/mandos/release : revision 237.7.195

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

46

43

import errno

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

65

import cPickle as pickle

69

66

import multiprocessing

70

67

import types

71

68

import binascii

72

69

import tempfile

73

70

import itertools

74

71

import collections

75

import codecs

76

72

77

73

import dbus

78

74

import dbus.service

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

75

import gobject

83

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

95

88

except ImportError:

96

89

SO_BINDTODEVICE = None

97

90

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.1"

91

version = "1.6.2"

102

92

stored_state_file = "clients.pickle"

103

93

104

94

logger = logging.getLogger()

105

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

106

98

107

99

try:

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

110

103

except (OSError, AttributeError):

111

112

104

def if_nametoindex(interface):

113

105

"Get an interface index the hard way, i.e. using fcntl()"

114

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

115

107

with contextlib.closing(socket.socket()) as s:

116

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

117

struct.pack(b"16s16x", interface))

118

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

119

113

return interface_index

120

114

121

115

122

116

def initlogger(debug, level=logging.WARNING):

123

117

"""init logger and add loglevel"""

124

118

125

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

129

119

syslogger.setFormatter(logging.Formatter

130

120

('Mandos [%(process)d]: %(levelname)s:'

131

121

' %(message)s'))

148

138

149

139

class PGPEngine(object):

150

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

152

141

def __init__(self):

153

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

143

self.gnupgargs = ['--batch',

193

182

194

183

def encrypt(self, data, password):

195

184

passphrase = self.password_encode(password)

196

with tempfile.NamedTemporaryFile(

197

dir=self.tempdir) as passfile:

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

198

187

passfile.write(passphrase)

199

188

passfile.flush()

200

189

proc = subprocess.Popen(['gpg', '--symmetric',

211

200

212

201

def decrypt(self, data, password):

213

202

passphrase = self.password_encode(password)

214

with tempfile.NamedTemporaryFile(

215

dir = self.tempdir) as passfile:

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

216

205

passfile.write(passphrase)

217

206

passfile.flush()

218

207

proc = subprocess.Popen(['gpg', '--decrypt',

222

211

stdin = subprocess.PIPE,

223

212

stdout = subprocess.PIPE,

224

213

stderr = subprocess.PIPE)

225

decrypted_plaintext, err = proc.communicate(input = data)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

226

216

if proc.returncode != 0:

227

217

raise PGPError(err)

228

218

return decrypted_plaintext

231

221

class AvahiError(Exception):

232

222

def __init__(self, value, *args, **kwargs):

233

223

self.value = value

234

return super(AvahiError, self).__init__(value, *args,

235

**kwargs)

236

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

237

227

238

228

class AvahiServiceError(AvahiError):

239

229

pass

240

230

241

242

231

class AvahiGroupError(AvahiError):

243

232

pass

244

233

264

253

bus: dbus.SystemBus()

265

254

"""

266

255

267

def __init__(self,

268

interface = avahi.IF_UNSPEC,

269

name = None,

270

servicetype = None,

271

port = None,

272

TXT = None,

273

domain = "",

274

host = "",

275

max_renames = 32768,

276

protocol = avahi.PROTO_UNSPEC,

277

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

278

260

self.interface = interface

279

261

self.name = name

280

262

self.type = servicetype

290

272

self.bus = bus

291

273

self.entry_group_state_changed_match = None

292

274

293

def rename(self, remove=True):

275

def rename(self):

294

276

"""Derived from the Avahi example code"""

295

277

if self.rename_count >= self.max_renames:

296

278

logger.critical("No suitable Zeroconf service name found"

297

279

" after %i retries, exiting.",

298

280

self.rename_count)

299

281

raise AvahiServiceError("Too many renames")

300

self.name = str(

301

self.server.GetAlternativeServiceName(self.name))

302

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

303

284

logger.info("Changing Zeroconf service name to %r ...",

304

285

self.name)

305

if remove:

306

self.remove()

286

self.remove()

307

287

try:

308

288

self.add()

309

289

except dbus.exceptions.DBusException as error:

310

if (error.get_dbus_name()

311

== "org.freedesktop.Avahi.CollisionError"):

312

logger.info("Local Zeroconf service name collision.")

313

return self.rename(remove=False)

314

else:

315

logger.critical("D-Bus Exception", exc_info=error)

316

self.cleanup()

317

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

318

294

319

295

def remove(self):

320

296

"""Derived from the Avahi example code"""

358

334

self.rename()

359

335

elif state == avahi.ENTRY_GROUP_FAILURE:

360

336

logger.critical("Avahi: Error in group state changed %s",

361

str(error))

362

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

363

340

364

341

def cleanup(self):

365

342

"""Derived from the Avahi example code"""

375

352

def server_state_changed(self, state, error=None):

376

353

"""Derived from the Avahi example code"""

377

354

logger.debug("Avahi server state change: %i", state)

378

bad_states = {

379

avahi.SERVER_INVALID: "Zeroconf server invalid",

380

avahi.SERVER_REGISTERING: None,

381

avahi.SERVER_COLLISION: "Zeroconf server name collision",

382

avahi.SERVER_FAILURE: "Zeroconf server failure",

383

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

384

362

if state in bad_states:

385

363

if bad_states[state] is not None:

386

364

if error is None:

389

367

logger.error(bad_states[state] + ": %r", error)

390

368

self.cleanup()

391

369

elif state == avahi.SERVER_RUNNING:

392

try:

393

self.add()

394

except dbus.exceptions.DBusException as error:

395

if (error.get_dbus_name()

396

== "org.freedesktop.Avahi.CollisionError"):

397

logger.info("Local Zeroconf service name"

398

" collision.")

399

return self.rename(remove=False)

400

else:

401

logger.critical("D-Bus Exception", exc_info=error)

402

self.cleanup()

403

os._exit(1)

370

self.add()

404

371

else:

405

372

if error is None:

406

373

logger.debug("Unknown state: %r", state)

416

383

follow_name_owner_changes=True),

417

384

avahi.DBUS_INTERFACE_SERVER)

418

385

self.server.connect_to_signal("StateChanged",

419

self.server_state_changed)

386

self.server_state_changed)

420

387

self.server_state_changed(self.server.GetState())

421

388

422

389

423

390

class AvahiServiceToSyslog(AvahiService):

424

def rename(self, *args, **kwargs):

391

def rename(self):

425

392

"""Add the new name to the syslog messages"""

426

ret = AvahiService.rename(self, *args, **kwargs)

427

syslogger.setFormatter(logging.Formatter(

428

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

429

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

430

398

return ret

431

399

432

# Pretend that we have a GnuTLS module

433

class GnuTLS(object):

434

"""This isn't so much a class as it is a module-like namespace.

435

It is instantiated once, and simulates having a GnuTLS module."""

436

437

_library = ctypes.cdll.LoadLibrary(

438

ctypes.util.find_library("gnutls"))

439

_need_version = "3.3.0"

440

def __init__(self):

441

# Need to use class name "GnuTLS" here, since this method is

442

# called before the assignment to the "gnutls" global variable

443

# happens.

444

if GnuTLS.check_version(self._need_version) is None:

445

raise GnuTLS.Error("Needs GnuTLS {} or later"

446

.format(self._need_version))

447

448

# Unless otherwise indicated, the constants and types below are

449

# all from the gnutls/gnutls.h C header file.

450

451

# Constants

452

E_SUCCESS = 0

453

E_INTERRUPTED = -52

454

E_AGAIN = -28

455

CRT_OPENPGP = 2

456

CLIENT = 2

457

SHUT_RDWR = 0

458

CRD_CERTIFICATE = 1

459

E_NO_CERTIFICATE_FOUND = -49

460

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

461

462

# Types

463

class session_int(ctypes.Structure):

464

_fields_ = []

465

session_t = ctypes.POINTER(session_int)

466

class certificate_credentials_st(ctypes.Structure):

467

_fields_ = []

468

certificate_credentials_t = ctypes.POINTER(

469

certificate_credentials_st)

470

certificate_type_t = ctypes.c_int

471

class datum_t(ctypes.Structure):

472

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

473

('size', ctypes.c_uint)]

474

class openpgp_crt_int(ctypes.Structure):

475

_fields_ = []

476

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

477

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

478

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

479

credentials_type_t = ctypes.c_int #

480

transport_ptr_t = ctypes.c_void_p

481

close_request_t = ctypes.c_int

482

483

# Exceptions

484

class Error(Exception):

485

# We need to use the class name "GnuTLS" here, since this

486

# exception might be raised from within GnuTLS.__init__,

487

# which is called before the assignment to the "gnutls"

488

# global variable has happened.

489

def __init__(self, message = None, code = None, args=()):

490

# Default usage is by a message string, but if a return

491

# code is passed, convert it to a string with

492

# gnutls.strerror()

493

self.code = code

494

if message is None and code is not None:

495

message = GnuTLS.strerror(code)

496

return super(GnuTLS.Error, self).__init__(

497

message, *args)

498

499

class CertificateSecurityError(Error):

500

pass

501

502

# Classes

503

class Credentials(object):

504

def __init__(self):

505

self._c_object = gnutls.certificate_credentials_t()

506

gnutls.certificate_allocate_credentials(

507

ctypes.byref(self._c_object))

508

self.type = gnutls.CRD_CERTIFICATE

509

510

def __del__(self):

511

gnutls.certificate_free_credentials(self._c_object)

512

513

class ClientSession(object):

514

def __init__(self, socket, credentials = None):

515

self._c_object = gnutls.session_t()

516

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

517

gnutls.set_default_priority(self._c_object)

518

gnutls.transport_set_ptr(self._c_object, socket.fileno())

519

gnutls.handshake_set_private_extensions(self._c_object,

520

True)

521

self.socket = socket

522

if credentials is None:

523

credentials = gnutls.Credentials()

524

gnutls.credentials_set(self._c_object, credentials.type,

525

ctypes.cast(credentials._c_object,

526

ctypes.c_void_p))

527

self.credentials = credentials

528

529

def __del__(self):

530

gnutls.deinit(self._c_object)

531

532

def handshake(self):

533

return gnutls.handshake(self._c_object)

534

535

def send(self, data):

536

data = bytes(data)

537

data_len = len(data)

538

while data_len > 0:

539

data_len -= gnutls.record_send(self._c_object,

540

data[-data_len:],

541

data_len)

542

543

def bye(self):

544

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

545

546

# Error handling functions

547

def _error_code(result):

548

"""A function to raise exceptions on errors, suitable

549

for the 'restype' attribute on ctypes functions"""

550

if result >= 0:

551

return result

552

if result == gnutls.E_NO_CERTIFICATE_FOUND:

553

raise gnutls.CertificateSecurityError(code = result)

554

raise gnutls.Error(code = result)

555

556

def _retry_on_error(result, func, arguments):

557

"""A function to retry on some errors, suitable

558

for the 'errcheck' attribute on ctypes functions"""

559

while result < 0:

560

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

561

return _error_code(result)

562

result = func(*arguments)

563

return result

564

565

# Unless otherwise indicated, the function declarations below are

566

# all from the gnutls/gnutls.h C header file.

567

568

# Functions

569

priority_set_direct = _library.gnutls_priority_set_direct

570

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

571

ctypes.POINTER(ctypes.c_char_p)]

572

priority_set_direct.restype = _error_code

573

574

init = _library.gnutls_init

575

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

576

init.restype = _error_code

577

578

set_default_priority = _library.gnutls_set_default_priority

579

set_default_priority.argtypes = [session_t]

580

set_default_priority.restype = _error_code

581

582

record_send = _library.gnutls_record_send

583

record_send.argtypes = [session_t, ctypes.c_void_p,

584

ctypes.c_size_t]

585

record_send.restype = ctypes.c_ssize_t

586

record_send.errcheck = _retry_on_error

587

588

certificate_allocate_credentials = (

589

_library.gnutls_certificate_allocate_credentials)

590

certificate_allocate_credentials.argtypes = [

591

ctypes.POINTER(certificate_credentials_t)]

592

certificate_allocate_credentials.restype = _error_code

593

594

certificate_free_credentials = (

595

_library.gnutls_certificate_free_credentials)

596

certificate_free_credentials.argtypes = [certificate_credentials_t]

597

certificate_free_credentials.restype = None

598

599

handshake_set_private_extensions = (

600

_library.gnutls_handshake_set_private_extensions)

601

handshake_set_private_extensions.argtypes = [session_t,

602

ctypes.c_int]

603

handshake_set_private_extensions.restype = None

604

605

credentials_set = _library.gnutls_credentials_set

606

credentials_set.argtypes = [session_t, credentials_type_t,

607

ctypes.c_void_p]

608

credentials_set.restype = _error_code

609

610

strerror = _library.gnutls_strerror

611

strerror.argtypes = [ctypes.c_int]

612

strerror.restype = ctypes.c_char_p

613

614

certificate_type_get = _library.gnutls_certificate_type_get

615

certificate_type_get.argtypes = [session_t]

616

certificate_type_get.restype = _error_code

617

618

certificate_get_peers = _library.gnutls_certificate_get_peers

619

certificate_get_peers.argtypes = [session_t,

620

ctypes.POINTER(ctypes.c_uint)]

621

certificate_get_peers.restype = ctypes.POINTER(datum_t)

622

623

global_set_log_level = _library.gnutls_global_set_log_level

624

global_set_log_level.argtypes = [ctypes.c_int]

625

global_set_log_level.restype = None

626

627

global_set_log_function = _library.gnutls_global_set_log_function

628

global_set_log_function.argtypes = [log_func]

629

global_set_log_function.restype = None

630

631

deinit = _library.gnutls_deinit

632

deinit.argtypes = [session_t]

633

deinit.restype = None

634

635

handshake = _library.gnutls_handshake

636

handshake.argtypes = [session_t]

637

handshake.restype = _error_code

638

handshake.errcheck = _retry_on_error

639

640

transport_set_ptr = _library.gnutls_transport_set_ptr

641

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

642

transport_set_ptr.restype = None

643

644

bye = _library.gnutls_bye

645

bye.argtypes = [session_t, close_request_t]

646

bye.restype = _error_code

647

bye.errcheck = _retry_on_error

648

649

check_version = _library.gnutls_check_version

650

check_version.argtypes = [ctypes.c_char_p]

651

check_version.restype = ctypes.c_char_p

652

653

# All the function declarations below are from gnutls/openpgp.h

654

655

openpgp_crt_init = _library.gnutls_openpgp_crt_init

656

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

657

openpgp_crt_init.restype = _error_code

658

659

openpgp_crt_import = _library.gnutls_openpgp_crt_import

660

openpgp_crt_import.argtypes = [openpgp_crt_t,

661

ctypes.POINTER(datum_t),

662

openpgp_crt_fmt_t]

663

openpgp_crt_import.restype = _error_code

664

665

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

666

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

667

ctypes.POINTER(ctypes.c_uint)]

668

openpgp_crt_verify_self.restype = _error_code

669

670

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

671

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

672

openpgp_crt_deinit.restype = None

673

674

openpgp_crt_get_fingerprint = (

675

_library.gnutls_openpgp_crt_get_fingerprint)

676

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

677

ctypes.c_void_p,

678

ctypes.POINTER(

679

ctypes.c_size_t)]

680

openpgp_crt_get_fingerprint.restype = _error_code

681

682

# Remove non-public functions

683

del _error_code, _retry_on_error

684

# Create the global "gnutls" object, simulating a module

685

gnutls = GnuTLS()

686

687

def call_pipe(connection, # : multiprocessing.Connection

688

func, *args, **kwargs):

689

"""This function is meant to be called by multiprocessing.Process

690

691

This function runs func(*args, **kwargs), and writes the resulting

692

return value on the provided multiprocessing.Connection.

693

"""

694

connection.send(func(*args, **kwargs))

695

connection.close()

400

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

696

407

697

408

class Client(object):

698

409

"""A representation of a client host served by this server.

725

436

last_checker_status: integer between 0 and 255 reflecting exit

726

437

status of last checker. -1 reflects crashed

727

438

checker, -2 means no checker completed yet.

728

last_checker_signal: The signal which killed the last checker, if

729

last_checker_status is -1

730

439

last_enabled: datetime.datetime(); (UTC) or None

731

440

name: string; from the config file, used in log messages and

732

441

D-Bus identifiers

745

454

"fingerprint", "host", "interval",

746

455

"last_approval_request", "last_checked_ok",

747

456

"last_enabled", "name", "timeout")

748

client_defaults = {

749

"timeout": "PT5M",

750

"extended_timeout": "PT15M",

751

"interval": "PT2M",

752

"checker": "fping -q -- %%(host)s",

753

"host": "",

754

"approval_delay": "PT0S",

755

"approval_duration": "PT1S",

756

"approved_by_default": "True",

757

"enabled": "True",

758

}

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

759

482

760

483

@staticmethod

761

484

def config_parser(config):

777

500

client["enabled"] = config.getboolean(client_name,

778

501

"enabled")

779

502

780

# Uppercase and remove spaces from fingerprint for later

781

# comparison purposes with return value from the

782

# fingerprint() function

783

503

client["fingerprint"] = (section["fingerprint"].upper()

784

504

.replace(" ", ""))

785

505

if "secret" in section:

790

510

"rb") as secfile:

791

511

client["secret"] = secfile.read()

792

512

else:

793

raise TypeError("No secret or secfile for section {}"

513

raise TypeError("No secret or secfile for section {0}"

794

514

.format(section))

795

515

client["timeout"] = string_to_delta(section["timeout"])

796

516

client["extended_timeout"] = string_to_delta(

813

533

server_settings = {}

814

534

self.server_settings = server_settings

815

535

# adding all client settings

816

for setting, value in settings.items():

536

for setting, value in settings.iteritems():

817

537

setattr(self, setting, value)

818

538

819

539

if self.enabled:

827

547

self.expires = None

828

548

829

549

logger.debug("Creating client %r", self.name)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

830

553

logger.debug(" Fingerprint: %s", self.fingerprint)

831

554

self.created = settings.get("created",

832

555

datetime.datetime.utcnow())

839

562

self.current_checker_command = None

840

563

self.approved = None

841

564

self.approvals_pending = 0

842

self.changedstate = multiprocessing_manager.Condition(

843

multiprocessing_manager.Lock())

844

self.client_structure = [attr

845

for attr in self.__dict__.iterkeys()

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

846

570

if not attr.startswith("_")]

847

571

self.client_structure.append("client_structure")

848

572

849

for name, t in inspect.getmembers(

850

type(self), lambda obj: isinstance(obj, property)):

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

851

577

if not name.startswith("_"):

852

578

self.client_structure.append(name)

853

579

895

621

# and every interval from then on.

896

622

if self.checker_initiator_tag is not None:

897

623

gobject.source_remove(self.checker_initiator_tag)

898

self.checker_initiator_tag = gobject.timeout_add(

899

int(self.interval.total_seconds() * 1000),

900

self.start_checker)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

901

627

# Schedule a disable() when 'timeout' has passed

902

628

if self.disable_initiator_tag is not None:

903

629

gobject.source_remove(self.disable_initiator_tag)

904

self.disable_initiator_tag = gobject.timeout_add(

905

int(self.timeout.total_seconds() * 1000), self.disable)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

906

633

# Also start a new checker *right now*.

907

634

self.start_checker()

908

635

909

def checker_callback(self, source, condition, connection,

910

command):

636

def checker_callback(self, pid, condition, command):

911

637

"""The checker has completed, so take appropriate actions."""

912

638

self.checker_callback_tag = None

913

639

self.checker = None

914

# Read return code from connection (see call_pipe)

915

returncode = connection.recv()

916

connection.close()

917

918

if returncode >= 0:

919

self.last_checker_status = returncode

920

self.last_checker_signal = None

640

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

921

642

if self.last_checker_status == 0:

922

643

logger.info("Checker for %(name)s succeeded",

923

644

vars(self))

924

645

self.checked_ok()

925

646

else:

926

logger.info("Checker for %(name)s failed", vars(self))

647

logger.info("Checker for %(name)s failed",

648

vars(self))

927

649

else:

928

650

self.last_checker_status = -1

929

self.last_checker_signal = -returncode

930

651

logger.warning("Checker for %(name)s crashed?",

931

652

vars(self))

932

return False

933

653

934

654

def checked_ok(self):

935

655

"""Assert that the client has been seen, alive and well."""

936

656

self.last_checked_ok = datetime.datetime.utcnow()

937

657

self.last_checker_status = 0

938

self.last_checker_signal = None

939

658

self.bump_timeout()

940

659

941

660

def bump_timeout(self, timeout=None):

946

665

gobject.source_remove(self.disable_initiator_tag)

947

666

self.disable_initiator_tag = None

948

667

if getattr(self, "enabled", False):

949

self.disable_initiator_tag = gobject.timeout_add(

950

int(timeout.total_seconds() * 1000), self.disable)

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

951

671

self.expires = datetime.datetime.utcnow() + timeout

952

672

953

673

def need_approval(self):

967

687

# than 'timeout' for the client to be disabled, which is as it

968

688

# should be.

969

689

970

if self.checker is not None and not self.checker.is_alive():

971

logger.warning("Checker was not alive; joining")

972

self.checker.join()

973

self.checker = None

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

974

704

# Start a new checker if needed

975

705

if self.checker is None:

976

706

# Escape attributes for the shell

977

escaped_attrs = {

978

attr: re.escape(str(getattr(self, attr)))

979

for attr in self.runtime_expansions }

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

980

711

try:

981

712

command = self.checker_command % escaped_attrs

982

713

except TypeError as error:

983

714

logger.error('Could not format string "%s"',

984

self.checker_command,

715

self.checker_command, exc_info=error)

716

return True # Try again later

717

self.current_checker_command = command

718

try:

719

logger.info("Starting checker %r for %s",

720

command, self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True, cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

985

739

exc_info=error)

986

return True # Try again later

987

self.current_checker_command = command

988

logger.info("Starting checker %r for %s", command,

989

self.name)

990

# We don't need to redirect stdout and stderr, since

991

# in normal mode, that is already done by daemon(),

992

# and in debug mode we don't want to. (Stdin is

993

# always replaced by /dev/null.)

994

# The exception is when not debugging but nevertheless

995

# running in the foreground; use the previously

996

# created wnull.

997

popen_args = { "close_fds": True,

998

"shell": True,

999

"cwd": "/" }

1000

if (not self.server_settings["debug"]

1001

and self.server_settings["foreground"]):

1002

popen_args.update({"stdout": wnull,

1003

"stderr": wnull })

1004

pipe = multiprocessing.Pipe(duplex = False)

1005

self.checker = multiprocessing.Process(

1006

target = call_pipe,

1007

args = (pipe[1], subprocess.call, command),

1008

kwargs = popen_args)

1009

self.checker.start()

1010

self.checker_callback_tag = gobject.io_add_watch(

1011

pipe[0].fileno(), gobject.IO_IN,

1012

self.checker_callback, pipe[0], command)

740

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

745

# The checker may have completed before the gobject

746

# watch was added. Check for this.

747

try:

748

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

749

except OSError as error:

750

if error.errno == errno.ECHILD:

751

# This should never happen

752

logger.error("Child process vanished",

753

exc_info=error)

754

return True

755

raise

756

if pid:

757

gobject.source_remove(self.checker_callback_tag)

758

self.checker_callback(pid, status, command)

1013

759

# Re-run this periodically if run by gobject.timeout_add

1014

760

return True

1015

761

1021

767

if getattr(self, "checker", None) is None:

1022

768

return

1023

769

logger.debug("Stopping checker for %(name)s", vars(self))

1024

self.checker.terminate()

770

try:

771

self.checker.terminate()

772

#time.sleep(0.5)

773

#if self.checker.poll() is None:

774

# self.checker.kill()

775

except OSError as error:

776

if error.errno != errno.ESRCH: # No such process

777

raise

1025

778

self.checker = None

1026

779

1027

780

1028

def dbus_service_property(dbus_interface,

1029

signature="v",

1030

access="readwrite",

1031

byte_arrays=False):

781

def dbus_service_property(dbus_interface, signature="v",

782

access="readwrite", byte_arrays=False):

1032

783

"""Decorators for marking methods of a DBusObjectWithProperties to

1033

784

become properties on the D-Bus.

1034

785

1043

794

# "Set" method, so we fail early here:

1044

795

if byte_arrays and signature != "ay":

1045

796

raise ValueError("Byte arrays not supported for non-'ay'"

1046

" signature {!r}".format(signature))

1047

797

" signature {0!r}".format(signature))

1048

798

def decorator(func):

1049

799

func._dbus_is_property = True

1050

800

func._dbus_interface = dbus_interface

1055

805

func._dbus_name = func._dbus_name[:-14]

1056

806

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1057

807

return func

1058

1059

808

return decorator

1060

809

1061

810

1070

819

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1071

820

"false"}

1072

821

"""

1073

1074

822

def decorator(func):

1075

823

func._dbus_is_interface = True

1076

824

func._dbus_interface = dbus_interface

1077

825

func._dbus_name = dbus_interface

1078

826

return func

1079

1080

827

return decorator

1081

828

1082

829

1084

831

"""Decorator to annotate D-Bus methods, signals or properties

1085

832

Usage:

1086

833

1087

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1088

"org.freedesktop.DBus.Property."

1089

"EmitsChangedSignal": "false"})

1090

834

@dbus_service_property("org.example.Interface", signature="b",

1091

835

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

1092

839

def Property_dbus_property(self):

1093

840

return dbus.Boolean(False)

1094

1095

See also the DBusObjectWithAnnotations class.

1096

841

"""

1097

1098

842

def decorator(func):

1099

843

func._dbus_annotations = annotations

1100

844

return func

1101

1102

845

return decorator

1103

846

1104

847

1105

848

class DBusPropertyException(dbus.exceptions.DBusException):

1106

849

"""A base class for D-Bus property-related exceptions

1107

850

"""

1108

pass

851

def __unicode__(self):

852

return unicode(str(self))

1109

853

1110

854

1111

855

class DBusPropertyAccessException(DBusPropertyException):

1120

864

pass

1121

865

1122

866

1123

class DBusObjectWithAnnotations(dbus.service.Object):

1124

"""A D-Bus object with annotations.

867

class DBusObjectWithProperties(dbus.service.Object):

868

"""A D-Bus object with properties.

1125

869

1126

Classes inheriting from this can use the dbus_annotations

1127

decorator to add annotations to methods or signals.

870

Classes inheriting from this can use the dbus_service_property

871

decorator to expose methods as D-Bus properties. It exposes the

872

standard Get(), Set(), and GetAll() methods on the D-Bus.

1128

873

"""

1129

874

1130

875

@staticmethod

1134

879

If called like _is_dbus_thing("method") it returns a function

1135

880

suitable for use as predicate to inspect.getmembers().

1136

881

"""

1137

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1138

883

False)

1139

884

1140

885

def _get_all_dbus_things(self, thing):

1141

886

"""Returns a generator of (name, attribute) pairs

1142

887

"""

1143

return ((getattr(athing.__get__(self), "_dbus_name", name),

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

1144

890

athing.__get__(self))

1145

891

for cls in self.__class__.__mro__

1146

892

for name, athing in

1147

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1148

1149

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1150

out_signature = "s",

1151

path_keyword = 'object_path',

1152

connection_keyword = 'connection')

1153

def Introspect(self, object_path, connection):

1154

"""Overloading of standard D-Bus method.

1155

1156

Inserts annotation tags on methods and signals.

1157

"""

1158

xmlstring = dbus.service.Object.Introspect(self, object_path,

1159

connection)

1160

try:

1161

document = xml.dom.minidom.parseString(xmlstring)

1162

1163

for if_tag in document.getElementsByTagName("interface"):

1164

# Add annotation tags

1165

for typ in ("method", "signal"):

1166

for tag in if_tag.getElementsByTagName(typ):

1167

annots = dict()

1168

for name, prop in (self.

1169

_get_all_dbus_things(typ)):

1170

if (name == tag.getAttribute("name")

1171

and prop._dbus_interface

1172

== if_tag.getAttribute("name")):

1173

annots.update(getattr(

1174

prop, "_dbus_annotations", {}))

1175

for name, value in annots.items():

1176

ann_tag = document.createElement(

1177

"annotation")

1178

ann_tag.setAttribute("name", name)

1179

ann_tag.setAttribute("value", value)

1180

tag.appendChild(ann_tag)

1181

# Add interface annotation tags

1182

for annotation, value in dict(

1183

itertools.chain.from_iterable(

1184

annotations().items()

1185

for name, annotations

1186

in self._get_all_dbus_things("interface")

1187

if name == if_tag.getAttribute("name")

1188

)).items():

1189

ann_tag = document.createElement("annotation")

1190

ann_tag.setAttribute("name", annotation)

1191

ann_tag.setAttribute("value", value)

1192

if_tag.appendChild(ann_tag)

1193

# Fix argument name for the Introspect method itself

1194

if (if_tag.getAttribute("name")

1195

== dbus.INTROSPECTABLE_IFACE):

1196

for cn in if_tag.getElementsByTagName("method"):

1197

if cn.getAttribute("name") == "Introspect":

1198

for arg in cn.getElementsByTagName("arg"):

1199

if (arg.getAttribute("direction")

1200

== "out"):

1201

arg.setAttribute("name",

1202

"xml_data")

1203

xmlstring = document.toxml("utf-8")

1204

document.unlink()

1205

except (AttributeError, xml.dom.DOMException,

1206

xml.parsers.expat.ExpatError) as error:

1207

logger.error("Failed to override Introspection method",

1208

exc_info=error)

1209

return xmlstring

1210

1211

1212

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1213

"""A D-Bus object with properties.

1214

1215

Classes inheriting from this can use the dbus_service_property

1216

decorator to expose methods as D-Bus properties. It exposes the

1217

standard Get(), Set(), and GetAll() methods on the D-Bus.

1218

"""

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

1219

895

1220

896

def _get_dbus_property(self, interface_name, property_name):

1221

897

"""Returns a bound method if one exists which is a D-Bus

1222

898

property with the specified name and interface.

1223

899

"""

1224

for cls in self.__class__.__mro__:

1225

for name, value in inspect.getmembers(

1226

cls, self._is_dbus_thing("property")):

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

1227

904

if (value._dbus_name == property_name

1228

905

and value._dbus_interface == interface_name):

1229

906

return value.__get__(self)

1230

907

1231

908

# No such property

1232

raise DBusPropertyNotFound("{}:{}.{}".format(

1233

self.dbus_object_path, interface_name, property_name))

1234

1235

@classmethod

1236

def _get_all_interface_names(cls):

1237

"""Get a sequence of all interfaces supported by an object"""

1238

return (name for name in set(getattr(getattr(x, attr),

1239

"_dbus_interface", None)

1240

for x in (inspect.getmro(cls))

1241

for attr in dir(x))

1242

if name is not None)

1243

1244

@dbus.service.method(dbus.PROPERTIES_IFACE,

1245

in_signature="ss",

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

+ interface_name + "."

911

+ property_name)

912

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1246

914

out_signature="v")

1247

915

def Get(self, interface_name, property_name):

1248

916

"""Standard D-Bus property Get() method, see D-Bus standard.

1266

934

# The byte_arrays option is not supported yet on

1267

935

# signatures other than "ay".

1268

936

if prop._dbus_signature != "ay":

1269

raise ValueError("Byte arrays not supported for non-"

1270

"'ay' signature {!r}"

1271

.format(prop._dbus_signature))

937

raise ValueError

1272

938

value = dbus.ByteArray(b''.join(chr(byte)

1273

939

for byte in value))

1274

940

prop(value)

1275

941

1276

@dbus.service.method(dbus.PROPERTIES_IFACE,

1277

in_signature="s",

942

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1278

943

out_signature="a{sv}")

1279

944

def GetAll(self, interface_name):

1280

945

"""Standard D-Bus property GetAll() method, see D-Bus

1295

960

if not hasattr(value, "variant_level"):

1296

961

properties[name] = value

1297

962

continue

1298

properties[name] = type(value)(

1299

value, variant_level = value.variant_level + 1)

963

properties[name] = type(value)(value, variant_level=

964

value.variant_level+1)

1300

965

return dbus.Dictionary(properties, signature="sv")

1301

966

1302

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1303

def PropertiesChanged(self, interface_name, changed_properties,

1304

invalidated_properties):

1305

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1306

standard.

1307

"""

1308

pass

1309

1310

967

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1311

968

out_signature="s",

1312

969

path_keyword='object_path',

1316

973

1317

974

Inserts property tags and interface annotation tags.

1318

975

"""

1319

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1320

object_path,

1321

connection)

976

xmlstring = dbus.service.Object.Introspect(self, object_path,

977

connection)

1322

978

try:

1323

979

document = xml.dom.minidom.parseString(xmlstring)

1324

1325

980

def make_tag(document, name, prop):

1326

981

e = document.createElement("property")

1327

982

e.setAttribute("name", name)

1328

983

e.setAttribute("type", prop._dbus_signature)

1329

984

e.setAttribute("access", prop._dbus_access)

1330

985

return e

1331

1332

986

for if_tag in document.getElementsByTagName("interface"):

1333

987

# Add property tags

1334

988

for tag in (make_tag(document, name, prop)

1337

991

if prop._dbus_interface

1338

992

== if_tag.getAttribute("name")):

1339

993

if_tag.appendChild(tag)

1340

# Add annotation tags for properties

1341

for tag in if_tag.getElementsByTagName("property"):

1342

annots = dict()

1343

for name, prop in self._get_all_dbus_things(

1344

"property"):

1345

if (name == tag.getAttribute("name")

1346

and prop._dbus_interface

1347

== if_tag.getAttribute("name")):

1348

annots.update(getattr(

1349

prop, "_dbus_annotations", {}))

1350

for name, value in annots.items():

1351

ann_tag = document.createElement(

1352

"annotation")

1353

ann_tag.setAttribute("name", name)

1354

ann_tag.setAttribute("value", value)

1355

tag.appendChild(ann_tag)

994

# Add annotation tags

995

for typ in ("method", "signal", "property"):

996

for tag in if_tag.getElementsByTagName(typ):

997

annots = dict()

998

for name, prop in (self.

999

_get_all_dbus_things(typ)):

1000

if (name == tag.getAttribute("name")

1001

and prop._dbus_interface

1002

== if_tag.getAttribute("name")):

1003

annots.update(getattr

1004

(prop,

1005

"_dbus_annotations",

1006

{}))

1007

for name, value in annots.iteritems():

1008

ann_tag = document.createElement(

1009

"annotation")

1010

ann_tag.setAttribute("name", name)

1011

ann_tag.setAttribute("value", value)

1012

tag.appendChild(ann_tag)

1013

# Add interface annotation tags

1014

for annotation, value in dict(

1015

itertools.chain.from_iterable(

1016

annotations().iteritems()

1017

for name, annotations in

1018

self._get_all_dbus_things("interface")

1019

if name == if_tag.getAttribute("name")

1020

)).iteritems():

1021

ann_tag = document.createElement("annotation")

1022

ann_tag.setAttribute("name", annotation)

1023

ann_tag.setAttribute("value", value)

1024

if_tag.appendChild(ann_tag)

1356

1025

# Add the names to the return values for the

1357

1026

# "org.freedesktop.DBus.Properties" methods

1358

1027

if (if_tag.getAttribute("name")

1376

1045

exc_info=error)

1377

1046

return xmlstring

1378

1047

1379

try:

1380

dbus.OBJECT_MANAGER_IFACE

1381

except AttributeError:

1382

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1383

1384

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1385

"""A D-Bus object with an ObjectManager.

1386

1387

Classes inheriting from this exposes the standard

1388

GetManagedObjects call and the InterfacesAdded and

1389

InterfacesRemoved signals on the standard

1390

"org.freedesktop.DBus.ObjectManager" interface.

1391

1392

Note: No signals are sent automatically; they must be sent

1393

manually.

1394

"""

1395

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1396

out_signature = "a{oa{sa{sv}}}")

1397

def GetManagedObjects(self):

1398

"""This function must be overridden"""

1399

raise NotImplementedError()

1400

1401

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1402

signature = "oa{sa{sv}}")

1403

def InterfacesAdded(self, object_path, interfaces_and_properties):

1404

pass

1405

1406

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1407

def InterfacesRemoved(self, object_path, interfaces):

1408

pass

1409

1410

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1411

out_signature = "s",

1412

path_keyword = 'object_path',

1413

connection_keyword = 'connection')

1414

def Introspect(self, object_path, connection):

1415

"""Overloading of standard D-Bus method.

1416

1417

Override return argument name of GetManagedObjects to be

1418

"objpath_interfaces_and_properties"

1419

"""

1420

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1421

object_path,

1422

connection)

1423

try:

1424

document = xml.dom.minidom.parseString(xmlstring)

1425

1426

for if_tag in document.getElementsByTagName("interface"):

1427

# Fix argument name for the GetManagedObjects method

1428

if (if_tag.getAttribute("name")

1429

== dbus.OBJECT_MANAGER_IFACE):

1430

for cn in if_tag.getElementsByTagName("method"):

1431

if (cn.getAttribute("name")

1432

== "GetManagedObjects"):

1433

for arg in cn.getElementsByTagName("arg"):

1434

if (arg.getAttribute("direction")

1435

== "out"):

1436

arg.setAttribute(

1437

"name",

1438

"objpath_interfaces"

1439

"_and_properties")

1440

xmlstring = document.toxml("utf-8")

1441

document.unlink()

1442

except (AttributeError, xml.dom.DOMException,

1443

xml.parsers.expat.ExpatError) as error:

1444

logger.error("Failed to override Introspection method",

1445

exc_info = error)

1446

return xmlstring

1447

1048

1448

1049

def datetime_to_dbus(dt, variant_level=0):

1449

1050

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1450

1051

if dt is None:

1451

1052

return dbus.String("", variant_level = variant_level)

1452

return dbus.String(dt.isoformat(), variant_level=variant_level)

1053

return dbus.String(dt.isoformat(),

1054

variant_level=variant_level)

1453

1055

1454

1056

1455

1057

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1475

1077

(from DBusObjectWithProperties) and interfaces (from the

1476

1078

dbus_interface_annotations decorator).

1477

1079

"""

1478

1479

1080

def wrapper(cls):

1480

1081

for orig_interface_name, alt_interface_name in (

1481

alt_interface_names.items()):

1082

alt_interface_names.iteritems()):

1482

1083

attr = {}

1483

1084

interface_names = set()

1484

1085

# Go though all attributes of the class

1486

1087

# Ignore non-D-Bus attributes, and D-Bus attributes

1487

1088

# with the wrong interface name

1488

1089

if (not hasattr(attribute, "_dbus_interface")

1489

or not attribute._dbus_interface.startswith(

1490

orig_interface_name)):

1090

or not attribute._dbus_interface

1091

.startswith(orig_interface_name)):

1491

1092

continue

1492

1093

# Create an alternate D-Bus interface name based on

1493

1094

# the current name

1494

alt_interface = attribute._dbus_interface.replace(

1495

orig_interface_name, alt_interface_name)

1095

alt_interface = (attribute._dbus_interface

1096

.replace(orig_interface_name,

1097

alt_interface_name))

1496

1098

interface_names.add(alt_interface)

1497

1099

# Is this a D-Bus signal?

1498

1100

if getattr(attribute, "_dbus_is_signal", False):

1499

if sys.version_info.major == 2:

1500

# Extract the original non-method undecorated

1501

# function by black magic

1502

nonmethod_func = (dict(

1101

# Extract the original non-method undecorated

1102

# function by black magic

1103

nonmethod_func = (dict(

1503

1104

zip(attribute.func_code.co_freevars,

1504

attribute.__closure__))

1505

["func"].cell_contents)

1506

else:

1507

nonmethod_func = attribute

1105

attribute.__closure__))["func"]

1106

.cell_contents)

1508

1107

# Create a new, but exactly alike, function

1509

1108

# object, and decorate it to be a new D-Bus signal

1510

1109

# with the alternate D-Bus interface name

1511

if sys.version_info.major == 2:

1512

new_function = types.FunctionType(

1513

nonmethod_func.func_code,

1514

nonmethod_func.func_globals,

1515

nonmethod_func.func_name,

1516

nonmethod_func.func_defaults,

1517

nonmethod_func.func_closure)

1518

else:

1519

new_function = types.FunctionType(

1520

nonmethod_func.__code__,

1521

nonmethod_func.__globals__,

1522

nonmethod_func.__name__,

1523

nonmethod_func.__defaults__,

1524

nonmethod_func.__closure__)

1525

new_function = (dbus.service.signal(

1526

alt_interface,

1527

attribute._dbus_signature)(new_function))

1110

new_function = (dbus.service.signal

1111

(alt_interface,

1112

attribute._dbus_signature)

1113

(types.FunctionType(

1114

nonmethod_func.func_code,

1115

nonmethod_func.func_globals,

1116

nonmethod_func.func_name,

1117

nonmethod_func.func_defaults,

1118

nonmethod_func.func_closure)))

1528

1119

# Copy annotations, if any

1529

1120

try:

1530

new_function._dbus_annotations = dict(

1531

attribute._dbus_annotations)

1121

new_function._dbus_annotations = (

1122

dict(attribute._dbus_annotations))

1532

1123

except AttributeError:

1533

1124

pass

1534

1125

# Define a creator of a function to call both the

1539

1130

"""This function is a scope container to pass

1540

1131

func1 and func2 to the "call_both" function

1541

1132

outside of its arguments"""

1542

1543

@functools.wraps(func2)

1544

1133

def call_both(*args, **kwargs):

1545

1134

"""This function will emit two D-Bus

1546

1135

signals by calling func1 and func2"""

1547

1136

func1(*args, **kwargs)

1548

1137

func2(*args, **kwargs)

1549

# Make wrapper function look like a D-Bus signal

1550

for name, attr in inspect.getmembers(func2):

1551

if name.startswith("_dbus_"):

1552

setattr(call_both, name, attr)

1553

1554

1138

return call_both

1555

1139

# Create the "call_both" function and add it to

1556

1140

# the class

1561

1145

# object. Decorate it to be a new D-Bus method

1562

1146

# with the alternate D-Bus interface name. Add it

1563

1147

# to the class.

1564

attr[attrname] = (

1565

dbus.service.method(

1566

alt_interface,

1567

attribute._dbus_in_signature,

1568

attribute._dbus_out_signature)

1569

(types.FunctionType(attribute.func_code,

1570

attribute.func_globals,

1571

attribute.func_name,

1572

attribute.func_defaults,

1573

attribute.func_closure)))

1148

attr[attrname] = (dbus.service.method

1149

(alt_interface,

1150

attribute._dbus_in_signature,

1151

attribute._dbus_out_signature)

1152

(types.FunctionType

1153

(attribute.func_code,

1154

attribute.func_globals,

1155

attribute.func_name,

1156

attribute.func_defaults,

1157

attribute.func_closure)))

1574

1158

# Copy annotations, if any

1575

1159

try:

1576

attr[attrname]._dbus_annotations = dict(

1577

attribute._dbus_annotations)

1160

attr[attrname]._dbus_annotations = (

1161

dict(attribute._dbus_annotations))

1578

1162

except AttributeError:

1579

1163

pass

1580

1164

# Is this a D-Bus property?

1583

1167

# object, and decorate it to be a new D-Bus

1584

1168

# property with the alternate D-Bus interface

1585

1169

# name. Add it to the class.

1586

attr[attrname] = (dbus_service_property(

1587

alt_interface, attribute._dbus_signature,

1588

attribute._dbus_access,

1589

attribute._dbus_get_args_options

1590

["byte_arrays"])

1591

(types.FunctionType(

1592

attribute.func_code,

1593

attribute.func_globals,

1594

attribute.func_name,

1595

attribute.func_defaults,

1596

attribute.func_closure)))

1170

attr[attrname] = (dbus_service_property

1171

(alt_interface,

1172

attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute

1175

._dbus_get_args_options

1176

["byte_arrays"])

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1597

1183

# Copy annotations, if any

1598

1184

try:

1599

attr[attrname]._dbus_annotations = dict(

1600

attribute._dbus_annotations)

1185

attr[attrname]._dbus_annotations = (

1186

dict(attribute._dbus_annotations))

1601

1187

except AttributeError:

1602

1188

pass

1603

1189

# Is this a D-Bus interface?

1606

1192

# object. Decorate it to be a new D-Bus interface

1607

1193

# with the alternate D-Bus interface name. Add it

1608

1194

# to the class.

1609

attr[attrname] = (

1610

dbus_interface_annotations(alt_interface)

1611

(types.FunctionType(attribute.func_code,

1612

attribute.func_globals,

1613

attribute.func_name,

1614

attribute.func_defaults,

1615

attribute.func_closure)))

1195

attr[attrname] = (dbus_interface_annotations

1196

(alt_interface)

1197

(types.FunctionType

1198

(attribute.func_code,

1199

attribute.func_globals,

1200

attribute.func_name,

1201

attribute.func_defaults,

1202

attribute.func_closure)))

1616

1203

if deprecate:

1617

1204

# Deprecate all alternate interfaces

1618

iname="_AlternateDBusNames_interface_annotation{}"

1205

iname="_AlternateDBusNames_interface_annotation{0}"

1619

1206

for interface_name in interface_names:

1620

1621

1207

@dbus_interface_annotations(interface_name)

1622

1208

def func(self):

1623

1209

return { "org.freedesktop.DBus.Deprecated":

1624

"true" }

1210

"true" }

1625

1211

# Find an unused name

1626

1212

for aname in (iname.format(i)

1627

1213

for i in itertools.count()):

1631

1217

if interface_names:

1632

1218

# Replace the class with a new subclass of it with

1633

1219

# methods, signals, etc. as created above.

1634

cls = type(b"{}Alternate".format(cls.__name__),

1635

(cls, ), attr)

1220

cls = type(b"{0}Alternate".format(cls.__name__),

1221

(cls,), attr)

1636

1222

return cls

1637

1638

1223

return wrapper

1639

1224

1640

1225

1641

1226

@alternate_dbus_interfaces({"se.recompile.Mandos":

1642

"se.bsnet.fukt.Mandos"})

1227

"se.bsnet.fukt.Mandos"})

1643

1228

class ClientDBus(Client, DBusObjectWithProperties):

1644

1229

"""A Client class using D-Bus

1645

1230

1649

1234

"""

1650

1235

1651

1236

runtime_expansions = (Client.runtime_expansions

1652

+ ("dbus_object_path", ))

1653

1654

_interface = "se.recompile.Mandos.Client"

1237

+ ("dbus_object_path",))

1655

1238

1656

1239

# dbus.service.Object doesn't use super(), so we can't either.

1657

1240

1660

1243

Client.__init__(self, *args, **kwargs)

1661

1244

# Only now, when this client is initialized, can it show up on

1662

1245

# the D-Bus

1663

client_object_name = str(self.name).translate(

1246

client_object_name = unicode(self.name).translate(

1664

1247

{ord("."): ord("_"),

1665

1248

ord("-"): ord("_")})

1666

self.dbus_object_path = dbus.ObjectPath(

1667

"/clients/" + client_object_name)

1249

self.dbus_object_path = (dbus.ObjectPath

1250

("/clients/" + client_object_name))

1668

1251

DBusObjectWithProperties.__init__(self, self.bus,

1669

1252

self.dbus_object_path)

1670

1253

1671

def notifychangeproperty(transform_func, dbus_name,

1672

type_func=lambda x: x,

1673

variant_level=1,

1674

invalidate_only=False,

1675

_interface=_interface):

1254

def notifychangeproperty(transform_func,

1255

dbus_name, type_func=lambda x: x,

1256

variant_level=1):

1676

1257

""" Modify a variable so that it's a property which announces

1677

1258

its changes to DBus.

1678

1259

1683

1264

to the D-Bus. Default: no transform

1684

1265

variant_level: D-Bus variant level. Default: 1

1685

1266

"""

1686

attrname = "_{}".format(dbus_name)

1687

1267

attrname = "_{0}".format(dbus_name)

1688

1268

def setter(self, value):

1689

1269

if hasattr(self, "dbus_object_path"):

1690

1270

if (not hasattr(self, attrname) or

1691

1271

type_func(getattr(self, attrname, None))

1692

1272

!= type_func(value)):

1693

if invalidate_only:

1694

self.PropertiesChanged(

1695

_interface, dbus.Dictionary(),

1696

dbus.Array((dbus_name, )))

1697

else:

1698

dbus_value = transform_func(

1699

type_func(value),

1700

variant_level = variant_level)

1701

self.PropertyChanged(dbus.String(dbus_name),

1702

dbus_value)

1703

self.PropertiesChanged(

1704

_interface,

1705

dbus.Dictionary({ dbus.String(dbus_name):

1706

dbus_value }),

1707

dbus.Array())

1273

dbus_value = transform_func(type_func(value),

1274

variant_level

1275

=variant_level)

1276

self.PropertyChanged(dbus.String(dbus_name),

1277

dbus_value)

1708

1278

setattr(self, attrname, value)

1709

1279

1710

1280

return property(lambda self: getattr(self, attrname), setter)

1716

1286

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1717

1287

last_enabled = notifychangeproperty(datetime_to_dbus,

1718

1288

"LastEnabled")

1719

checker = notifychangeproperty(

1720

dbus.Boolean, "CheckerRunning",

1721

type_func = lambda checker: checker is not None)

1289

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1290

type_func = lambda checker:

1291

checker is not None)

1722

1292

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1723

1293

"LastCheckedOK")

1724

1294

last_checker_status = notifychangeproperty(dbus.Int16,

1727

1297

datetime_to_dbus, "LastApprovalRequest")

1728

1298

approved_by_default = notifychangeproperty(dbus.Boolean,

1729

1299

"ApprovedByDefault")

1730

approval_delay = notifychangeproperty(

1731

dbus.UInt64, "ApprovalDelay",

1732

type_func = lambda td: td.total_seconds() * 1000)

1300

approval_delay = notifychangeproperty(dbus.UInt64,

1301

"ApprovalDelay",

1302

type_func =

1303

timedelta_to_milliseconds)

1733

1304

approval_duration = notifychangeproperty(

1734

1305

dbus.UInt64, "ApprovalDuration",

1735

type_func = lambda td: td.total_seconds() * 1000)

1306

type_func = timedelta_to_milliseconds)

1736

1307

host = notifychangeproperty(dbus.String, "Host")

1737

timeout = notifychangeproperty(

1738

dbus.UInt64, "Timeout",

1739

type_func = lambda td: td.total_seconds() * 1000)

1308

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1309

type_func =

1310

timedelta_to_milliseconds)

1740

1311

extended_timeout = notifychangeproperty(

1741

1312

dbus.UInt64, "ExtendedTimeout",

1742

type_func = lambda td: td.total_seconds() * 1000)

1743

interval = notifychangeproperty(

1744

dbus.UInt64, "Interval",

1745

type_func = lambda td: td.total_seconds() * 1000)

1313

type_func = timedelta_to_milliseconds)

1314

interval = notifychangeproperty(dbus.UInt64,

1315

"Interval",

1316

type_func =

1317

timedelta_to_milliseconds)

1746

1318

checker_command = notifychangeproperty(dbus.String, "Checker")

1747

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1748

invalidate_only=True)

1749

1319

1750

1320

del notifychangeproperty

1751

1321

1758

1328

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1759

1329

Client.__del__(self, *args, **kwargs)

1760

1330

1761

def checker_callback(self, source, condition,

1762

connection, command, *args, **kwargs):

1763

ret = Client.checker_callback(self, source, condition,

1764

connection, command, *args,

1765

**kwargs)

1766

exitstatus = self.last_checker_status

1767

if exitstatus >= 0:

1331

def checker_callback(self, pid, condition, command,

1332

*args, **kwargs):

1333

self.checker_callback_tag = None

1334

self.checker = None

1335

if os.WIFEXITED(condition):

1336

exitstatus = os.WEXITSTATUS(condition)

1768

1337

# Emit D-Bus signal

1769

1338

self.CheckerCompleted(dbus.Int16(exitstatus),

1770

# This is specific to GNU libC

1771

dbus.Int64(exitstatus << 8),

1339

dbus.Int64(condition),

1772

1340

dbus.String(command))

1773

1341

else:

1774

1342

# Emit D-Bus signal

1775

1343

self.CheckerCompleted(dbus.Int16(-1),

1776

dbus.Int64(

1777

# This is specific to GNU libC

1778

(exitstatus << 8)

1779

| self.last_checker_signal),

1344

dbus.Int64(condition),

1780

1345

dbus.String(command))

1781

return ret

1346

1347

return Client.checker_callback(self, pid, condition, command,

1348

*args, **kwargs)

1782

1349

1783

1350

def start_checker(self, *args, **kwargs):

1784

old_checker_pid = getattr(self.checker, "pid", None)

1351

old_checker = self.checker

1352

if self.checker is not None:

1353

old_checker_pid = self.checker.pid

1354

else:

1355

old_checker_pid = None

1785

1356

r = Client.start_checker(self, *args, **kwargs)

1786

1357

# Only if new checker process was started

1787

1358

if (self.checker is not None

1796

1367

1797

1368

def approve(self, value=True):

1798

1369

self.approved = value

1799

gobject.timeout_add(int(self.approval_duration.total_seconds()

1800

* 1000), self._reset_approved)

1370

gobject.timeout_add(timedelta_to_milliseconds

1371

(self.approval_duration),

1372

self._reset_approved)

1801

1373

self.send_changedstate()

1802

1374

1803

1375

## D-Bus methods, signals & properties

1376

_interface = "se.recompile.Mandos.Client"

1804

1377

1805

1378

## Interfaces

1806

1379

1380

@dbus_interface_annotations(_interface)

1381

def _foo(self):

1382

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1383

"false"}

1384

1807

1385

## Signals

1808

1386

1809

1387

# CheckerCompleted - signal

1819

1397

pass

1820

1398

1821

1399

# PropertyChanged - signal

1822

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1823

1400

@dbus.service.signal(_interface, signature="sv")

1824

1401

def PropertyChanged(self, property, value):

1825

1402

"D-Bus signal"

1859

1436

self.checked_ok()

1860

1437

1861

1438

# Enable - method

1862

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1863

1439

@dbus.service.method(_interface)

1864

1440

def Enable(self):

1865

1441

"D-Bus method"

1866

1442

self.enable()

1867

1443

1868

1444

# StartChecker - method

1869

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1870

1445

@dbus.service.method(_interface)

1871

1446

def StartChecker(self):

1872

1447

"D-Bus method"

1873

1448

self.start_checker()

1874

1449

1875

1450

# Disable - method

1876

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1877

1451

@dbus.service.method(_interface)

1878

1452

def Disable(self):

1879

1453

"D-Bus method"

1880

1454

self.disable()

1881

1455

1882

1456

# StopChecker - method

1883

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1884

1457

@dbus.service.method(_interface)

1885

1458

def StopChecker(self):

1886

1459

self.stop_checker()

1893

1466

return dbus.Boolean(bool(self.approvals_pending))

1894

1467

1895

1468

# ApprovedByDefault - property

1896

@dbus_service_property(_interface,

1897

signature="b",

1469

@dbus_service_property(_interface, signature="b",

1898

1470

access="readwrite")

1899

1471

def ApprovedByDefault_dbus_property(self, value=None):

1900

1472

if value is None: # get

1902

1474

self.approved_by_default = bool(value)

1903

1475

1904

1476

# ApprovalDelay - property

1905

@dbus_service_property(_interface,

1906

signature="t",

1477

@dbus_service_property(_interface, signature="t",

1907

1478

access="readwrite")

1908

1479

def ApprovalDelay_dbus_property(self, value=None):

1909

1480

if value is None: # get

1910

return dbus.UInt64(self.approval_delay.total_seconds()

1911

* 1000)

1481

return dbus.UInt64(self.approval_delay_milliseconds())

1912

1482

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1913

1483

1914

1484

# ApprovalDuration - property

1915

@dbus_service_property(_interface,

1916

signature="t",

1485

@dbus_service_property(_interface, signature="t",

1917

1486

access="readwrite")

1918

1487

def ApprovalDuration_dbus_property(self, value=None):

1919

1488

if value is None: # get

1920

return dbus.UInt64(self.approval_duration.total_seconds()

1921

* 1000)

1489

return dbus.UInt64(timedelta_to_milliseconds(

1490

self.approval_duration))

1922

1491

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1923

1492

1924

1493

# Name - property

1925

@dbus_annotations(

1926

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1927

1494

@dbus_service_property(_interface, signature="s", access="read")

1928

1495

def Name_dbus_property(self):

1929

1496

return dbus.String(self.name)

1930

1497

1931

1498

# Fingerprint - property

1932

@dbus_annotations(

1933

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1934

1499

@dbus_service_property(_interface, signature="s", access="read")

1935

1500

def Fingerprint_dbus_property(self):

1936

1501

return dbus.String(self.fingerprint)

1937

1502

1938

1503

# Host - property

1939

@dbus_service_property(_interface,

1940

signature="s",

1504

@dbus_service_property(_interface, signature="s",

1941

1505

access="readwrite")

1942

1506

def Host_dbus_property(self, value=None):

1943

1507

if value is None: # get

1944

1508

return dbus.String(self.host)

1945

self.host = str(value)

1509

self.host = unicode(value)

1946

1510

1947

1511

# Created - property

1948

@dbus_annotations(

1949

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1950

1512

@dbus_service_property(_interface, signature="s", access="read")

1951

1513

def Created_dbus_property(self):

1952

1514

return datetime_to_dbus(self.created)

1957

1519

return datetime_to_dbus(self.last_enabled)

1958

1520

1959

1521

# Enabled - property

1960

@dbus_service_property(_interface,

1961

signature="b",

1522

@dbus_service_property(_interface, signature="b",

1962

1523

access="readwrite")

1963

1524

def Enabled_dbus_property(self, value=None):

1964

1525

if value is None: # get

1969

1530

self.disable()

1970

1531

1971

1532

# LastCheckedOK - property

1972

@dbus_service_property(_interface,

1973

signature="s",

1533

@dbus_service_property(_interface, signature="s",

1974

1534

access="readwrite")

1975

1535

def LastCheckedOK_dbus_property(self, value=None):

1976

1536

if value is not None:

1979

1539

return datetime_to_dbus(self.last_checked_ok)

1980

1540

1981

1541

# LastCheckerStatus - property

1982

@dbus_service_property(_interface, signature="n", access="read")

1542

@dbus_service_property(_interface, signature="n",

1543

access="read")

1983

1544

def LastCheckerStatus_dbus_property(self):

1984

1545

return dbus.Int16(self.last_checker_status)

1985

1546

1994

1555

return datetime_to_dbus(self.last_approval_request)

1995

1556

1996

1557

# Timeout - property

1997

@dbus_service_property(_interface,

1998

signature="t",

1558

@dbus_service_property(_interface, signature="t",

1999

1559

access="readwrite")

2000

1560

def Timeout_dbus_property(self, value=None):

2001

1561

if value is None: # get

2002

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

return dbus.UInt64(self.timeout_milliseconds())

2003

1563

old_timeout = self.timeout

2004

1564

self.timeout = datetime.timedelta(0, 0, 0, value)

2005

1565

# Reschedule disabling

2014

1574

is None):

2015

1575

return

2016

1576

gobject.source_remove(self.disable_initiator_tag)

2017

self.disable_initiator_tag = gobject.timeout_add(

2018

int((self.expires - now).total_seconds() * 1000),

2019

self.disable)

1577

self.disable_initiator_tag = (

1578

gobject.timeout_add(

1579

timedelta_to_milliseconds(self.expires - now),

1580

self.disable))

2020

1581

2021

1582

# ExtendedTimeout - property

2022

@dbus_service_property(_interface,

2023

signature="t",

1583

@dbus_service_property(_interface, signature="t",

2024

1584

access="readwrite")

2025

1585

def ExtendedTimeout_dbus_property(self, value=None):

2026

1586

if value is None: # get

2027

return dbus.UInt64(self.extended_timeout.total_seconds()

2028

* 1000)

1587

return dbus.UInt64(self.extended_timeout_milliseconds())

2029

1588

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2030

1589

2031

1590

# Interval - property

2032

@dbus_service_property(_interface,

2033

signature="t",

1591

@dbus_service_property(_interface, signature="t",

2034

1592

access="readwrite")

2035

1593

def Interval_dbus_property(self, value=None):

2036

1594

if value is None: # get

2037

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

return dbus.UInt64(self.interval_milliseconds())

2038

1596

self.interval = datetime.timedelta(0, 0, 0, value)

2039

1597

if getattr(self, "checker_initiator_tag", None) is None:

2040

1598

return

2041

1599

if self.enabled:

2042

1600

# Reschedule checker run

2043

1601

gobject.source_remove(self.checker_initiator_tag)

2044

self.checker_initiator_tag = gobject.timeout_add(

2045

value, self.start_checker)

2046

self.start_checker() # Start one now, too

1602

self.checker_initiator_tag = (gobject.timeout_add

1603

(value, self.start_checker))

1604

self.start_checker() # Start one now, too

2047

1605

2048

1606

# Checker - property

2049

@dbus_service_property(_interface,

2050

signature="s",

1607

@dbus_service_property(_interface, signature="s",

2051

1608

access="readwrite")

2052

1609

def Checker_dbus_property(self, value=None):

2053

1610

if value is None: # get

2054

1611

return dbus.String(self.checker_command)

2055

self.checker_command = str(value)

1612

self.checker_command = unicode(value)

2056

1613

2057

1614

# CheckerRunning - property

2058

@dbus_service_property(_interface,

2059

signature="b",

1615

@dbus_service_property(_interface, signature="b",

2060

1616

access="readwrite")

2061

1617

def CheckerRunning_dbus_property(self, value=None):

2062

1618

if value is None: # get

2067

1623

self.stop_checker()

2068

1624

2069

1625

# ObjectPath - property

2070

@dbus_annotations(

2071

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2072

"org.freedesktop.DBus.Deprecated": "true"})

2073

1626

@dbus_service_property(_interface, signature="o", access="read")

2074

1627

def ObjectPath_dbus_property(self):

2075

1628

return self.dbus_object_path # is already a dbus.ObjectPath

2076

1629

2077

1630

# Secret = property

2078

@dbus_annotations(

2079

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2080

"invalidates"})

2081

@dbus_service_property(_interface,

2082

signature="ay",

2083

access="write",

2084

byte_arrays=True)

1631

@dbus_service_property(_interface, signature="ay",

1632

access="write", byte_arrays=True)

2085

1633

def Secret_dbus_property(self, value):

2086

self.secret = bytes(value)

1634

self.secret = str(value)

2087

1635

2088

1636

del _interface

2089

1637

2093

1641

self._pipe = child_pipe

2094

1642

self._pipe.send(('init', fpr, address))

2095

1643

if not self._pipe.recv():

2096

raise KeyError(fpr)

1644

raise KeyError()

2097

1645

2098

1646

def __getattribute__(self, name):

2099

1647

if name == '_pipe':

2103

1651

if data[0] == 'data':

2104

1652

return data[1]

2105

1653

if data[0] == 'function':

2106

2107

1654

def func(*args, **kwargs):

2108

1655

self._pipe.send(('funcall', name, args, kwargs))

2109

1656

return self._pipe.recv()[1]

2110

2111

1657

return func

2112

1658

2113

1659

def __setattr__(self, name, value):

2125

1671

def handle(self):

2126

1672

with contextlib.closing(self.server.child_pipe) as child_pipe:

2127

1673

logger.info("TCP connection from: %s",

2128

str(self.client_address))

1674

unicode(self.client_address))

2129

1675

logger.debug("Pipe FD: %d",

2130

1676

self.server.child_pipe.fileno())

2131

1677

2132

session = gnutls.ClientSession(self.request)

1678

session = (gnutls.connection

1679

.ClientSession(self.request,

1680

gnutls.connection

1681

.X509Credentials()))

1682

1683

# Note: gnutls.connection.X509Credentials is really a

1684

# generic GnuTLS certificate credentials object so long as

1685

# no X.509 keys are added to it. Therefore, we can use it

1686

# here despite using OpenPGP certificates.

2133

1687

2134

1688

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2135

1689

# "+AES-256-CBC", "+SHA1",

2139

1693

priority = self.server.gnutls_priority

2140

1694

if priority is None:

2141

1695

priority = "NORMAL"

2142

gnutls.priority_set_direct(session._c_object, priority,

2143

None)

1696

(gnutls.library.functions

1697

.gnutls_priority_set_direct(session._c_object,

1698

priority, None))

2144

1699

2145

1700

# Start communication using the Mandos protocol

2146

1701

# Get protocol number

2156

1711

# Start GnuTLS connection

2157

1712

try:

2158

1713

session.handshake()

2159

except gnutls.Error as error:

1714

except gnutls.errors.GNUTLSError as error:

2160

1715

logger.warning("Handshake failed: %s", error)

2161

1716

# Do not run session.bye() here: the session is not

2162

1717

# established. Just abandon the request.

2166

1721

approval_required = False

2167

1722

try:

2168

1723

try:

2169

fpr = self.fingerprint(

2170

self.peer_certificate(session))

2171

except (TypeError, gnutls.Error) as error:

1724

fpr = self.fingerprint(self.peer_certificate

1725

(session))

1726

except (TypeError,

1727

gnutls.errors.GNUTLSError) as error:

2172

1728

logger.warning("Bad certificate: %s", error)

2173

1729

return

2174

1730

logger.debug("Fingerprint: %s", fpr)

2187

1743

while True:

2188

1744

if not client.enabled:

2189

1745

logger.info("Client %s is disabled",

2190

client.name)

1746

client.name)

2191

1747

if self.server.use_dbus:

2192

1748

# Emit D-Bus signal

2193

1749

client.Rejected("Disabled")

2202

1758

if self.server.use_dbus:

2203

1759

# Emit D-Bus signal

2204

1760

client.NeedApproval(

2205

client.approval_delay.total_seconds()

2206

* 1000, client.approved_by_default)

1761

client.approval_delay_milliseconds(),

1762

client.approved_by_default)

2207

1763

else:

2208

1764

logger.warning("Client %s was not approved",

2209

1765

client.name)

2215

1771

#wait until timeout or approved

2216

1772

time = datetime.datetime.now()

2217

1773

client.changedstate.acquire()

2218

client.changedstate.wait(delay.total_seconds())

1774

client.changedstate.wait(

1775

float(timedelta_to_milliseconds(delay)

1776

/ 1000))

2219

1777

client.changedstate.release()

2220

1778

time2 = datetime.datetime.now()

2221

1779

if (time2 - time) >= delay:

2232

1790

else:

2233

1791

delay -= time2 - time

2234

1792

2235

try:

2236

session.send(client.secret)

2237

except gnutls.Error as error:

2238

logger.warning("gnutls send failed",

2239

exc_info = error)

2240

return

1793

sent_size = 0

1794

while sent_size < len(client.secret):

1795

try:

1796

sent = session.send(client.secret[sent_size:])

1797

except gnutls.errors.GNUTLSError as error:

1798

logger.warning("gnutls send failed",

1799

exc_info=error)

1800

return

1801

logger.debug("Sent: %d, remaining: %d",

1802

sent, len(client.secret)

1803

- (sent_size + sent))

1804

sent_size += sent

2241

1805

2242

1806

logger.info("Sending secret to %s", client.name)

2243

1807

# bump the timeout using extended_timeout

2251

1815

client.approvals_pending -= 1

2252

1816

try:

2253

1817

session.bye()

2254

except gnutls.Error as error:

1818

except gnutls.errors.GNUTLSError as error:

2255

1819

logger.warning("GnuTLS bye failed",

2256

1820

exc_info=error)

2257

1821

2259

1823

def peer_certificate(session):

2260

1824

"Return the peer's OpenPGP certificate as a bytestring"

2261

1825

# If not an OpenPGP certificate...

2262

if (gnutls.certificate_type_get(session._c_object)

2263

!= gnutls.CRT_OPENPGP):

2264

# ...return invalid data

2265

return b""

1826

if (gnutls.library.functions

1827

.gnutls_certificate_type_get(session._c_object)

1828

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1829

# ...do the normal thing

1830

return session.peer_certificate

2266

1831

list_size = ctypes.c_uint(1)

2267

cert_list = (gnutls.certificate_get_peers

1832

cert_list = (gnutls.library.functions

1833

.gnutls_certificate_get_peers

2268

1834

(session._c_object, ctypes.byref(list_size)))

2269

1835

if not bool(cert_list) and list_size.value != 0:

2270

raise gnutls.Error("error getting peer certificate")

1836

raise gnutls.errors.GNUTLSError("error getting peer"

1837

" certificate")

2271

1838

if list_size.value == 0:

2272

1839

return None

2273

1840

cert = cert_list[0]

2277

1844

def fingerprint(openpgp):

2278

1845

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2279

1846

# New GnuTLS "datum" with the OpenPGP public key

2280

datum = gnutls.datum_t(

2281

ctypes.cast(ctypes.c_char_p(openpgp),

2282

ctypes.POINTER(ctypes.c_ubyte)),

2283

ctypes.c_uint(len(openpgp)))

1847

datum = (gnutls.library.types

1848

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1849

ctypes.POINTER

1850

(ctypes.c_ubyte)),

1851

ctypes.c_uint(len(openpgp))))

2284

1852

# New empty GnuTLS certificate

2285

crt = gnutls.openpgp_crt_t()

2286

gnutls.openpgp_crt_init(ctypes.byref(crt))

1853

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2287

1856

# Import the OpenPGP public key into the certificate

2288

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2289

gnutls.OPENPGP_FMT_RAW)

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1859

gnutls.library.constants

1860

.GNUTLS_OPENPGP_FMT_RAW))

2290

1861

# Verify the self signature in the key

2291

1862

crtverify = ctypes.c_uint()

2292

gnutls.openpgp_crt_verify_self(crt, 0,

2293

ctypes.byref(crtverify))

1863

(gnutls.library.functions

1864

.gnutls_openpgp_crt_verify_self(crt, 0,

1865

ctypes.byref(crtverify)))

2294

1866

if crtverify.value != 0:

2295

gnutls.openpgp_crt_deinit(crt)

2296

raise gnutls.CertificateSecurityError("Verify failed")

1867

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1868

raise (gnutls.errors.CertificateSecurityError

1869

("Verify failed"))

2297

1870

# New buffer for the fingerprint

2298

1871

buf = ctypes.create_string_buffer(20)

2299

1872

buf_len = ctypes.c_size_t()

2300

1873

# Get the fingerprint from the certificate into the buffer

2301

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2302

ctypes.byref(buf_len))

1874

(gnutls.library.functions

1875

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1876

ctypes.byref(buf_len)))

2303

1877

# Deinit the certificate

2304

gnutls.openpgp_crt_deinit(crt)

1878

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2305

1879

# Convert the buffer to a Python bytestring

2306

1880

fpr = ctypes.string_at(buf, buf_len.value)

2307

1881

# Convert the bytestring to hexadecimal notation

2311

1885

2312

1886

class MultiprocessingMixIn(object):

2313

1887

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2314

2315

1888

def sub_process_main(self, request, address):

2316

1889

try:

2317

1890

self.finish_request(request, address)

2329

1902

2330

1903

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2331

1904

""" adds a pipe to the MixIn """

2332

2333

1905

def process_request(self, request, client_address):

2334

1906

"""Overrides and wraps the original process_request().

2335

1907

2356

1928

interface: None or a network interface name (string)

2357

1929

use_ipv6: Boolean; to use IPv6 or not

2358

1930

"""

2359

2360

1931

def __init__(self, server_address, RequestHandlerClass,

2361

interface=None,

2362

use_ipv6=True,

2363

socketfd=None):

1932

interface=None, use_ipv6=True, socketfd=None):

2364

1933

"""If socketfd is set, use that file descriptor instead of

2365

1934

creating a new one with socket.socket().

2366

1935

"""

2407

1976

self.interface)

2408

1977

else:

2409

1978

try:

2410

self.socket.setsockopt(

2411

socket.SOL_SOCKET, SO_BINDTODEVICE,

2412

(self.interface + "\0").encode("utf-8"))

1979

self.socket.setsockopt(socket.SOL_SOCKET,

1980

SO_BINDTODEVICE,

1981

str(self.interface + '\0'))

2413

1982

except socket.error as error:

2414

1983

if error.errno == errno.EPERM:

2415

1984

logger.error("No permission to bind to"

2433

2002

self.server_address = (any_address,

2434

2003

self.server_address[1])

2435

2004

elif not self.server_address[1]:

2436

self.server_address = (self.server_address[0], 0)

2005

self.server_address = (self.server_address[0],

2006

0)

2437

2007

# if self.interface:

2438

2008

# self.server_address = (self.server_address[0],

2439

2009

# 0, # port

2453

2023

2454

2024

Assumes a gobject.MainLoop event loop.

2455

2025

"""

2456

2457

2026

def __init__(self, server_address, RequestHandlerClass,

2458

interface=None,

2459

use_ipv6=True,

2460

clients=None,

2461

gnutls_priority=None,

2462

use_dbus=True,

2463

socketfd=None):

2027

interface=None, use_ipv6=True, clients=None,

2028

gnutls_priority=None, use_dbus=True, socketfd=None):

2464

2029

self.enabled = False

2465

2030

self.clients = clients

2466

2031

if self.clients is None:

2472

2037

interface = interface,

2473

2038

use_ipv6 = use_ipv6,

2474

2039

socketfd = socketfd)

2475

2476

2040

def server_activate(self):

2477

2041

if self.enabled:

2478

2042

return socketserver.TCPServer.server_activate(self)

2482

2046

2483

2047

def add_pipe(self, parent_pipe, proc):

2484

2048

# Call "handle_ipc" for both data and EOF events

2485

gobject.io_add_watch(

2486

parent_pipe.fileno(),

2487

gobject.IO_IN | gobject.IO_HUP,

2488

functools.partial(self.handle_ipc,

2489

parent_pipe = parent_pipe,

2490

proc = proc))

2049

gobject.io_add_watch(parent_pipe.fileno(),

2050

gobject.IO_IN | gobject.IO_HUP,

2051

functools.partial(self.handle_ipc,

2052

parent_pipe =

2053

parent_pipe,

2054

proc = proc))

2491

2055

2492

def handle_ipc(self, source, condition,

2493

parent_pipe=None,

2494

proc = None,

2495

client_object=None):

2056

def handle_ipc(self, source, condition, parent_pipe=None,

2057

proc = None, client_object=None):

2496

2058

# error, or the other end of multiprocessing.Pipe has closed

2497

2059

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2498

2060

# Wait for other process to exit

2521

2083

parent_pipe.send(False)

2522

2084

return False

2523

2085

2524

gobject.io_add_watch(

2525

parent_pipe.fileno(),

2526

gobject.IO_IN | gobject.IO_HUP,

2527

functools.partial(self.handle_ipc,

2528

parent_pipe = parent_pipe,

2529

proc = proc,

2530

client_object = client))

2086

gobject.io_add_watch(parent_pipe.fileno(),

2087

gobject.IO_IN | gobject.IO_HUP,

2088

functools.partial(self.handle_ipc,

2089

parent_pipe =

2090

parent_pipe,

2091

proc = proc,

2092

client_object =

2093

client))

2531

2094

parent_pipe.send(True)

2532

2095

# remove the old hook in favor of the new above hook on

2533

2096

# same fileno

2539

2102

2540

2103

parent_pipe.send(('data', getattr(client_object,

2541

2104

funcname)(*args,

2542

**kwargs)))

2105

**kwargs)))

2543

2106

2544

2107

if command == 'getattr':

2545

2108

attrname = request[1]

2546

if isinstance(client_object.__getattribute__(attrname),

2547

collections.Callable):

2548

parent_pipe.send(('function', ))

2109

if callable(client_object.__getattribute__(attrname)):

2110

parent_pipe.send(('function',))

2549

2111

else:

2550

parent_pipe.send((

2551

'data', client_object.__getattribute__(attrname)))

2112

parent_pipe.send(('data', client_object

2113

.__getattribute__(attrname)))

2552

2114

2553

2115

if command == 'setattr':

2554

2116

attrname = request[1]

2585

2147

# avoid excessive use of external libraries.

2586

2148

2587

2149

# New type for defining tokens, syntax, and semantics all-in-one

2588

Token = collections.namedtuple("Token", (

2589

"regexp", # To match token; if "value" is not None, must have

2590

# a "group" containing digits

2591

"value", # datetime.timedelta or None

2592

"followers")) # Tokens valid after this token

2150

Token = collections.namedtuple("Token",

2151

("regexp", # To match token; if

2152

# "value" is not None,

2153

# must have a "group"

2154

# containing digits

2155

"value", # datetime.timedelta or

2156

# None

2157

"followers")) # Tokens valid after

2158

# this token

2593

2159

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2594

2160

# the "duration" ABNF definition in RFC 3339, Appendix A.

2595

2161

token_end = Token(re.compile(r"$"), None, frozenset())

2596

2162

token_second = Token(re.compile(r"(\d+)S"),

2597

2163

datetime.timedelta(seconds=1),

2598

frozenset((token_end, )))

2164

frozenset((token_end,)))

2599

2165

token_minute = Token(re.compile(r"(\d+)M"),

2600

2166

datetime.timedelta(minutes=1),

2601

2167

frozenset((token_second, token_end)))

2617

2183

frozenset((token_month, token_end)))

2618

2184

token_week = Token(re.compile(r"(\d+)W"),

2619

2185

datetime.timedelta(weeks=1),

2620

frozenset((token_end, )))

2186

frozenset((token_end,)))

2621

2187

token_duration = Token(re.compile(r"P"), None,

2622

2188

frozenset((token_year, token_month,

2623

2189

token_day, token_time,

2624

token_week)))

2190

token_week))),

2625

2191

# Define starting values

2626

2192

value = datetime.timedelta() # Value so far

2627

2193

found_token = None

2628

followers = frozenset((token_duration, )) # Following valid tokens

2194

followers = frozenset(token_duration,) # Following valid tokens

2629

2195

s = duration # String left to parse

2630

2196

# Loop until end token is found

2631

2197

while found_token is not token_end:

2648

2214

break

2649

2215

else:

2650

2216

# No currently valid tokens were found

2651

raise ValueError("Invalid RFC 3339 duration: {!r}"

2652

.format(duration))

2217

raise ValueError("Invalid RFC 3339 duration")

2653

2218

# End token found

2654

2219

return value

2655

2220

2679

2244

timevalue = datetime.timedelta(0)

2680

2245

for s in interval.split():

2681

2246

try:

2682

suffix = s[-1]

2247

suffix = unicode(s[-1])

2683

2248

value = int(s[:-1])

2684

2249

if suffix == "d":

2685

2250

delta = datetime.timedelta(value)

2692

2257

elif suffix == "w":

2693

2258

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2694

2259

else:

2695

raise ValueError("Unknown suffix {!r}".format(suffix))

2260

raise ValueError("Unknown suffix {0!r}"

2261

.format(suffix))

2696

2262

except IndexError as e:

2697

2263

raise ValueError(*(e.args))

2698

2264

timevalue += delta

2715

2281

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2716

2282

if not stat.S_ISCHR(os.fstat(null).st_mode):

2717

2283

raise OSError(errno.ENODEV,

2718

"{} not a character device"

2284

"{0} not a character device"

2719

2285

.format(os.devnull))

2720

2286

os.dup2(null, sys.stdin.fileno())

2721

2287

os.dup2(null, sys.stdout.fileno())

2731

2297

2732

2298

parser = argparse.ArgumentParser()

2733

2299

parser.add_argument("-v", "--version", action="version",

2734

version = "%(prog)s {}".format(version),

2300

version = "%(prog)s {0}".format(version),

2735

2301

help="show version number and exit")

2736

2302

parser.add_argument("-i", "--interface", metavar="IF",

2737

2303

help="Bind to interface IF")

2770

2336

help="Directory to save/restore state in")

2771

2337

parser.add_argument("--foreground", action="store_true",

2772

2338

help="Run in foreground", default=None)

2773

parser.add_argument("--no-zeroconf", action="store_false",

2774

dest="zeroconf", help="Do not use Zeroconf",

2775

default=None)

2776

2339

2777

2340

options = parser.parse_args()

2778

2341

2779

2342

if options.check:

2780

2343

import doctest

2781

fail_count, test_count = doctest.testmod()

2782

sys.exit(os.EX_OK if fail_count == 0 else 1)

2344

doctest.testmod()

2345

sys.exit()

2783

2346

2784

2347

# Default values for config file for server-global settings

2785

2348

server_defaults = { "interface": "",

2787

2350

"port": "",

2788

2351

"debug": "False",

2789

2352

"priority":

2790

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2791

":+SIGN-DSA-SHA256",

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2792

2354

"servicename": "Mandos",

2793

2355

"use_dbus": "True",

2794

2356

"use_ipv6": "True",

2797

2359

"socket": "",

2798

2360

"statedir": "/var/lib/mandos",

2799

2361

"foreground": "False",

2800

"zeroconf": "True",

2801

}

2362

}

2802

2363

2803

2364

# Parse config file for server-global settings

2804

2365

server_config = configparser.SafeConfigParser(server_defaults)

2805

2366

del server_defaults

2806

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2367

server_config.read(os.path.join(options.configdir,

2368

"mandos.conf"))

2807

2369

# Convert the SafeConfigParser object to a dict

2808

2370

server_settings = server_config.defaults()

2809

2371

# Use the appropriate methods on the non-string config options

2827

2389

# Override the settings from the config file with command line

2828

2390

# options, if set.

2829

2391

for option in ("interface", "address", "port", "debug",

2830

"priority", "servicename", "configdir", "use_dbus",

2831

"use_ipv6", "debuglevel", "restore", "statedir",

2832

"socket", "foreground", "zeroconf"):

2392

"priority", "servicename", "configdir",

2393

"use_dbus", "use_ipv6", "debuglevel", "restore",

2394

"statedir", "socket", "foreground"):

2833

2395

value = getattr(options, option)

2834

2396

if value is not None:

2835

2397

server_settings[option] = value

2836

2398

del options

2837

2399

# Force all strings to be unicode

2838

2400

for option in server_settings.keys():

2839

if isinstance(server_settings[option], bytes):

2840

server_settings[option] = (server_settings[option]

2841

.decode("utf-8"))

2401

if type(server_settings[option]) is str:

2402

server_settings[option] = unicode(server_settings[option])

2842

2403

# Force all boolean options to be boolean

2843

2404

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2844

"foreground", "zeroconf"):

2405

"foreground"):

2845

2406

server_settings[option] = bool(server_settings[option])

2846

2407

# Debug implies foreground

2847

2408

if server_settings["debug"]:

2850

2411

2851

2412

##################################################################

2852

2413

2853

if (not server_settings["zeroconf"]

2854

and not (server_settings["port"]

2855

or server_settings["socket"] != "")):

2856

parser.error("Needs port or socket to work without Zeroconf")

2857

2858

2414

# For convenience

2859

2415

debug = server_settings["debug"]

2860

2416

debuglevel = server_settings["debuglevel"]

2863

2419

stored_state_path = os.path.join(server_settings["statedir"],

2864

2420

stored_state_file)

2865

2421

foreground = server_settings["foreground"]

2866

zeroconf = server_settings["zeroconf"]

2867

2422

2868

2423

if debug:

2869

2424

initlogger(debug, logging.DEBUG)

2875

2430

initlogger(debug, level)

2876

2431

2877

2432

if server_settings["servicename"] != "Mandos":

2878

syslogger.setFormatter(

2879

logging.Formatter('Mandos ({}) [%(process)d]:'

2880

' %(levelname)s: %(message)s'.format(

2881

server_settings["servicename"])))

2433

syslogger.setFormatter(logging.Formatter

2434

('Mandos ({0}) [%(process)d]:'

2435

' %(levelname)s: %(message)s'

2436

.format(server_settings

2437

["servicename"])))

2882

2438

2883

2439

# Parse config file with clients

2884

2440

client_config = configparser.SafeConfigParser(Client

2889

2445

global mandos_dbus_service

2890

2446

mandos_dbus_service = None

2891

2447

2892

socketfd = None

2893

if server_settings["socket"] != "":

2894

socketfd = server_settings["socket"]

2895

tcp_server = MandosServer(

2896

(server_settings["address"], server_settings["port"]),

2897

ClientHandler,

2898

interface=(server_settings["interface"] or None),

2899

use_ipv6=use_ipv6,

2900

gnutls_priority=server_settings["priority"],

2901

use_dbus=use_dbus,

2902

socketfd=socketfd)

2448

tcp_server = MandosServer((server_settings["address"],

2449

server_settings["port"]),

2450

ClientHandler,

2451

interface=(server_settings["interface"]

2452

or None),

2453

use_ipv6=use_ipv6,

2454

gnutls_priority=

2455

server_settings["priority"],

2456

use_dbus=use_dbus,

2457

socketfd=(server_settings["socket"]

2458

or None))

2903

2459

if not foreground:

2904

2460

pidfilename = "/run/mandos.pid"

2905

2461

if not os.path.isdir("/run/."):

2906

2462

pidfilename = "/var/run/mandos.pid"

2907

2463

pidfile = None

2908

2464

try:

2909

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2465

pidfile = open(pidfilename, "w")

2910

2466

except IOError as e:

2911

2467

logger.error("Could not open file %r", pidfilename,

2912

2468

exc_info=e)

2933

2489

2934

2490

# "Use a log level over 10 to enable all debugging options."

2935

2491

# - GnuTLS manual

2936

gnutls.global_set_log_level(11)

2492

gnutls.library.functions.gnutls_global_set_log_level(11)

2937

2493

2938

@gnutls.log_func

2494

@gnutls.library.types.gnutls_log_func

2939

2495

def debug_gnutls(level, string):

2940

2496

logger.debug("GnuTLS: %s", string[:-1])

2941

2497

2942

gnutls.global_set_log_function(debug_gnutls)

2498

(gnutls.library.functions

2499

.gnutls_global_set_log_function(debug_gnutls))

2943

2500

2944

2501

# Redirect stdin so all checkers get /dev/null

2945

2502

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2965

2522

if use_dbus:

2966

2523

try:

2967

2524

bus_name = dbus.service.BusName("se.recompile.Mandos",

2968

bus,

2969

do_not_queue=True)

2970

old_bus_name = dbus.service.BusName(

2971

"se.bsnet.fukt.Mandos", bus,

2972

do_not_queue=True)

2973

except dbus.exceptions.DBusException as e:

2525

bus, do_not_queue=True)

2526

old_bus_name = (dbus.service.BusName

2527

("se.bsnet.fukt.Mandos", bus,

2528

do_not_queue=True))

2529

except dbus.exceptions.NameExistsException as e:

2974

2530

logger.error("Disabling D-Bus:", exc_info=e)

2975

2531

use_dbus = False

2976

2532

server_settings["use_dbus"] = False

2977

2533

tcp_server.use_dbus = False

2978

if zeroconf:

2979

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2980

service = AvahiServiceToSyslog(

2981

name = server_settings["servicename"],

2982

servicetype = "_mandos._tcp",

2983

protocol = protocol,

2984

bus = bus)

2985

if server_settings["interface"]:

2986

service.interface = if_nametoindex(

2987

server_settings["interface"].encode("utf-8"))

2534

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2535

service = AvahiServiceToSyslog(name =

2536

server_settings["servicename"],

2537

servicetype = "_mandos._tcp",

2538

protocol = protocol, bus = bus)

2539

if server_settings["interface"]:

2540

service.interface = (if_nametoindex

2541

(str(server_settings["interface"])))

2988

2542

2989

2543

global multiprocessing_manager

2990

2544

multiprocessing_manager = multiprocessing.Manager()

3009

2563

if server_settings["restore"]:

3010

2564

try:

3011

2565

with open(stored_state_path, "rb") as stored_state:

3012

clients_data, old_client_settings = pickle.load(

3013

stored_state)

2566

clients_data, old_client_settings = (pickle.load

2567

(stored_state))

3014

2568

os.remove(stored_state_path)

3015

2569

except IOError as e:

3016

2570

if e.errno == errno.ENOENT:

3017

logger.warning("Could not load persistent state:"

3018

" {}".format(os.strerror(e.errno)))

2571

logger.warning("Could not load persistent state: {0}"

2572

.format(os.strerror(e.errno)))

3019

2573

else:

3020

2574

logger.critical("Could not load persistent state:",

3021

2575

exc_info=e)

3022

2576

raise

3023

2577

except EOFError as e:

3024

2578

logger.warning("Could not load persistent state: "

3025

"EOFError:",

3026

exc_info=e)

2579

"EOFError:", exc_info=e)

3027

2580

3028

2581

with PGPEngine() as pgp:

3029

for client_name, client in clients_data.items():

2582

for client_name, client in clients_data.iteritems():

3030

2583

# Skip removed clients

3031

2584

if client_name not in client_settings:

3032

2585

continue

3041

2594

# For each value in new config, check if it

3042

2595

# differs from the old config value (Except for

3043

2596

# the "secret" attribute)

3044

if (name != "secret"

3045

and (value !=

3046

old_client_settings[client_name][name])):

2597

if (name != "secret" and

2598

value != old_client_settings[client_name]

2599

[name]):

3047

2600

client[name] = value

3048

2601

except KeyError:

3049

2602

pass

3050

2603

3051

2604

# Clients who has passed its expire date can still be

3052

# enabled if its last checker was successful. A Client

2605

# enabled if its last checker was successful. Clients

3053

2606

# whose checker succeeded before we stored its state is

3054

2607

# assumed to have successfully run all checkers during

3055

2608

# downtime.

3057

2610

if datetime.datetime.utcnow() >= client["expires"]:

3058

2611

if not client["last_checked_ok"]:

3059

2612

logger.warning(

3060

"disabling client {} - Client never "

3061

"performed a successful checker".format(

3062

client_name))

2613

"disabling client {0} - Client never "

2614

"performed a successful checker"

2615

.format(client_name))

3063

2616

client["enabled"] = False

3064

2617

elif client["last_checker_status"] != 0:

3065

2618

logger.warning(

3066

"disabling client {} - Client last"

3067

" checker failed with error code"

3068

" {}".format(

3069

client_name,

3070

client["last_checker_status"]))

2619

"disabling client {0} - Client "

2620

"last checker failed with error code {1}"

2621

.format(client_name,

2622

client["last_checker_status"]))

3071

2623

client["enabled"] = False

3072

2624

else:

3073

client["expires"] = (

3074

datetime.datetime.utcnow()

3075

+ client["timeout"])

2625

client["expires"] = (datetime.datetime

2626

.utcnow()

2627

+ client["timeout"])

3076

2628

logger.debug("Last checker succeeded,"

3077

" keeping {} enabled".format(

3078

client_name))

2629

" keeping {0} enabled"

2630

.format(client_name))

3079

2631

try:

3080

client["secret"] = pgp.decrypt(

3081

client["encrypted_secret"],

3082

client_settings[client_name]["secret"])

2632

client["secret"] = (

2633

pgp.decrypt(client["encrypted_secret"],

2634

client_settings[client_name]

2635

["secret"]))

3083

2636

except PGPError:

3084

2637

# If decryption fails, we use secret from new settings

3085

logger.debug("Failed to decrypt {} old secret".format(

3086

client_name))

3087

client["secret"] = (client_settings[client_name]

3088

["secret"])

2638

logger.debug("Failed to decrypt {0} old secret"

2639

.format(client_name))

2640

client["secret"] = (

2641

client_settings[client_name]["secret"])

3089

2642

3090

2643

# Add/remove clients based on new changes made to config

3091

2644

for client_name in (set(old_client_settings)

3096

2649

clients_data[client_name] = client_settings[client_name]

3097

2650

3098

2651

# Create all client objects

3099

for client_name, client in clients_data.items():

2652

for client_name, client in clients_data.iteritems():

3100

2653

tcp_server.clients[client_name] = client_class(

3101

name = client_name,

3102

settings = client,

2654

name = client_name, settings = client,

3103

2655

server_settings = server_settings)

3104

2656

3105

2657

if not tcp_server.clients:

3107

2659

3108

2660

if not foreground:

3109

2661

if pidfile is not None:

3110

pid = os.getpid()

3111

2662

try:

3112

2663

with pidfile:

3113

print(pid, file=pidfile)

2664

pid = os.getpid()

2665

pidfile.write(str(pid) + "\n".encode("utf-8"))

3114

2666

except IOError:

3115

2667

logger.error("Could not write to file %r with PID %d",

3116

2668

pidfilename, pid)

3121

2673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3122

2674

3123

2675

if use_dbus:

3124

3125

@alternate_dbus_interfaces(

3126

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3127

class MandosDBusService(DBusObjectWithObjectManager):

2676

@alternate_dbus_interfaces({"se.recompile.Mandos":

2677

"se.bsnet.fukt.Mandos"})

2678

class MandosDBusService(DBusObjectWithProperties):

3128

2679

"""A D-Bus proxy object"""

3129

3130

2680

def __init__(self):

3131

2681

dbus.service.Object.__init__(self, bus, "/")

3132

3133

2682

_interface = "se.recompile.Mandos"

3134

2683

2684

@dbus_interface_annotations(_interface)

2685

def _foo(self):

2686

return { "org.freedesktop.DBus.Property"

2687

".EmitsChangedSignal":

2688

"false"}

2689

3135

2690

@dbus.service.signal(_interface, signature="o")

3136

2691

def ClientAdded(self, objpath):

3137

2692

"D-Bus signal"

3142

2697

"D-Bus signal"

3143

2698

pass

3144

2699

3145

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3146

"true"})

3147

2700

@dbus.service.signal(_interface, signature="os")

3148

2701

def ClientRemoved(self, objpath, name):

3149

2702

"D-Bus signal"

3150

2703

pass

3151

2704

3152

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3153

"true"})

3154

2705

@dbus.service.method(_interface, out_signature="ao")

3155

2706

def GetAllClients(self):

3156

2707

"D-Bus method"

3157

return dbus.Array(c.dbus_object_path for c in

2708

return dbus.Array(c.dbus_object_path

2709

for c in

3158

2710

tcp_server.clients.itervalues())

3159

2711

3160

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3161

"true"})

3162

2712

@dbus.service.method(_interface,

3163

2713

out_signature="a{oa{sv}}")

3164

2714

def GetAllClientsWithProperties(self):

3165

2715

"D-Bus method"

3166

2716

return dbus.Dictionary(

3167

{ c.dbus_object_path: c.GetAll(

3168

"se.recompile.Mandos.Client")

3169

for c in tcp_server.clients.itervalues() },

2717

((c.dbus_object_path, c.GetAll(""))

2718

for c in tcp_server.clients.itervalues()),

3170

2719

signature="oa{sv}")

3171

2720

3172

2721

@dbus.service.method(_interface, in_signature="o")

3176

2725

if c.dbus_object_path == object_path:

3177

2726

del tcp_server.clients[c.name]

3178

2727

c.remove_from_connection()

3179

# Don't signal the disabling

2728

# Don't signal anything except ClientRemoved

3180

2729

c.disable(quiet=True)

3181

# Emit D-Bus signal for removal

3182

self.client_removed_signal(c)

2730

# Emit D-Bus signal

2731

self.ClientRemoved(object_path, c.name)

3183

2732

return

3184

2733

raise KeyError(object_path)

3185

2734

3186

2735

del _interface

3187

3188

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3189

out_signature = "a{oa{sa{sv}}}")

3190

def GetManagedObjects(self):

3191

"""D-Bus method"""

3192

return dbus.Dictionary(

3193

{ client.dbus_object_path:

3194

dbus.Dictionary(

3195

{ interface: client.GetAll(interface)

3196

for interface in

3197

client._get_all_interface_names()})

3198

for client in tcp_server.clients.values()})

3199

3200

def client_added_signal(self, client):

3201

"""Send the new standard signal and the old signal"""

3202

if use_dbus:

3203

# New standard signal

3204

self.InterfacesAdded(

3205

client.dbus_object_path,

3206

dbus.Dictionary(

3207

{ interface: client.GetAll(interface)

3208

for interface in

3209

client._get_all_interface_names()}))

3210

# Old signal

3211

self.ClientAdded(client.dbus_object_path)

3212

3213

def client_removed_signal(self, client):

3214

"""Send the new standard signal and the old signal"""

3215

if use_dbus:

3216

# New standard signal

3217

self.InterfacesRemoved(

3218

client.dbus_object_path,

3219

client._get_all_interface_names())

3220

# Old signal

3221

self.ClientRemoved(client.dbus_object_path,

3222

client.name)

3223

2736

3224

2737

mandos_dbus_service = MandosDBusService()

3225

2738

3226

2739

def cleanup():

3227

2740

"Cleanup function; run on exit"

3228

if zeroconf:

3229

service.cleanup()

2741

service.cleanup()

3230

2742

3231

2743

multiprocessing.active_children()

3232

2744

wnull.close()

3246

2758

3247

2759

# A list of attributes that can not be pickled

3248

2760

# + secret.

3249

exclude = { "bus", "changedstate", "secret",

3250

"checker", "server_settings" }

3251

for name, typ in inspect.getmembers(dbus.service

3252

.Object):

2761

exclude = set(("bus", "changedstate", "secret",

2762

"checker", "server_settings"))

2763

for name, typ in (inspect.getmembers

2764

(dbus.service.Object)):

3253

2765

exclude.add(name)

3254

2766

3255

2767

client_dict["encrypted_secret"] = (client

3262

2774

del client_settings[client.name]["secret"]

3263

2775

3264

2776

try:

3265

with tempfile.NamedTemporaryFile(

3266

mode='wb',

3267

suffix=".pickle",

3268

prefix='clients-',

3269

dir=os.path.dirname(stored_state_path),

3270

delete=False) as stored_state:

2777

with (tempfile.NamedTemporaryFile

2778

(mode='wb', suffix=".pickle", prefix='clients-',

2779

dir=os.path.dirname(stored_state_path),

2780

delete=False)) as stored_state:

3271

2781

pickle.dump((clients, client_settings), stored_state)

3272

tempname = stored_state.name

2782

tempname=stored_state.name

3273

2783

os.rename(tempname, stored_state_path)

3274

2784

except (IOError, OSError) as e:

3275

2785

if not debug:

3278

2788

except NameError:

3279

2789

pass

3280

2790

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3281

logger.warning("Could not save persistent state: {}"

2791

logger.warning("Could not save persistent state: {0}"

3282

2792

.format(os.strerror(e.errno)))

3283

2793

else:

3284

2794

logger.warning("Could not save persistent state:",

3290

2800

name, client = tcp_server.clients.popitem()

3291

2801

if use_dbus:

3292

2802

client.remove_from_connection()

3293

# Don't signal the disabling

2803

# Don't signal anything except ClientRemoved

3294

2804

client.disable(quiet=True)

3295

# Emit D-Bus signal for removal

3296

2805

if use_dbus:

3297

mandos_dbus_service.client_removed_signal(client)

2806

# Emit D-Bus signal

2807

mandos_dbus_service.ClientRemoved(client

2808

.dbus_object_path,

2809

client.name)

3298

2810

client_settings.clear()

3299

2811

3300

2812

atexit.register(cleanup)

3301

2813

3302

2814

for client in tcp_server.clients.itervalues():

3303

2815

if use_dbus:

3304

# Emit D-Bus signal for adding

3305

mandos_dbus_service.client_added_signal(client)

2816

# Emit D-Bus signal

2817

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3306

2818

# Need to initiate checking of clients

3307

2819

if client.enabled:

3308

2820

client.init_checker()

3311

2823

tcp_server.server_activate()

3312

2824

3313

2825

# Find out what port we got

3314

if zeroconf:

3315

service.port = tcp_server.socket.getsockname()[1]

2826

service.port = tcp_server.socket.getsockname()[1]

3316

2827

if use_ipv6:

3317

2828

logger.info("Now listening on address %r, port %d,"

3318

2829

" flowinfo %d, scope_id %d",

3324

2835

#service.interface = tcp_server.socket.getsockname()[3]

3325

2836

3326

2837

try:

3327

if zeroconf:

3328

# From the Avahi example code

3329

try:

3330

service.activate()

3331

except dbus.exceptions.DBusException as error:

3332

logger.critical("D-Bus Exception", exc_info=error)

3333

cleanup()

3334

sys.exit(1)

3335

# End of Avahi example code

2838

# From the Avahi example code

2839

try:

2840

service.activate()

2841

except dbus.exceptions.DBusException as error:

2842

logger.critical("D-Bus Exception", exc_info=error)

2843

cleanup()

2844

sys.exit(1)

2845

# End of Avahi example code

3336

2846

3337

2847

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3338

2848

lambda *args, **kwargs:

3353

2863

# Must run before the D-Bus bus name gets deregistered

3354

2864

cleanup()

3355

2865

3356

3357

2866

if __name__ == '__main__':

3358

2867

main()