctypes.c_int
534
535
# Exceptions
536
class Error(Exception):
537
# We need to use the class name "GnuTLS" here, since this
538
# exception might be raised from within GnuTLS.__init__,
539
# which is called before the assignment to the "gnutls"
540
# global variable has happened.
541
def __init__(self, message = None, code = None, args=()):
542
# Default usage is by a message string, but if a return
543
# code is passed, convert it to a string with
544
# gnutls.strerror()
545
self.code = code
546
if message is None and code is not None:
547
message = GnuTLS.strerror(code)
548
return super(GnuTLS.Error, self).__init__(
549
message, *args)
550
551
class CertificateSecurityError(Error):
552
pass
553
554
# Classes
555
class Credentials(object):
556
def __init__(self):
557
self._c_object = gnutls.certificate_credentials_t()
558
gnutls.certificate_allocate_credentials(
559
ctypes.byref(self._c_object))
560
self.type = gnutls.CRD_CERTIFICATE
561
562
def __del__(self):
563
gnutls.certificate_free_credentials(self._c_object)
564
565
class ClientSession(object):
566
def __init__(self, socket, credentials = None):
567
self._c_object = gnutls.session_t()
568
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
569
gnutls.set_default_priority(self._c_object)
570
gnutls.transport_set_ptr(self._c_object, socket.fileno())
571
gnutls.handshake_set_private_extensions(self._c_object,
572
True)
573
self.socket = socket
574
if credentials is None:
575
credentials = gnutls.Credentials()
576
gnutls.credentials_set(self._c_object, credentials.type,
577
ctypes.cast(credentials._c_object,
578
ctypes.c_void_p))
579
self.credentials = credentials
580
581
def __del__(self):
582
gnutls.deinit(self._c_object)
583
584
def handshake(self):
585
return gnutls.handshake(self._c_object)
586
587
def send(self, data):
588
data = bytes(data)
589
data_len = len(data)
590
while data_len > 0:
591
data_len -= gnutls.record_send(self._c_object,
592
data[-data_len:],
593
data_len)
594
595
def bye(self):
596
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
597
598
# Error handling functions
599
def _error_code(result):
600
"""A function to raise exceptions on errors, suitable
601
for the 'restype' attribute on ctypes functions"""
602
if result >= 0:
603
return result
604
if result == gnutls.E_NO_CERTIFICATE_FOUND:
605
raise gnutls.CertificateSecurityError(code = result)
606
raise gnutls.Error(code = result)
607
608
def _retry_on_error(result, func, arguments):
609
"""A function to retry on some errors, suitable
610
for the 'errcheck' attribute on ctypes functions"""
611
while result < 0:
612
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
613
return _error_code(result)
614
result = func(*arguments)
615
return result
616
617
# Unless otherwise indicated, the function declarations below are
618
# all from the gnutls/gnutls.h C header file.
619
620
# Functions
621
priority_set_direct = _library.gnutls_priority_set_direct
622
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
623
ctypes.POINTER(ctypes.c_char_p)]
624
priority_set_direct.restype = _error_code
625
626
init = _library.gnutls_init
627
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
628
init.restype = _error_code
629
630
set_default_priority = _library.gnutls_set_default_priority
631
set_default_priority.argtypes = [session_t]
632
set_default_priority.restype = _error_code
633
634
record_send = _library.gnutls_record_send
635
record_send.argtypes = [session_t, ctypes.c_void_p,
636
ctypes.c_size_t]
637
record_send.restype = ctypes.c_ssize_t
638
record_send.errcheck = _retry_on_error
639
640
certificate_allocate_credentials = (
641
_library.gnutls_certificate_allocate_credentials)
642
certificate_allocate_credentials.argtypes = [
643
ctypes.POINTER(certificate_credentials_t)]
644
certificate_allocate_credentials.restype = _error_code
645
646
certificate_free_credentials = (
647
_library.gnutls_certificate_free_credentials)
648
certificate_free_credentials.argtypes = [certificate_credentials_t]
649
certificate_free_credentials.restype = None
650
651
handshake_set_private_extensions = (
652
_library.gnutls_handshake_set_private_extensions)
653
handshake_set_private_extensions.argtypes = [session_t,
654
ctypes.c_int]
655
handshake_set_private_extensions.restype = None
656
657
credentials_set = _library.gnutls_credentials_set
658
credentials_set.argtypes = [session_t, credentials_type_t,
659
ctypes.c_void_p]
660
credentials_set.restype = _error_code
661
662
strerror = _library.gnutls_strerror
663
strerror.argtypes = [ctypes.c_int]
664
strerror.restype = ctypes.c_char_p
665
666
certificate_type_get = _library.gnutls_certificate_type_get
667
certificate_type_get.argtypes = [session_t]
668
certificate_type_get.restype = _error_code
669
670
certificate_get_peers = _library.gnutls_certificate_get_peers
671
certificate_get_peers.argtypes = [session_t,
672
ctypes.POINTER(ctypes.c_uint)]
673
certificate_get_peers.restype = ctypes.POINTER(datum_t)
674
675
global_set_log_level = _library.gnutls_global_set_log_level
676
global_set_log_level.argtypes = [ctypes.c_int]
677
global_set_log_level.restype = None
678
679
global_set_log_function = _library.gnutls_global_set_log_function
680
global_set_log_function.argtypes = [log_func]
681
global_set_log_function.restype = None
682
683
deinit = _library.gnutls_deinit
684
deinit.argtypes = [session_t]
685
deinit.restype = None
686
687
handshake = _library.gnutls_handshake
688
handshake.argtypes = [session_t]
689
handshake.restype = _error_code
690
handshake.errcheck = _retry_on_error
691
692
transport_set_ptr = _library.gnutls_transport_set_ptr
693
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
694
transport_set_ptr.restype = None
695
696
bye = _library.gnutls_bye
697
bye.argtypes = [session_t, close_request_t]
698
bye.restype = _error_code
699
bye.errcheck = _retry_on_error
700
701
check_version = _library.gnutls_check_version
702
check_version.argtypes = [ctypes.c_char_p]
703
check_version.restype = ctypes.c_char_p
704
705
# All the function declarations below are from gnutls/openpgp.h
706
707
openpgp_crt_init = _library.gnutls_openpgp_crt_init
708
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
709
openpgp_crt_init.restype = _error_code
710
711
openpgp_crt_import = _library.gnutls_openpgp_crt_import
712
openpgp_crt_import.argtypes = [openpgp_crt_t,
713
ctypes.POINTER(datum_t),
714
openpgp_crt_fmt_t]
715
openpgp_crt_import.restype = _error_code
716
717
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
718
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
719
ctypes.POINTER(ctypes.c_uint)]
720
openpgp_crt_verify_self.restype = _error_code
721
722
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
723
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
724
openpgp_crt_deinit.restype = None
725
726
openpgp_crt_get_fingerprint = (
727
_library.gnutls_openpgp_crt_get_fingerprint)
728
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
729
ctypes.c_void_p,
730
ctypes.POINTER(
731
ctypes.c_size_t)]
732
openpgp_crt_get_fingerprint.restype = _error_code
733
734
# Remove non-public functions
735
del _error_code, _retry_on_error
736
# Create the global "gnutls" object, simulating a module
737
gnutls = GnuTLS()
738
739
def call_pipe(connection, # : multiprocessing.Connection
740
func, *args, **kwargs):
741
"""This function is meant to be called by multiprocessing.Process
742
743
This function runs func(*args, **kwargs), and writes the resulting
744
return value on the provided multiprocessing.Connection.
745
"""
746
connection.send(func(*args, **kwargs))
747
connection.close()
394
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
748
401
749
402
class Client(object):
750
403
"""A representation of a client host served by this server.
756
409
checker: subprocess.Popen(); a running checker process used
757
410
to see if the client lives.
758
411
'None' if no process is running.
759
checker_callback_tag: a GLib event source tag, or None
412
checker_callback_tag: a gobject event source tag, or None
760
413
checker_command: string; External command which is run to check
761
414
if client lives. %() expansions are done at
762
415
runtime with vars(self) as dict, so that for
763
416
instance %(name)s can be used in the command.
764
checker_initiator_tag: a GLib event source tag, or None
417
checker_initiator_tag: a gobject event source tag, or None
765
418
created: datetime.datetime(); (UTC) object creation
766
419
client_structure: Object describing what attributes a client has
767
420
and is used for storing the client at exit
768
421
current_checker_command: string; current running checker_command
769
disable_initiator_tag: a GLib event source tag, or None
422
disable_initiator_tag: a gobject event source tag, or None
770
423
enabled: bool()
771
424
fingerprint: string (40 or 32 hexadecimal digits); used to
772
425
uniquely identify the client
777
430
last_checker_status: integer between 0 and 255 reflecting exit
778
431
status of last checker. -1 reflects crashed
779
432
checker, -2 means no checker completed yet.
780
last_checker_signal: The signal which killed the last checker, if
781
last_checker_status is -1
782
433
last_enabled: datetime.datetime(); (UTC) or None
783
434
name: string; from the config file, used in log messages and
784
435
D-Bus identifiers
797
448
"fingerprint", "host", "interval",
798
449
"last_approval_request", "last_checked_ok",
799
450
"last_enabled", "name", "timeout")
800
client_defaults = {
801
"timeout": "PT5M",
802
"extended_timeout": "PT15M",
803
"interval": "PT2M",
804
"checker": "fping -q -- %%(host)s",
805
"host": "",
806
"approval_delay": "PT0S",
807
"approval_duration": "PT1S",
808
"approved_by_default": "True",
809
"enabled": "True",
810
}
451
client_defaults = { "timeout": "PT5M",
452
"extended_timeout": "PT15M",
453
"interval": "PT2M",
454
"checker": "fping -q -- %%(host)s",
455
"host": "",
456
"approval_delay": "PT0S",
457
"approval_duration": "PT1S",
458
"approved_by_default": "True",
459
"enabled": "True",
460
}
461
462
def timeout_milliseconds(self):
463
"Return the 'timeout' attribute in milliseconds"
464
return timedelta_to_milliseconds(self.timeout)
465
466
def extended_timeout_milliseconds(self):
467
"Return the 'extended_timeout' attribute in milliseconds"
468
return timedelta_to_milliseconds(self.extended_timeout)
469
470
def interval_milliseconds(self):
471
"Return the 'interval' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.interval)
473
474
def approval_delay_milliseconds(self):
475
return timedelta_to_milliseconds(self.approval_delay)
811
476
812
477
@staticmethod
813
478
def config_parser(config):
829
494
client["enabled"] = config.getboolean(client_name,
830
495
"enabled")
831
496
832
# Uppercase and remove spaces from fingerprint for later
833
# comparison purposes with return value from the
834
# fingerprint() function
835
497
client["fingerprint"] = (section["fingerprint"].upper()
836
498
.replace(" ", ""))
837
499
if "secret" in section:
838
client["secret"] = codecs.decode(section["secret"]
839
.encode("utf-8"),
840
"base64")
500
client["secret"] = section["secret"].decode("base64")
841
501
elif "secfile" in section:
842
502
with open(os.path.expanduser(os.path.expandvars
843
503
(section["secfile"])),
844
504
"rb") as secfile:
845
505
client["secret"] = secfile.read()
846
506
else:
847
raise TypeError("No secret or secfile for section {}"
507
raise TypeError("No secret or secfile for section {0}"
848
508
.format(section))
849
509
client["timeout"] = string_to_delta(section["timeout"])
850
510
client["extended_timeout"] = string_to_delta(
867
527
server_settings = {}
868
528
self.server_settings = server_settings
869
529
# adding all client settings
870
for setting, value in settings.items():
530
for setting, value in settings.iteritems():
871
531
setattr(self, setting, value)
872
532
873
533
if self.enabled:
881
541
self.expires = None
882
542
883
543
logger.debug("Creating client %r", self.name)
544
# Uppercase and remove spaces from fingerprint for later
545
# comparison purposes with return value from the fingerprint()
546
# function
884
547
logger.debug(" Fingerprint: %s", self.fingerprint)
885
548
self.created = settings.get("created",
886
549
datetime.datetime.utcnow())
893
556
self.current_checker_command = None
894
557
self.approved = None
895
558
self.approvals_pending = 0
896
self.changedstate = multiprocessing_manager.Condition(
897
multiprocessing_manager.Lock())
898
self.client_structure = [attr
899
for attr in self.__dict__.keys()
559
self.changedstate = (multiprocessing_manager
560
.Condition(multiprocessing_manager
561
.Lock()))
562
self.client_structure = [attr for attr in
563
self.__dict__.iterkeys()
900
564
if not attr.startswith("_")]
901
565
self.client_structure.append("client_structure")
902
566
903
for name, t in inspect.getmembers(
904
type(self), lambda obj: isinstance(obj, property)):
567
for name, t in inspect.getmembers(type(self),
568
lambda obj:
569
isinstance(obj,
570
property)):
905
571
if not name.startswith("_"):
906
572
self.client_structure.append(name)
907
573
928
594
if not quiet:
929
595
logger.info("Disabling client %s", self.name)
930
596
if getattr(self, "disable_initiator_tag", None) is not None:
931
GLib.source_remove(self.disable_initiator_tag)
597
gobject.source_remove(self.disable_initiator_tag)
932
598
self.disable_initiator_tag = None
933
599
self.expires = None
934
600
if getattr(self, "checker_initiator_tag", None) is not None:
935
GLib.source_remove(self.checker_initiator_tag)
601
gobject.source_remove(self.checker_initiator_tag)
936
602
self.checker_initiator_tag = None
937
603
self.stop_checker()
938
604
self.enabled = False
939
605
if not quiet:
940
606
self.send_changedstate()
941
# Do not run this again if called by a GLib.timeout_add
607
# Do not run this again if called by a gobject.timeout_add
942
608
return False
943
609
944
610
def __del__(self):
948
614
# Schedule a new checker to be started an 'interval' from now,
949
615
# and every interval from then on.
950
616
if self.checker_initiator_tag is not None:
951
GLib.source_remove(self.checker_initiator_tag)
952
self.checker_initiator_tag = GLib.timeout_add(
953
int(self.interval.total_seconds() * 1000),
954
self.start_checker)
617
gobject.source_remove(self.checker_initiator_tag)
618
self.checker_initiator_tag = (gobject.timeout_add
619
(self.interval_milliseconds(),
620
self.start_checker))
955
621
# Schedule a disable() when 'timeout' has passed
956
622
if self.disable_initiator_tag is not None:
957
GLib.source_remove(self.disable_initiator_tag)
958
self.disable_initiator_tag = GLib.timeout_add(
959
int(self.timeout.total_seconds() * 1000), self.disable)
623
gobject.source_remove(self.disable_initiator_tag)
624
self.disable_initiator_tag = (gobject.timeout_add
625
(self.timeout_milliseconds(),
626
self.disable))
960
627
# Also start a new checker *right now*.
961
628
self.start_checker()
962
629
963
def checker_callback(self, source, condition, connection,
964
command):
630
def checker_callback(self, pid, condition, command):
965
631
"""The checker has completed, so take appropriate actions."""
966
632
self.checker_callback_tag = None
967
633
self.checker = None
968
# Read return code from connection (see call_pipe)
969
returncode = connection.recv()
970
connection.close()
971
972
if returncode >= 0:
973
self.last_checker_status = returncode
974
self.last_checker_signal = None
634
if os.WIFEXITED(condition):
635
self.last_checker_status = os.WEXITSTATUS(condition)
975
636
if self.last_checker_status == 0:
976
637
logger.info("Checker for %(name)s succeeded",
977
638
vars(self))
978
639
self.checked_ok()
979
640
else:
980
logger.info("Checker for %(name)s failed", vars(self))
641
logger.info("Checker for %(name)s failed",
642
vars(self))
981
643
else:
982
644
self.last_checker_status = -1
983
self.last_checker_signal = -returncode
984
645
logger.warning("Checker for %(name)s crashed?",
985
646
vars(self))
986
return False
987
647
988
648
def checked_ok(self):
989
649
"""Assert that the client has been seen, alive and well."""
990
650
self.last_checked_ok = datetime.datetime.utcnow()
991
651
self.last_checker_status = 0
992
self.last_checker_signal = None
993
652
self.bump_timeout()
994
653
995
654
def bump_timeout(self, timeout=None):
997
656
if timeout is None:
998
657
timeout = self.timeout
999
658
if self.disable_initiator_tag is not None:
1000
GLib.source_remove(self.disable_initiator_tag)
659
gobject.source_remove(self.disable_initiator_tag)
1001
660
self.disable_initiator_tag = None
1002
661
if getattr(self, "enabled", False):
1003
self.disable_initiator_tag = GLib.timeout_add(
1004
int(timeout.total_seconds() * 1000), self.disable)
662
self.disable_initiator_tag = (gobject.timeout_add
663
(timedelta_to_milliseconds
664
(timeout), self.disable))
1005
665
self.expires = datetime.datetime.utcnow() + timeout
1006
666
1007
667
def need_approval(self):
1021
681
# than 'timeout' for the client to be disabled, which is as it
1022
682
# should be.
1023
683
1024
if self.checker is not None and not self.checker.is_alive():
1025
logger.warning("Checker was not alive; joining")
1026
self.checker.join()
1027
self.checker = None
684
# If a checker exists, make sure it is not a zombie
685
try:
686
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
687
except (AttributeError, OSError) as error:
688
if (isinstance(error, OSError)
689
and error.errno != errno.ECHILD):
690
raise error
691
else:
692
if pid:
693
logger.warning("Checker was a zombie")
694
gobject.source_remove(self.checker_callback_tag)
695
self.checker_callback(pid, status,
696
self.current_checker_command)
1028
697
# Start a new checker if needed
1029
698
if self.checker is None:
1030
699
# Escape attributes for the shell
1031
escaped_attrs = {
1032
attr: re.escape(str(getattr(self, attr)))
1033
for attr in self.runtime_expansions }
700
escaped_attrs = dict(
701
(attr, re.escape(unicode(getattr(self, attr))))
702
for attr in
703
self.runtime_expansions)
1034
704
try:
1035
705
command = self.checker_command % escaped_attrs
1036
706
except TypeError as error:
1037
707
logger.error('Could not format string "%s"',
1038
self.checker_command,
708
self.checker_command, exc_info=error)
709
return True # Try again later
710
self.current_checker_command = command
711
try:
712
logger.info("Starting checker %r for %s",
713
command, self.name)
714
# We don't need to redirect stdout and stderr, since
715
# in normal mode, that is already done by daemon(),
716
# and in debug mode we don't want to. (Stdin is
717
# always replaced by /dev/null.)
718
# The exception is when not debugging but nevertheless
719
# running in the foreground; use the previously
720
# created wnull.
721
popen_args = {}
722
if (not self.server_settings["debug"]
723
and self.server_settings["foreground"]):
724
popen_args.update({"stdout": wnull,
725
"stderr": wnull })
726
self.checker = subprocess.Popen(command,
727
close_fds=True,
728
shell=True, cwd="/",
729
**popen_args)
730
except OSError as error:
731
logger.error("Failed to start subprocess",
1039
732
exc_info=error)
1040
return True # Try again later
1041
self.current_checker_command = command
1042
logger.info("Starting checker %r for %s", command,
1043
self.name)
1044
# We don't need to redirect stdout and stderr, since
1045
# in normal mode, that is already done by daemon(),
1046
# and in debug mode we don't want to. (Stdin is
1047
# always replaced by /dev/null.)
1048
# The exception is when not debugging but nevertheless
1049
# running in the foreground; use the previously
1050
# created wnull.
1051
popen_args = { "close_fds": True,
1052
"shell": True,
1053
"cwd": "/" }
1054
if (not self.server_settings["debug"]
1055
and self.server_settings["foreground"]):
1056
popen_args.update({"stdout": wnull,
1057
"stderr": wnull })
1058
pipe = multiprocessing.Pipe(duplex = False)
1059
self.checker = multiprocessing.Process(
1060
target = call_pipe,
1061
args = (pipe[1], subprocess.call, command),
1062
kwargs = popen_args)
1063
self.checker.start()
1064
self.checker_callback_tag = GLib.io_add_watch(
1065
pipe[0].fileno(), GLib.IO_IN,
1066
self.checker_callback, pipe[0], command)
1067
# Re-run this periodically if run by GLib.timeout_add
733
return True
734
self.checker_callback_tag = (gobject.child_watch_add
735
(self.checker.pid,
736
self.checker_callback,
737
data=command))
738
# The checker may have completed before the gobject
739
# watch was added. Check for this.
740
try:
741
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
742
except OSError as error:
743
if error.errno == errno.ECHILD:
744
# This should never happen
745
logger.error("Child process vanished",
746
exc_info=error)
747
return True
748
raise
749
if pid:
750
gobject.source_remove(self.checker_callback_tag)
751
self.checker_callback(pid, status, command)
752
# Re-run this periodically if run by gobject.timeout_add
1068
753
return True
1069
754
1070
755
def stop_checker(self):
1071
756
"""Force the checker process, if any, to stop."""
1072
757
if self.checker_callback_tag:
1073
GLib.source_remove(self.checker_callback_tag)
758
gobject.source_remove(self.checker_callback_tag)
1074
759
self.checker_callback_tag = None
1075
760
if getattr(self, "checker", None) is None:
1076
761
return
1077
762
logger.debug("Stopping checker for %(name)s", vars(self))
1078
self.checker.terminate()
763
try:
764
self.checker.terminate()
765
#time.sleep(0.5)
766
#if self.checker.poll() is None:
767
# self.checker.kill()
768
except OSError as error:
769
if error.errno != errno.ESRCH: # No such process
770
raise
1079
771
self.checker = None
1080
772
1081
773
1082
def dbus_service_property(dbus_interface,
1083
signature="v",
1084
access="readwrite",
1085
byte_arrays=False):
774
def dbus_service_property(dbus_interface, signature="v",
775
access="readwrite", byte_arrays=False):
1086
776
"""Decorators for marking methods of a DBusObjectWithProperties to
1087
777
become properties on the D-Bus.
1088
778
1097
787
# "Set" method, so we fail early here:
1098
788
if byte_arrays and signature != "ay":
1099
789
raise ValueError("Byte arrays not supported for non-'ay'"
1100
" signature {!r}".format(signature))
1101
790
" signature {0!r}".format(signature))
1102
791
def decorator(func):
1103
792
func._dbus_is_property = True
1104
793
func._dbus_interface = dbus_interface
1109
798
func._dbus_name = func._dbus_name[:-14]
1110
799
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1111
800
return func
1112
1113
801
return decorator
1114
802
1115
803
1124
812
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1125
813
"false"}
1126
814
"""
1127
1128
815
def decorator(func):
1129
816
func._dbus_is_interface = True
1130
817
func._dbus_interface = dbus_interface
1131
818
func._dbus_name = dbus_interface
1132
819
return func
1133
1134
820
return decorator
1135
821
1136
822
1138
824
"""Decorator to annotate D-Bus methods, signals or properties
1139
825
Usage:
1140
826
1141
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1142
"org.freedesktop.DBus.Property."
1143
"EmitsChangedSignal": "false"})
1144
827
@dbus_service_property("org.example.Interface", signature="b",
1145
828
access="r")
829
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
830
"org.freedesktop.DBus.Property."
831
"EmitsChangedSignal": "false"})
1146
832
def Property_dbus_property(self):
1147
833
return dbus.Boolean(False)
1148
1149
See also the DBusObjectWithAnnotations class.
1150
834
"""
1151
1152
835
def decorator(func):
1153
836
func._dbus_annotations = annotations
1154
837
return func
1155
1156
838
return decorator
1157
839
1158
840
1159
841
class DBusPropertyException(dbus.exceptions.DBusException):
1160
842
"""A base class for D-Bus property-related exceptions
1161
843
"""
1162
pass
844
def __unicode__(self):
845
return unicode(str(self))
1163
846
1164
847
1165
848
class DBusPropertyAccessException(DBusPropertyException):
1174
857
pass
1175
858
1176
859
1177
class DBusObjectWithAnnotations(dbus.service.Object):
1178
"""A D-Bus object with annotations.
860
class DBusObjectWithProperties(dbus.service.Object):
861
"""A D-Bus object with properties.
1179
862
1180
Classes inheriting from this can use the dbus_annotations
1181
decorator to add annotations to methods or signals.
863
Classes inheriting from this can use the dbus_service_property
864
decorator to expose methods as D-Bus properties. It exposes the
865
standard Get(), Set(), and GetAll() methods on the D-Bus.
1182
866
"""
1183
867
1184
868
@staticmethod
1188
872
If called like _is_dbus_thing("method") it returns a function
1189
873
suitable for use as predicate to inspect.getmembers().
1190
874
"""
1191
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
875
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1192
876
False)
1193
877
1194
878
def _get_all_dbus_things(self, thing):
1195
879
"""Returns a generator of (name, attribute) pairs
1196
880
"""
1197
return ((getattr(athing.__get__(self), "_dbus_name", name),
881
return ((getattr(athing.__get__(self), "_dbus_name",
882
name),
1198
883
athing.__get__(self))
1199
884
for cls in self.__class__.__mro__
1200
885
for name, athing in
1201
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1202
1203
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1204
out_signature = "s",
1205
path_keyword = 'object_path',
1206
connection_keyword = 'connection')
1207
def Introspect(self, object_path, connection):
1208
"""Overloading of standard D-Bus method.
1209
1210
Inserts annotation tags on methods and signals.
1211
"""
1212
xmlstring = dbus.service.Object.Introspect(self, object_path,
1213
connection)
1214
try:
1215
document = xml.dom.minidom.parseString(xmlstring)
1216
1217
for if_tag in document.getElementsByTagName("interface"):
1218
# Add annotation tags
1219
for typ in ("method", "signal"):
1220
for tag in if_tag.getElementsByTagName(typ):
1221
annots = dict()
1222
for name, prop in (self.
1223
_get_all_dbus_things(typ)):
1224
if (name == tag.getAttribute("name")
1225
and prop._dbus_interface
1226
== if_tag.getAttribute("name")):
1227
annots.update(getattr(
1228
prop, "_dbus_annotations", {}))
1229
for name, value in annots.items():
1230
ann_tag = document.createElement(
1231
"annotation")
1232
ann_tag.setAttribute("name", name)
1233
ann_tag.setAttribute("value", value)
1234
tag.appendChild(ann_tag)
1235
# Add interface annotation tags
1236
for annotation, value in dict(
1237
itertools.chain.from_iterable(
1238
annotations().items()
1239
for name, annotations
1240
in self._get_all_dbus_things("interface")
1241
if name == if_tag.getAttribute("name")
1242
)).items():
1243
ann_tag = document.createElement("annotation")
1244
ann_tag.setAttribute("name", annotation)
1245
ann_tag.setAttribute("value", value)
1246
if_tag.appendChild(ann_tag)
1247
# Fix argument name for the Introspect method itself
1248
if (if_tag.getAttribute("name")
1249
== dbus.INTROSPECTABLE_IFACE):
1250
for cn in if_tag.getElementsByTagName("method"):
1251
if cn.getAttribute("name") == "Introspect":
1252
for arg in cn.getElementsByTagName("arg"):
1253
if (arg.getAttribute("direction")
1254
== "out"):
1255
arg.setAttribute("name",
1256
"xml_data")
1257
xmlstring = document.toxml("utf-8")
1258
document.unlink()
1259
except (AttributeError, xml.dom.DOMException,
1260
xml.parsers.expat.ExpatError) as error:
1261
logger.error("Failed to override Introspection method",
1262
exc_info=error)
1263
return xmlstring
1264
1265
1266
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1267
"""A D-Bus object with properties.
1268
1269
Classes inheriting from this can use the dbus_service_property
1270
decorator to expose methods as D-Bus properties. It exposes the
1271
standard Get(), Set(), and GetAll() methods on the D-Bus.
1272
"""
886
inspect.getmembers(cls,
887
self._is_dbus_thing(thing)))
1273
888
1274
889
def _get_dbus_property(self, interface_name, property_name):
1275
890
"""Returns a bound method if one exists which is a D-Bus
1276
891
property with the specified name and interface.
1277
892
"""
1278
for cls in self.__class__.__mro__:
1279
for name, value in inspect.getmembers(
1280
cls, self._is_dbus_thing("property")):
893
for cls in self.__class__.__mro__:
894
for name, value in (inspect.getmembers
895
(cls,
896
self._is_dbus_thing("property"))):
1281
897
if (value._dbus_name == property_name
1282
898
and value._dbus_interface == interface_name):
1283
899
return value.__get__(self)
1284
900
1285
901
# No such property
1286
raise DBusPropertyNotFound("{}:{}.{}".format(
1287
self.dbus_object_path, interface_name, property_name))
1288
1289
@classmethod
1290
def _get_all_interface_names(cls):
1291
"""Get a sequence of all interfaces supported by an object"""
1292
return (name for name in set(getattr(getattr(x, attr),
1293
"_dbus_interface", None)
1294
for x in (inspect.getmro(cls))
1295
for attr in dir(x))
1296
if name is not None)
1297
1298
@dbus.service.method(dbus.PROPERTIES_IFACE,
1299
in_signature="ss",
902
raise DBusPropertyNotFound(self.dbus_object_path + ":"
903
+ interface_name + "."
904
+ property_name)
905
906
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1300
907
out_signature="v")
1301
908
def Get(self, interface_name, property_name):
1302
909
"""Standard D-Bus property Get() method, see D-Bus standard.
1320
927
# The byte_arrays option is not supported yet on
1321
928
# signatures other than "ay".
1322
929
if prop._dbus_signature != "ay":
1323
raise ValueError("Byte arrays not supported for non-"
1324
"'ay' signature {!r}"
1325
.format(prop._dbus_signature))
930
raise ValueError
1326
931
value = dbus.ByteArray(b''.join(chr(byte)
1327
932
for byte in value))
1328
933
prop(value)
1329
934
1330
@dbus.service.method(dbus.PROPERTIES_IFACE,
1331
in_signature="s",
935
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1332
936
out_signature="a{sv}")
1333
937
def GetAll(self, interface_name):
1334
938
"""Standard D-Bus property GetAll() method, see D-Bus
1349
953
if not hasattr(value, "variant_level"):
1350
954
properties[name] = value
1351
955
continue
1352
properties[name] = type(value)(
1353
value, variant_level = value.variant_level + 1)
956
properties[name] = type(value)(value, variant_level=
957
value.variant_level+1)
1354
958
return dbus.Dictionary(properties, signature="sv")
1355
959
1356
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1357
def PropertiesChanged(self, interface_name, changed_properties,
1358
invalidated_properties):
1359
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1360
standard.
1361
"""
1362
pass
1363
1364
960
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1365
961
out_signature="s",
1366
962
path_keyword='object_path',
1370
966
1371
967
Inserts property tags and interface annotation tags.
1372
968
"""
1373
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1374
object_path,
1375
connection)
969
xmlstring = dbus.service.Object.Introspect(self, object_path,
970
connection)
1376
971
try:
1377
972
document = xml.dom.minidom.parseString(xmlstring)
1378
1379
973
def make_tag(document, name, prop):
1380
974
e = document.createElement("property")
1381
975
e.setAttribute("name", name)
1382
976
e.setAttribute("type", prop._dbus_signature)
1383
977
e.setAttribute("access", prop._dbus_access)
1384
978
return e
1385
1386
979
for if_tag in document.getElementsByTagName("interface"):
1387
980
# Add property tags
1388
981
for tag in (make_tag(document, name, prop)
1391
984
if prop._dbus_interface
1392
985
== if_tag.getAttribute("name")):
1393
986
if_tag.appendChild(tag)
1394
# Add annotation tags for properties
1395
for tag in if_tag.getElementsByTagName("property"):
1396
annots = dict()
1397
for name, prop in self._get_all_dbus_things(
1398
"property"):
1399
if (name == tag.getAttribute("name")
1400
and prop._dbus_interface
1401
== if_tag.getAttribute("name")):
1402
annots.update(getattr(
1403
prop, "_dbus_annotations", {}))
1404
for name, value in annots.items():
1405
ann_tag = document.createElement(
1406
"annotation")
1407
ann_tag.setAttribute("name", name)
1408
ann_tag.setAttribute("value", value)
1409
tag.appendChild(ann_tag)
987
# Add annotation tags
988
for typ in ("method", "signal", "property"):
989
for tag in if_tag.getElementsByTagName(typ):
990
annots = dict()
991
for name, prop in (self.
992
_get_all_dbus_things(typ)):
993
if (name == tag.getAttribute("name")
994
and prop._dbus_interface
995
== if_tag.getAttribute("name")):
996
annots.update(getattr
997
(prop,
998
"_dbus_annotations",
999
{}))
1000
for name, value in annots.iteritems():
1001
ann_tag = document.createElement(
1002
"annotation")
1003
ann_tag.setAttribute("name", name)
1004
ann_tag.setAttribute("value", value)
1005
tag.appendChild(ann_tag)
1006
# Add interface annotation tags
1007
for annotation, value in dict(
1008
itertools.chain.from_iterable(
1009
annotations().iteritems()
1010
for name, annotations in
1011
self._get_all_dbus_things("interface")
1012
if name == if_tag.getAttribute("name")
1013
)).iteritems():
1014
ann_tag = document.createElement("annotation")
1015
ann_tag.setAttribute("name", annotation)
1016
ann_tag.setAttribute("value", value)
1017
if_tag.appendChild(ann_tag)
1410
1018
# Add the names to the return values for the
1411
1019
# "org.freedesktop.DBus.Properties" methods
1412
1020
if (if_tag.getAttribute("name")
1430
1038
exc_info=error)
1431
1039
return xmlstring
1432
1040
1433
try:
1434
dbus.OBJECT_MANAGER_IFACE
1435
except AttributeError:
1436
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1437
1438
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1439
"""A D-Bus object with an ObjectManager.
1440
1441
Classes inheriting from this exposes the standard
1442
GetManagedObjects call and the InterfacesAdded and
1443
InterfacesRemoved signals on the standard
1444
"org.freedesktop.DBus.ObjectManager" interface.
1445
1446
Note: No signals are sent automatically; they must be sent
1447
manually.
1448
"""
1449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1450
out_signature = "a{oa{sa{sv}}}")
1451
def GetManagedObjects(self):
1452
"""This function must be overridden"""
1453
raise NotImplementedError()
1454
1455
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1456
signature = "oa{sa{sv}}")
1457
def InterfacesAdded(self, object_path, interfaces_and_properties):
1458
pass
1459
1460
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1461
def InterfacesRemoved(self, object_path, interfaces):
1462
pass
1463
1464
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1465
out_signature = "s",
1466
path_keyword = 'object_path',
1467
connection_keyword = 'connection')
1468
def Introspect(self, object_path, connection):
1469
"""Overloading of standard D-Bus method.
1470
1471
Override return argument name of GetManagedObjects to be
1472
"objpath_interfaces_and_properties"
1473
"""
1474
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1475
object_path,
1476
connection)
1477
try:
1478
document = xml.dom.minidom.parseString(xmlstring)
1479
1480
for if_tag in document.getElementsByTagName("interface"):
1481
# Fix argument name for the GetManagedObjects method
1482
if (if_tag.getAttribute("name")
1483
== dbus.OBJECT_MANAGER_IFACE):
1484
for cn in if_tag.getElementsByTagName("method"):
1485
if (cn.getAttribute("name")
1486
== "GetManagedObjects"):
1487
for arg in cn.getElementsByTagName("arg"):
1488
if (arg.getAttribute("direction")
1489
== "out"):
1490
arg.setAttribute(
1491
"name",
1492
"objpath_interfaces"
1493
"_and_properties")
1494
xmlstring = document.toxml("utf-8")
1495
document.unlink()
1496
except (AttributeError, xml.dom.DOMException,
1497
xml.parsers.expat.ExpatError) as error:
1498
logger.error("Failed to override Introspection method",
1499
exc_info = error)
1500
return xmlstring
1501
1041
1502
1042
def datetime_to_dbus(dt, variant_level=0):
1503
1043
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1504
1044
if dt is None:
1505
1045
return dbus.String("", variant_level = variant_level)
1506
return dbus.String(dt.isoformat(), variant_level=variant_level)
1046
return dbus.String(dt.isoformat(),
1047
variant_level=variant_level)
1507
1048
1508
1049
1509
1050
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1529
1070
(from DBusObjectWithProperties) and interfaces (from the
1530
1071
dbus_interface_annotations decorator).
1531
1072
"""
1532
1533
1073
def wrapper(cls):
1534
1074
for orig_interface_name, alt_interface_name in (
1535
alt_interface_names.items()):
1075
alt_interface_names.iteritems()):
1536
1076
attr = {}
1537
1077
interface_names = set()
1538
1078
# Go though all attributes of the class
1540
1080
# Ignore non-D-Bus attributes, and D-Bus attributes
1541
1081
# with the wrong interface name
1542
1082
if (not hasattr(attribute, "_dbus_interface")
1543
or not attribute._dbus_interface.startswith(
1544
orig_interface_name)):
1083
or not attribute._dbus_interface
1084
.startswith(orig_interface_name)):
1545
1085
continue
1546
1086
# Create an alternate D-Bus interface name based on
1547
1087
# the current name
1548
alt_interface = attribute._dbus_interface.replace(
1549
orig_interface_name, alt_interface_name)
1088
alt_interface = (attribute._dbus_interface
1089
.replace(orig_interface_name,
1090
alt_interface_name))
1550
1091
interface_names.add(alt_interface)
1551
1092
# Is this a D-Bus signal?
1552
1093
if getattr(attribute, "_dbus_is_signal", False):
1553
1094
# Extract the original non-method undecorated
1554
1095
# function by black magic
1555
if sys.version_info.major == 2:
1556
nonmethod_func = (dict(
1096
nonmethod_func = (dict(
1557
1097
zip(attribute.func_code.co_freevars,
1558
attribute.__closure__))
1559
["func"].cell_contents)
1560
else:
1561
nonmethod_func = (dict(
1562
zip(attribute.__code__.co_freevars,
1563
attribute.__closure__))
1564
["func"].cell_contents)
1098
attribute.__closure__))["func"]
1099
.cell_contents)
1565
1100
# Create a new, but exactly alike, function
1566
1101
# object, and decorate it to be a new D-Bus signal
1567
1102
# with the alternate D-Bus interface name
1568
new_function = copy_function(nonmethod_func)
1569
new_function = (dbus.service.signal(
1570
alt_interface,
1571
attribute._dbus_signature)(new_function))
1103
new_function = (dbus.service.signal
1104
(alt_interface,
1105
attribute._dbus_signature)
1106
(types.FunctionType(
1107
nonmethod_func.func_code,
1108
nonmethod_func.func_globals,
1109
nonmethod_func.func_name,
1110
nonmethod_func.func_defaults,
1111
nonmethod_func.func_closure)))
1572
1112
# Copy annotations, if any
1573
1113
try:
1574
new_function._dbus_annotations = dict(
1575
attribute._dbus_annotations)
1114
new_function._dbus_annotations = (
1115
dict(attribute._dbus_annotations))
1576
1116
except AttributeError:
1577
1117
pass
1578
1118
# Define a creator of a function to call both the
1583
1123
"""This function is a scope container to pass
1584
1124
func1 and func2 to the "call_both" function
1585
1125
outside of its arguments"""
1586
1587
@functools.wraps(func2)
1588
1126
def call_both(*args, **kwargs):
1589
1127
"""This function will emit two D-Bus
1590
1128
signals by calling func1 and func2"""
1591
1129
func1(*args, **kwargs)
1592
1130
func2(*args, **kwargs)
1593
# Make wrapper function look like a D-Bus signal
1594
for name, attr in inspect.getmembers(func2):
1595
if name.startswith("_dbus_"):
1596
setattr(call_both, name, attr)
1597
1598
1131
return call_both
1599
1132
# Create the "call_both" function and add it to
1600
1133
# the class
1605
1138
# object. Decorate it to be a new D-Bus method
1606
1139
# with the alternate D-Bus interface name. Add it
1607
1140
# to the class.
1608
attr[attrname] = (
1609
dbus.service.method(
1610
alt_interface,
1611
attribute._dbus_in_signature,
1612
attribute._dbus_out_signature)
1613
(copy_function(attribute)))
1141
attr[attrname] = (dbus.service.method
1142
(alt_interface,
1143
attribute._dbus_in_signature,
1144
attribute._dbus_out_signature)
1145
(types.FunctionType
1146
(attribute.func_code,
1147
attribute.func_globals,
1148
attribute.func_name,
1149
attribute.func_defaults,
1150
attribute.func_closure)))
1614
1151
# Copy annotations, if any
1615
1152
try:
1616
attr[attrname]._dbus_annotations = dict(
1617
attribute._dbus_annotations)
1153
attr[attrname]._dbus_annotations = (
1154
dict(attribute._dbus_annotations))
1618
1155
except AttributeError:
1619
1156
pass
1620
1157
# Is this a D-Bus property?
1623
1160
# object, and decorate it to be a new D-Bus
1624
1161
# property with the alternate D-Bus interface
1625
1162
# name. Add it to the class.
1626
attr[attrname] = (dbus_service_property(
1627
alt_interface, attribute._dbus_signature,
1628
attribute._dbus_access,
1629
attribute._dbus_get_args_options
1630
["byte_arrays"])
1631
(copy_function(attribute)))
1163
attr[attrname] = (dbus_service_property
1164
(alt_interface,
1165
attribute._dbus_signature,
1166
attribute._dbus_access,
1167
attribute
1168
._dbus_get_args_options
1169
["byte_arrays"])
1170
(types.FunctionType
1171
(attribute.func_code,
1172
attribute.func_globals,
1173
attribute.func_name,
1174
attribute.func_defaults,
1175
attribute.func_closure)))
1632
1176
# Copy annotations, if any
1633
1177
try:
1634
attr[attrname]._dbus_annotations = dict(
1635
attribute._dbus_annotations)
1178
attr[attrname]._dbus_annotations = (
1179
dict(attribute._dbus_annotations))
1636
1180
except AttributeError:
1637
1181
pass
1638
1182
# Is this a D-Bus interface?
1641
1185
# object. Decorate it to be a new D-Bus interface
1642
1186
# with the alternate D-Bus interface name. Add it
1643
1187
# to the class.
1644
attr[attrname] = (
1645
dbus_interface_annotations(alt_interface)
1646
(copy_function(attribute)))
1188
attr[attrname] = (dbus_interface_annotations
1189
(alt_interface)
1190
(types.FunctionType
1191
(attribute.func_code,
1192
attribute.func_globals,
1193
attribute.func_name,
1194
attribute.func_defaults,
1195
attribute.func_closure)))
1647
1196
if deprecate:
1648
1197
# Deprecate all alternate interfaces
1649
iname="_AlternateDBusNames_interface_annotation{}"
1198
iname="_AlternateDBusNames_interface_annotation{0}"
1650
1199
for interface_name in interface_names:
1651
1652
1200
@dbus_interface_annotations(interface_name)
1653
1201
def func(self):
1654
1202
return { "org.freedesktop.DBus.Deprecated":
1655
"true" }
1203
"true" }
1656
1204
# Find an unused name
1657
1205
for aname in (iname.format(i)
1658
1206
for i in itertools.count()):
1662
1210
if interface_names:
1663
1211
# Replace the class with a new subclass of it with
1664
1212
# methods, signals, etc. as created above.
1665
if sys.version_info.major == 2:
1666
cls = type(b"{}Alternate".format(cls.__name__),
1667
(cls, ), attr)
1668
else:
1669
cls = type("{}Alternate".format(cls.__name__),
1670
(cls, ), attr)
1213
cls = type(b"{0}Alternate".format(cls.__name__),
1214
(cls,), attr)
1671
1215
return cls
1672
1673
1216
return wrapper
1674
1217
1675
1218
1676
1219
@alternate_dbus_interfaces({"se.recompile.Mandos":
1677
"se.bsnet.fukt.Mandos"})
1220
"se.bsnet.fukt.Mandos"})
1678
1221
class ClientDBus(Client, DBusObjectWithProperties):
1679
1222
"""A Client class using D-Bus
1680
1223
1684
1227
"""
1685
1228
1686
1229
runtime_expansions = (Client.runtime_expansions
1687
+ ("dbus_object_path", ))
1688
1689
_interface = "se.recompile.Mandos.Client"
1230
+ ("dbus_object_path",))
1690
1231
1691
1232
# dbus.service.Object doesn't use super(), so we can't either.
1692
1233
1695
1236
Client.__init__(self, *args, **kwargs)
1696
1237
# Only now, when this client is initialized, can it show up on
1697
1238
# the D-Bus
1698
client_object_name = str(self.name).translate(
1239
client_object_name = unicode(self.name).translate(
1699
1240
{ord("."): ord("_"),
1700
1241
ord("-"): ord("_")})
1701
self.dbus_object_path = dbus.ObjectPath(
1702
"/clients/" + client_object_name)
1242
self.dbus_object_path = (dbus.ObjectPath
1243
("/clients/" + client_object_name))
1703
1244
DBusObjectWithProperties.__init__(self, self.bus,
1704
1245
self.dbus_object_path)
1705
1246
1706
def notifychangeproperty(transform_func, dbus_name,
1707
type_func=lambda x: x,
1708
variant_level=1,
1709
invalidate_only=False,
1710
_interface=_interface):
1247
def notifychangeproperty(transform_func,
1248
dbus_name, type_func=lambda x: x,
1249
variant_level=1):
1711
1250
""" Modify a variable so that it's a property which announces
1712
1251
its changes to DBus.
1713
1252
1718
1257
to the D-Bus. Default: no transform
1719
1258
variant_level: D-Bus variant level. Default: 1
1720
1259
"""
1721
attrname = "_{}".format(dbus_name)
1722
1260
attrname = "_{0}".format(dbus_name)
1723
1261
def setter(self, value):
1724
1262
if hasattr(self, "dbus_object_path"):
1725
1263
if (not hasattr(self, attrname) or
1726
1264
type_func(getattr(self, attrname, None))
1727
1265
!= type_func(value)):
1728
if invalidate_only:
1729
self.PropertiesChanged(
1730
_interface, dbus.Dictionary(),
1731
dbus.Array((dbus_name, )))
1732
else:
1733
dbus_value = transform_func(
1734
type_func(value),
1735
variant_level = variant_level)
1736
self.PropertyChanged(dbus.String(dbus_name),
1737
dbus_value)
1738
self.PropertiesChanged(
1739
_interface,
1740
dbus.Dictionary({ dbus.String(dbus_name):
1741
dbus_value }),
1742
dbus.Array())
1266
dbus_value = transform_func(type_func(value),
1267
variant_level
1268
=variant_level)
1269
self.PropertyChanged(dbus.String(dbus_name),
1270
dbus_value)
1743
1271
setattr(self, attrname, value)
1744
1272
1745
1273
return property(lambda self: getattr(self, attrname), setter)
1751
1279
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1752
1280
last_enabled = notifychangeproperty(datetime_to_dbus,
1753
1281
"LastEnabled")
1754
checker = notifychangeproperty(
1755
dbus.Boolean, "CheckerRunning",
1756
type_func = lambda checker: checker is not None)
1282
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1283
type_func = lambda checker:
1284
checker is not None)
1757
1285
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1758
1286
"LastCheckedOK")
1759
1287
last_checker_status = notifychangeproperty(dbus.Int16,
1762
1290
datetime_to_dbus, "LastApprovalRequest")
1763
1291
approved_by_default = notifychangeproperty(dbus.Boolean,
1764
1292
"ApprovedByDefault")
1765
approval_delay = notifychangeproperty(
1766
dbus.UInt64, "ApprovalDelay",
1767
type_func = lambda td: td.total_seconds() * 1000)
1293
approval_delay = notifychangeproperty(dbus.UInt64,
1294
"ApprovalDelay",
1295
type_func =
1296
timedelta_to_milliseconds)
1768
1297
approval_duration = notifychangeproperty(
1769
1298
dbus.UInt64, "ApprovalDuration",
1770
type_func = lambda td: td.total_seconds() * 1000)
1299
type_func = timedelta_to_milliseconds)
1771
1300
host = notifychangeproperty(dbus.String, "Host")
1772
timeout = notifychangeproperty(
1773
dbus.UInt64, "Timeout",
1774
type_func = lambda td: td.total_seconds() * 1000)
1301
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1302
type_func =
1303
timedelta_to_milliseconds)
1775
1304
extended_timeout = notifychangeproperty(
1776
1305
dbus.UInt64, "ExtendedTimeout",
1777
type_func = lambda td: td.total_seconds() * 1000)
1778
interval = notifychangeproperty(
1779
dbus.UInt64, "Interval",
1780
type_func = lambda td: td.total_seconds() * 1000)
1306
type_func = timedelta_to_milliseconds)
1307
interval = notifychangeproperty(dbus.UInt64,
1308
"Interval",
1309
type_func =
1310
timedelta_to_milliseconds)
1781
1311
checker_command = notifychangeproperty(dbus.String, "Checker")
1782
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1783
invalidate_only=True)
1784
1312
1785
1313
del notifychangeproperty
1786
1314
1793
1321
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1794
1322
Client.__del__(self, *args, **kwargs)
1795
1323
1796
def checker_callback(self, source, condition,
1797
connection, command, *args, **kwargs):
1798
ret = Client.checker_callback(self, source, condition,
1799
connection, command, *args,
1800
**kwargs)
1801
exitstatus = self.last_checker_status
1802
if exitstatus >= 0:
1324
def checker_callback(self, pid, condition, command,
1325
*args, **kwargs):
1326
self.checker_callback_tag = None
1327
self.checker = None
1328
if os.WIFEXITED(condition):
1329
exitstatus = os.WEXITSTATUS(condition)
1803
1330
# Emit D-Bus signal
1804
1331
self.CheckerCompleted(dbus.Int16(exitstatus),
1805
# This is specific to GNU libC
1806
dbus.Int64(exitstatus << 8),
1332
dbus.Int64(condition),
1807
1333
dbus.String(command))
1808
1334
else:
1809
1335
# Emit D-Bus signal
1810
1336
self.CheckerCompleted(dbus.Int16(-1),
1811
dbus.Int64(
1812
# This is specific to GNU libC
1813
(exitstatus << 8)
1814
| self.last_checker_signal),
1337
dbus.Int64(condition),
1815
1338
dbus.String(command))
1816
return ret
1339
1340
return Client.checker_callback(self, pid, condition, command,
1341
*args, **kwargs)
1817
1342
1818
1343
def start_checker(self, *args, **kwargs):
1819
old_checker_pid = getattr(self.checker, "pid", None)
1344
old_checker = self.checker
1345
if self.checker is not None:
1346
old_checker_pid = self.checker.pid
1347
else:
1348
old_checker_pid = None
1820
1349
r = Client.start_checker(self, *args, **kwargs)
1821
1350
# Only if new checker process was started
1822
1351
if (self.checker is not None
1831
1360
1832
1361
def approve(self, value=True):
1833
1362
self.approved = value
1834
GLib.timeout_add(int(self.approval_duration.total_seconds()
1835
* 1000), self._reset_approved)
1363
gobject.timeout_add(timedelta_to_milliseconds
1364
(self.approval_duration),
1365
self._reset_approved)
1836
1366
self.send_changedstate()
1837
1367
1838
1368
## D-Bus methods, signals & properties
1369
_interface = "se.recompile.Mandos.Client"
1839
1370
1840
1371
## Interfaces
1841
1372
1373
@dbus_interface_annotations(_interface)
1374
def _foo(self):
1375
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1376
"false"}
1377
1842
1378
## Signals
1843
1379
1844
1380
# CheckerCompleted - signal
1854
1390
pass
1855
1391
1856
1392
# PropertyChanged - signal
1857
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1858
1393
@dbus.service.signal(_interface, signature="sv")
1859
1394
def PropertyChanged(self, property, value):
1860
1395
"D-Bus signal"
1894
1429
self.checked_ok()
1895
1430
1896
1431
# Enable - method
1897
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1898
1432
@dbus.service.method(_interface)
1899
1433
def Enable(self):
1900
1434
"D-Bus method"
1901
1435
self.enable()
1902
1436
1903
1437
# StartChecker - method
1904
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1905
1438
@dbus.service.method(_interface)
1906
1439
def StartChecker(self):
1907
1440
"D-Bus method"
1908
1441
self.start_checker()
1909
1442
1910
1443
# Disable - method
1911
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1912
1444
@dbus.service.method(_interface)
1913
1445
def Disable(self):
1914
1446
"D-Bus method"
1915
1447
self.disable()
1916
1448
1917
1449
# StopChecker - method
1918
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1919
1450
@dbus.service.method(_interface)
1920
1451
def StopChecker(self):
1921
1452
self.stop_checker()
1928
1459
return dbus.Boolean(bool(self.approvals_pending))
1929
1460
1930
1461
# ApprovedByDefault - property
1931
@dbus_service_property(_interface,
1932
signature="b",
1462
@dbus_service_property(_interface, signature="b",
1933
1463
access="readwrite")
1934
1464
def ApprovedByDefault_dbus_property(self, value=None):
1935
1465
if value is None: # get
1937
1467
self.approved_by_default = bool(value)
1938
1468
1939
1469
# ApprovalDelay - property
1940
@dbus_service_property(_interface,
1941
signature="t",
1470
@dbus_service_property(_interface, signature="t",
1942
1471
access="readwrite")
1943
1472
def ApprovalDelay_dbus_property(self, value=None):
1944
1473
if value is None: # get
1945
return dbus.UInt64(self.approval_delay.total_seconds()
1946
* 1000)
1474
return dbus.UInt64(self.approval_delay_milliseconds())
1947
1475
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1948
1476
1949
1477
# ApprovalDuration - property
1950
@dbus_service_property(_interface,
1951
signature="t",
1478
@dbus_service_property(_interface, signature="t",
1952
1479
access="readwrite")
1953
1480
def ApprovalDuration_dbus_property(self, value=None):
1954
1481
if value is None: # get
1955
return dbus.UInt64(self.approval_duration.total_seconds()
1956
* 1000)
1482
return dbus.UInt64(timedelta_to_milliseconds(
1483
self.approval_duration))
1957
1484
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1958
1485
1959
1486
# Name - property
1960
@dbus_annotations(
1961
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1962
1487
@dbus_service_property(_interface, signature="s", access="read")
1963
1488
def Name_dbus_property(self):
1964
1489
return dbus.String(self.name)
1965
1490
1966
1491
# Fingerprint - property
1967
@dbus_annotations(
1968
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1969
1492
@dbus_service_property(_interface, signature="s", access="read")
1970
1493
def Fingerprint_dbus_property(self):
1971
1494
return dbus.String(self.fingerprint)
1972
1495
1973
1496
# Host - property
1974
@dbus_service_property(_interface,
1975
signature="s",
1497
@dbus_service_property(_interface, signature="s",
1976
1498
access="readwrite")
1977
1499
def Host_dbus_property(self, value=None):
1978
1500
if value is None: # get
1979
1501
return dbus.String(self.host)
1980
self.host = str(value)
1502
self.host = unicode(value)
1981
1503
1982
1504
# Created - property
1983
@dbus_annotations(
1984
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1985
1505
@dbus_service_property(_interface, signature="s", access="read")
1986
1506
def Created_dbus_property(self):
1987
1507
return datetime_to_dbus(self.created)
1992
1512
return datetime_to_dbus(self.last_enabled)
1993
1513
1994
1514
# Enabled - property
1995
@dbus_service_property(_interface,
1996
signature="b",
1515
@dbus_service_property(_interface, signature="b",
1997
1516
access="readwrite")
1998
1517
def Enabled_dbus_property(self, value=None):
1999
1518
if value is None: # get
2004
1523
self.disable()
2005
1524
2006
1525
# LastCheckedOK - property
2007
@dbus_service_property(_interface,
2008
signature="s",
1526
@dbus_service_property(_interface, signature="s",
2009
1527
access="readwrite")
2010
1528
def LastCheckedOK_dbus_property(self, value=None):
2011
1529
if value is not None:
2014
1532
return datetime_to_dbus(self.last_checked_ok)
2015
1533
2016
1534
# LastCheckerStatus - property
2017
@dbus_service_property(_interface, signature="n", access="read")
1535
@dbus_service_property(_interface, signature="n",
1536
access="read")
2018
1537
def LastCheckerStatus_dbus_property(self):
2019
1538
return dbus.Int16(self.last_checker_status)
2020
1539
2029
1548
return datetime_to_dbus(self.last_approval_request)
2030
1549
2031
1550
# Timeout - property
2032
@dbus_service_property(_interface,
2033
signature="t",
1551
@dbus_service_property(_interface, signature="t",
2034
1552
access="readwrite")
2035
1553
def Timeout_dbus_property(self, value=None):
2036
1554
if value is None: # get
2037
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1555
return dbus.UInt64(self.timeout_milliseconds())
2038
1556
old_timeout = self.timeout
2039
1557
self.timeout = datetime.timedelta(0, 0, 0, value)
2040
1558
# Reschedule disabling
2048
1566
if (getattr(self, "disable_initiator_tag", None)
2049
1567
is None):
2050
1568
return
2051
GLib.source_remove(self.disable_initiator_tag)
2052
self.disable_initiator_tag = GLib.timeout_add(
2053
int((self.expires - now).total_seconds() * 1000),
2054
self.disable)
1569
gobject.source_remove(self.disable_initiator_tag)
1570
self.disable_initiator_tag = (
1571
gobject.timeout_add(
1572
timedelta_to_milliseconds(self.expires - now),
1573
self.disable))
2055
1574
2056
1575
# ExtendedTimeout - property
2057
@dbus_service_property(_interface,
2058
signature="t",
1576
@dbus_service_property(_interface, signature="t",
2059
1577
access="readwrite")
2060
1578
def ExtendedTimeout_dbus_property(self, value=None):
2061
1579
if value is None: # get
2062
return dbus.UInt64(self.extended_timeout.total_seconds()
2063
* 1000)
1580
return dbus.UInt64(self.extended_timeout_milliseconds())
2064
1581
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2065
1582
2066
1583
# Interval - property
2067
@dbus_service_property(_interface,
2068
signature="t",
1584
@dbus_service_property(_interface, signature="t",
2069
1585
access="readwrite")
2070
1586
def Interval_dbus_property(self, value=None):
2071
1587
if value is None: # get
2072
return dbus.UInt64(self.interval.total_seconds() * 1000)
1588
return dbus.UInt64(self.interval_milliseconds())
2073
1589
self.interval = datetime.timedelta(0, 0, 0, value)
2074
1590
if getattr(self, "checker_initiator_tag", None) is None:
2075
1591
return
2076
1592
if self.enabled:
2077
1593
# Reschedule checker run
2078
GLib.source_remove(self.checker_initiator_tag)
2079
self.checker_initiator_tag = GLib.timeout_add(
2080
value, self.start_checker)
2081
self.start_checker() # Start one now, too
1594
gobject.source_remove(self.checker_initiator_tag)
1595
self.checker_initiator_tag = (gobject.timeout_add
1596
(value, self.start_checker))
1597
self.start_checker() # Start one now, too
2082
1598
2083
1599
# Checker - property
2084
@dbus_service_property(_interface,
2085
signature="s",
1600
@dbus_service_property(_interface, signature="s",
2086
1601
access="readwrite")
2087
1602
def Checker_dbus_property(self, value=None):
2088
1603
if value is None: # get
2089
1604
return dbus.String(self.checker_command)
2090
self.checker_command = str(value)
1605
self.checker_command = unicode(value)
2091
1606
2092
1607
# CheckerRunning - property
2093
@dbus_service_property(_interface,
2094
signature="b",
1608
@dbus_service_property(_interface, signature="b",
2095
1609
access="readwrite")
2096
1610
def CheckerRunning_dbus_property(self, value=None):
2097
1611
if value is None: # get
2102
1616
self.stop_checker()
2103
1617
2104
1618
# ObjectPath - property
2105
@dbus_annotations(
2106
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2107
"org.freedesktop.DBus.Deprecated": "true"})
2108
1619
@dbus_service_property(_interface, signature="o", access="read")
2109
1620
def ObjectPath_dbus_property(self):
2110
1621
return self.dbus_object_path # is already a dbus.ObjectPath
2111
1622
2112
1623
# Secret = property
2113
@dbus_annotations(
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2115
"invalidates"})
2116
@dbus_service_property(_interface,
2117
signature="ay",
2118
access="write",
2119
byte_arrays=True)
1624
@dbus_service_property(_interface, signature="ay",
1625
access="write", byte_arrays=True)
2120
1626
def Secret_dbus_property(self, value):
2121
self.secret = bytes(value)
1627
self.secret = str(value)
2122
1628
2123
1629
del _interface
2124
1630
2128
1634
self._pipe = child_pipe
2129
1635
self._pipe.send(('init', fpr, address))
2130
1636
if not self._pipe.recv():
2131
raise KeyError(fpr)
1637
raise KeyError()
2132
1638
2133
1639
def __getattribute__(self, name):
2134
1640
if name == '_pipe':
2138
1644
if data[0] == 'data':
2139
1645
return data[1]
2140
1646
if data[0] == 'function':
2141
2142
1647
def func(*args, **kwargs):
2143
1648
self._pipe.send(('funcall', name, args, kwargs))
2144
1649
return self._pipe.recv()[1]
2145
2146
1650
return func
2147
1651
2148
1652
def __setattr__(self, name, value):
2160
1664
def handle(self):
2161
1665
with contextlib.closing(self.server.child_pipe) as child_pipe:
2162
1666
logger.info("TCP connection from: %s",
2163
str(self.client_address))
1667
unicode(self.client_address))
2164
1668
logger.debug("Pipe FD: %d",
2165
1669
self.server.child_pipe.fileno())
2166
1670
2167
session = gnutls.ClientSession(self.request)
1671
session = (gnutls.connection
1672
.ClientSession(self.request,
1673
gnutls.connection
1674
.X509Credentials()))
1675
1676
# Note: gnutls.connection.X509Credentials is really a
1677
# generic GnuTLS certificate credentials object so long as
1678
# no X.509 keys are added to it. Therefore, we can use it
1679
# here despite using OpenPGP certificates.
2168
1680
2169
1681
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2170
1682
# "+AES-256-CBC", "+SHA1",
2174
1686
priority = self.server.gnutls_priority
2175
1687
if priority is None:
2176
1688
priority = "NORMAL"
2177
gnutls.priority_set_direct(session._c_object, priority,
2178
None)
1689
(gnutls.library.functions
1690
.gnutls_priority_set_direct(session._c_object,
1691
priority, None))
2179
1692
2180
1693
# Start communication using the Mandos protocol
2181
1694
# Get protocol number
2183
1696
logger.debug("Protocol version: %r", line)
2184
1697
try:
2185
1698
if int(line.strip().split()[0]) > 1:
2186
raise RuntimeError(line)
1699
raise RuntimeError
2187
1700
except (ValueError, IndexError, RuntimeError) as error:
2188
1701
logger.error("Unknown protocol version: %s", error)
2189
1702
return
2191
1704
# Start GnuTLS connection
2192
1705
try:
2193
1706
session.handshake()
2194
except gnutls.Error as error:
1707
except gnutls.errors.GNUTLSError as error:
2195
1708
logger.warning("Handshake failed: %s", error)
2196
1709
# Do not run session.bye() here: the session is not
2197
1710
# established. Just abandon the request.
2201
1714
approval_required = False
2202
1715
try:
2203
1716
try:
2204
fpr = self.fingerprint(
2205
self.peer_certificate(session))
2206
except (TypeError, gnutls.Error) as error:
1717
fpr = self.fingerprint(self.peer_certificate
1718
(session))
1719
except (TypeError,
1720
gnutls.errors.GNUTLSError) as error:
2207
1721
logger.warning("Bad certificate: %s", error)
2208
1722
return
2209
1723
logger.debug("Fingerprint: %s", fpr)
2222
1736
while True:
2223
1737
if not client.enabled:
2224
1738
logger.info("Client %s is disabled",
2225
client.name)
1739
client.name)
2226
1740
if self.server.use_dbus:
2227
1741
# Emit D-Bus signal
2228
1742
client.Rejected("Disabled")
2237
1751
if self.server.use_dbus:
2238
1752
# Emit D-Bus signal
2239
1753
client.NeedApproval(
2240
client.approval_delay.total_seconds()
2241
* 1000, client.approved_by_default)
1754
client.approval_delay_milliseconds(),
1755
client.approved_by_default)
2242
1756
else:
2243
1757
logger.warning("Client %s was not approved",
2244
1758
client.name)
2250
1764
#wait until timeout or approved
2251
1765
time = datetime.datetime.now()
2252
1766
client.changedstate.acquire()
2253
client.changedstate.wait(delay.total_seconds())
1767
client.changedstate.wait(
1768
float(timedelta_to_milliseconds(delay)
1769
/ 1000))
2254
1770
client.changedstate.release()
2255
1771
time2 = datetime.datetime.now()
2256
1772
if (time2 - time) >= delay:
2267
1783
else:
2268
1784
delay -= time2 - time
2269
1785
2270
try:
2271
session.send(client.secret)
2272
except gnutls.Error as error:
2273
logger.warning("gnutls send failed",
2274
exc_info = error)
2275
return
1786
sent_size = 0
1787
while sent_size < len(client.secret):
1788
try:
1789
sent = session.send(client.secret[sent_size:])
1790
except gnutls.errors.GNUTLSError as error:
1791
logger.warning("gnutls send failed",
1792
exc_info=error)
1793
return
1794
logger.debug("Sent: %d, remaining: %d",
1795
sent, len(client.secret)
1796
- (sent_size + sent))
1797
sent_size += sent
2276
1798
2277
1799
logger.info("Sending secret to %s", client.name)
2278
1800
# bump the timeout using extended_timeout
2286
1808
client.approvals_pending -= 1
2287
1809
try:
2288
1810
session.bye()
2289
except gnutls.Error as error:
1811
except gnutls.errors.GNUTLSError as error:
2290
1812
logger.warning("GnuTLS bye failed",
2291
1813
exc_info=error)
2292
1814
2294
1816
def peer_certificate(session):
2295
1817
"Return the peer's OpenPGP certificate as a bytestring"
2296
1818
# If not an OpenPGP certificate...
2297
if (gnutls.certificate_type_get(session._c_object)
2298
!= gnutls.CRT_OPENPGP):
2299
# ...return invalid data
2300
return b""
1819
if (gnutls.library.functions
1820
.gnutls_certificate_type_get(session._c_object)
1821
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1822
# ...do the normal thing
1823
return session.peer_certificate
2301
1824
list_size = ctypes.c_uint(1)
2302
cert_list = (gnutls.certificate_get_peers
1825
cert_list = (gnutls.library.functions
1826
.gnutls_certificate_get_peers
2303
1827
(session._c_object, ctypes.byref(list_size)))
2304
1828
if not bool(cert_list) and list_size.value != 0:
2305
raise gnutls.Error("error getting peer certificate")
1829
raise gnutls.errors.GNUTLSError("error getting peer"
1830
" certificate")
2306
1831
if list_size.value == 0:
2307
1832
return None
2308
1833
cert = cert_list[0]
2312
1837
def fingerprint(openpgp):
2313
1838
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2314
1839
# New GnuTLS "datum" with the OpenPGP public key
2315
datum = gnutls.datum_t(
2316
ctypes.cast(ctypes.c_char_p(openpgp),
2317
ctypes.POINTER(ctypes.c_ubyte)),
2318
ctypes.c_uint(len(openpgp)))
1840
datum = (gnutls.library.types
1841
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1842
ctypes.POINTER
1843
(ctypes.c_ubyte)),
1844
ctypes.c_uint(len(openpgp))))
2319
1845
# New empty GnuTLS certificate
2320
crt = gnutls.openpgp_crt_t()
2321
gnutls.openpgp_crt_init(ctypes.byref(crt))
1846
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1847
(gnutls.library.functions
1848
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2322
1849
# Import the OpenPGP public key into the certificate
2323
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2324
gnutls.OPENPGP_FMT_RAW)
1850
(gnutls.library.functions
1851
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1852
gnutls.library.constants
1853
.GNUTLS_OPENPGP_FMT_RAW))
2325
1854
# Verify the self signature in the key
2326
1855
crtverify = ctypes.c_uint()
2327
gnutls.openpgp_crt_verify_self(crt, 0,
2328
ctypes.byref(crtverify))
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_verify_self(crt, 0,
1858
ctypes.byref(crtverify)))
2329
1859
if crtverify.value != 0:
2330
gnutls.openpgp_crt_deinit(crt)
2331
raise gnutls.CertificateSecurityError("Verify failed")
1860
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1861
raise (gnutls.errors.CertificateSecurityError
1862
("Verify failed"))
2332
1863
# New buffer for the fingerprint
2333
1864
buf = ctypes.create_string_buffer(20)
2334
1865
buf_len = ctypes.c_size_t()
2335
1866
# Get the fingerprint from the certificate into the buffer
2336
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2337
ctypes.byref(buf_len))
1867
(gnutls.library.functions
1868
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1869
ctypes.byref(buf_len)))
2338
1870
# Deinit the certificate
2339
gnutls.openpgp_crt_deinit(crt)
1871
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2340
1872
# Convert the buffer to a Python bytestring
2341
1873
fpr = ctypes.string_at(buf, buf_len.value)
2342
1874
# Convert the bytestring to hexadecimal notation
2346
1878
2347
1879
class MultiprocessingMixIn(object):
2348
1880
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2349
2350
1881
def sub_process_main(self, request, address):
2351
1882
try:
2352
1883
self.finish_request(request, address)
2364
1895
2365
1896
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2366
1897
""" adds a pipe to the MixIn """
2367
2368
1898
def process_request(self, request, client_address):
2369
1899
"""Overrides and wraps the original process_request().
2370
1900
2379
1909
2380
1910
def add_pipe(self, parent_pipe, proc):
2381
1911
"""Dummy function; override as necessary"""
2382
raise NotImplementedError()
1912
raise NotImplementedError
2383
1913
2384
1914
2385
1915
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2391
1921
interface: None or a network interface name (string)
2392
1922
use_ipv6: Boolean; to use IPv6 or not
2393
1923
"""
2394
2395
1924
def __init__(self, server_address, RequestHandlerClass,
2396
interface=None,
2397
use_ipv6=True,
2398
socketfd=None):
1925
interface=None, use_ipv6=True, socketfd=None):
2399
1926
"""If socketfd is set, use that file descriptor instead of
2400
1927
creating a new one with socket.socket().
2401
1928
"""
2442
1969
self.interface)
2443
1970
else:
2444
1971
try:
2445
self.socket.setsockopt(
2446
socket.SOL_SOCKET, SO_BINDTODEVICE,
2447
(self.interface + "\0").encode("utf-8"))
1972
self.socket.setsockopt(socket.SOL_SOCKET,
1973
SO_BINDTODEVICE,
1974
str(self.interface + '\0'))
2448
1975
except socket.error as error:
2449
1976
if error.errno == errno.EPERM:
2450
1977
logger.error("No permission to bind to"
2468
1995
self.server_address = (any_address,
2469
1996
self.server_address[1])
2470
1997
elif not self.server_address[1]:
2471
self.server_address = (self.server_address[0], 0)
1998
self.server_address = (self.server_address[0],
1999
0)
2472
2000
# if self.interface:
2473
2001
# self.server_address = (self.server_address[0],
2474
2002
# 0, # port
2486
2014
gnutls_priority GnuTLS priority string
2487
2015
use_dbus: Boolean; to emit D-Bus signals or not
2488
2016
2489
Assumes a GLib.MainLoop event loop.
2017
Assumes a gobject.MainLoop event loop.
2490
2018
"""
2491
2492
2019
def __init__(self, server_address, RequestHandlerClass,
2493
interface=None,
2494
use_ipv6=True,
2495
clients=None,
2496
gnutls_priority=None,
2497
use_dbus=True,
2498
socketfd=None):
2020
interface=None, use_ipv6=True, clients=None,
2021
gnutls_priority=None, use_dbus=True, socketfd=None):
2499
2022
self.enabled = False
2500
2023
self.clients = clients
2501
2024
if self.clients is None:
2507
2030
interface = interface,
2508
2031
use_ipv6 = use_ipv6,
2509
2032
socketfd = socketfd)
2510
2511
2033
def server_activate(self):
2512
2034
if self.enabled:
2513
2035
return socketserver.TCPServer.server_activate(self)
2517
2039
2518
2040
def add_pipe(self, parent_pipe, proc):
2519
2041
# Call "handle_ipc" for both data and EOF events
2520
GLib.io_add_watch(
2521
parent_pipe.fileno(),
2522
GLib.IO_IN | GLib.IO_HUP,
2523
functools.partial(self.handle_ipc,
2524
parent_pipe = parent_pipe,
2525
proc = proc))
2042
gobject.io_add_watch(parent_pipe.fileno(),
2043
gobject.IO_IN | gobject.IO_HUP,
2044
functools.partial(self.handle_ipc,
2045
parent_pipe =
2046
parent_pipe,
2047
proc = proc))
2526
2048
2527
def handle_ipc(self, source, condition,
2528
parent_pipe=None,
2529
proc = None,
2530
client_object=None):
2049
def handle_ipc(self, source, condition, parent_pipe=None,
2050
proc = None, client_object=None):
2531
2051
# error, or the other end of multiprocessing.Pipe has closed
2532
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2052
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2533
2053
# Wait for other process to exit
2534
2054
proc.join()
2535
2055
return False
2542
2062
fpr = request[1]
2543
2063
address = request[2]
2544
2064
2545
for c in self.clients.values():
2065
for c in self.clients.itervalues():
2546
2066
if c.fingerprint == fpr:
2547
2067
client = c
2548
2068
break
2556
2076
parent_pipe.send(False)
2557
2077
return False
2558
2078
2559
GLib.io_add_watch(
2560
parent_pipe.fileno(),
2561
GLib.IO_IN | GLib.IO_HUP,
2562
functools.partial(self.handle_ipc,
2563
parent_pipe = parent_pipe,
2564
proc = proc,
2565
client_object = client))
2079
gobject.io_add_watch(parent_pipe.fileno(),
2080
gobject.IO_IN | gobject.IO_HUP,
2081
functools.partial(self.handle_ipc,
2082
parent_pipe =
2083
parent_pipe,
2084
proc = proc,
2085
client_object =
2086
client))
2566
2087
parent_pipe.send(True)
2567
2088
# remove the old hook in favor of the new above hook on
2568
2089
# same fileno
2574
2095
2575
2096
parent_pipe.send(('data', getattr(client_object,
2576
2097
funcname)(*args,
2577
**kwargs)))
2098
**kwargs)))
2578
2099
2579
2100
if command == 'getattr':
2580
2101
attrname = request[1]
2581
if isinstance(client_object.__getattribute__(attrname),
2582
collections.Callable):
2583
parent_pipe.send(('function', ))
2102
if callable(client_object.__getattribute__(attrname)):
2103
parent_pipe.send(('function',))
2584
2104
else:
2585
parent_pipe.send((
2586
'data', client_object.__getattribute__(attrname)))
2105
parent_pipe.send(('data', client_object
2106
.__getattribute__(attrname)))
2587
2107
2588
2108
if command == 'setattr':
2589
2109
attrname = request[1]
2620
2140
# avoid excessive use of external libraries.
2621
2141
2622
2142
# New type for defining tokens, syntax, and semantics all-in-one
2623
Token = collections.namedtuple("Token", (
2624
"regexp", # To match token; if "value" is not None, must have
2625
# a "group" containing digits
2626
"value", # datetime.timedelta or None
2627
"followers")) # Tokens valid after this token
2143
Token = collections.namedtuple("Token",
2144
("regexp", # To match token; if
2145
# "value" is not None,
2146
# must have a "group"
2147
# containing digits
2148
"value", # datetime.timedelta or
2149
# None
2150
"followers")) # Tokens valid after
2151
# this token
2628
2152
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2629
2153
# the "duration" ABNF definition in RFC 3339, Appendix A.
2630
2154
token_end = Token(re.compile(r"$"), None, frozenset())
2631
2155
token_second = Token(re.compile(r"(\d+)S"),
2632
2156
datetime.timedelta(seconds=1),
2633
frozenset((token_end, )))
2157
frozenset((token_end,)))
2634
2158
token_minute = Token(re.compile(r"(\d+)M"),
2635
2159
datetime.timedelta(minutes=1),
2636
2160
frozenset((token_second, token_end)))
2652
2176
frozenset((token_month, token_end)))
2653
2177
token_week = Token(re.compile(r"(\d+)W"),
2654
2178
datetime.timedelta(weeks=1),
2655
frozenset((token_end, )))
2179
frozenset((token_end,)))
2656
2180
token_duration = Token(re.compile(r"P"), None,
2657
2181
frozenset((token_year, token_month,
2658
2182
token_day, token_time,
2659
token_week)))
2183
token_week))),
2660
2184
# Define starting values
2661
2185
value = datetime.timedelta() # Value so far
2662
2186
found_token = None
2663
followers = frozenset((token_duration, )) # Following valid tokens
2187
followers = frozenset(token_duration,) # Following valid tokens
2664
2188
s = duration # String left to parse
2665
2189
# Loop until end token is found
2666
2190
while found_token is not token_end:
2683
2207
break
2684
2208
else:
2685
2209
# No currently valid tokens were found
2686
raise ValueError("Invalid RFC 3339 duration: {!r}"
2687
.format(duration))
2210
raise ValueError("Invalid RFC 3339 duration")
2688
2211
# End token found
2689
2212
return value
2690
2213
2714
2237
timevalue = datetime.timedelta(0)
2715
2238
for s in interval.split():
2716
2239
try:
2717
suffix = s[-1]
2240
suffix = unicode(s[-1])
2718
2241
value = int(s[:-1])
2719
2242
if suffix == "d":
2720
2243
delta = datetime.timedelta(value)
2727
2250
elif suffix == "w":
2728
2251
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2729
2252
else:
2730
raise ValueError("Unknown suffix {!r}".format(suffix))
2731
except IndexError as e:
2253
raise ValueError("Unknown suffix {0!r}"
2254
.format(suffix))
2255
except (ValueError, IndexError) as e:
2732
2256
raise ValueError(*(e.args))
2733
2257
timevalue += delta
2734
2258
return timevalue
2750
2274
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2751
2275
if not stat.S_ISCHR(os.fstat(null).st_mode):
2752
2276
raise OSError(errno.ENODEV,
2753
"{} not a character device"
2277
"{0} not a character device"
2754
2278
.format(os.devnull))
2755
2279
os.dup2(null, sys.stdin.fileno())
2756
2280
os.dup2(null, sys.stdout.fileno())
2766
2290
2767
2291
parser = argparse.ArgumentParser()
2768
2292
parser.add_argument("-v", "--version", action="version",
2769
version = "%(prog)s {}".format(version),
2293
version = "%(prog)s {0}".format(version),
2770
2294
help="show version number and exit")
2771
2295
parser.add_argument("-i", "--interface", metavar="IF",
2772
2296
help="Bind to interface IF")
2805
2329
help="Directory to save/restore state in")
2806
2330
parser.add_argument("--foreground", action="store_true",
2807
2331
help="Run in foreground", default=None)
2808
parser.add_argument("--no-zeroconf", action="store_false",
2809
dest="zeroconf", help="Do not use Zeroconf",
2810
default=None)
2811
2332
2812
2333
options = parser.parse_args()
2813
2334
2814
2335
if options.check:
2815
2336
import doctest
2816
fail_count, test_count = doctest.testmod()
2817
sys.exit(os.EX_OK if fail_count == 0 else 1)
2337
doctest.testmod()
2338
sys.exit()
2818
2339
2819
2340
# Default values for config file for server-global settings
2820
2341
server_defaults = { "interface": "",
2822
2343
"port": "",
2823
2344
"debug": "False",
2824
2345
"priority":
2825
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2826
":+SIGN-DSA-SHA256",
2346
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",
2827
2347
"servicename": "Mandos",
2828
2348
"use_dbus": "True",
2829
2349
"use_ipv6": "True",
2832
2352
"socket": "",
2833
2353
"statedir": "/var/lib/mandos",
2834
2354
"foreground": "False",
2835
"zeroconf": "True",
2836
}
2355
}
2837
2356
2838
2357
# Parse config file for server-global settings
2839
2358
server_config = configparser.SafeConfigParser(server_defaults)
2840
2359
del server_defaults
2841
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2360
server_config.read(os.path.join(options.configdir,
2361
"mandos.conf"))
2842
2362
# Convert the SafeConfigParser object to a dict
2843
2363
server_settings = server_config.defaults()
2844
2364
# Use the appropriate methods on the non-string config options
2862
2382
# Override the settings from the config file with command line
2863
2383
# options, if set.
2864
2384
for option in ("interface", "address", "port", "debug",
2865
"priority", "servicename", "configdir", "use_dbus",
2866
"use_ipv6", "debuglevel", "restore", "statedir",
2867
"socket", "foreground", "zeroconf"):
2385
"priority", "servicename", "configdir",
2386
"use_dbus", "use_ipv6", "debuglevel", "restore",
2387
"statedir", "socket", "foreground"):
2868
2388
value = getattr(options, option)
2869
2389
if value is not None:
2870
2390
server_settings[option] = value
2871
2391
del options
2872
2392
# Force all strings to be unicode
2873
2393
for option in server_settings.keys():
2874
if isinstance(server_settings[option], bytes):
2875
server_settings[option] = (server_settings[option]
2876
.decode("utf-8"))
2394
if type(server_settings[option]) is str:
2395
server_settings[option] = unicode(server_settings[option])
2877
2396
# Force all boolean options to be boolean
2878
2397
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2879
"foreground", "zeroconf"):
2398
"foreground"):
2880
2399
server_settings[option] = bool(server_settings[option])
2881
2400
# Debug implies foreground
2882
2401
if server_settings["debug"]:
2885
2404
2886
2405
##################################################################
2887
2406
2888
if (not server_settings["zeroconf"]
2889
and not (server_settings["port"]
2890
or server_settings["socket"] != "")):
2891
parser.error("Needs port or socket to work without Zeroconf")
2892
2893
2407
# For convenience
2894
2408
debug = server_settings["debug"]
2895
2409
debuglevel = server_settings["debuglevel"]
2898
2412
stored_state_path = os.path.join(server_settings["statedir"],
2899
2413
stored_state_file)
2900
2414
foreground = server_settings["foreground"]
2901
zeroconf = server_settings["zeroconf"]
2902
2415
2903
2416
if debug:
2904
2417
initlogger(debug, logging.DEBUG)
2910
2423
initlogger(debug, level)
2911
2424
2912
2425
if server_settings["servicename"] != "Mandos":
2913
syslogger.setFormatter(
2914
logging.Formatter('Mandos ({}) [%(process)d]:'
2915
' %(levelname)s: %(message)s'.format(
2916
server_settings["servicename"])))
2426
syslogger.setFormatter(logging.Formatter
2427
('Mandos ({0}) [%(process)d]:'
2428
' %(levelname)s: %(message)s'
2429
.format(server_settings
2430
["servicename"])))
2917
2431
2918
2432
# Parse config file with clients
2919
2433
client_config = configparser.SafeConfigParser(Client
2924
2438
global mandos_dbus_service
2925
2439
mandos_dbus_service = None
2926
2440
2927
socketfd = None
2928
if server_settings["socket"] != "":
2929
socketfd = server_settings["socket"]
2930
tcp_server = MandosServer(
2931
(server_settings["address"], server_settings["port"]),
2932
ClientHandler,
2933
interface=(server_settings["interface"] or None),
2934
use_ipv6=use_ipv6,
2935
gnutls_priority=server_settings["priority"],
2936
use_dbus=use_dbus,
2937
socketfd=socketfd)
2441
tcp_server = MandosServer((server_settings["address"],
2442
server_settings["port"]),
2443
ClientHandler,
2444
interface=(server_settings["interface"]
2445
or None),
2446
use_ipv6=use_ipv6,
2447
gnutls_priority=
2448
server_settings["priority"],
2449
use_dbus=use_dbus,
2450
socketfd=(server_settings["socket"]
2451
or None))
2938
2452
if not foreground:
2939
2453
pidfilename = "/run/mandos.pid"
2940
if not os.path.isdir("/run/."):
2941
pidfilename = "/var/run/mandos.pid"
2942
2454
pidfile = None
2943
2455
try:
2944
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2456
pidfile = open(pidfilename, "w")
2945
2457
except IOError as e:
2946
2458
logger.error("Could not open file %r", pidfilename,
2947
2459
exc_info=e)
2948
2460
2949
for name, group in (("_mandos", "_mandos"),
2950
("mandos", "mandos"),
2951
("nobody", "nogroup")):
2461
for name in ("_mandos", "mandos", "nobody"):
2952
2462
try:
2953
2463
uid = pwd.getpwnam(name).pw_uid
2954
gid = pwd.getpwnam(group).pw_gid
2464
gid = pwd.getpwnam(name).pw_gid
2955
2465
break
2956
2466
except KeyError:
2957
2467
continue
2961
2471
try:
2962
2472
os.setgid(gid)
2963
2473
os.setuid(uid)
2964
if debug:
2965
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2966
gid))
2967
2474
except OSError as error:
2968
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2969
.format(uid, gid, os.strerror(error.errno)))
2970
2475
if error.errno != errno.EPERM:
2971
raise
2476
raise error
2972
2477
2973
2478
if debug:
2974
2479
# Enable all possible GnuTLS debugging
2975
2480
2976
2481
# "Use a log level over 10 to enable all debugging options."
2977
2482
# - GnuTLS manual
2978
gnutls.global_set_log_level(11)
2483
gnutls.library.functions.gnutls_global_set_log_level(11)
2979
2484
2980
@gnutls.log_func
2485
@gnutls.library.types.gnutls_log_func
2981
2486
def debug_gnutls(level, string):
2982
2487
logger.debug("GnuTLS: %s", string[:-1])
2983
2488
2984
gnutls.global_set_log_function(debug_gnutls)
2489
(gnutls.library.functions
2490
.gnutls_global_set_log_function(debug_gnutls))
2985
2491
2986
2492
# Redirect stdin so all checkers get /dev/null
2987
2493
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2994
2500
# Close all input and output, do double fork, etc.
2995
2501
daemon()
2996
2502
2997
# multiprocessing will use threads, so before we use GLib we need
2998
# to inform GLib that threads will be used.
2999
GLib.threads_init()
2503
# multiprocessing will use threads, so before we use gobject we
2504
# need to inform gobject that threads will be used.
2505
gobject.threads_init()
3000
2506
3001
2507
global main_loop
3002
2508
# From the Avahi example code
3003
2509
DBusGMainLoop(set_as_default=True)
3004
main_loop = GLib.MainLoop()
2510
main_loop = gobject.MainLoop()
3005
2511
bus = dbus.SystemBus()
3006
2512
# End of Avahi example code
3007
2513
if use_dbus:
3008
2514
try:
3009
2515
bus_name = dbus.service.BusName("se.recompile.Mandos",
3010
bus,
3011
do_not_queue=True)
3012
old_bus_name = dbus.service.BusName(
3013
"se.bsnet.fukt.Mandos", bus,
3014
do_not_queue=True)
3015
except dbus.exceptions.DBusException as e:
2516
bus, do_not_queue=True)
2517
old_bus_name = (dbus.service.BusName
2518
("se.bsnet.fukt.Mandos", bus,
2519
do_not_queue=True))
2520
except dbus.exceptions.NameExistsException as e:
3016
2521
logger.error("Disabling D-Bus:", exc_info=e)
3017
2522
use_dbus = False
3018
2523
server_settings["use_dbus"] = False
3019
2524
tcp_server.use_dbus = False
3020
if zeroconf:
3021
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3022
service = AvahiServiceToSyslog(
3023
name = server_settings["servicename"],
3024
servicetype = "_mandos._tcp",
3025
protocol = protocol,
3026
bus = bus)
3027
if server_settings["interface"]:
3028
service.interface = if_nametoindex(
3029
server_settings["interface"].encode("utf-8"))
2525
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2526
service = AvahiServiceToSyslog(name =
2527
server_settings["servicename"],
2528
servicetype = "_mandos._tcp",
2529
protocol = protocol, bus = bus)
2530
if server_settings["interface"]:
2531
service.interface = (if_nametoindex
2532
(str(server_settings["interface"])))
3030
2533
3031
2534
global multiprocessing_manager
3032
2535
multiprocessing_manager = multiprocessing.Manager()
3051
2554
if server_settings["restore"]:
3052
2555
try:
3053
2556
with open(stored_state_path, "rb") as stored_state:
3054
if sys.version_info.major == 2:
3055
clients_data, old_client_settings = pickle.load(
3056
stored_state)
3057
else:
3058
bytes_clients_data, bytes_old_client_settings = (
3059
pickle.load(stored_state, encoding = "bytes"))
3060
### Fix bytes to strings
3061
## clients_data
3062
# .keys()
3063
clients_data = { (key.decode("utf-8")
3064
if isinstance(key, bytes)
3065
else key): value
3066
for key, value in
3067
bytes_clients_data.items() }
3068
del bytes_clients_data
3069
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3074
clients_data[key] = value
3075
# .client_structure
3076
value["client_structure"] = [
3077
(s.decode("utf-8")
3078
if isinstance(s, bytes)
3079
else s) for s in
3080
value["client_structure"] ]
3081
# .name & .host
3082
for k in ("name", "host"):
3083
if isinstance(value[k], bytes):
3084
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys()
3087
old_client_settings = {
3088
(key.decode("utf-8")
3089
if isinstance(key, bytes)
3090
else key): value
3091
for key, value in
3092
bytes_old_client_settings.items() }
3093
del bytes_old_client_settings
3094
# .host
3095
for value in old_client_settings.values():
3096
if isinstance(value["host"], bytes):
3097
value["host"] = (value["host"]
3098
.decode("utf-8"))
2557
clients_data, old_client_settings = (pickle.load
2558
(stored_state))
3099
2559
os.remove(stored_state_path)
3100
2560
except IOError as e:
3101
2561
if e.errno == errno.ENOENT:
3102
logger.warning("Could not load persistent state:"
3103
" {}".format(os.strerror(e.errno)))
2562
logger.warning("Could not load persistent state: {0}"
2563
.format(os.strerror(e.errno)))
3104
2564
else:
3105
2565
logger.critical("Could not load persistent state:",
3106
2566
exc_info=e)
3107
2567
raise
3108
2568
except EOFError as e:
3109
2569
logger.warning("Could not load persistent state: "
3110
"EOFError:",
3111
exc_info=e)
2570
"EOFError:", exc_info=e)
3112
2571
3113
2572
with PGPEngine() as pgp:
3114
for client_name, client in clients_data.items():
2573
for client_name, client in clients_data.iteritems():
3115
2574
# Skip removed clients
3116
2575
if client_name not in client_settings:
3117
2576
continue
3126
2585
# For each value in new config, check if it
3127
2586
# differs from the old config value (Except for
3128
2587
# the "secret" attribute)
3129
if (name != "secret"
3130
and (value !=
3131
old_client_settings[client_name][name])):
2588
if (name != "secret" and
2589
value != old_client_settings[client_name]
2590
[name]):
3132
2591
client[name] = value
3133
2592
except KeyError:
3134
2593
pass
3135
2594
3136
2595
# Clients who has passed its expire date can still be
3137
# enabled if its last checker was successful. A Client
2596
# enabled if its last checker was successful. Clients
3138
2597
# whose checker succeeded before we stored its state is
3139
2598
# assumed to have successfully run all checkers during
3140
2599
# downtime.
3142
2601
if datetime.datetime.utcnow() >= client["expires"]:
3143
2602
if not client["last_checked_ok"]:
3144
2603
logger.warning(
3145
"disabling client {} - Client never "
3146
"performed a successful checker".format(
3147
client_name))
2604
"disabling client {0} - Client never "
2605
"performed a successful checker"
2606
.format(client_name))
3148
2607
client["enabled"] = False
3149
2608
elif client["last_checker_status"] != 0:
3150
2609
logger.warning(
3151
"disabling client {} - Client last"
3152
" checker failed with error code"
3153
" {}".format(
3154
client_name,
3155
client["last_checker_status"]))
2610
"disabling client {0} - Client "
2611
"last checker failed with error code {1}"
2612
.format(client_name,
2613
client["last_checker_status"]))
3156
2614
client["enabled"] = False
3157
2615
else:
3158
client["expires"] = (
3159
datetime.datetime.utcnow()
3160
+ client["timeout"])
2616
client["expires"] = (datetime.datetime
2617
.utcnow()
2618
+ client["timeout"])
3161
2619
logger.debug("Last checker succeeded,"
3162
" keeping {} enabled".format(
3163
client_name))
2620
" keeping {0} enabled"
2621
.format(client_name))
3164
2622
try:
3165
client["secret"] = pgp.decrypt(
3166
client["encrypted_secret"],
3167
client_settings[client_name]["secret"])
2623
client["secret"] = (
2624
pgp.decrypt(client["encrypted_secret"],
2625
client_settings[client_name]
2626
["secret"]))
3168
2627
except PGPError:
3169
2628
# If decryption fails, we use secret from new settings
3170
logger.debug("Failed to decrypt {} old secret".format(
3171
client_name))
3172
client["secret"] = (client_settings[client_name]
3173
["secret"])
2629
logger.debug("Failed to decrypt {0} old secret"
2630
.format(client_name))
2631
client["secret"] = (
2632
client_settings[client_name]["secret"])
3174
2633
3175
2634
# Add/remove clients based on new changes made to config
3176
2635
for client_name in (set(old_client_settings)
3181
2640
clients_data[client_name] = client_settings[client_name]
3182
2641
3183
2642
# Create all client objects
3184
for client_name, client in clients_data.items():
2643
for client_name, client in clients_data.iteritems():
3185
2644
tcp_server.clients[client_name] = client_class(
3186
name = client_name,
3187
settings = client,
2645
name = client_name, settings = client,
3188
2646
server_settings = server_settings)
3189
2647
3190
2648
if not tcp_server.clients:
3192
2650
3193
2651
if not foreground:
3194
2652
if pidfile is not None:
3195
pid = os.getpid()
3196
2653
try:
3197
2654
with pidfile:
3198
print(pid, file=pidfile)
2655
pid = os.getpid()
2656
pidfile.write(str(pid) + "\n".encode("utf-8"))
3199
2657
except IOError:
3200
2658
logger.error("Could not write to file %r with PID %d",
3201
2659
pidfilename, pid)
3202
2660
del pidfile
3203
2661
del pidfilename
3204
2662
3205
for termsig in (signal.SIGHUP, signal.SIGTERM):
3206
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3207
lambda: main_loop.quit() and False)
2663
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2664
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3208
2665
3209
2666
if use_dbus:
3210
3211
@alternate_dbus_interfaces(
3212
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3213
class MandosDBusService(DBusObjectWithObjectManager):
2667
@alternate_dbus_interfaces({"se.recompile.Mandos":
2668
"se.bsnet.fukt.Mandos"})
2669
class MandosDBusService(DBusObjectWithProperties):
3214
2670
"""A D-Bus proxy object"""
3215
3216
2671
def __init__(self):
3217
2672
dbus.service.Object.__init__(self, bus, "/")
3218
3219
2673
_interface = "se.recompile.Mandos"
3220
2674
2675
@dbus_interface_annotations(_interface)
2676
def _foo(self):
2677
return { "org.freedesktop.DBus.Property"
2678
".EmitsChangedSignal":
2679
"false"}
2680
3221
2681
@dbus.service.signal(_interface, signature="o")
3222
2682
def ClientAdded(self, objpath):
3223
2683
"D-Bus signal"
3228
2688
"D-Bus signal"
3229
2689
pass
3230
2690
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3232
"true"})
3233
2691
@dbus.service.signal(_interface, signature="os")
3234
2692
def ClientRemoved(self, objpath, name):
3235
2693
"D-Bus signal"
3236
2694
pass
3237
2695
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3239
"true"})
3240
2696
@dbus.service.method(_interface, out_signature="ao")
3241
2697
def GetAllClients(self):
3242
2698
"D-Bus method"
3243
return dbus.Array(c.dbus_object_path for c in
3244
tcp_server.clients.values())
2699
return dbus.Array(c.dbus_object_path
2700
for c in
2701
tcp_server.clients.itervalues())
3245
2702
3246
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3247
"true"})
3248
2703
@dbus.service.method(_interface,
3249
2704
out_signature="a{oa{sv}}")
3250
2705
def GetAllClientsWithProperties(self):
3251
2706
"D-Bus method"
3252
2707
return dbus.Dictionary(
3253
{ c.dbus_object_path: c.GetAll(
3254
"se.recompile.Mandos.Client")
3255
for c in tcp_server.clients.values() },
2708
((c.dbus_object_path, c.GetAll(""))
2709
for c in tcp_server.clients.itervalues()),
3256
2710
signature="oa{sv}")
3257
2711
3258
2712
@dbus.service.method(_interface, in_signature="o")
3259
2713
def RemoveClient(self, object_path):
3260
2714
"D-Bus method"
3261
for c in tcp_server.clients.values():
2715
for c in tcp_server.clients.itervalues():
3262
2716
if c.dbus_object_path == object_path:
3263
2717
del tcp_server.clients[c.name]
3264
2718
c.remove_from_connection()
3265
# Don't signal the disabling
2719
# Don't signal anything except ClientRemoved
3266
2720
c.disable(quiet=True)
3267
# Emit D-Bus signal for removal
3268
self.client_removed_signal(c)
2721
# Emit D-Bus signal
2722
self.ClientRemoved(object_path, c.name)
3269
2723
return
3270
2724
raise KeyError(object_path)
3271
2725
3272
2726
del _interface
3273
3274
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3275
out_signature = "a{oa{sa{sv}}}")
3276
def GetManagedObjects(self):
3277
"""D-Bus method"""
3278
return dbus.Dictionary(
3279
{ client.dbus_object_path:
3280
dbus.Dictionary(
3281
{ interface: client.GetAll(interface)
3282
for interface in
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3285
3286
def client_added_signal(self, client):
3287
"""Send the new standard signal and the old signal"""
3288
if use_dbus:
3289
# New standard signal
3290
self.InterfacesAdded(
3291
client.dbus_object_path,
3292
dbus.Dictionary(
3293
{ interface: client.GetAll(interface)
3294
for interface in
3295
client._get_all_interface_names()}))
3296
# Old signal
3297
self.ClientAdded(client.dbus_object_path)
3298
3299
def client_removed_signal(self, client):
3300
"""Send the new standard signal and the old signal"""
3301
if use_dbus:
3302
# New standard signal
3303
self.InterfacesRemoved(
3304
client.dbus_object_path,
3305
client._get_all_interface_names())
3306
# Old signal
3307
self.ClientRemoved(client.dbus_object_path,
3308
client.name)
3309
2727
3310
2728
mandos_dbus_service = MandosDBusService()
3311
2729
3312
2730
def cleanup():
3313
2731
"Cleanup function; run on exit"
3314
if zeroconf:
3315
service.cleanup()
2732
service.cleanup()
3316
2733
3317
2734
multiprocessing.active_children()
3318
2735
wnull.close()
3324
2741
# removed/edited, old secret will thus be unrecovable.
3325
2742
clients = {}
3326
2743
with PGPEngine() as pgp:
3327
for client in tcp_server.clients.values():
2744
for client in tcp_server.clients.itervalues():
3328
2745
key = client_settings[client.name]["secret"]
3329
2746
client.encrypted_secret = pgp.encrypt(client.secret,
3330
2747
key)
3332
2749
3333
2750
# A list of attributes that can not be pickled
3334
2751
# + secret.
3335
exclude = { "bus", "changedstate", "secret",
3336
"checker", "server_settings" }
3337
for name, typ in inspect.getmembers(dbus.service
3338
.Object):
2752
exclude = set(("bus", "changedstate", "secret",
2753
"checker", "server_settings"))
2754
for name, typ in (inspect.getmembers
2755
(dbus.service.Object)):
3339
2756
exclude.add(name)
3340
2757
3341
2758
client_dict["encrypted_secret"] = (client
3348
2765
del client_settings[client.name]["secret"]
3349
2766
3350
2767
try:
3351
with tempfile.NamedTemporaryFile(
3352
mode='wb',
3353
suffix=".pickle",
3354
prefix='clients-',
3355
dir=os.path.dirname(stored_state_path),
3356
delete=False) as stored_state:
3357
pickle.dump((clients, client_settings), stored_state,
3358
protocol = 2)
3359
tempname = stored_state.name
2768
with (tempfile.NamedTemporaryFile
2769
(mode='wb', suffix=".pickle", prefix='clients-',
2770
dir=os.path.dirname(stored_state_path),
2771
delete=False)) as stored_state:
2772
pickle.dump((clients, client_settings), stored_state)
2773
tempname=stored_state.name
3360
2774
os.rename(tempname, stored_state_path)
3361
2775
except (IOError, OSError) as e:
3362
2776
if not debug:
3365
2779
except NameError:
3366
2780
pass
3367
2781
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3368
logger.warning("Could not save persistent state: {}"
2782
logger.warning("Could not save persistent state: {0}"
3369
2783
.format(os.strerror(e.errno)))
3370
2784
else:
3371
2785
logger.warning("Could not save persistent state:",
3372
2786
exc_info=e)
3373
raise
2787
raise e
3374
2788
3375
2789
# Delete all clients, and settings from config
3376
2790
while tcp_server.clients:
3377
2791
name, client = tcp_server.clients.popitem()
3378
2792
if use_dbus:
3379
2793
client.remove_from_connection()
3380
# Don't signal the disabling
2794
# Don't signal anything except ClientRemoved
3381
2795
client.disable(quiet=True)
3382
# Emit D-Bus signal for removal
3383
2796
if use_dbus:
3384
mandos_dbus_service.client_removed_signal(client)
2797
# Emit D-Bus signal
2798
mandos_dbus_service.ClientRemoved(client
2799
.dbus_object_path,
2800
client.name)
3385
2801
client_settings.clear()
3386
2802
3387
2803
atexit.register(cleanup)
3388
2804
3389
for client in tcp_server.clients.values():
2805
for client in tcp_server.clients.itervalues():
3390
2806
if use_dbus:
3391
# Emit D-Bus signal for adding
3392
mandos_dbus_service.client_added_signal(client)
2807
# Emit D-Bus signal
2808
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3393
2809
# Need to initiate checking of clients
3394
2810
if client.enabled:
3395
2811
client.init_checker()
3398
2814
tcp_server.server_activate()
3399
2815
3400
2816
# Find out what port we got
3401
if zeroconf:
3402
service.port = tcp_server.socket.getsockname()[1]
2817
service.port = tcp_server.socket.getsockname()[1]
3403
2818
if use_ipv6:
3404
2819
logger.info("Now listening on address %r, port %d,"
3405
2820
" flowinfo %d, scope_id %d",
3411
2826
#service.interface = tcp_server.socket.getsockname()[3]
3412
2827
3413
2828
try:
3414
if zeroconf:
3415
# From the Avahi example code
3416
try:
3417
service.activate()
3418
except dbus.exceptions.DBusException as error:
3419
logger.critical("D-Bus Exception", exc_info=error)
3420
cleanup()
3421
sys.exit(1)
3422
# End of Avahi example code
2829
# From the Avahi example code
2830
try:
2831
service.activate()
2832
except dbus.exceptions.DBusException as error:
2833
logger.critical("D-Bus Exception", exc_info=error)
2834
cleanup()
2835
sys.exit(1)
2836
# End of Avahi example code
3423
2837
3424
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3425
lambda *args, **kwargs:
3426
(tcp_server.handle_request
3427
(*args[2:], **kwargs) or True))
2838
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2839
lambda *args, **kwargs:
2840
(tcp_server.handle_request
2841
(*args[2:], **kwargs) or True))
3428
2842
3429
2843
logger.debug("Starting main loop")
3430
2844
main_loop.run()
3440
2854
# Must run before the D-Bus bus name gets deregistered
3441
2855
cleanup()
3442
2856
3443
3444
2857
if __name__ == '__main__':
3445
2858
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0