/mandos/release : revision 237.7.211

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

46

43

import errno

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

65

import cPickle as pickle

69

66

import multiprocessing

70

67

import types

71

68

import binascii

72

69

import tempfile

73

70

import itertools

74

71

import collections

75

import codecs

76

72

77

73

import dbus

78

74

import dbus.service

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

75

import gobject

83

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

95

88

except ImportError:

96

89

SO_BINDTODEVICE = None

97

90

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.1"

91

version = "1.6.4"

102

92

stored_state_file = "clients.pickle"

103

93

104

94

logger = logging.getLogger()

105

95

syslogger = None

106

96

107

97

try:

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

110

101

except (OSError, AttributeError):

111

112

102

def if_nametoindex(interface):

113

103

"Get an interface index the hard way, i.e. using fcntl()"

114

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

115

105

with contextlib.closing(socket.socket()) as s:

116

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

117

struct.pack(b"16s16x", interface))

118

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

119

111

return interface_index

120

112

121

113

122

114

def initlogger(debug, level=logging.WARNING):

123

115

"""init logger and add loglevel"""

124

116

125

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

117

syslogger = (logging.handlers.SysLogHandler

118

(facility =

119

logging.handlers.SysLogHandler.LOG_DAEMON,

120

address = str("/dev/log")))

129

121

syslogger.setFormatter(logging.Formatter

130

122

('Mandos [%(process)d]: %(levelname)s:'

131

123

' %(message)s'))

148

140

149

141

class PGPEngine(object):

150

142

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

152

143

def __init__(self):

153

144

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

145

self.gnupgargs = ['--batch',

193

184

194

185

def encrypt(self, data, password):

195

186

passphrase = self.password_encode(password)

196

with tempfile.NamedTemporaryFile(

197

dir=self.tempdir) as passfile:

187

with tempfile.NamedTemporaryFile(dir=self.tempdir

188

) as passfile:

198

189

passfile.write(passphrase)

199

190

passfile.flush()

200

191

proc = subprocess.Popen(['gpg', '--symmetric',

211

202

212

203

def decrypt(self, data, password):

213

204

passphrase = self.password_encode(password)

214

with tempfile.NamedTemporaryFile(

215

dir = self.tempdir) as passfile:

205

with tempfile.NamedTemporaryFile(dir = self.tempdir

206

) as passfile:

216

207

passfile.write(passphrase)

217

208

passfile.flush()

218

209

proc = subprocess.Popen(['gpg', '--decrypt',

222

213

stdin = subprocess.PIPE,

223

214

stdout = subprocess.PIPE,

224

215

stderr = subprocess.PIPE)

225

decrypted_plaintext, err = proc.communicate(input = data)

216

decrypted_plaintext, err = proc.communicate(input

217

= data)

226

218

if proc.returncode != 0:

227

219

raise PGPError(err)

228

220

return decrypted_plaintext

231

223

class AvahiError(Exception):

232

224

def __init__(self, value, *args, **kwargs):

233

225

self.value = value

234

return super(AvahiError, self).__init__(value, *args,

235

**kwargs)

236

226

super(AvahiError, self).__init__(value, *args, **kwargs)

227

def __unicode__(self):

228

return unicode(repr(self.value))

237

229

238

230

class AvahiServiceError(AvahiError):

239

231

pass

240

232

241

242

233

class AvahiGroupError(AvahiError):

243

234

pass

244

235

264

255

bus: dbus.SystemBus()

265

256

"""

266

257

267

def __init__(self,

268

interface = avahi.IF_UNSPEC,

269

name = None,

270

servicetype = None,

271

port = None,

272

TXT = None,

273

domain = "",

274

host = "",

275

max_renames = 32768,

276

protocol = avahi.PROTO_UNSPEC,

277

bus = None):

258

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

259

servicetype = None, port = None, TXT = None,

260

domain = "", host = "", max_renames = 32768,

261

protocol = avahi.PROTO_UNSPEC, bus = None):

278

262

self.interface = interface

279

263

self.name = name

280

264

self.type = servicetype

290

274

self.bus = bus

291

275

self.entry_group_state_changed_match = None

292

276

293

def rename(self, remove=True):

277

def rename(self):

294

278

"""Derived from the Avahi example code"""

295

279

if self.rename_count >= self.max_renames:

296

280

logger.critical("No suitable Zeroconf service name found"

297

281

" after %i retries, exiting.",

298

282

self.rename_count)

299

283

raise AvahiServiceError("Too many renames")

300

self.name = str(

301

self.server.GetAlternativeServiceName(self.name))

302

self.rename_count += 1

284

self.name = unicode(self.server

285

.GetAlternativeServiceName(self.name))

303

286

logger.info("Changing Zeroconf service name to %r ...",

304

287

self.name)

305

if remove:

306

self.remove()

288

self.remove()

307

289

try:

308

290

self.add()

309

291

except dbus.exceptions.DBusException as error:

310

if (error.get_dbus_name()

311

== "org.freedesktop.Avahi.CollisionError"):

312

logger.info("Local Zeroconf service name collision.")

313

return self.rename(remove=False)

314

else:

315

logger.critical("D-Bus Exception", exc_info=error)

316

self.cleanup()

317

os._exit(1)

292

logger.critical("D-Bus Exception", exc_info=error)

293

self.cleanup()

294

os._exit(1)

295

self.rename_count += 1

318

296

319

297

def remove(self):

320

298

"""Derived from the Avahi example code"""

358

336

self.rename()

359

337

elif state == avahi.ENTRY_GROUP_FAILURE:

360

338

logger.critical("Avahi: Error in group state changed %s",

361

str(error))

362

raise AvahiGroupError("State changed: {!s}".format(error))

339

unicode(error))

340

raise AvahiGroupError("State changed: {0!s}"

341

.format(error))

363

342

364

343

def cleanup(self):

365

344

"""Derived from the Avahi example code"""

375

354

def server_state_changed(self, state, error=None):

376

355

"""Derived from the Avahi example code"""

377

356

logger.debug("Avahi server state change: %i", state)

378

bad_states = {

379

avahi.SERVER_INVALID: "Zeroconf server invalid",

380

avahi.SERVER_REGISTERING: None,

381

avahi.SERVER_COLLISION: "Zeroconf server name collision",

382

avahi.SERVER_FAILURE: "Zeroconf server failure",

383

}

357

bad_states = { avahi.SERVER_INVALID:

358

"Zeroconf server invalid",

359

avahi.SERVER_REGISTERING: None,

360

avahi.SERVER_COLLISION:

361

"Zeroconf server name collision",

362

avahi.SERVER_FAILURE:

363

"Zeroconf server failure" }

384

364

if state in bad_states:

385

365

if bad_states[state] is not None:

386

366

if error is None:

389

369

logger.error(bad_states[state] + ": %r", error)

390

370

self.cleanup()

391

371

elif state == avahi.SERVER_RUNNING:

392

try:

393

self.add()

394

except dbus.exceptions.DBusException as error:

395

if (error.get_dbus_name()

396

== "org.freedesktop.Avahi.CollisionError"):

397

logger.info("Local Zeroconf service name"

398

" collision.")

399

return self.rename(remove=False)

400

else:

401

logger.critical("D-Bus Exception", exc_info=error)

402

self.cleanup()

403

os._exit(1)

372

self.add()

404

373

else:

405

374

if error is None:

406

375

logger.debug("Unknown state: %r", state)

416

385

follow_name_owner_changes=True),

417

386

avahi.DBUS_INTERFACE_SERVER)

418

387

self.server.connect_to_signal("StateChanged",

419

self.server_state_changed)

388

self.server_state_changed)

420

389

self.server_state_changed(self.server.GetState())

421

390

422

391

423

392

class AvahiServiceToSyslog(AvahiService):

424

def rename(self, *args, **kwargs):

393

def rename(self):

425

394

"""Add the new name to the syslog messages"""

426

ret = AvahiService.rename(self, *args, **kwargs)

427

syslogger.setFormatter(logging.Formatter(

428

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

429

.format(self.name)))

395

ret = AvahiService.rename(self)

396

syslogger.setFormatter(logging.Formatter

397

('Mandos ({0}) [%(process)d]:'

398

' %(levelname)s: %(message)s'

399

.format(self.name)))

430

400

return ret

431

401

432

# Pretend that we have a GnuTLS module

433

class GnuTLS(object):

434

"""This isn't so much a class as it is a module-like namespace.

435

It is instantiated once, and simulates having a GnuTLS module."""

436

437

_library = ctypes.cdll.LoadLibrary(

438

ctypes.util.find_library("gnutls"))

439

_need_version = "3.3.0"

440

def __init__(self):

441

# Need to use class name "GnuTLS" here, since this method is

442

# called before the assignment to the "gnutls" global variable

443

# happens.

444

if GnuTLS.check_version(self._need_version) is None:

445

raise GnuTLS.Error("Needs GnuTLS {} or later"

446

.format(self._need_version))

447

448

# Unless otherwise indicated, the constants and types below are

449

# all from the gnutls/gnutls.h C header file.

450

451

# Constants

452

E_SUCCESS = 0

453

E_INTERRUPTED = -52

454

E_AGAIN = -28

455

CRT_OPENPGP = 2

456

CLIENT = 2

457

SHUT_RDWR = 0

458

CRD_CERTIFICATE = 1

459

E_NO_CERTIFICATE_FOUND = -49

460

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

461

462

# Types

463

class session_int(ctypes.Structure):

464

_fields_ = []

465

session_t = ctypes.POINTER(session_int)

466

class certificate_credentials_st(ctypes.Structure):

467

_fields_ = []

468

certificate_credentials_t = ctypes.POINTER(

469

certificate_credentials_st)

470

certificate_type_t = ctypes.c_int

471

class datum_t(ctypes.Structure):

472

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

473

('size', ctypes.c_uint)]

474

class openpgp_crt_int(ctypes.Structure):

475

_fields_ = []

476

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

477

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

478

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

479

credentials_type_t = ctypes.c_int #

480

transport_ptr_t = ctypes.c_void_p

481

close_request_t = ctypes.c_int

482

483

# Exceptions

484

class Error(Exception):

485

# We need to use the class name "GnuTLS" here, since this

486

# exception might be raised from within GnuTLS.__init__,

487

# which is called before the assignment to the "gnutls"

488

# global variable has happened.

489

def __init__(self, message = None, code = None, args=()):

490

# Default usage is by a message string, but if a return

491

# code is passed, convert it to a string with

492

# gnutls.strerror()

493

self.code = code

494

if message is None and code is not None:

495

message = GnuTLS.strerror(code)

496

return super(GnuTLS.Error, self).__init__(

497

message, *args)

498

499

class CertificateSecurityError(Error):

500

pass

501

502

# Classes

503

class Credentials(object):

504

def __init__(self):

505

self._c_object = gnutls.certificate_credentials_t()

506

gnutls.certificate_allocate_credentials(

507

ctypes.byref(self._c_object))

508

self.type = gnutls.CRD_CERTIFICATE

509

510

def __del__(self):

511

gnutls.certificate_free_credentials(self._c_object)

512

513

class ClientSession(object):

514

def __init__(self, socket, credentials = None):

515

self._c_object = gnutls.session_t()

516

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

517

gnutls.set_default_priority(self._c_object)

518

gnutls.transport_set_ptr(self._c_object, socket.fileno())

519

gnutls.handshake_set_private_extensions(self._c_object,

520

True)

521

self.socket = socket

522

if credentials is None:

523

credentials = gnutls.Credentials()

524

gnutls.credentials_set(self._c_object, credentials.type,

525

ctypes.cast(credentials._c_object,

526

ctypes.c_void_p))

527

self.credentials = credentials

528

529

def __del__(self):

530

gnutls.deinit(self._c_object)

531

532

def handshake(self):

533

return gnutls.handshake(self._c_object)

534

535

def send(self, data):

536

data = bytes(data)

537

data_len = len(data)

538

while data_len > 0:

539

data_len -= gnutls.record_send(self._c_object,

540

data[-data_len:],

541

data_len)

542

543

def bye(self):

544

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

545

546

# Error handling functions

547

def _error_code(result):

548

"""A function to raise exceptions on errors, suitable

549

for the 'restype' attribute on ctypes functions"""

550

if result >= 0:

551

return result

552

if result == gnutls.E_NO_CERTIFICATE_FOUND:

553

raise gnutls.CertificateSecurityError(code = result)

554

raise gnutls.Error(code = result)

555

556

def _retry_on_error(result, func, arguments):

557

"""A function to retry on some errors, suitable

558

for the 'errcheck' attribute on ctypes functions"""

559

while result < 0:

560

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

561

return _error_code(result)

562

result = func(*arguments)

563

return result

564

565

# Unless otherwise indicated, the function declarations below are

566

# all from the gnutls/gnutls.h C header file.

567

568

# Functions

569

priority_set_direct = _library.gnutls_priority_set_direct

570

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

571

ctypes.POINTER(ctypes.c_char_p)]

572

priority_set_direct.restype = _error_code

573

574

init = _library.gnutls_init

575

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

576

init.restype = _error_code

577

578

set_default_priority = _library.gnutls_set_default_priority

579

set_default_priority.argtypes = [session_t]

580

set_default_priority.restype = _error_code

581

582

record_send = _library.gnutls_record_send

583

record_send.argtypes = [session_t, ctypes.c_void_p,

584

ctypes.c_size_t]

585

record_send.restype = ctypes.c_ssize_t

586

record_send.errcheck = _retry_on_error

587

588

certificate_allocate_credentials = (

589

_library.gnutls_certificate_allocate_credentials)

590

certificate_allocate_credentials.argtypes = [

591

ctypes.POINTER(certificate_credentials_t)]

592

certificate_allocate_credentials.restype = _error_code

593

594

certificate_free_credentials = (

595

_library.gnutls_certificate_free_credentials)

596

certificate_free_credentials.argtypes = [certificate_credentials_t]

597

certificate_free_credentials.restype = None

598

599

handshake_set_private_extensions = (

600

_library.gnutls_handshake_set_private_extensions)

601

handshake_set_private_extensions.argtypes = [session_t,

602

ctypes.c_int]

603

handshake_set_private_extensions.restype = None

604

605

credentials_set = _library.gnutls_credentials_set

606

credentials_set.argtypes = [session_t, credentials_type_t,

607

ctypes.c_void_p]

608

credentials_set.restype = _error_code

609

610

strerror = _library.gnutls_strerror

611

strerror.argtypes = [ctypes.c_int]

612

strerror.restype = ctypes.c_char_p

613

614

certificate_type_get = _library.gnutls_certificate_type_get

615

certificate_type_get.argtypes = [session_t]

616

certificate_type_get.restype = _error_code

617

618

certificate_get_peers = _library.gnutls_certificate_get_peers

619

certificate_get_peers.argtypes = [session_t,

620

ctypes.POINTER(ctypes.c_uint)]

621

certificate_get_peers.restype = ctypes.POINTER(datum_t)

622

623

global_set_log_level = _library.gnutls_global_set_log_level

624

global_set_log_level.argtypes = [ctypes.c_int]

625

global_set_log_level.restype = None

626

627

global_set_log_function = _library.gnutls_global_set_log_function

628

global_set_log_function.argtypes = [log_func]

629

global_set_log_function.restype = None

630

631

deinit = _library.gnutls_deinit

632

deinit.argtypes = [session_t]

633

deinit.restype = None

634

635

handshake = _library.gnutls_handshake

636

handshake.argtypes = [session_t]

637

handshake.restype = _error_code

638

handshake.errcheck = _retry_on_error

639

640

transport_set_ptr = _library.gnutls_transport_set_ptr

641

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

642

transport_set_ptr.restype = None

643

644

bye = _library.gnutls_bye

645

bye.argtypes = [session_t, close_request_t]

646

bye.restype = _error_code

647

bye.errcheck = _retry_on_error

648

649

check_version = _library.gnutls_check_version

650

check_version.argtypes = [ctypes.c_char_p]

651

check_version.restype = ctypes.c_char_p

652

653

# All the function declarations below are from gnutls/openpgp.h

654

655

openpgp_crt_init = _library.gnutls_openpgp_crt_init

656

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

657

openpgp_crt_init.restype = _error_code

658

659

openpgp_crt_import = _library.gnutls_openpgp_crt_import

660

openpgp_crt_import.argtypes = [openpgp_crt_t,

661

ctypes.POINTER(datum_t),

662

openpgp_crt_fmt_t]

663

openpgp_crt_import.restype = _error_code

664

665

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

666

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

667

ctypes.POINTER(ctypes.c_uint)]

668

openpgp_crt_verify_self.restype = _error_code

669

670

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

671

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

672

openpgp_crt_deinit.restype = None

673

674

openpgp_crt_get_fingerprint = (

675

_library.gnutls_openpgp_crt_get_fingerprint)

676

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

677

ctypes.c_void_p,

678

ctypes.POINTER(

679

ctypes.c_size_t)]

680

openpgp_crt_get_fingerprint.restype = _error_code

681

682

# Remove non-public functions

683

del _error_code, _retry_on_error

684

# Create the global "gnutls" object, simulating a module

685

gnutls = GnuTLS()

686

687

def call_pipe(connection, # : multiprocessing.Connection

688

func, *args, **kwargs):

689

"""This function is meant to be called by multiprocessing.Process

690

691

This function runs func(*args, **kwargs), and writes the resulting

692

return value on the provided multiprocessing.Connection.

693

"""

694

connection.send(func(*args, **kwargs))

695

connection.close()

402

403

def timedelta_to_milliseconds(td):

404

"Convert a datetime.timedelta() to milliseconds"

405

return ((td.days * 24 * 60 * 60 * 1000)

406

+ (td.seconds * 1000)

407

+ (td.microseconds // 1000))

408

696

409

697

410

class Client(object):

698

411

"""A representation of a client host served by this server.

725

438

last_checker_status: integer between 0 and 255 reflecting exit

726

439

status of last checker. -1 reflects crashed

727

440

checker, -2 means no checker completed yet.

728

last_checker_signal: The signal which killed the last checker, if

729

last_checker_status is -1

730

441

last_enabled: datetime.datetime(); (UTC) or None

731

442

name: string; from the config file, used in log messages and

732

443

D-Bus identifiers

745

456

"fingerprint", "host", "interval",

746

457

"last_approval_request", "last_checked_ok",

747

458

"last_enabled", "name", "timeout")

748

client_defaults = {

749

"timeout": "PT5M",

750

"extended_timeout": "PT15M",

751

"interval": "PT2M",

752

"checker": "fping -q -- %%(host)s",

753

"host": "",

754

"approval_delay": "PT0S",

755

"approval_duration": "PT1S",

756

"approved_by_default": "True",

757

"enabled": "True",

758

}

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

469

470

def timeout_milliseconds(self):

471

"Return the 'timeout' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.timeout)

473

474

def extended_timeout_milliseconds(self):

475

"Return the 'extended_timeout' attribute in milliseconds"

476

return timedelta_to_milliseconds(self.extended_timeout)

477

478

def interval_milliseconds(self):

479

"Return the 'interval' attribute in milliseconds"

480

return timedelta_to_milliseconds(self.interval)

481

482

def approval_delay_milliseconds(self):

483

return timedelta_to_milliseconds(self.approval_delay)

759

484

760

485

@staticmethod

761

486

def config_parser(config):

777

502

client["enabled"] = config.getboolean(client_name,

778

503

"enabled")

779

504

780

# Uppercase and remove spaces from fingerprint for later

781

# comparison purposes with return value from the

782

# fingerprint() function

783

505

client["fingerprint"] = (section["fingerprint"].upper()

784

506

.replace(" ", ""))

785

507

if "secret" in section:

790

512

"rb") as secfile:

791

513

client["secret"] = secfile.read()

792

514

else:

793

raise TypeError("No secret or secfile for section {}"

515

raise TypeError("No secret or secfile for section {0}"

794

516

.format(section))

795

517

client["timeout"] = string_to_delta(section["timeout"])

796

518

client["extended_timeout"] = string_to_delta(

813

535

server_settings = {}

814

536

self.server_settings = server_settings

815

537

# adding all client settings

816

for setting, value in settings.items():

538

for setting, value in settings.iteritems():

817

539

setattr(self, setting, value)

818

540

819

541

if self.enabled:

827

549

self.expires = None

828

550

829

551

logger.debug("Creating client %r", self.name)

552

# Uppercase and remove spaces from fingerprint for later

553

# comparison purposes with return value from the fingerprint()

554

# function

830

555

logger.debug(" Fingerprint: %s", self.fingerprint)

831

556

self.created = settings.get("created",

832

557

datetime.datetime.utcnow())

839

564

self.current_checker_command = None

840

565

self.approved = None

841

566

self.approvals_pending = 0

842

self.changedstate = multiprocessing_manager.Condition(

843

multiprocessing_manager.Lock())

844

self.client_structure = [attr

845

for attr in self.__dict__.iterkeys()

567

self.changedstate = (multiprocessing_manager

568

.Condition(multiprocessing_manager

569

.Lock()))

570

self.client_structure = [attr for attr in

571

self.__dict__.iterkeys()

846

572

if not attr.startswith("_")]

847

573

self.client_structure.append("client_structure")

848

574

849

for name, t in inspect.getmembers(

850

type(self), lambda obj: isinstance(obj, property)):

575

for name, t in inspect.getmembers(type(self),

576

lambda obj:

577

isinstance(obj,

578

property)):

851

579

if not name.startswith("_"):

852

580

self.client_structure.append(name)

853

581

895

623

# and every interval from then on.

896

624

if self.checker_initiator_tag is not None:

897

625

gobject.source_remove(self.checker_initiator_tag)

898

self.checker_initiator_tag = gobject.timeout_add(

899

int(self.interval.total_seconds() * 1000),

900

self.start_checker)

626

self.checker_initiator_tag = (gobject.timeout_add

627

(self.interval_milliseconds(),

628

self.start_checker))

901

629

# Schedule a disable() when 'timeout' has passed

902

630

if self.disable_initiator_tag is not None:

903

631

gobject.source_remove(self.disable_initiator_tag)

904

self.disable_initiator_tag = gobject.timeout_add(

905

int(self.timeout.total_seconds() * 1000), self.disable)

632

self.disable_initiator_tag = (gobject.timeout_add

633

(self.timeout_milliseconds(),

634

self.disable))

906

635

# Also start a new checker *right now*.

907

636

self.start_checker()

908

637

909

def checker_callback(self, source, condition, connection,

910

command):

638

def checker_callback(self, pid, condition, command):

911

639

"""The checker has completed, so take appropriate actions."""

912

640

self.checker_callback_tag = None

913

641

self.checker = None

914

# Read return code from connection (see call_pipe)

915

returncode = connection.recv()

916

connection.close()

917

918

if returncode >= 0:

919

self.last_checker_status = returncode

920

self.last_checker_signal = None

642

if os.WIFEXITED(condition):

643

self.last_checker_status = os.WEXITSTATUS(condition)

921

644

if self.last_checker_status == 0:

922

645

logger.info("Checker for %(name)s succeeded",

923

646

vars(self))

924

647

self.checked_ok()

925

648

else:

926

logger.info("Checker for %(name)s failed", vars(self))

649

logger.info("Checker for %(name)s failed",

650

vars(self))

927

651

else:

928

652

self.last_checker_status = -1

929

self.last_checker_signal = -returncode

930

653

logger.warning("Checker for %(name)s crashed?",

931

654

vars(self))

932

return False

933

655

934

656

def checked_ok(self):

935

657

"""Assert that the client has been seen, alive and well."""

936

658

self.last_checked_ok = datetime.datetime.utcnow()

937

659

self.last_checker_status = 0

938

self.last_checker_signal = None

939

660

self.bump_timeout()

940

661

941

662

def bump_timeout(self, timeout=None):

946

667

gobject.source_remove(self.disable_initiator_tag)

947

668

self.disable_initiator_tag = None

948

669

if getattr(self, "enabled", False):

949

self.disable_initiator_tag = gobject.timeout_add(

950

int(timeout.total_seconds() * 1000), self.disable)

670

self.disable_initiator_tag = (gobject.timeout_add

671

(timedelta_to_milliseconds

672

(timeout), self.disable))

951

673

self.expires = datetime.datetime.utcnow() + timeout

952

674

953

675

def need_approval(self):

967

689

# than 'timeout' for the client to be disabled, which is as it

968

690

# should be.

969

691

970

if self.checker is not None and not self.checker.is_alive():

971

logger.warning("Checker was not alive; joining")

972

self.checker.join()

973

self.checker = None

692

# If a checker exists, make sure it is not a zombie

693

try:

694

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

695

except AttributeError:

696

pass

697

except OSError as error:

698

if error.errno != errno.ECHILD:

699

raise

700

else:

701

if pid:

702

logger.warning("Checker was a zombie")

703

gobject.source_remove(self.checker_callback_tag)

704

self.checker_callback(pid, status,

705

self.current_checker_command)

974

706

# Start a new checker if needed

975

707

if self.checker is None:

976

708

# Escape attributes for the shell

977

escaped_attrs = {

978

attr: re.escape(str(getattr(self, attr)))

979

for attr in self.runtime_expansions }

709

escaped_attrs = dict(

710

(attr, re.escape(unicode(getattr(self, attr))))

711

for attr in

712

self.runtime_expansions)

980

713

try:

981

714

command = self.checker_command % escaped_attrs

982

715

except TypeError as error:

983

716

logger.error('Could not format string "%s"',

984

self.checker_command,

717

self.checker_command, exc_info=error)

718

return True # Try again later

719

self.current_checker_command = command

720

try:

721

logger.info("Starting checker %r for %s",

722

command, self.name)

723

# We don't need to redirect stdout and stderr, since

724

# in normal mode, that is already done by daemon(),

725

# and in debug mode we don't want to. (Stdin is

726

# always replaced by /dev/null.)

727

# The exception is when not debugging but nevertheless

728

# running in the foreground; use the previously

729

# created wnull.

730

popen_args = {}

731

if (not self.server_settings["debug"]

732

and self.server_settings["foreground"]):

733

popen_args.update({"stdout": wnull,

734

"stderr": wnull })

735

self.checker = subprocess.Popen(command,

736

close_fds=True,

737

shell=True, cwd="/",

738

**popen_args)

739

except OSError as error:

740

logger.error("Failed to start subprocess",

985

741

exc_info=error)

986

return True # Try again later

987

self.current_checker_command = command

988

logger.info("Starting checker %r for %s", command,

989

self.name)

990

# We don't need to redirect stdout and stderr, since

991

# in normal mode, that is already done by daemon(),

992

# and in debug mode we don't want to. (Stdin is

993

# always replaced by /dev/null.)

994

# The exception is when not debugging but nevertheless

995

# running in the foreground; use the previously

996

# created wnull.

997

popen_args = { "close_fds": True,

998

"shell": True,

999

"cwd": "/" }

1000

if (not self.server_settings["debug"]

1001

and self.server_settings["foreground"]):

1002

popen_args.update({"stdout": wnull,

1003

"stderr": wnull })

1004

pipe = multiprocessing.Pipe(duplex = False)

1005

self.checker = multiprocessing.Process(

1006

target = call_pipe,

1007

args = (pipe[1], subprocess.call, command),

1008

kwargs = popen_args)

1009

self.checker.start()

1010

self.checker_callback_tag = gobject.io_add_watch(

1011

pipe[0].fileno(), gobject.IO_IN,

1012

self.checker_callback, pipe[0], command)

742

return True

743

self.checker_callback_tag = (gobject.child_watch_add

744

(self.checker.pid,

745

self.checker_callback,

746

data=command))

747

# The checker may have completed before the gobject

748

# watch was added. Check for this.

749

try:

750

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

751

except OSError as error:

752

if error.errno == errno.ECHILD:

753

# This should never happen

754

logger.error("Child process vanished",

755

exc_info=error)

756

return True

757

raise

758

if pid:

759

gobject.source_remove(self.checker_callback_tag)

760

self.checker_callback(pid, status, command)

1013

761

# Re-run this periodically if run by gobject.timeout_add

1014

762

return True

1015

763

1021

769

if getattr(self, "checker", None) is None:

1022

770

return

1023

771

logger.debug("Stopping checker for %(name)s", vars(self))

1024

self.checker.terminate()

772

try:

773

self.checker.terminate()

774

#time.sleep(0.5)

775

#if self.checker.poll() is None:

776

# self.checker.kill()

777

except OSError as error:

778

if error.errno != errno.ESRCH: # No such process

779

raise

1025

780

self.checker = None

1026

781

1027

782

1028

def dbus_service_property(dbus_interface,

1029

signature="v",

1030

access="readwrite",

1031

byte_arrays=False):

783

def dbus_service_property(dbus_interface, signature="v",

784

access="readwrite", byte_arrays=False):

1032

785

"""Decorators for marking methods of a DBusObjectWithProperties to

1033

786

become properties on the D-Bus.

1034

787

1043

796

# "Set" method, so we fail early here:

1044

797

if byte_arrays and signature != "ay":

1045

798

raise ValueError("Byte arrays not supported for non-'ay'"

1046

" signature {!r}".format(signature))

1047

799

" signature {0!r}".format(signature))

1048

800

def decorator(func):

1049

801

func._dbus_is_property = True

1050

802

func._dbus_interface = dbus_interface

1055

807

func._dbus_name = func._dbus_name[:-14]

1056

808

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1057

809

return func

1058

1059

810

return decorator

1060

811

1061

812

1070

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1071

822

"false"}

1072

823

"""

1073

1074

824

def decorator(func):

1075

825

func._dbus_is_interface = True

1076

826

func._dbus_interface = dbus_interface

1077

827

func._dbus_name = dbus_interface

1078

828

return func

1079

1080

829

return decorator

1081

830

1082

831

1084

833

"""Decorator to annotate D-Bus methods, signals or properties

1085

834

Usage:

1086

835

1087

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1088

"org.freedesktop.DBus.Property."

1089

"EmitsChangedSignal": "false"})

1090

836

@dbus_service_property("org.example.Interface", signature="b",

1091

837

access="r")

838

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

1092

841

def Property_dbus_property(self):

1093

842

return dbus.Boolean(False)

1094

1095

See also the DBusObjectWithAnnotations class.

1096

843

"""

1097

1098

844

def decorator(func):

1099

845

func._dbus_annotations = annotations

1100

846

return func

1101

1102

847

return decorator

1103

848

1104

849

1105

850

class DBusPropertyException(dbus.exceptions.DBusException):

1106

851

"""A base class for D-Bus property-related exceptions

1107

852

"""

1108

pass

853

def __unicode__(self):

854

return unicode(str(self))

1109

855

1110

856

1111

857

class DBusPropertyAccessException(DBusPropertyException):

1120

866

pass

1121

867

1122

868

1123

class DBusObjectWithAnnotations(dbus.service.Object):

1124

"""A D-Bus object with annotations.

869

class DBusObjectWithProperties(dbus.service.Object):

870

"""A D-Bus object with properties.

1125

871

1126

Classes inheriting from this can use the dbus_annotations

1127

decorator to add annotations to methods or signals.

872

Classes inheriting from this can use the dbus_service_property

873

decorator to expose methods as D-Bus properties. It exposes the

874

standard Get(), Set(), and GetAll() methods on the D-Bus.

1128

875

"""

1129

876

1130

877

@staticmethod

1134

881

If called like _is_dbus_thing("method") it returns a function

1135

882

suitable for use as predicate to inspect.getmembers().

1136

883

"""

1137

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

884

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1138

885

False)

1139

886

1140

887

def _get_all_dbus_things(self, thing):

1141

888

"""Returns a generator of (name, attribute) pairs

1142

889

"""

1143

return ((getattr(athing.__get__(self), "_dbus_name", name),

890

return ((getattr(athing.__get__(self), "_dbus_name",

891

name),

1144

892

athing.__get__(self))

1145

893

for cls in self.__class__.__mro__

1146

894

for name, athing in

1147

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1148

1149

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1150

out_signature = "s",

1151

path_keyword = 'object_path',

1152

connection_keyword = 'connection')

1153

def Introspect(self, object_path, connection):

1154

"""Overloading of standard D-Bus method.

1155

1156

Inserts annotation tags on methods and signals.

1157

"""

1158

xmlstring = dbus.service.Object.Introspect(self, object_path,

1159

connection)

1160

try:

1161

document = xml.dom.minidom.parseString(xmlstring)

1162

1163

for if_tag in document.getElementsByTagName("interface"):

1164

# Add annotation tags

1165

for typ in ("method", "signal"):

1166

for tag in if_tag.getElementsByTagName(typ):

1167

annots = dict()

1168

for name, prop in (self.

1169

_get_all_dbus_things(typ)):

1170

if (name == tag.getAttribute("name")

1171

and prop._dbus_interface

1172

== if_tag.getAttribute("name")):

1173

annots.update(getattr(

1174

prop, "_dbus_annotations", {}))

1175

for name, value in annots.items():

1176

ann_tag = document.createElement(

1177

"annotation")

1178

ann_tag.setAttribute("name", name)

1179

ann_tag.setAttribute("value", value)

1180

tag.appendChild(ann_tag)

1181

# Add interface annotation tags

1182

for annotation, value in dict(

1183

itertools.chain.from_iterable(

1184

annotations().items()

1185

for name, annotations

1186

in self._get_all_dbus_things("interface")

1187

if name == if_tag.getAttribute("name")

1188

)).items():

1189

ann_tag = document.createElement("annotation")

1190

ann_tag.setAttribute("name", annotation)

1191

ann_tag.setAttribute("value", value)

1192

if_tag.appendChild(ann_tag)

1193

# Fix argument name for the Introspect method itself

1194

if (if_tag.getAttribute("name")

1195

== dbus.INTROSPECTABLE_IFACE):

1196

for cn in if_tag.getElementsByTagName("method"):

1197

if cn.getAttribute("name") == "Introspect":

1198

for arg in cn.getElementsByTagName("arg"):

1199

if (arg.getAttribute("direction")

1200

== "out"):

1201

arg.setAttribute("name",

1202

"xml_data")

1203

xmlstring = document.toxml("utf-8")

1204

document.unlink()

1205

except (AttributeError, xml.dom.DOMException,

1206

xml.parsers.expat.ExpatError) as error:

1207

logger.error("Failed to override Introspection method",

1208

exc_info=error)

1209

return xmlstring

1210

1211

1212

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1213

"""A D-Bus object with properties.

1214

1215

Classes inheriting from this can use the dbus_service_property

1216

decorator to expose methods as D-Bus properties. It exposes the

1217

standard Get(), Set(), and GetAll() methods on the D-Bus.

1218

"""

895

inspect.getmembers(cls,

896

self._is_dbus_thing(thing)))

1219

897

1220

898

def _get_dbus_property(self, interface_name, property_name):

1221

899

"""Returns a bound method if one exists which is a D-Bus

1222

900

property with the specified name and interface.

1223

901

"""

1224

for cls in self.__class__.__mro__:

1225

for name, value in inspect.getmembers(

1226

cls, self._is_dbus_thing("property")):

902

for cls in self.__class__.__mro__:

903

for name, value in (inspect.getmembers

904

(cls,

905

self._is_dbus_thing("property"))):

1227

906

if (value._dbus_name == property_name

1228

907

and value._dbus_interface == interface_name):

1229

908

return value.__get__(self)

1230

909

1231

910

# No such property

1232

raise DBusPropertyNotFound("{}:{}.{}".format(

1233

self.dbus_object_path, interface_name, property_name))

1234

1235

@classmethod

1236

def _get_all_interface_names(cls):

1237

"""Get a sequence of all interfaces supported by an object"""

1238

return (name for name in set(getattr(getattr(x, attr),

1239

"_dbus_interface", None)

1240

for x in (inspect.getmro(cls))

1241

for attr in dir(x))

1242

if name is not None)

1243

1244

@dbus.service.method(dbus.PROPERTIES_IFACE,

1245

in_signature="ss",

911

raise DBusPropertyNotFound(self.dbus_object_path + ":"

912

+ interface_name + "."

913

+ property_name)

914

915

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1246

916

out_signature="v")

1247

917

def Get(self, interface_name, property_name):

1248

918

"""Standard D-Bus property Get() method, see D-Bus standard.

1267

937

# signatures other than "ay".

1268

938

if prop._dbus_signature != "ay":

1269

939

raise ValueError("Byte arrays not supported for non-"

1270

"'ay' signature {!r}"

940

"'ay' signature {0!r}"

1271

941

.format(prop._dbus_signature))

1272

942

value = dbus.ByteArray(b''.join(chr(byte)

1273

943

for byte in value))

1274

944

prop(value)

1275

945

1276

@dbus.service.method(dbus.PROPERTIES_IFACE,

1277

in_signature="s",

946

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1278

947

out_signature="a{sv}")

1279

948

def GetAll(self, interface_name):

1280

949

"""Standard D-Bus property GetAll() method, see D-Bus

1295

964

if not hasattr(value, "variant_level"):

1296

965

properties[name] = value

1297

966

continue

1298

properties[name] = type(value)(

1299

value, variant_level = value.variant_level + 1)

967

properties[name] = type(value)(value, variant_level=

968

value.variant_level+1)

1300

969

return dbus.Dictionary(properties, signature="sv")

1301

970

1302

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1303

def PropertiesChanged(self, interface_name, changed_properties,

1304

invalidated_properties):

1305

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1306

standard.

1307

"""

1308

pass

1309

1310

971

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1311

972

out_signature="s",

1312

973

path_keyword='object_path',

1316

977

1317

978

Inserts property tags and interface annotation tags.

1318

979

"""

1319

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1320

object_path,

1321

connection)

980

xmlstring = dbus.service.Object.Introspect(self, object_path,

981

connection)

1322

982

try:

1323

983

document = xml.dom.minidom.parseString(xmlstring)

1324

1325

984

def make_tag(document, name, prop):

1326

985

e = document.createElement("property")

1327

986

e.setAttribute("name", name)

1328

987

e.setAttribute("type", prop._dbus_signature)

1329

988

e.setAttribute("access", prop._dbus_access)

1330

989

return e

1331

1332

990

for if_tag in document.getElementsByTagName("interface"):

1333

991

# Add property tags

1334

992

for tag in (make_tag(document, name, prop)

1337

995

if prop._dbus_interface

1338

996

== if_tag.getAttribute("name")):

1339

997

if_tag.appendChild(tag)

1340

# Add annotation tags for properties

1341

for tag in if_tag.getElementsByTagName("property"):

1342

annots = dict()

1343

for name, prop in self._get_all_dbus_things(

1344

"property"):

1345

if (name == tag.getAttribute("name")

1346

and prop._dbus_interface

1347

== if_tag.getAttribute("name")):

1348

annots.update(getattr(

1349

prop, "_dbus_annotations", {}))

1350

for name, value in annots.items():

1351

ann_tag = document.createElement(

1352

"annotation")

1353

ann_tag.setAttribute("name", name)

1354

ann_tag.setAttribute("value", value)

1355

tag.appendChild(ann_tag)

998

# Add annotation tags

999

for typ in ("method", "signal", "property"):

1000

for tag in if_tag.getElementsByTagName(typ):

1001

annots = dict()

1002

for name, prop in (self.

1003

_get_all_dbus_things(typ)):

1004

if (name == tag.getAttribute("name")

1005

and prop._dbus_interface

1006

== if_tag.getAttribute("name")):

1007

annots.update(getattr

1008

(prop,

1009

"_dbus_annotations",

1010

{}))

1011

for name, value in annots.iteritems():

1012

ann_tag = document.createElement(

1013

"annotation")

1014

ann_tag.setAttribute("name", name)

1015

ann_tag.setAttribute("value", value)

1016

tag.appendChild(ann_tag)

1017

# Add interface annotation tags

1018

for annotation, value in dict(

1019

itertools.chain.from_iterable(

1020

annotations().iteritems()

1021

for name, annotations in

1022

self._get_all_dbus_things("interface")

1023

if name == if_tag.getAttribute("name")

1024

)).iteritems():

1025

ann_tag = document.createElement("annotation")

1026

ann_tag.setAttribute("name", annotation)

1027

ann_tag.setAttribute("value", value)

1028

if_tag.appendChild(ann_tag)

1356

1029

# Add the names to the return values for the

1357

1030

# "org.freedesktop.DBus.Properties" methods

1358

1031

if (if_tag.getAttribute("name")

1376

1049

exc_info=error)

1377

1050

return xmlstring

1378

1051

1379

try:

1380

dbus.OBJECT_MANAGER_IFACE

1381

except AttributeError:

1382

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1383

1384

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1385

"""A D-Bus object with an ObjectManager.

1386

1387

Classes inheriting from this exposes the standard

1388

GetManagedObjects call and the InterfacesAdded and

1389

InterfacesRemoved signals on the standard

1390

"org.freedesktop.DBus.ObjectManager" interface.

1391

1392

Note: No signals are sent automatically; they must be sent

1393

manually.

1394

"""

1395

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1396

out_signature = "a{oa{sa{sv}}}")

1397

def GetManagedObjects(self):

1398

"""This function must be overridden"""

1399

raise NotImplementedError()

1400

1401

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1402

signature = "oa{sa{sv}}")

1403

def InterfacesAdded(self, object_path, interfaces_and_properties):

1404

pass

1405

1406

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1407

def InterfacesRemoved(self, object_path, interfaces):

1408

pass

1409

1410

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1411

out_signature = "s",

1412

path_keyword = 'object_path',

1413

connection_keyword = 'connection')

1414

def Introspect(self, object_path, connection):

1415

"""Overloading of standard D-Bus method.

1416

1417

Override return argument name of GetManagedObjects to be

1418

"objpath_interfaces_and_properties"

1419

"""

1420

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1421

object_path,

1422

connection)

1423

try:

1424

document = xml.dom.minidom.parseString(xmlstring)

1425

1426

for if_tag in document.getElementsByTagName("interface"):

1427

# Fix argument name for the GetManagedObjects method

1428

if (if_tag.getAttribute("name")

1429

== dbus.OBJECT_MANAGER_IFACE):

1430

for cn in if_tag.getElementsByTagName("method"):

1431

if (cn.getAttribute("name")

1432

== "GetManagedObjects"):

1433

for arg in cn.getElementsByTagName("arg"):

1434

if (arg.getAttribute("direction")

1435

== "out"):

1436

arg.setAttribute(

1437

"name",

1438

"objpath_interfaces"

1439

"_and_properties")

1440

xmlstring = document.toxml("utf-8")

1441

document.unlink()

1442

except (AttributeError, xml.dom.DOMException,

1443

xml.parsers.expat.ExpatError) as error:

1444

logger.error("Failed to override Introspection method",

1445

exc_info = error)

1446

return xmlstring

1447

1052

1448

1053

def datetime_to_dbus(dt, variant_level=0):

1449

1054

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1450

1055

if dt is None:

1451

1056

return dbus.String("", variant_level = variant_level)

1452

return dbus.String(dt.isoformat(), variant_level=variant_level)

1057

return dbus.String(dt.isoformat(),

1058

variant_level=variant_level)

1453

1059

1454

1060

1455

1061

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1475

1081

(from DBusObjectWithProperties) and interfaces (from the

1476

1082

dbus_interface_annotations decorator).

1477

1083

"""

1478

1479

1084

def wrapper(cls):

1480

1085

for orig_interface_name, alt_interface_name in (

1481

alt_interface_names.items()):

1086

alt_interface_names.iteritems()):

1482

1087

attr = {}

1483

1088

interface_names = set()

1484

1089

# Go though all attributes of the class

1486

1091

# Ignore non-D-Bus attributes, and D-Bus attributes

1487

1092

# with the wrong interface name

1488

1093

if (not hasattr(attribute, "_dbus_interface")

1489

or not attribute._dbus_interface.startswith(

1490

orig_interface_name)):

1094

or not attribute._dbus_interface

1095

.startswith(orig_interface_name)):

1491

1096

continue

1492

1097

# Create an alternate D-Bus interface name based on

1493

1098

# the current name

1494

alt_interface = attribute._dbus_interface.replace(

1495

orig_interface_name, alt_interface_name)

1099

alt_interface = (attribute._dbus_interface

1100

.replace(orig_interface_name,

1101

alt_interface_name))

1496

1102

interface_names.add(alt_interface)

1497

1103

# Is this a D-Bus signal?

1498

1104

if getattr(attribute, "_dbus_is_signal", False):

1499

if sys.version_info.major == 2:

1500

# Extract the original non-method undecorated

1501

# function by black magic

1502

nonmethod_func = (dict(

1105

# Extract the original non-method undecorated

1106

# function by black magic

1107

nonmethod_func = (dict(

1503

1108

zip(attribute.func_code.co_freevars,

1504

attribute.__closure__))

1505

["func"].cell_contents)

1506

else:

1507

nonmethod_func = attribute

1109

attribute.__closure__))["func"]

1110

.cell_contents)

1508

1111

# Create a new, but exactly alike, function

1509

1112

# object, and decorate it to be a new D-Bus signal

1510

1113

# with the alternate D-Bus interface name

1511

if sys.version_info.major == 2:

1512

new_function = types.FunctionType(

1513

nonmethod_func.func_code,

1514

nonmethod_func.func_globals,

1515

nonmethod_func.func_name,

1516

nonmethod_func.func_defaults,

1517

nonmethod_func.func_closure)

1518

else:

1519

new_function = types.FunctionType(

1520

nonmethod_func.__code__,

1521

nonmethod_func.__globals__,

1522

nonmethod_func.__name__,

1523

nonmethod_func.__defaults__,

1524

nonmethod_func.__closure__)

1525

new_function = (dbus.service.signal(

1526

alt_interface,

1527

attribute._dbus_signature)(new_function))

1114

new_function = (dbus.service.signal

1115

(alt_interface,

1116

attribute._dbus_signature)

1117

(types.FunctionType(

1118

nonmethod_func.func_code,

1119

nonmethod_func.func_globals,

1120

nonmethod_func.func_name,

1121

nonmethod_func.func_defaults,

1122

nonmethod_func.func_closure)))

1528

1123

# Copy annotations, if any

1529

1124

try:

1530

new_function._dbus_annotations = dict(

1531

attribute._dbus_annotations)

1125

new_function._dbus_annotations = (

1126

dict(attribute._dbus_annotations))

1532

1127

except AttributeError:

1533

1128

pass

1534

1129

# Define a creator of a function to call both the

1539

1134

"""This function is a scope container to pass

1540

1135

func1 and func2 to the "call_both" function

1541

1136

outside of its arguments"""

1542

1543

@functools.wraps(func2)

1544

1137

def call_both(*args, **kwargs):

1545

1138

"""This function will emit two D-Bus

1546

1139

signals by calling func1 and func2"""

1547

1140

func1(*args, **kwargs)

1548

1141

func2(*args, **kwargs)

1549

# Make wrapper function look like a D-Bus signal

1550

for name, attr in inspect.getmembers(func2):

1551

if name.startswith("_dbus_"):

1552

setattr(call_both, name, attr)

1553

1554

1142

return call_both

1555

1143

# Create the "call_both" function and add it to

1556

1144

# the class

1561

1149

# object. Decorate it to be a new D-Bus method

1562

1150

# with the alternate D-Bus interface name. Add it

1563

1151

# to the class.

1564

attr[attrname] = (

1565

dbus.service.method(

1566

alt_interface,

1567

attribute._dbus_in_signature,

1568

attribute._dbus_out_signature)

1569

(types.FunctionType(attribute.func_code,

1570

attribute.func_globals,

1571

attribute.func_name,

1572

attribute.func_defaults,

1573

attribute.func_closure)))

1152

attr[attrname] = (dbus.service.method

1153

(alt_interface,

1154

attribute._dbus_in_signature,

1155

attribute._dbus_out_signature)

1156

(types.FunctionType

1157

(attribute.func_code,

1158

attribute.func_globals,

1159

attribute.func_name,

1160

attribute.func_defaults,

1161

attribute.func_closure)))

1574

1162

# Copy annotations, if any

1575

1163

try:

1576

attr[attrname]._dbus_annotations = dict(

1577

attribute._dbus_annotations)

1164

attr[attrname]._dbus_annotations = (

1165

dict(attribute._dbus_annotations))

1578

1166

except AttributeError:

1579

1167

pass

1580

1168

# Is this a D-Bus property?

1583

1171

# object, and decorate it to be a new D-Bus

1584

1172

# property with the alternate D-Bus interface

1585

1173

# name. Add it to the class.

1586

attr[attrname] = (dbus_service_property(

1587

alt_interface, attribute._dbus_signature,

1588

attribute._dbus_access,

1589

attribute._dbus_get_args_options

1590

["byte_arrays"])

1591

(types.FunctionType(

1592

attribute.func_code,

1593

attribute.func_globals,

1594

attribute.func_name,

1595

attribute.func_defaults,

1596

attribute.func_closure)))

1174

attr[attrname] = (dbus_service_property

1175

(alt_interface,

1176

attribute._dbus_signature,

1177

attribute._dbus_access,

1178

attribute

1179

._dbus_get_args_options

1180

["byte_arrays"])

1181

(types.FunctionType

1182

(attribute.func_code,

1183

attribute.func_globals,

1184

attribute.func_name,

1185

attribute.func_defaults,

1186

attribute.func_closure)))

1597

1187

# Copy annotations, if any

1598

1188

try:

1599

attr[attrname]._dbus_annotations = dict(

1600

attribute._dbus_annotations)

1189

attr[attrname]._dbus_annotations = (

1190

dict(attribute._dbus_annotations))

1601

1191

except AttributeError:

1602

1192

pass

1603

1193

# Is this a D-Bus interface?

1606

1196

# object. Decorate it to be a new D-Bus interface

1607

1197

# with the alternate D-Bus interface name. Add it

1608

1198

# to the class.

1609

attr[attrname] = (

1610

dbus_interface_annotations(alt_interface)

1611

(types.FunctionType(attribute.func_code,

1612

attribute.func_globals,

1613

attribute.func_name,

1614

attribute.func_defaults,

1615

attribute.func_closure)))

1199

attr[attrname] = (dbus_interface_annotations

1200

(alt_interface)

1201

(types.FunctionType

1202

(attribute.func_code,

1203

attribute.func_globals,

1204

attribute.func_name,

1205

attribute.func_defaults,

1206

attribute.func_closure)))

1616

1207

if deprecate:

1617

1208

# Deprecate all alternate interfaces

1618

iname="_AlternateDBusNames_interface_annotation{}"

1209

iname="_AlternateDBusNames_interface_annotation{0}"

1619

1210

for interface_name in interface_names:

1620

1621

1211

@dbus_interface_annotations(interface_name)

1622

1212

def func(self):

1623

1213

return { "org.freedesktop.DBus.Deprecated":

1624

"true" }

1214

"true" }

1625

1215

# Find an unused name

1626

1216

for aname in (iname.format(i)

1627

1217

for i in itertools.count()):

1631

1221

if interface_names:

1632

1222

# Replace the class with a new subclass of it with

1633

1223

# methods, signals, etc. as created above.

1634

cls = type(b"{}Alternate".format(cls.__name__),

1635

(cls, ), attr)

1224

cls = type(b"{0}Alternate".format(cls.__name__),

1225

(cls,), attr)

1636

1226

return cls

1637

1638

1227

return wrapper

1639

1228

1640

1229

1641

1230

@alternate_dbus_interfaces({"se.recompile.Mandos":

1642

"se.bsnet.fukt.Mandos"})

1231

"se.bsnet.fukt.Mandos"})

1643

1232

class ClientDBus(Client, DBusObjectWithProperties):

1644

1233

"""A Client class using D-Bus

1645

1234

1649

1238

"""

1650

1239

1651

1240

runtime_expansions = (Client.runtime_expansions

1652

+ ("dbus_object_path", ))

1653

1654

_interface = "se.recompile.Mandos.Client"

1241

+ ("dbus_object_path",))

1655

1242

1656

1243

# dbus.service.Object doesn't use super(), so we can't either.

1657

1244

1660

1247

Client.__init__(self, *args, **kwargs)

1661

1248

# Only now, when this client is initialized, can it show up on

1662

1249

# the D-Bus

1663

client_object_name = str(self.name).translate(

1250

client_object_name = unicode(self.name).translate(

1664

1251

{ord("."): ord("_"),

1665

1252

ord("-"): ord("_")})

1666

self.dbus_object_path = dbus.ObjectPath(

1667

"/clients/" + client_object_name)

1253

self.dbus_object_path = (dbus.ObjectPath

1254

("/clients/" + client_object_name))

1668

1255

DBusObjectWithProperties.__init__(self, self.bus,

1669

1256

self.dbus_object_path)

1670

1257

1671

def notifychangeproperty(transform_func, dbus_name,

1672

type_func=lambda x: x,

1673

variant_level=1,

1674

invalidate_only=False,

1675

_interface=_interface):

1258

def notifychangeproperty(transform_func,

1259

dbus_name, type_func=lambda x: x,

1260

variant_level=1):

1676

1261

""" Modify a variable so that it's a property which announces

1677

1262

its changes to DBus.

1678

1263

1683

1268

to the D-Bus. Default: no transform

1684

1269

variant_level: D-Bus variant level. Default: 1

1685

1270

"""

1686

attrname = "_{}".format(dbus_name)

1687

1271

attrname = "_{0}".format(dbus_name)

1688

1272

def setter(self, value):

1689

1273

if hasattr(self, "dbus_object_path"):

1690

1274

if (not hasattr(self, attrname) or

1691

1275

type_func(getattr(self, attrname, None))

1692

1276

!= type_func(value)):

1693

if invalidate_only:

1694

self.PropertiesChanged(

1695

_interface, dbus.Dictionary(),

1696

dbus.Array((dbus_name, )))

1697

else:

1698

dbus_value = transform_func(

1699

type_func(value),

1700

variant_level = variant_level)

1701

self.PropertyChanged(dbus.String(dbus_name),

1702

dbus_value)

1703

self.PropertiesChanged(

1704

_interface,

1705

dbus.Dictionary({ dbus.String(dbus_name):

1706

dbus_value }),

1707

dbus.Array())

1277

dbus_value = transform_func(type_func(value),

1278

variant_level

1279

=variant_level)

1280

self.PropertyChanged(dbus.String(dbus_name),

1281

dbus_value)

1708

1282

setattr(self, attrname, value)

1709

1283

1710

1284

return property(lambda self: getattr(self, attrname), setter)

1716

1290

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1717

1291

last_enabled = notifychangeproperty(datetime_to_dbus,

1718

1292

"LastEnabled")

1719

checker = notifychangeproperty(

1720

dbus.Boolean, "CheckerRunning",

1721

type_func = lambda checker: checker is not None)

1293

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1294

type_func = lambda checker:

1295

checker is not None)

1722

1296

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1723

1297

"LastCheckedOK")

1724

1298

last_checker_status = notifychangeproperty(dbus.Int16,

1727

1301

datetime_to_dbus, "LastApprovalRequest")

1728

1302

approved_by_default = notifychangeproperty(dbus.Boolean,

1729

1303

"ApprovedByDefault")

1730

approval_delay = notifychangeproperty(

1731

dbus.UInt64, "ApprovalDelay",

1732

type_func = lambda td: td.total_seconds() * 1000)

1304

approval_delay = notifychangeproperty(dbus.UInt64,

1305

"ApprovalDelay",

1306

type_func =

1307

timedelta_to_milliseconds)

1733

1308

approval_duration = notifychangeproperty(

1734

1309

dbus.UInt64, "ApprovalDuration",

1735

type_func = lambda td: td.total_seconds() * 1000)

1310

type_func = timedelta_to_milliseconds)

1736

1311

host = notifychangeproperty(dbus.String, "Host")

1737

timeout = notifychangeproperty(

1738

dbus.UInt64, "Timeout",

1739

type_func = lambda td: td.total_seconds() * 1000)

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func =

1314

timedelta_to_milliseconds)

1740

1315

extended_timeout = notifychangeproperty(

1741

1316

dbus.UInt64, "ExtendedTimeout",

1742

type_func = lambda td: td.total_seconds() * 1000)

1743

interval = notifychangeproperty(

1744

dbus.UInt64, "Interval",

1745

type_func = lambda td: td.total_seconds() * 1000)

1317

type_func = timedelta_to_milliseconds)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

timedelta_to_milliseconds)

1746

1322

checker_command = notifychangeproperty(dbus.String, "Checker")

1747

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1748

invalidate_only=True)

1749

1323

1750

1324

del notifychangeproperty

1751

1325

1758

1332

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1759

1333

Client.__del__(self, *args, **kwargs)

1760

1334

1761

def checker_callback(self, source, condition,

1762

connection, command, *args, **kwargs):

1763

ret = Client.checker_callback(self, source, condition,

1764

connection, command, *args,

1765

**kwargs)

1766

exitstatus = self.last_checker_status

1767

if exitstatus >= 0:

1335

def checker_callback(self, pid, condition, command,

1336

*args, **kwargs):

1337

self.checker_callback_tag = None

1338

self.checker = None

1339

if os.WIFEXITED(condition):

1340

exitstatus = os.WEXITSTATUS(condition)

1768

1341

# Emit D-Bus signal

1769

1342

self.CheckerCompleted(dbus.Int16(exitstatus),

1770

# This is specific to GNU libC

1771

dbus.Int64(exitstatus << 8),

1343

dbus.Int64(condition),

1772

1344

dbus.String(command))

1773

1345

else:

1774

1346

# Emit D-Bus signal

1775

1347

self.CheckerCompleted(dbus.Int16(-1),

1776

dbus.Int64(

1777

# This is specific to GNU libC

1778

(exitstatus << 8)

1779

| self.last_checker_signal),

1348

dbus.Int64(condition),

1780

1349

dbus.String(command))

1781

return ret

1350

1351

return Client.checker_callback(self, pid, condition, command,

1352

*args, **kwargs)

1782

1353

1783

1354

def start_checker(self, *args, **kwargs):

1784

1355

old_checker_pid = getattr(self.checker, "pid", None)

1796

1367

1797

1368

def approve(self, value=True):

1798

1369

self.approved = value

1799

gobject.timeout_add(int(self.approval_duration.total_seconds()

1800

* 1000), self._reset_approved)

1370

gobject.timeout_add(timedelta_to_milliseconds

1371

(self.approval_duration),

1372

self._reset_approved)

1801

1373

self.send_changedstate()

1802

1374

1803

1375

## D-Bus methods, signals & properties

1376

_interface = "se.recompile.Mandos.Client"

1804

1377

1805

1378

## Interfaces

1806

1379

1380

@dbus_interface_annotations(_interface)

1381

def _foo(self):

1382

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1383

"false"}

1384

1807

1385

## Signals

1808

1386

1809

1387

# CheckerCompleted - signal

1819

1397

pass

1820

1398

1821

1399

# PropertyChanged - signal

1822

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1823

1400

@dbus.service.signal(_interface, signature="sv")

1824

1401

def PropertyChanged(self, property, value):

1825

1402

"D-Bus signal"

1859

1436

self.checked_ok()

1860

1437

1861

1438

# Enable - method

1862

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1863

1439

@dbus.service.method(_interface)

1864

1440

def Enable(self):

1865

1441

"D-Bus method"

1866

1442

self.enable()

1867

1443

1868

1444

# StartChecker - method

1869

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1870

1445

@dbus.service.method(_interface)

1871

1446

def StartChecker(self):

1872

1447

"D-Bus method"

1873

1448

self.start_checker()

1874

1449

1875

1450

# Disable - method

1876

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1877

1451

@dbus.service.method(_interface)

1878

1452

def Disable(self):

1879

1453

"D-Bus method"

1880

1454

self.disable()

1881

1455

1882

1456

# StopChecker - method

1883

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1884

1457

@dbus.service.method(_interface)

1885

1458

def StopChecker(self):

1886

1459

self.stop_checker()

1893

1466

return dbus.Boolean(bool(self.approvals_pending))

1894

1467

1895

1468

# ApprovedByDefault - property

1896

@dbus_service_property(_interface,

1897

signature="b",

1469

@dbus_service_property(_interface, signature="b",

1898

1470

access="readwrite")

1899

1471

def ApprovedByDefault_dbus_property(self, value=None):

1900

1472

if value is None: # get

1902

1474

self.approved_by_default = bool(value)

1903

1475

1904

1476

# ApprovalDelay - property

1905

@dbus_service_property(_interface,

1906

signature="t",

1477

@dbus_service_property(_interface, signature="t",

1907

1478

access="readwrite")

1908

1479

def ApprovalDelay_dbus_property(self, value=None):

1909

1480

if value is None: # get

1910

return dbus.UInt64(self.approval_delay.total_seconds()

1911

* 1000)

1481

return dbus.UInt64(self.approval_delay_milliseconds())

1912

1482

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1913

1483

1914

1484

# ApprovalDuration - property

1915

@dbus_service_property(_interface,

1916

signature="t",

1485

@dbus_service_property(_interface, signature="t",

1917

1486

access="readwrite")

1918

1487

def ApprovalDuration_dbus_property(self, value=None):

1919

1488

if value is None: # get

1920

return dbus.UInt64(self.approval_duration.total_seconds()

1921

* 1000)

1489

return dbus.UInt64(timedelta_to_milliseconds(

1490

self.approval_duration))

1922

1491

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1923

1492

1924

1493

# Name - property

1925

@dbus_annotations(

1926

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1927

1494

@dbus_service_property(_interface, signature="s", access="read")

1928

1495

def Name_dbus_property(self):

1929

1496

return dbus.String(self.name)

1930

1497

1931

1498

# Fingerprint - property

1932

@dbus_annotations(

1933

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1934

1499

@dbus_service_property(_interface, signature="s", access="read")

1935

1500

def Fingerprint_dbus_property(self):

1936

1501

return dbus.String(self.fingerprint)

1937

1502

1938

1503

# Host - property

1939

@dbus_service_property(_interface,

1940

signature="s",

1504

@dbus_service_property(_interface, signature="s",

1941

1505

access="readwrite")

1942

1506

def Host_dbus_property(self, value=None):

1943

1507

if value is None: # get

1944

1508

return dbus.String(self.host)

1945

self.host = str(value)

1509

self.host = unicode(value)

1946

1510

1947

1511

# Created - property

1948

@dbus_annotations(

1949

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1950

1512

@dbus_service_property(_interface, signature="s", access="read")

1951

1513

def Created_dbus_property(self):

1952

1514

return datetime_to_dbus(self.created)

1957

1519

return datetime_to_dbus(self.last_enabled)

1958

1520

1959

1521

# Enabled - property

1960

@dbus_service_property(_interface,

1961

signature="b",

1522

@dbus_service_property(_interface, signature="b",

1962

1523

access="readwrite")

1963

1524

def Enabled_dbus_property(self, value=None):

1964

1525

if value is None: # get

1969

1530

self.disable()

1970

1531

1971

1532

# LastCheckedOK - property

1972

@dbus_service_property(_interface,

1973

signature="s",

1533

@dbus_service_property(_interface, signature="s",

1974

1534

access="readwrite")

1975

1535

def LastCheckedOK_dbus_property(self, value=None):

1976

1536

if value is not None:

1979

1539

return datetime_to_dbus(self.last_checked_ok)

1980

1540

1981

1541

# LastCheckerStatus - property

1982

@dbus_service_property(_interface, signature="n", access="read")

1542

@dbus_service_property(_interface, signature="n",

1543

access="read")

1983

1544

def LastCheckerStatus_dbus_property(self):

1984

1545

return dbus.Int16(self.last_checker_status)

1985

1546

1994

1555

return datetime_to_dbus(self.last_approval_request)

1995

1556

1996

1557

# Timeout - property

1997

@dbus_service_property(_interface,

1998

signature="t",

1558

@dbus_service_property(_interface, signature="t",

1999

1559

access="readwrite")

2000

1560

def Timeout_dbus_property(self, value=None):

2001

1561

if value is None: # get

2002

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

return dbus.UInt64(self.timeout_milliseconds())

2003

1563

old_timeout = self.timeout

2004

1564

self.timeout = datetime.timedelta(0, 0, 0, value)

2005

1565

# Reschedule disabling

2014

1574

is None):

2015

1575

return

2016

1576

gobject.source_remove(self.disable_initiator_tag)

2017

self.disable_initiator_tag = gobject.timeout_add(

2018

int((self.expires - now).total_seconds() * 1000),

2019

self.disable)

1577

self.disable_initiator_tag = (

1578

gobject.timeout_add(

1579

timedelta_to_milliseconds(self.expires - now),

1580

self.disable))

2020

1581

2021

1582

# ExtendedTimeout - property

2022

@dbus_service_property(_interface,

2023

signature="t",

1583

@dbus_service_property(_interface, signature="t",

2024

1584

access="readwrite")

2025

1585

def ExtendedTimeout_dbus_property(self, value=None):

2026

1586

if value is None: # get

2027

return dbus.UInt64(self.extended_timeout.total_seconds()

2028

* 1000)

1587

return dbus.UInt64(self.extended_timeout_milliseconds())

2029

1588

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2030

1589

2031

1590

# Interval - property

2032

@dbus_service_property(_interface,

2033

signature="t",

1591

@dbus_service_property(_interface, signature="t",

2034

1592

access="readwrite")

2035

1593

def Interval_dbus_property(self, value=None):

2036

1594

if value is None: # get

2037

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

return dbus.UInt64(self.interval_milliseconds())

2038

1596

self.interval = datetime.timedelta(0, 0, 0, value)

2039

1597

if getattr(self, "checker_initiator_tag", None) is None:

2040

1598

return

2041

1599

if self.enabled:

2042

1600

# Reschedule checker run

2043

1601

gobject.source_remove(self.checker_initiator_tag)

2044

self.checker_initiator_tag = gobject.timeout_add(

2045

value, self.start_checker)

2046

self.start_checker() # Start one now, too

1602

self.checker_initiator_tag = (gobject.timeout_add

1603

(value, self.start_checker))

1604

self.start_checker() # Start one now, too

2047

1605

2048

1606

# Checker - property

2049

@dbus_service_property(_interface,

2050

signature="s",

1607

@dbus_service_property(_interface, signature="s",

2051

1608

access="readwrite")

2052

1609

def Checker_dbus_property(self, value=None):

2053

1610

if value is None: # get

2054

1611

return dbus.String(self.checker_command)

2055

self.checker_command = str(value)

1612

self.checker_command = unicode(value)

2056

1613

2057

1614

# CheckerRunning - property

2058

@dbus_service_property(_interface,

2059

signature="b",

1615

@dbus_service_property(_interface, signature="b",

2060

1616

access="readwrite")

2061

1617

def CheckerRunning_dbus_property(self, value=None):

2062

1618

if value is None: # get

2067

1623

self.stop_checker()

2068

1624

2069

1625

# ObjectPath - property

2070

@dbus_annotations(

2071

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2072

"org.freedesktop.DBus.Deprecated": "true"})

2073

1626

@dbus_service_property(_interface, signature="o", access="read")

2074

1627

def ObjectPath_dbus_property(self):

2075

1628

return self.dbus_object_path # is already a dbus.ObjectPath

2076

1629

2077

1630

# Secret = property

2078

@dbus_annotations(

2079

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2080

"invalidates"})

2081

@dbus_service_property(_interface,

2082

signature="ay",

2083

access="write",

2084

byte_arrays=True)

1631

@dbus_service_property(_interface, signature="ay",

1632

access="write", byte_arrays=True)

2085

1633

def Secret_dbus_property(self, value):

2086

self.secret = bytes(value)

1634

self.secret = str(value)

2087

1635

2088

1636

del _interface

2089

1637

2093

1641

self._pipe = child_pipe

2094

1642

self._pipe.send(('init', fpr, address))

2095

1643

if not self._pipe.recv():

2096

raise KeyError(fpr)

1644

raise KeyError()

2097

1645

2098

1646

def __getattribute__(self, name):

2099

1647

if name == '_pipe':

2103

1651

if data[0] == 'data':

2104

1652

return data[1]

2105

1653

if data[0] == 'function':

2106

2107

1654

def func(*args, **kwargs):

2108

1655

self._pipe.send(('funcall', name, args, kwargs))

2109

1656

return self._pipe.recv()[1]

2110

2111

1657

return func

2112

1658

2113

1659

def __setattr__(self, name, value):

2125

1671

def handle(self):

2126

1672

with contextlib.closing(self.server.child_pipe) as child_pipe:

2127

1673

logger.info("TCP connection from: %s",

2128

str(self.client_address))

1674

unicode(self.client_address))

2129

1675

logger.debug("Pipe FD: %d",

2130

1676

self.server.child_pipe.fileno())

2131

1677

2132

session = gnutls.ClientSession(self.request)

1678

session = (gnutls.connection

1679

.ClientSession(self.request,

1680

gnutls.connection

1681

.X509Credentials()))

1682

1683

# Note: gnutls.connection.X509Credentials is really a

1684

# generic GnuTLS certificate credentials object so long as

1685

# no X.509 keys are added to it. Therefore, we can use it

1686

# here despite using OpenPGP certificates.

2133

1687

2134

1688

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2135

1689

# "+AES-256-CBC", "+SHA1",

2139

1693

priority = self.server.gnutls_priority

2140

1694

if priority is None:

2141

1695

priority = "NORMAL"

2142

gnutls.priority_set_direct(session._c_object, priority,

2143

None)

1696

(gnutls.library.functions

1697

.gnutls_priority_set_direct(session._c_object,

1698

priority, None))

2144

1699

2145

1700

# Start communication using the Mandos protocol

2146

1701

# Get protocol number

2156

1711

# Start GnuTLS connection

2157

1712

try:

2158

1713

session.handshake()

2159

except gnutls.Error as error:

1714

except gnutls.errors.GNUTLSError as error:

2160

1715

logger.warning("Handshake failed: %s", error)

2161

1716

# Do not run session.bye() here: the session is not

2162

1717

# established. Just abandon the request.

2166

1721

approval_required = False

2167

1722

try:

2168

1723

try:

2169

fpr = self.fingerprint(

2170

self.peer_certificate(session))

2171

except (TypeError, gnutls.Error) as error:

1724

fpr = self.fingerprint(self.peer_certificate

1725

(session))

1726

except (TypeError,

1727

gnutls.errors.GNUTLSError) as error:

2172

1728

logger.warning("Bad certificate: %s", error)

2173

1729

return

2174

1730

logger.debug("Fingerprint: %s", fpr)

2187

1743

while True:

2188

1744

if not client.enabled:

2189

1745

logger.info("Client %s is disabled",

2190

client.name)

1746

client.name)

2191

1747

if self.server.use_dbus:

2192

1748

# Emit D-Bus signal

2193

1749

client.Rejected("Disabled")

2202

1758

if self.server.use_dbus:

2203

1759

# Emit D-Bus signal

2204

1760

client.NeedApproval(

2205

client.approval_delay.total_seconds()

2206

* 1000, client.approved_by_default)

1761

client.approval_delay_milliseconds(),

1762

client.approved_by_default)

2207

1763

else:

2208

1764

logger.warning("Client %s was not approved",

2209

1765

client.name)

2215

1771

#wait until timeout or approved

2216

1772

time = datetime.datetime.now()

2217

1773

client.changedstate.acquire()

2218

client.changedstate.wait(delay.total_seconds())

1774

client.changedstate.wait(

1775

float(timedelta_to_milliseconds(delay)

1776

/ 1000))

2219

1777

client.changedstate.release()

2220

1778

time2 = datetime.datetime.now()

2221

1779

if (time2 - time) >= delay:

2232

1790

else:

2233

1791

delay -= time2 - time

2234

1792

2235

try:

2236

session.send(client.secret)

2237

except gnutls.Error as error:

2238

logger.warning("gnutls send failed",

2239

exc_info = error)

2240

return

1793

sent_size = 0

1794

while sent_size < len(client.secret):

1795

try:

1796

sent = session.send(client.secret[sent_size:])

1797

except gnutls.errors.GNUTLSError as error:

1798

logger.warning("gnutls send failed",

1799

exc_info=error)

1800

return

1801

logger.debug("Sent: %d, remaining: %d",

1802

sent, len(client.secret)

1803

- (sent_size + sent))

1804

sent_size += sent

2241

1805

2242

1806

logger.info("Sending secret to %s", client.name)

2243

1807

# bump the timeout using extended_timeout

2251

1815

client.approvals_pending -= 1

2252

1816

try:

2253

1817

session.bye()

2254

except gnutls.Error as error:

1818

except gnutls.errors.GNUTLSError as error:

2255

1819

logger.warning("GnuTLS bye failed",

2256

1820

exc_info=error)

2257

1821

2259

1823

def peer_certificate(session):

2260

1824

"Return the peer's OpenPGP certificate as a bytestring"

2261

1825

# If not an OpenPGP certificate...

2262

if (gnutls.certificate_type_get(session._c_object)

2263

!= gnutls.CRT_OPENPGP):

2264

# ...return invalid data

2265

return b""

1826

if (gnutls.library.functions

1827

.gnutls_certificate_type_get(session._c_object)

1828

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1829

# ...do the normal thing

1830

return session.peer_certificate

2266

1831

list_size = ctypes.c_uint(1)

2267

cert_list = (gnutls.certificate_get_peers

1832

cert_list = (gnutls.library.functions

1833

.gnutls_certificate_get_peers

2268

1834

(session._c_object, ctypes.byref(list_size)))

2269

1835

if not bool(cert_list) and list_size.value != 0:

2270

raise gnutls.Error("error getting peer certificate")

1836

raise gnutls.errors.GNUTLSError("error getting peer"

1837

" certificate")

2271

1838

if list_size.value == 0:

2272

1839

return None

2273

1840

cert = cert_list[0]

2277

1844

def fingerprint(openpgp):

2278

1845

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2279

1846

# New GnuTLS "datum" with the OpenPGP public key

2280

datum = gnutls.datum_t(

2281

ctypes.cast(ctypes.c_char_p(openpgp),

2282

ctypes.POINTER(ctypes.c_ubyte)),

2283

ctypes.c_uint(len(openpgp)))

1847

datum = (gnutls.library.types

1848

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1849

ctypes.POINTER

1850

(ctypes.c_ubyte)),

1851

ctypes.c_uint(len(openpgp))))

2284

1852

# New empty GnuTLS certificate

2285

crt = gnutls.openpgp_crt_t()

2286

gnutls.openpgp_crt_init(ctypes.byref(crt))

1853

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2287

1856

# Import the OpenPGP public key into the certificate

2288

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2289

gnutls.OPENPGP_FMT_RAW)

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1859

gnutls.library.constants

1860

.GNUTLS_OPENPGP_FMT_RAW))

2290

1861

# Verify the self signature in the key

2291

1862

crtverify = ctypes.c_uint()

2292

gnutls.openpgp_crt_verify_self(crt, 0,

2293

ctypes.byref(crtverify))

1863

(gnutls.library.functions

1864

.gnutls_openpgp_crt_verify_self(crt, 0,

1865

ctypes.byref(crtverify)))

2294

1866

if crtverify.value != 0:

2295

gnutls.openpgp_crt_deinit(crt)

2296

raise gnutls.CertificateSecurityError("Verify failed")

1867

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1868

raise (gnutls.errors.CertificateSecurityError

1869

("Verify failed"))

2297

1870

# New buffer for the fingerprint

2298

1871

buf = ctypes.create_string_buffer(20)

2299

1872

buf_len = ctypes.c_size_t()

2300

1873

# Get the fingerprint from the certificate into the buffer

2301

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2302

ctypes.byref(buf_len))

1874

(gnutls.library.functions

1875

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1876

ctypes.byref(buf_len)))

2303

1877

# Deinit the certificate

2304

gnutls.openpgp_crt_deinit(crt)

1878

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2305

1879

# Convert the buffer to a Python bytestring

2306

1880

fpr = ctypes.string_at(buf, buf_len.value)

2307

1881

# Convert the bytestring to hexadecimal notation

2311

1885

2312

1886

class MultiprocessingMixIn(object):

2313

1887

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2314

2315

1888

def sub_process_main(self, request, address):

2316

1889

try:

2317

1890

self.finish_request(request, address)

2329

1902

2330

1903

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2331

1904

""" adds a pipe to the MixIn """

2332

2333

1905

def process_request(self, request, client_address):

2334

1906

"""Overrides and wraps the original process_request().

2335

1907

2356

1928

interface: None or a network interface name (string)

2357

1929

use_ipv6: Boolean; to use IPv6 or not

2358

1930

"""

2359

2360

1931

def __init__(self, server_address, RequestHandlerClass,

2361

interface=None,

2362

use_ipv6=True,

2363

socketfd=None):

1932

interface=None, use_ipv6=True, socketfd=None):

2364

1933

"""If socketfd is set, use that file descriptor instead of

2365

1934

creating a new one with socket.socket().

2366

1935

"""

2407

1976

self.interface)

2408

1977

else:

2409

1978

try:

2410

self.socket.setsockopt(

2411

socket.SOL_SOCKET, SO_BINDTODEVICE,

2412

(self.interface + "\0").encode("utf-8"))

1979

self.socket.setsockopt(socket.SOL_SOCKET,

1980

SO_BINDTODEVICE,

1981

str(self.interface + '\0'))

2413

1982

except socket.error as error:

2414

1983

if error.errno == errno.EPERM:

2415

1984

logger.error("No permission to bind to"

2433

2002

self.server_address = (any_address,

2434

2003

self.server_address[1])

2435

2004

elif not self.server_address[1]:

2436

self.server_address = (self.server_address[0], 0)

2005

self.server_address = (self.server_address[0],

2006

0)

2437

2007

# if self.interface:

2438

2008

# self.server_address = (self.server_address[0],

2439

2009

# 0, # port

2453

2023

2454

2024

Assumes a gobject.MainLoop event loop.

2455

2025

"""

2456

2457

2026

def __init__(self, server_address, RequestHandlerClass,

2458

interface=None,

2459

use_ipv6=True,

2460

clients=None,

2461

gnutls_priority=None,

2462

use_dbus=True,

2463

socketfd=None):

2027

interface=None, use_ipv6=True, clients=None,

2028

gnutls_priority=None, use_dbus=True, socketfd=None):

2464

2029

self.enabled = False

2465

2030

self.clients = clients

2466

2031

if self.clients is None:

2472

2037

interface = interface,

2473

2038

use_ipv6 = use_ipv6,

2474

2039

socketfd = socketfd)

2475

2476

2040

def server_activate(self):

2477

2041

if self.enabled:

2478

2042

return socketserver.TCPServer.server_activate(self)

2482

2046

2483

2047

def add_pipe(self, parent_pipe, proc):

2484

2048

# Call "handle_ipc" for both data and EOF events

2485

gobject.io_add_watch(

2486

parent_pipe.fileno(),

2487

gobject.IO_IN | gobject.IO_HUP,

2488

functools.partial(self.handle_ipc,

2489

parent_pipe = parent_pipe,

2490

proc = proc))

2049

gobject.io_add_watch(parent_pipe.fileno(),

2050

gobject.IO_IN | gobject.IO_HUP,

2051

functools.partial(self.handle_ipc,

2052

parent_pipe =

2053

parent_pipe,

2054

proc = proc))

2491

2055

2492

def handle_ipc(self, source, condition,

2493

parent_pipe=None,

2494

proc = None,

2495

client_object=None):

2056

def handle_ipc(self, source, condition, parent_pipe=None,

2057

proc = None, client_object=None):

2496

2058

# error, or the other end of multiprocessing.Pipe has closed

2497

2059

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2498

2060

# Wait for other process to exit

2521

2083

parent_pipe.send(False)

2522

2084

return False

2523

2085

2524

gobject.io_add_watch(

2525

parent_pipe.fileno(),

2526

gobject.IO_IN | gobject.IO_HUP,

2527

functools.partial(self.handle_ipc,

2528

parent_pipe = parent_pipe,

2529

proc = proc,

2530

client_object = client))

2086

gobject.io_add_watch(parent_pipe.fileno(),

2087

gobject.IO_IN | gobject.IO_HUP,

2088

functools.partial(self.handle_ipc,

2089

parent_pipe =

2090

parent_pipe,

2091

proc = proc,

2092

client_object =

2093

client))

2531

2094

parent_pipe.send(True)

2532

2095

# remove the old hook in favor of the new above hook on

2533

2096

# same fileno

2539

2102

2540

2103

parent_pipe.send(('data', getattr(client_object,

2541

2104

funcname)(*args,

2542

**kwargs)))

2105

**kwargs)))

2543

2106

2544

2107

if command == 'getattr':

2545

2108

attrname = request[1]

2546

if isinstance(client_object.__getattribute__(attrname),

2547

collections.Callable):

2548

parent_pipe.send(('function', ))

2109

if callable(client_object.__getattribute__(attrname)):

2110

parent_pipe.send(('function',))

2549

2111

else:

2550

parent_pipe.send((

2551

'data', client_object.__getattribute__(attrname)))

2112

parent_pipe.send(('data', client_object

2113

.__getattribute__(attrname)))

2552

2114

2553

2115

if command == 'setattr':

2554

2116

attrname = request[1]

2585

2147

# avoid excessive use of external libraries.

2586

2148

2587

2149

# New type for defining tokens, syntax, and semantics all-in-one

2588

Token = collections.namedtuple("Token", (

2589

"regexp", # To match token; if "value" is not None, must have

2590

# a "group" containing digits

2591

"value", # datetime.timedelta or None

2592

"followers")) # Tokens valid after this token

2150

Token = collections.namedtuple("Token",

2151

("regexp", # To match token; if

2152

# "value" is not None,

2153

# must have a "group"

2154

# containing digits

2155

"value", # datetime.timedelta or

2156

# None

2157

"followers")) # Tokens valid after

2158

# this token

2593

2159

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2594

2160

# the "duration" ABNF definition in RFC 3339, Appendix A.

2595

2161

token_end = Token(re.compile(r"$"), None, frozenset())

2596

2162

token_second = Token(re.compile(r"(\d+)S"),

2597

2163

datetime.timedelta(seconds=1),

2598

frozenset((token_end, )))

2164

frozenset((token_end,)))

2599

2165

token_minute = Token(re.compile(r"(\d+)M"),

2600

2166

datetime.timedelta(minutes=1),

2601

2167

frozenset((token_second, token_end)))

2617

2183

frozenset((token_month, token_end)))

2618

2184

token_week = Token(re.compile(r"(\d+)W"),

2619

2185

datetime.timedelta(weeks=1),

2620

frozenset((token_end, )))

2186

frozenset((token_end,)))

2621

2187

token_duration = Token(re.compile(r"P"), None,

2622

2188

frozenset((token_year, token_month,

2623

2189

token_day, token_time,

2624

token_week)))

2190

token_week))),

2625

2191

# Define starting values

2626

2192

value = datetime.timedelta() # Value so far

2627

2193

found_token = None

2628

followers = frozenset((token_duration, )) # Following valid tokens

2194

followers = frozenset(token_duration,) # Following valid tokens

2629

2195

s = duration # String left to parse

2630

2196

# Loop until end token is found

2631

2197

while found_token is not token_end:

2648

2214

break

2649

2215

else:

2650

2216

# No currently valid tokens were found

2651

raise ValueError("Invalid RFC 3339 duration: {!r}"

2652

.format(duration))

2217

raise ValueError("Invalid RFC 3339 duration")

2653

2218

# End token found

2654

2219

return value

2655

2220

2679

2244

timevalue = datetime.timedelta(0)

2680

2245

for s in interval.split():

2681

2246

try:

2682

suffix = s[-1]

2247

suffix = unicode(s[-1])

2683

2248

value = int(s[:-1])

2684

2249

if suffix == "d":

2685

2250

delta = datetime.timedelta(value)

2692

2257

elif suffix == "w":

2693

2258

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2694

2259

else:

2695

raise ValueError("Unknown suffix {!r}".format(suffix))

2260

raise ValueError("Unknown suffix {0!r}"

2261

.format(suffix))

2696

2262

except IndexError as e:

2697

2263

raise ValueError(*(e.args))

2698

2264

timevalue += delta

2715

2281

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2716

2282

if not stat.S_ISCHR(os.fstat(null).st_mode):

2717

2283

raise OSError(errno.ENODEV,

2718

"{} not a character device"

2284

"{0} not a character device"

2719

2285

.format(os.devnull))

2720

2286

os.dup2(null, sys.stdin.fileno())

2721

2287

os.dup2(null, sys.stdout.fileno())

2731

2297

2732

2298

parser = argparse.ArgumentParser()

2733

2299

parser.add_argument("-v", "--version", action="version",

2734

version = "%(prog)s {}".format(version),

2300

version = "%(prog)s {0}".format(version),

2735

2301

help="show version number and exit")

2736

2302

parser.add_argument("-i", "--interface", metavar="IF",

2737

2303

help="Bind to interface IF")

2770

2336

help="Directory to save/restore state in")

2771

2337

parser.add_argument("--foreground", action="store_true",

2772

2338

help="Run in foreground", default=None)

2773

parser.add_argument("--no-zeroconf", action="store_false",

2774

dest="zeroconf", help="Do not use Zeroconf",

2775

default=None)

2776

2339

2777

2340

options = parser.parse_args()

2778

2341

2787

2350

"port": "",

2788

2351

"debug": "False",

2789

2352

"priority":

2790

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2791

":+SIGN-DSA-SHA256",

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2792

2354

"servicename": "Mandos",

2793

2355

"use_dbus": "True",

2794

2356

"use_ipv6": "True",

2797

2359

"socket": "",

2798

2360

"statedir": "/var/lib/mandos",

2799

2361

"foreground": "False",

2800

"zeroconf": "True",

2801

}

2362

}

2802

2363

2803

2364

# Parse config file for server-global settings

2804

2365

server_config = configparser.SafeConfigParser(server_defaults)

2805

2366

del server_defaults

2806

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2367

server_config.read(os.path.join(options.configdir,

2368

"mandos.conf"))

2807

2369

# Convert the SafeConfigParser object to a dict

2808

2370

server_settings = server_config.defaults()

2809

2371

# Use the appropriate methods on the non-string config options

2827

2389

# Override the settings from the config file with command line

2828

2390

# options, if set.

2829

2391

for option in ("interface", "address", "port", "debug",

2830

"priority", "servicename", "configdir", "use_dbus",

2831

"use_ipv6", "debuglevel", "restore", "statedir",

2832

"socket", "foreground", "zeroconf"):

2392

"priority", "servicename", "configdir",

2393

"use_dbus", "use_ipv6", "debuglevel", "restore",

2394

"statedir", "socket", "foreground"):

2833

2395

value = getattr(options, option)

2834

2396

if value is not None:

2835

2397

server_settings[option] = value

2836

2398

del options

2837

2399

# Force all strings to be unicode

2838

2400

for option in server_settings.keys():

2839

if isinstance(server_settings[option], bytes):

2840

server_settings[option] = (server_settings[option]

2841

.decode("utf-8"))

2401

if type(server_settings[option]) is str:

2402

server_settings[option] = unicode(server_settings[option])

2842

2403

# Force all boolean options to be boolean

2843

2404

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2844

"foreground", "zeroconf"):

2405

"foreground"):

2845

2406

server_settings[option] = bool(server_settings[option])

2846

2407

# Debug implies foreground

2847

2408

if server_settings["debug"]:

2850

2411

2851

2412

##################################################################

2852

2413

2853

if (not server_settings["zeroconf"]

2854

and not (server_settings["port"]

2855

or server_settings["socket"] != "")):

2856

parser.error("Needs port or socket to work without Zeroconf")

2857

2858

2414

# For convenience

2859

2415

debug = server_settings["debug"]

2860

2416

debuglevel = server_settings["debuglevel"]

2863

2419

stored_state_path = os.path.join(server_settings["statedir"],

2864

2420

stored_state_file)

2865

2421

foreground = server_settings["foreground"]

2866

zeroconf = server_settings["zeroconf"]

2867

2422

2868

2423

if debug:

2869

2424

initlogger(debug, logging.DEBUG)

2875

2430

initlogger(debug, level)

2876

2431

2877

2432

if server_settings["servicename"] != "Mandos":

2878

syslogger.setFormatter(

2879

logging.Formatter('Mandos ({}) [%(process)d]:'

2880

' %(levelname)s: %(message)s'.format(

2881

server_settings["servicename"])))

2433

syslogger.setFormatter(logging.Formatter

2434

('Mandos ({0}) [%(process)d]:'

2435

' %(levelname)s: %(message)s'

2436

.format(server_settings

2437

["servicename"])))

2882

2438

2883

2439

# Parse config file with clients

2884

2440

client_config = configparser.SafeConfigParser(Client

2889

2445

global mandos_dbus_service

2890

2446

mandos_dbus_service = None

2891

2447

2892

socketfd = None

2893

if server_settings["socket"] != "":

2894

socketfd = server_settings["socket"]

2895

tcp_server = MandosServer(

2896

(server_settings["address"], server_settings["port"]),

2897

ClientHandler,

2898

interface=(server_settings["interface"] or None),

2899

use_ipv6=use_ipv6,

2900

gnutls_priority=server_settings["priority"],

2901

use_dbus=use_dbus,

2902

socketfd=socketfd)

2448

tcp_server = MandosServer((server_settings["address"],

2449

server_settings["port"]),

2450

ClientHandler,

2451

interface=(server_settings["interface"]

2452

or None),

2453

use_ipv6=use_ipv6,

2454

gnutls_priority=

2455

server_settings["priority"],

2456

use_dbus=use_dbus,

2457

socketfd=(server_settings["socket"]

2458

or None))

2903

2459

if not foreground:

2904

2460

pidfilename = "/run/mandos.pid"

2905

2461

if not os.path.isdir("/run/."):

2906

2462

pidfilename = "/var/run/mandos.pid"

2907

2463

pidfile = None

2908

2464

try:

2909

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2465

pidfile = open(pidfilename, "w")

2910

2466

except IOError as e:

2911

2467

logger.error("Could not open file %r", pidfilename,

2912

2468

exc_info=e)

2933

2489

2934

2490

# "Use a log level over 10 to enable all debugging options."

2935

2491

# - GnuTLS manual

2936

gnutls.global_set_log_level(11)

2492

gnutls.library.functions.gnutls_global_set_log_level(11)

2937

2493

2938

@gnutls.log_func

2494

@gnutls.library.types.gnutls_log_func

2939

2495

def debug_gnutls(level, string):

2940

2496

logger.debug("GnuTLS: %s", string[:-1])

2941

2497

2942

gnutls.global_set_log_function(debug_gnutls)

2498

(gnutls.library.functions

2499

.gnutls_global_set_log_function(debug_gnutls))

2943

2500

2944

2501

# Redirect stdin so all checkers get /dev/null

2945

2502

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2965

2522

if use_dbus:

2966

2523

try:

2967

2524

bus_name = dbus.service.BusName("se.recompile.Mandos",

2968

bus,

2969

do_not_queue=True)

2970

old_bus_name = dbus.service.BusName(

2971

"se.bsnet.fukt.Mandos", bus,

2972

do_not_queue=True)

2973

except dbus.exceptions.DBusException as e:

2525

bus, do_not_queue=True)

2526

old_bus_name = (dbus.service.BusName

2527

("se.bsnet.fukt.Mandos", bus,

2528

do_not_queue=True))

2529

except dbus.exceptions.NameExistsException as e:

2974

2530

logger.error("Disabling D-Bus:", exc_info=e)

2975

2531

use_dbus = False

2976

2532

server_settings["use_dbus"] = False

2977

2533

tcp_server.use_dbus = False

2978

if zeroconf:

2979

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2980

service = AvahiServiceToSyslog(

2981

name = server_settings["servicename"],

2982

servicetype = "_mandos._tcp",

2983

protocol = protocol,

2984

bus = bus)

2985

if server_settings["interface"]:

2986

service.interface = if_nametoindex(

2987

server_settings["interface"].encode("utf-8"))

2534

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2535

service = AvahiServiceToSyslog(name =

2536

server_settings["servicename"],

2537

servicetype = "_mandos._tcp",

2538

protocol = protocol, bus = bus)

2539

if server_settings["interface"]:

2540

service.interface = (if_nametoindex

2541

(str(server_settings["interface"])))

2988

2542

2989

2543

global multiprocessing_manager

2990

2544

multiprocessing_manager = multiprocessing.Manager()

3009

2563

if server_settings["restore"]:

3010

2564

try:

3011

2565

with open(stored_state_path, "rb") as stored_state:

3012

clients_data, old_client_settings = pickle.load(

3013

stored_state)

2566

clients_data, old_client_settings = (pickle.load

2567

(stored_state))

3014

2568

os.remove(stored_state_path)

3015

2569

except IOError as e:

3016

2570

if e.errno == errno.ENOENT:

3017

logger.warning("Could not load persistent state:"

3018

" {}".format(os.strerror(e.errno)))

2571

logger.warning("Could not load persistent state: {0}"

2572

.format(os.strerror(e.errno)))

3019

2573

else:

3020

2574

logger.critical("Could not load persistent state:",

3021

2575

exc_info=e)

3022

2576

raise

3023

2577

except EOFError as e:

3024

2578

logger.warning("Could not load persistent state: "

3025

"EOFError:",

3026

exc_info=e)

2579

"EOFError:", exc_info=e)

3027

2580

3028

2581

with PGPEngine() as pgp:

3029

for client_name, client in clients_data.items():

2582

for client_name, client in clients_data.iteritems():

3030

2583

# Skip removed clients

3031

2584

if client_name not in client_settings:

3032

2585

continue

3041

2594

# For each value in new config, check if it

3042

2595

# differs from the old config value (Except for

3043

2596

# the "secret" attribute)

3044

if (name != "secret"

3045

and (value !=

3046

old_client_settings[client_name][name])):

2597

if (name != "secret" and

2598

value != old_client_settings[client_name]

2599

[name]):

3047

2600

client[name] = value

3048

2601

except KeyError:

3049

2602

pass

3050

2603

3051

2604

# Clients who has passed its expire date can still be

3052

# enabled if its last checker was successful. A Client

2605

# enabled if its last checker was successful. Clients

3053

2606

# whose checker succeeded before we stored its state is

3054

2607

# assumed to have successfully run all checkers during

3055

2608

# downtime.

3057

2610

if datetime.datetime.utcnow() >= client["expires"]:

3058

2611

if not client["last_checked_ok"]:

3059

2612

logger.warning(

3060

"disabling client {} - Client never "

3061

"performed a successful checker".format(

3062

client_name))

2613

"disabling client {0} - Client never "

2614

"performed a successful checker"

2615

.format(client_name))

3063

2616

client["enabled"] = False

3064

2617

elif client["last_checker_status"] != 0:

3065

2618

logger.warning(

3066

"disabling client {} - Client last"

3067

" checker failed with error code"

3068

" {}".format(

3069

client_name,

3070

client["last_checker_status"]))

2619

"disabling client {0} - Client "

2620

"last checker failed with error code {1}"

2621

.format(client_name,

2622

client["last_checker_status"]))

3071

2623

client["enabled"] = False

3072

2624

else:

3073

client["expires"] = (

3074

datetime.datetime.utcnow()

3075

+ client["timeout"])

2625

client["expires"] = (datetime.datetime

2626

.utcnow()

2627

+ client["timeout"])

3076

2628

logger.debug("Last checker succeeded,"

3077

" keeping {} enabled".format(

3078

client_name))

2629

" keeping {0} enabled"

2630

.format(client_name))

3079

2631

try:

3080

client["secret"] = pgp.decrypt(

3081

client["encrypted_secret"],

3082

client_settings[client_name]["secret"])

2632

client["secret"] = (

2633

pgp.decrypt(client["encrypted_secret"],

2634

client_settings[client_name]

2635

["secret"]))

3083

2636

except PGPError:

3084

2637

# If decryption fails, we use secret from new settings

3085

logger.debug("Failed to decrypt {} old secret".format(

3086

client_name))

3087

client["secret"] = (client_settings[client_name]

3088

["secret"])

2638

logger.debug("Failed to decrypt {0} old secret"

2639

.format(client_name))

2640

client["secret"] = (

2641

client_settings[client_name]["secret"])

3089

2642

3090

2643

# Add/remove clients based on new changes made to config

3091

2644

for client_name in (set(old_client_settings)

3096

2649

clients_data[client_name] = client_settings[client_name]

3097

2650

3098

2651

# Create all client objects

3099

for client_name, client in clients_data.items():

2652

for client_name, client in clients_data.iteritems():

3100

2653

tcp_server.clients[client_name] = client_class(

3101

name = client_name,

3102

settings = client,

2654

name = client_name, settings = client,

3103

2655

server_settings = server_settings)

3104

2656

3105

2657

if not tcp_server.clients:

3107

2659

3108

2660

if not foreground:

3109

2661

if pidfile is not None:

3110

pid = os.getpid()

3111

2662

try:

3112

2663

with pidfile:

3113

print(pid, file=pidfile)

2664

pid = os.getpid()

2665

pidfile.write(str(pid) + "\n".encode("utf-8"))

3114

2666

except IOError:

3115

2667

logger.error("Could not write to file %r with PID %d",

3116

2668

pidfilename, pid)

3121

2673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3122

2674

3123

2675

if use_dbus:

3124

3125

@alternate_dbus_interfaces(

3126

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3127

class MandosDBusService(DBusObjectWithObjectManager):

2676

@alternate_dbus_interfaces({"se.recompile.Mandos":

2677

"se.bsnet.fukt.Mandos"})

2678

class MandosDBusService(DBusObjectWithProperties):

3128

2679

"""A D-Bus proxy object"""

3129

3130

2680

def __init__(self):

3131

2681

dbus.service.Object.__init__(self, bus, "/")

3132

3133

2682

_interface = "se.recompile.Mandos"

3134

2683

2684

@dbus_interface_annotations(_interface)

2685

def _foo(self):

2686

return { "org.freedesktop.DBus.Property"

2687

".EmitsChangedSignal":

2688

"false"}

2689

3135

2690

@dbus.service.signal(_interface, signature="o")

3136

2691

def ClientAdded(self, objpath):

3137

2692

"D-Bus signal"

3142

2697

"D-Bus signal"

3143

2698

pass

3144

2699

3145

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3146

"true"})

3147

2700

@dbus.service.signal(_interface, signature="os")

3148

2701

def ClientRemoved(self, objpath, name):

3149

2702

"D-Bus signal"

3150

2703

pass

3151

2704

3152

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3153

"true"})

3154

2705

@dbus.service.method(_interface, out_signature="ao")

3155

2706

def GetAllClients(self):

3156

2707

"D-Bus method"

3157

return dbus.Array(c.dbus_object_path for c in

2708

return dbus.Array(c.dbus_object_path

2709

for c in

3158

2710

tcp_server.clients.itervalues())

3159

2711

3160

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3161

"true"})

3162

2712

@dbus.service.method(_interface,

3163

2713

out_signature="a{oa{sv}}")

3164

2714

def GetAllClientsWithProperties(self):

3165

2715

"D-Bus method"

3166

2716

return dbus.Dictionary(

3167

{ c.dbus_object_path: c.GetAll(

3168

"se.recompile.Mandos.Client")

3169

for c in tcp_server.clients.itervalues() },

2717

((c.dbus_object_path, c.GetAll(""))

2718

for c in tcp_server.clients.itervalues()),

3170

2719

signature="oa{sv}")

3171

2720

3172

2721

@dbus.service.method(_interface, in_signature="o")

3176

2725

if c.dbus_object_path == object_path:

3177

2726

del tcp_server.clients[c.name]

3178

2727

c.remove_from_connection()

3179

# Don't signal the disabling

2728

# Don't signal anything except ClientRemoved

3180

2729

c.disable(quiet=True)

3181

# Emit D-Bus signal for removal

3182

self.client_removed_signal(c)

2730

# Emit D-Bus signal

2731

self.ClientRemoved(object_path, c.name)

3183

2732

return

3184

2733

raise KeyError(object_path)

3185

2734

3186

2735

del _interface

3187

3188

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3189

out_signature = "a{oa{sa{sv}}}")

3190

def GetManagedObjects(self):

3191

"""D-Bus method"""

3192

return dbus.Dictionary(

3193

{ client.dbus_object_path:

3194

dbus.Dictionary(

3195

{ interface: client.GetAll(interface)

3196

for interface in

3197

client._get_all_interface_names()})

3198

for client in tcp_server.clients.values()})

3199

3200

def client_added_signal(self, client):

3201

"""Send the new standard signal and the old signal"""

3202

if use_dbus:

3203

# New standard signal

3204

self.InterfacesAdded(

3205

client.dbus_object_path,

3206

dbus.Dictionary(

3207

{ interface: client.GetAll(interface)

3208

for interface in

3209

client._get_all_interface_names()}))

3210

# Old signal

3211

self.ClientAdded(client.dbus_object_path)

3212

3213

def client_removed_signal(self, client):

3214

"""Send the new standard signal and the old signal"""

3215

if use_dbus:

3216

# New standard signal

3217

self.InterfacesRemoved(

3218

client.dbus_object_path,

3219

client._get_all_interface_names())

3220

# Old signal

3221

self.ClientRemoved(client.dbus_object_path,

3222

client.name)

3223

2736

3224

2737

mandos_dbus_service = MandosDBusService()

3225

2738

3226

2739

def cleanup():

3227

2740

"Cleanup function; run on exit"

3228

if zeroconf:

3229

service.cleanup()

2741

service.cleanup()

3230

2742

3231

2743

multiprocessing.active_children()

3232

2744

wnull.close()

3246

2758

3247

2759

# A list of attributes that can not be pickled

3248

2760

# + secret.

3249

exclude = { "bus", "changedstate", "secret",

3250

"checker", "server_settings" }

3251

for name, typ in inspect.getmembers(dbus.service

3252

.Object):

2761

exclude = set(("bus", "changedstate", "secret",

2762

"checker", "server_settings"))

2763

for name, typ in (inspect.getmembers

2764

(dbus.service.Object)):

3253

2765

exclude.add(name)

3254

2766

3255

2767

client_dict["encrypted_secret"] = (client

3262

2774

del client_settings[client.name]["secret"]

3263

2775

3264

2776

try:

3265

with tempfile.NamedTemporaryFile(

3266

mode='wb',

3267

suffix=".pickle",

3268

prefix='clients-',

3269

dir=os.path.dirname(stored_state_path),

3270

delete=False) as stored_state:

2777

with (tempfile.NamedTemporaryFile

2778

(mode='wb', suffix=".pickle", prefix='clients-',

2779

dir=os.path.dirname(stored_state_path),

2780

delete=False)) as stored_state:

3271

2781

pickle.dump((clients, client_settings), stored_state)

3272

tempname = stored_state.name

2782

tempname=stored_state.name

3273

2783

os.rename(tempname, stored_state_path)

3274

2784

except (IOError, OSError) as e:

3275

2785

if not debug:

3278

2788

except NameError:

3279

2789

pass

3280

2790

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3281

logger.warning("Could not save persistent state: {}"

2791

logger.warning("Could not save persistent state: {0}"

3282

2792

.format(os.strerror(e.errno)))

3283

2793

else:

3284

2794

logger.warning("Could not save persistent state:",

3290

2800

name, client = tcp_server.clients.popitem()

3291

2801

if use_dbus:

3292

2802

client.remove_from_connection()

3293

# Don't signal the disabling

2803

# Don't signal anything except ClientRemoved

3294

2804

client.disable(quiet=True)

3295

# Emit D-Bus signal for removal

3296

2805

if use_dbus:

3297

mandos_dbus_service.client_removed_signal(client)

2806

# Emit D-Bus signal

2807

mandos_dbus_service.ClientRemoved(client

2808

.dbus_object_path,

2809

client.name)

3298

2810

client_settings.clear()

3299

2811

3300

2812

atexit.register(cleanup)

3301

2813

3302

2814

for client in tcp_server.clients.itervalues():

3303

2815

if use_dbus:

3304

# Emit D-Bus signal for adding

3305

mandos_dbus_service.client_added_signal(client)

2816

# Emit D-Bus signal

2817

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3306

2818

# Need to initiate checking of clients

3307

2819

if client.enabled:

3308

2820

client.init_checker()

3311

2823

tcp_server.server_activate()

3312

2824

3313

2825

# Find out what port we got

3314

if zeroconf:

3315

service.port = tcp_server.socket.getsockname()[1]

2826

service.port = tcp_server.socket.getsockname()[1]

3316

2827

if use_ipv6:

3317

2828

logger.info("Now listening on address %r, port %d,"

3318

2829

" flowinfo %d, scope_id %d",

3324

2835

#service.interface = tcp_server.socket.getsockname()[3]

3325

2836

3326

2837

try:

3327

if zeroconf:

3328

# From the Avahi example code

3329

try:

3330

service.activate()

3331

except dbus.exceptions.DBusException as error:

3332

logger.critical("D-Bus Exception", exc_info=error)

3333

cleanup()

3334

sys.exit(1)

3335

# End of Avahi example code

2838

# From the Avahi example code

2839

try:

2840

service.activate()

2841

except dbus.exceptions.DBusException as error:

2842

logger.critical("D-Bus Exception", exc_info=error)

2843

cleanup()

2844

sys.exit(1)

2845

# End of Avahi example code

3336

2846

3337

2847

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3338

2848

lambda *args, **kwargs:

3353

2863

# Must run before the D-Bus bus name gets deregistered

3354

2864

cleanup()

3355

2865

3356

3357

2866

if __name__ == '__main__':

3358

2867

main()