/mandos/release : revision 237.7.234

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

71

import collections

81

import codecs

82

72

83

73

import dbus

84

74

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

import gobject

89

76

import avahi

90

77

from dbus.mainloop.glib import DBusGMainLoop

91

78

import ctypes

101

88

except ImportError:

102

89

SO_BINDTODEVICE = None

103

90

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

91

version = "1.6.5"

108

92

stored_state_file = "clients.pickle"

109

93

110

94

logger = logging.getLogger()

111

95

syslogger = None

112

96

113

97

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

116

101

except (OSError, AttributeError):

117

118

102

def if_nametoindex(interface):

119

103

"Get an interface index the hard way, i.e. using fcntl()"

120

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

105

with contextlib.closing(socket.socket()) as s:

122

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

125

111

return interface_index

126

112

127

113

128

114

def initlogger(debug, level=logging.WARNING):

129

115

"""init logger and add loglevel"""

130

116

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

117

syslogger = (logging.handlers.SysLogHandler

118

(facility =

119

logging.handlers.SysLogHandler.LOG_DAEMON,

120

address = str("/dev/log")))

135

121

syslogger.setFormatter(logging.Formatter

136

122

('Mandos [%(process)d]: %(levelname)s:'

137

123

' %(message)s'))

154

140

155

141

class PGPEngine(object):

156

142

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

143

def __init__(self):

159

144

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

145

self.gnupgargs = ['--batch',

199

184

200

185

def encrypt(self, data, password):

201

186

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

187

with tempfile.NamedTemporaryFile(dir=self.tempdir

188

) as passfile:

204

189

passfile.write(passphrase)

205

190

passfile.flush()

206

191

proc = subprocess.Popen(['gpg', '--symmetric',

217

202

218

203

def decrypt(self, data, password):

219

204

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

205

with tempfile.NamedTemporaryFile(dir = self.tempdir

206

) as passfile:

222

207

passfile.write(passphrase)

223

208

passfile.flush()

224

209

proc = subprocess.Popen(['gpg', '--decrypt',

228

213

stdin = subprocess.PIPE,

229

214

stdout = subprocess.PIPE,

230

215

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

216

decrypted_plaintext, err = proc.communicate(input

217

= data)

232

218

if proc.returncode != 0:

233

219

raise PGPError(err)

234

220

return decrypted_plaintext

237

223

class AvahiError(Exception):

238

224

def __init__(self, value, *args, **kwargs):

239

225

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

226

super(AvahiError, self).__init__(value, *args, **kwargs)

227

def __unicode__(self):

228

return unicode(repr(self.value))

243

229

244

230

class AvahiServiceError(AvahiError):

245

231

pass

246

232

247

248

233

class AvahiGroupError(AvahiError):

249

234

pass

250

235

270

255

bus: dbus.SystemBus()

271

256

"""

272

257

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

258

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

259

servicetype = None, port = None, TXT = None,

260

domain = "", host = "", max_renames = 32768,

261

protocol = avahi.PROTO_UNSPEC, bus = None):

284

262

self.interface = interface

285

263

self.name = name

286

264

self.type = servicetype

296

274

self.bus = bus

297

275

self.entry_group_state_changed_match = None

298

276

299

def rename(self, remove=True):

277

def rename(self):

300

278

"""Derived from the Avahi example code"""

301

279

if self.rename_count >= self.max_renames:

302

280

logger.critical("No suitable Zeroconf service name found"

303

281

" after %i retries, exiting.",

304

282

self.rename_count)

305

283

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

284

self.name = unicode(self.server

285

.GetAlternativeServiceName(self.name))

309

286

logger.info("Changing Zeroconf service name to %r ...",

310

287

self.name)

311

if remove:

312

self.remove()

288

self.remove()

313

289

try:

314

290

self.add()

315

291

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

292

logger.critical("D-Bus Exception", exc_info=error)

293

self.cleanup()

294

os._exit(1)

295

self.rename_count += 1

324

296

325

297

def remove(self):

326

298

"""Derived from the Avahi example code"""

364

336

self.rename()

365

337

elif state == avahi.ENTRY_GROUP_FAILURE:

366

338

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

339

unicode(error))

340

raise AvahiGroupError("State changed: {0!s}"

341

.format(error))

369

342

370

343

def cleanup(self):

371

344

"""Derived from the Avahi example code"""

381

354

def server_state_changed(self, state, error=None):

382

355

"""Derived from the Avahi example code"""

383

356

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

357

bad_states = { avahi.SERVER_INVALID:

358

"Zeroconf server invalid",

359

avahi.SERVER_REGISTERING: None,

360

avahi.SERVER_COLLISION:

361

"Zeroconf server name collision",

362

avahi.SERVER_FAILURE:

363

"Zeroconf server failure" }

390

364

if state in bad_states:

391

365

if bad_states[state] is not None:

392

366

if error is None:

395

369

logger.error(bad_states[state] + ": %r", error)

396

370

self.cleanup()

397

371

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

372

self.add()

410

373

else:

411

374

if error is None:

412

375

logger.debug("Unknown state: %r", state)

422

385

follow_name_owner_changes=True),

423

386

avahi.DBUS_INTERFACE_SERVER)

424

387

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

388

self.server_state_changed)

426

389

self.server_state_changed(self.server.GetState())

427

390

428

391

429

392

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

393

def rename(self):

431

394

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

395

ret = AvahiService.rename(self)

396

syslogger.setFormatter(logging.Formatter

397

('Mandos ({0}) [%(process)d]:'

398

' %(levelname)s: %(message)s'

399

.format(self.name)))

436

400

return ret

437

401

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

402

403

def timedelta_to_milliseconds(td):

404

"Convert a datetime.timedelta() to milliseconds"

405

return ((td.days * 24 * 60 * 60 * 1000)

406

+ (td.seconds * 1000)

407

+ (td.microseconds // 1000))

408

447

409

448

410

class Client(object):

449

411

"""A representation of a client host served by this server.

476

438

last_checker_status: integer between 0 and 255 reflecting exit

477

439

status of last checker. -1 reflects crashed

478

440

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

441

last_enabled: datetime.datetime(); (UTC) or None

482

442

name: string; from the config file, used in log messages and

483

443

D-Bus identifiers

496

456

"fingerprint", "host", "interval",

497

457

"last_approval_request", "last_checked_ok",

498

458

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

469

470

def timeout_milliseconds(self):

471

"Return the 'timeout' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.timeout)

473

474

def extended_timeout_milliseconds(self):

475

"Return the 'extended_timeout' attribute in milliseconds"

476

return timedelta_to_milliseconds(self.extended_timeout)

477

478

def interval_milliseconds(self):

479

"Return the 'interval' attribute in milliseconds"

480

return timedelta_to_milliseconds(self.interval)

481

482

def approval_delay_milliseconds(self):

483

return timedelta_to_milliseconds(self.approval_delay)

510

484

511

485

@staticmethod

512

486

def config_parser(config):

528

502

client["enabled"] = config.getboolean(client_name,

529

503

"enabled")

530

504

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

505

client["fingerprint"] = (section["fingerprint"].upper()

535

506

.replace(" ", ""))

536

507

if "secret" in section:

541

512

"rb") as secfile:

542

513

client["secret"] = secfile.read()

543

514

else:

544

raise TypeError("No secret or secfile for section {}"

515

raise TypeError("No secret or secfile for section {0}"

545

516

.format(section))

546

517

client["timeout"] = string_to_delta(section["timeout"])

547

518

client["extended_timeout"] = string_to_delta(

564

535

server_settings = {}

565

536

self.server_settings = server_settings

566

537

# adding all client settings

567

for setting, value in settings.items():

538

for setting, value in settings.iteritems():

568

539

setattr(self, setting, value)

569

540

570

541

if self.enabled:

578

549

self.expires = None

579

550

580

551

logger.debug("Creating client %r", self.name)

552

# Uppercase and remove spaces from fingerprint for later

553

# comparison purposes with return value from the fingerprint()

554

# function

581

555

logger.debug(" Fingerprint: %s", self.fingerprint)

582

556

self.created = settings.get("created",

583

557

datetime.datetime.utcnow())

590

564

self.current_checker_command = None

591

565

self.approved = None

592

566

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

567

self.changedstate = (multiprocessing_manager

568

.Condition(multiprocessing_manager

569

.Lock()))

570

self.client_structure = [attr for attr in

571

self.__dict__.iterkeys()

597

572

if not attr.startswith("_")]

598

573

self.client_structure.append("client_structure")

599

574

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

575

for name, t in inspect.getmembers(type(self),

576

lambda obj:

577

isinstance(obj,

578

property)):

602

579

if not name.startswith("_"):

603

580

self.client_structure.append(name)

604

581

646

623

# and every interval from then on.

647

624

if self.checker_initiator_tag is not None:

648

625

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

626

self.checker_initiator_tag = (gobject.timeout_add

627

(self.interval_milliseconds(),

628

self.start_checker))

652

629

# Schedule a disable() when 'timeout' has passed

653

630

if self.disable_initiator_tag is not None:

654

631

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

632

self.disable_initiator_tag = (gobject.timeout_add

633

(self.timeout_milliseconds(),

634

self.disable))

657

635

# Also start a new checker *right now*.

658

636

self.start_checker()

659

637

660

def checker_callback(self, source, condition, connection,

661

command):

638

def checker_callback(self, pid, condition, command):

662

639

"""The checker has completed, so take appropriate actions."""

663

640

self.checker_callback_tag = None

664

641

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

642

if os.WIFEXITED(condition):

643

self.last_checker_status = os.WEXITSTATUS(condition)

672

644

if self.last_checker_status == 0:

673

645

logger.info("Checker for %(name)s succeeded",

674

646

vars(self))

675

647

self.checked_ok()

676

648

else:

677

logger.info("Checker for %(name)s failed", vars(self))

649

logger.info("Checker for %(name)s failed",

650

vars(self))

678

651

else:

679

652

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

653

logger.warning("Checker for %(name)s crashed?",

682

654

vars(self))

683

return False

684

655

685

656

def checked_ok(self):

686

657

"""Assert that the client has been seen, alive and well."""

687

658

self.last_checked_ok = datetime.datetime.utcnow()

688

659

self.last_checker_status = 0

689

self.last_checker_signal = None

690

660

self.bump_timeout()

691

661

692

662

def bump_timeout(self, timeout=None):

697

667

gobject.source_remove(self.disable_initiator_tag)

698

668

self.disable_initiator_tag = None

699

669

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

670

self.disable_initiator_tag = (gobject.timeout_add

671

(timedelta_to_milliseconds

672

(timeout), self.disable))

702

673

self.expires = datetime.datetime.utcnow() + timeout

703

674

704

675

def need_approval(self):

718

689

# than 'timeout' for the client to be disabled, which is as it

719

690

# should be.

720

691

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

692

# If a checker exists, make sure it is not a zombie

693

try:

694

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

695

except AttributeError:

696

pass

697

except OSError as error:

698

if error.errno != errno.ECHILD:

699

raise

700

else:

701

if pid:

702

logger.warning("Checker was a zombie")

703

gobject.source_remove(self.checker_callback_tag)

704

self.checker_callback(pid, status,

705

self.current_checker_command)

725

706

# Start a new checker if needed

726

707

if self.checker is None:

727

708

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

709

escaped_attrs = dict(

710

(attr, re.escape(unicode(getattr(self, attr))))

711

for attr in

712

self.runtime_expansions)

731

713

try:

732

714

command = self.checker_command % escaped_attrs

733

715

except TypeError as error:

734

716

logger.error('Could not format string "%s"',

735

self.checker_command,

717

self.checker_command, exc_info=error)

718

return True # Try again later

719

self.current_checker_command = command

720

try:

721

logger.info("Starting checker %r for %s",

722

command, self.name)

723

# We don't need to redirect stdout and stderr, since

724

# in normal mode, that is already done by daemon(),

725

# and in debug mode we don't want to. (Stdin is

726

# always replaced by /dev/null.)

727

# The exception is when not debugging but nevertheless

728

# running in the foreground; use the previously

729

# created wnull.

730

popen_args = {}

731

if (not self.server_settings["debug"]

732

and self.server_settings["foreground"]):

733

popen_args.update({"stdout": wnull,

734

"stderr": wnull })

735

self.checker = subprocess.Popen(command,

736

close_fds=True,

737

shell=True, cwd="/",

738

**popen_args)

739

except OSError as error:

740

logger.error("Failed to start subprocess",

736

741

exc_info=error)

737

return True # Try again later

738

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

742

return True

743

self.checker_callback_tag = (gobject.child_watch_add

744

(self.checker.pid,

745

self.checker_callback,

746

data=command))

747

# The checker may have completed before the gobject

748

# watch was added. Check for this.

749

try:

750

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

751

except OSError as error:

752

if error.errno == errno.ECHILD:

753

# This should never happen

754

logger.error("Child process vanished",

755

exc_info=error)

756

return True

757

raise

758

if pid:

759

gobject.source_remove(self.checker_callback_tag)

760

self.checker_callback(pid, status, command)

764

761

# Re-run this periodically if run by gobject.timeout_add

765

762

return True

766

763

772

769

if getattr(self, "checker", None) is None:

773

770

return

774

771

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

772

try:

773

self.checker.terminate()

774

#time.sleep(0.5)

775

#if self.checker.poll() is None:

776

# self.checker.kill()

777

except OSError as error:

778

if error.errno != errno.ESRCH: # No such process

779

raise

776

780

self.checker = None

777

781

778

782

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

783

def dbus_service_property(dbus_interface, signature="v",

784

access="readwrite", byte_arrays=False):

783

785

"""Decorators for marking methods of a DBusObjectWithProperties to

784

786

become properties on the D-Bus.

785

787

794

796

# "Set" method, so we fail early here:

795

797

if byte_arrays and signature != "ay":

796

798

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {!r}".format(signature))

798

799

" signature {0!r}".format(signature))

799

800

def decorator(func):

800

801

func._dbus_is_property = True

801

802

func._dbus_interface = dbus_interface

806

807

func._dbus_name = func._dbus_name[:-14]

807

808

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

809

return func

809

810

return decorator

811

812

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

824

def decorator(func):

826

825

func._dbus_is_interface = True

827

826

func._dbus_interface = dbus_interface

828

827

func._dbus_name = dbus_interface

829

828

return func

830

831

829

return decorator

832

830

833

831

835

833

"""Decorator to annotate D-Bus methods, signals or properties

836

834

Usage:

837

835

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

836

@dbus_service_property("org.example.Interface", signature="b",

842

837

access="r")

838

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

843

841

def Property_dbus_property(self):

844

842

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

843

"""

848

849

844

def decorator(func):

850

845

func._dbus_annotations = annotations

851

846

return func

852

853

847

return decorator

854

848

855

849

856

850

class DBusPropertyException(dbus.exceptions.DBusException):

857

851

"""A base class for D-Bus property-related exceptions

858

852

"""

859

pass

853

def __unicode__(self):

854

return unicode(str(self))

860

855

861

856

862

857

class DBusPropertyAccessException(DBusPropertyException):

871

866

pass

872

867

873

868

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

869

class DBusObjectWithProperties(dbus.service.Object):

870

"""A D-Bus object with properties.

876

871

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

872

Classes inheriting from this can use the dbus_service_property

873

decorator to expose methods as D-Bus properties. It exposes the

874

standard Get(), Set(), and GetAll() methods on the D-Bus.

879

875

"""

880

876

881

877

@staticmethod

885

881

If called like _is_dbus_thing("method") it returns a function

886

882

suitable for use as predicate to inspect.getmembers().

887

883

"""

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

884

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

889

885

False)

890

886

891

887

def _get_all_dbus_things(self, thing):

892

888

"""Returns a generator of (name, attribute) pairs

893

889

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

890

return ((getattr(athing.__get__(self), "_dbus_name",

891

name),

895

892

athing.__get__(self))

896

893

for cls in self.__class__.__mro__

897

894

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

895

inspect.getmembers(cls,

896

self._is_dbus_thing(thing)))

970

897

971

898

def _get_dbus_property(self, interface_name, property_name):

972

899

"""Returns a bound method if one exists which is a D-Bus

973

900

property with the specified name and interface.

974

901

"""

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

902

for cls in self.__class__.__mro__:

903

for name, value in (inspect.getmembers

904

(cls,

905

self._is_dbus_thing("property"))):

978

906

if (value._dbus_name == property_name

979

907

and value._dbus_interface == interface_name):

980

908

return value.__get__(self)

981

909

982

910

# No such property

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

911

raise DBusPropertyNotFound(self.dbus_object_path + ":"

912

+ interface_name + "."

913

+ property_name)

914

915

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

997

916

out_signature="v")

998

917

def Get(self, interface_name, property_name):

999

918

"""Standard D-Bus property Get() method, see D-Bus standard.

1018

937

# signatures other than "ay".

1019

938

if prop._dbus_signature != "ay":

1020

939

raise ValueError("Byte arrays not supported for non-"

1021

"'ay' signature {!r}"

940

"'ay' signature {0!r}"

1022

941

.format(prop._dbus_signature))

1023

942

value = dbus.ByteArray(b''.join(chr(byte)

1024

943

for byte in value))

1025

944

prop(value)

1026

945

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

946

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1029

947

out_signature="a{sv}")

1030

948

def GetAll(self, interface_name):

1031

949

"""Standard D-Bus property GetAll() method, see D-Bus

1046

964

if not hasattr(value, "variant_level"):

1047

965

properties[name] = value

1048

966

continue

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

967

properties[name] = type(value)(value, variant_level=

968

value.variant_level+1)

1051

969

return dbus.Dictionary(properties, signature="sv")

1052

970

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1054

def PropertiesChanged(self, interface_name, changed_properties,

1055

invalidated_properties):

1056

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1057

standard.

1058

"""

1059

pass

1060

1061

971

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1062

972

out_signature="s",

1063

973

path_keyword='object_path',

1067

977

1068

978

Inserts property tags and interface annotation tags.

1069

979

"""

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

980

xmlstring = dbus.service.Object.Introspect(self, object_path,

981

connection)

1073

982

try:

1074

983

document = xml.dom.minidom.parseString(xmlstring)

1075

1076

984

def make_tag(document, name, prop):

1077

985

e = document.createElement("property")

1078

986

e.setAttribute("name", name)

1079

987

e.setAttribute("type", prop._dbus_signature)

1080

988

e.setAttribute("access", prop._dbus_access)

1081

989

return e

1082

1083

990

for if_tag in document.getElementsByTagName("interface"):

1084

991

# Add property tags

1085

992

for tag in (make_tag(document, name, prop)

1088

995

if prop._dbus_interface

1089

996

== if_tag.getAttribute("name")):

1090

997

if_tag.appendChild(tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

998

# Add annotation tags

999

for typ in ("method", "signal", "property"):

1000

for tag in if_tag.getElementsByTagName(typ):

1001

annots = dict()

1002

for name, prop in (self.

1003

_get_all_dbus_things(typ)):

1004

if (name == tag.getAttribute("name")

1005

and prop._dbus_interface

1006

== if_tag.getAttribute("name")):

1007

annots.update(getattr

1008

(prop,

1009

"_dbus_annotations",

1010

{}))

1011

for name, value in annots.iteritems():

1012

ann_tag = document.createElement(

1013

"annotation")

1014

ann_tag.setAttribute("name", name)

1015

ann_tag.setAttribute("value", value)

1016

tag.appendChild(ann_tag)

1017

# Add interface annotation tags

1018

for annotation, value in dict(

1019

itertools.chain.from_iterable(

1020

annotations().iteritems()

1021

for name, annotations in

1022

self._get_all_dbus_things("interface")

1023

if name == if_tag.getAttribute("name")

1024

)).iteritems():

1025

ann_tag = document.createElement("annotation")

1026

ann_tag.setAttribute("name", annotation)

1027

ann_tag.setAttribute("value", value)

1028

if_tag.appendChild(ann_tag)

1107

1029

# Add the names to the return values for the

1108

1030

# "org.freedesktop.DBus.Properties" methods

1109

1031

if (if_tag.getAttribute("name")

1127

1049

exc_info=error)

1128

1050

return xmlstring

1129

1051

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1158

def InterfacesRemoved(self, object_path, interfaces):

1159

pass

1160

1161

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1162

out_signature = "s",

1163

path_keyword = 'object_path',

1164

connection_keyword = 'connection')

1165

def Introspect(self, object_path, connection):

1166

"""Overloading of standard D-Bus method.

1167

1168

Override return argument name of GetManagedObjects to be

1169

"objpath_interfaces_and_properties"

1170

"""

1171

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1172

object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1198

1052

1199

1053

def datetime_to_dbus(dt, variant_level=0):

1200

1054

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1201

1055

if dt is None:

1202

1056

return dbus.String("", variant_level = variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1057

return dbus.String(dt.isoformat(),

1058

variant_level=variant_level)

1204

1059

1205

1060

1206

1061

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1226

1081

(from DBusObjectWithProperties) and interfaces (from the

1227

1082

dbus_interface_annotations decorator).

1228

1083

"""

1229

1230

1084

def wrapper(cls):

1231

1085

for orig_interface_name, alt_interface_name in (

1232

alt_interface_names.items()):

1086

alt_interface_names.iteritems()):

1233

1087

attr = {}

1234

1088

interface_names = set()

1235

1089

# Go though all attributes of the class

1237

1091

# Ignore non-D-Bus attributes, and D-Bus attributes

1238

1092

# with the wrong interface name

1239

1093

if (not hasattr(attribute, "_dbus_interface")

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1094

or not attribute._dbus_interface

1095

.startswith(orig_interface_name)):

1242

1096

continue

1243

1097

# Create an alternate D-Bus interface name based on

1244

1098

# the current name

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1099

alt_interface = (attribute._dbus_interface

1100

.replace(orig_interface_name,

1101

alt_interface_name))

1247

1102

interface_names.add(alt_interface)

1248

1103

# Is this a D-Bus signal?

1249

1104

if getattr(attribute, "_dbus_is_signal", False):

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1105

# Extract the original non-method undecorated

1106

# function by black magic

1107

nonmethod_func = (dict(

1254

1108

zip(attribute.func_code.co_freevars,

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1109

attribute.__closure__))["func"]

1110

.cell_contents)

1259

1111

# Create a new, but exactly alike, function

1260

1112

# object, and decorate it to be a new D-Bus signal

1261

1113

# with the alternate D-Bus interface name

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1114

new_function = (dbus.service.signal

1115

(alt_interface,

1116

attribute._dbus_signature)

1117

(types.FunctionType(

1118

nonmethod_func.func_code,

1119

nonmethod_func.func_globals,

1120

nonmethod_func.func_name,

1121

nonmethod_func.func_defaults,

1122

nonmethod_func.func_closure)))

1279

1123

# Copy annotations, if any

1280

1124

try:

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1125

new_function._dbus_annotations = (

1126

dict(attribute._dbus_annotations))

1283

1127

except AttributeError:

1284

1128

pass

1285

1129

# Define a creator of a function to call both the

1290

1134

"""This function is a scope container to pass

1291

1135

func1 and func2 to the "call_both" function

1292

1136

outside of its arguments"""

1293

1294

@functools.wraps(func2)

1295

1137

def call_both(*args, **kwargs):

1296

1138

"""This function will emit two D-Bus

1297

1139

signals by calling func1 and func2"""

1298

1140

func1(*args, **kwargs)

1299

1141

func2(*args, **kwargs)

1300

# Make wrapper function look like a D-Bus signal

1301

for name, attr in inspect.getmembers(func2):

1302

if name.startswith("_dbus_"):

1303

setattr(call_both, name, attr)

1304

1305

1142

return call_both

1306

1143

# Create the "call_both" function and add it to

1307

1144

# the class

1312

1149

# object. Decorate it to be a new D-Bus method

1313

1150

# with the alternate D-Bus interface name. Add it

1314

1151

# to the class.

1315

attr[attrname] = (

1316

dbus.service.method(

1317

alt_interface,

1318

attribute._dbus_in_signature,

1319

attribute._dbus_out_signature)

1320

(types.FunctionType(attribute.func_code,

1321

attribute.func_globals,

1322

attribute.func_name,

1323

attribute.func_defaults,

1324

attribute.func_closure)))

1152

attr[attrname] = (dbus.service.method

1153

(alt_interface,

1154

attribute._dbus_in_signature,

1155

attribute._dbus_out_signature)

1156

(types.FunctionType

1157

(attribute.func_code,

1158

attribute.func_globals,

1159

attribute.func_name,

1160

attribute.func_defaults,

1161

attribute.func_closure)))

1325

1162

# Copy annotations, if any

1326

1163

try:

1327

attr[attrname]._dbus_annotations = dict(

1328

attribute._dbus_annotations)

1164

attr[attrname]._dbus_annotations = (

1165

dict(attribute._dbus_annotations))

1329

1166

except AttributeError:

1330

1167

pass

1331

1168

# Is this a D-Bus property?

1334

1171

# object, and decorate it to be a new D-Bus

1335

1172

# property with the alternate D-Bus interface

1336

1173

# name. Add it to the class.

1337

attr[attrname] = (dbus_service_property(

1338

alt_interface, attribute._dbus_signature,

1339

attribute._dbus_access,

1340

attribute._dbus_get_args_options

1341

["byte_arrays"])

1342

(types.FunctionType(

1343

attribute.func_code,

1344

attribute.func_globals,

1345

attribute.func_name,

1346

attribute.func_defaults,

1347

attribute.func_closure)))

1174

attr[attrname] = (dbus_service_property

1175

(alt_interface,

1176

attribute._dbus_signature,

1177

attribute._dbus_access,

1178

attribute

1179

._dbus_get_args_options

1180

["byte_arrays"])

1181

(types.FunctionType

1182

(attribute.func_code,

1183

attribute.func_globals,

1184

attribute.func_name,

1185

attribute.func_defaults,

1186

attribute.func_closure)))

1348

1187

# Copy annotations, if any

1349

1188

try:

1350

attr[attrname]._dbus_annotations = dict(

1351

attribute._dbus_annotations)

1189

attr[attrname]._dbus_annotations = (

1190

dict(attribute._dbus_annotations))

1352

1191

except AttributeError:

1353

1192

pass

1354

1193

# Is this a D-Bus interface?

1357

1196

# object. Decorate it to be a new D-Bus interface

1358

1197

# with the alternate D-Bus interface name. Add it

1359

1198

# to the class.

1360

attr[attrname] = (

1361

dbus_interface_annotations(alt_interface)

1362

(types.FunctionType(attribute.func_code,

1363

attribute.func_globals,

1364

attribute.func_name,

1365

attribute.func_defaults,

1366

attribute.func_closure)))

1199

attr[attrname] = (dbus_interface_annotations

1200

(alt_interface)

1201

(types.FunctionType

1202

(attribute.func_code,

1203

attribute.func_globals,

1204

attribute.func_name,

1205

attribute.func_defaults,

1206

attribute.func_closure)))

1367

1207

if deprecate:

1368

1208

# Deprecate all alternate interfaces

1369

iname="_AlternateDBusNames_interface_annotation{}"

1209

iname="_AlternateDBusNames_interface_annotation{0}"

1370

1210

for interface_name in interface_names:

1371

1372

1211

@dbus_interface_annotations(interface_name)

1373

1212

def func(self):

1374

1213

return { "org.freedesktop.DBus.Deprecated":

1375

"true" }

1214

"true" }

1376

1215

# Find an unused name

1377

1216

for aname in (iname.format(i)

1378

1217

for i in itertools.count()):

1382

1221

if interface_names:

1383

1222

# Replace the class with a new subclass of it with

1384

1223

# methods, signals, etc. as created above.

1385

cls = type(b"{}Alternate".format(cls.__name__),

1386

(cls, ), attr)

1224

cls = type(b"{0}Alternate".format(cls.__name__),

1225

(cls,), attr)

1387

1226

return cls

1388

1389

1227

return wrapper

1390

1228

1391

1229

1392

1230

@alternate_dbus_interfaces({"se.recompile.Mandos":

1393

"se.bsnet.fukt.Mandos"})

1231

"se.bsnet.fukt.Mandos"})

1394

1232

class ClientDBus(Client, DBusObjectWithProperties):

1395

1233

"""A Client class using D-Bus

1396

1234

1400

1238

"""

1401

1239

1402

1240

runtime_expansions = (Client.runtime_expansions

1403

+ ("dbus_object_path", ))

1404

1405

_interface = "se.recompile.Mandos.Client"

1241

+ ("dbus_object_path",))

1406

1242

1407

1243

# dbus.service.Object doesn't use super(), so we can't either.

1408

1244

1411

1247

Client.__init__(self, *args, **kwargs)

1412

1248

# Only now, when this client is initialized, can it show up on

1413

1249

# the D-Bus

1414

client_object_name = str(self.name).translate(

1250

client_object_name = unicode(self.name).translate(

1415

1251

{ord("."): ord("_"),

1416

1252

ord("-"): ord("_")})

1417

self.dbus_object_path = dbus.ObjectPath(

1418

"/clients/" + client_object_name)

1253

self.dbus_object_path = (dbus.ObjectPath

1254

("/clients/" + client_object_name))

1419

1255

DBusObjectWithProperties.__init__(self, self.bus,

1420

1256

self.dbus_object_path)

1421

1257

1422

def notifychangeproperty(transform_func, dbus_name,

1423

type_func=lambda x: x,

1424

variant_level=1,

1425

invalidate_only=False,

1426

_interface=_interface):

1258

def notifychangeproperty(transform_func,

1259

dbus_name, type_func=lambda x: x,

1260

variant_level=1):

1427

1261

""" Modify a variable so that it's a property which announces

1428

1262

its changes to DBus.

1429

1263

1434

1268

to the D-Bus. Default: no transform

1435

1269

variant_level: D-Bus variant level. Default: 1

1436

1270

"""

1437

attrname = "_{}".format(dbus_name)

1438

1271

attrname = "_{0}".format(dbus_name)

1439

1272

def setter(self, value):

1440

1273

if hasattr(self, "dbus_object_path"):

1441

1274

if (not hasattr(self, attrname) or

1442

1275

type_func(getattr(self, attrname, None))

1443

1276

!= type_func(value)):

1444

if invalidate_only:

1445

self.PropertiesChanged(

1446

_interface, dbus.Dictionary(),

1447

dbus.Array((dbus_name, )))

1448

else:

1449

dbus_value = transform_func(

1450

type_func(value),

1451

variant_level = variant_level)

1452

self.PropertyChanged(dbus.String(dbus_name),

1453

dbus_value)

1454

self.PropertiesChanged(

1455

_interface,

1456

dbus.Dictionary({ dbus.String(dbus_name):

1457

dbus_value }),

1458

dbus.Array())

1277

dbus_value = transform_func(type_func(value),

1278

variant_level

1279

=variant_level)

1280

self.PropertyChanged(dbus.String(dbus_name),

1281

dbus_value)

1459

1282

setattr(self, attrname, value)

1460

1283

1461

1284

return property(lambda self: getattr(self, attrname), setter)

1467

1290

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1468

1291

last_enabled = notifychangeproperty(datetime_to_dbus,

1469

1292

"LastEnabled")

1470

checker = notifychangeproperty(

1471

dbus.Boolean, "CheckerRunning",

1472

type_func = lambda checker: checker is not None)

1293

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1294

type_func = lambda checker:

1295

checker is not None)

1473

1296

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1474

1297

"LastCheckedOK")

1475

1298

last_checker_status = notifychangeproperty(dbus.Int16,

1478

1301

datetime_to_dbus, "LastApprovalRequest")

1479

1302

approved_by_default = notifychangeproperty(dbus.Boolean,

1480

1303

"ApprovedByDefault")

1481

approval_delay = notifychangeproperty(

1482

dbus.UInt64, "ApprovalDelay",

1483

type_func = lambda td: td.total_seconds() * 1000)

1304

approval_delay = notifychangeproperty(dbus.UInt64,

1305

"ApprovalDelay",

1306

type_func =

1307

timedelta_to_milliseconds)

1484

1308

approval_duration = notifychangeproperty(

1485

1309

dbus.UInt64, "ApprovalDuration",

1486

type_func = lambda td: td.total_seconds() * 1000)

1310

type_func = timedelta_to_milliseconds)

1487

1311

host = notifychangeproperty(dbus.String, "Host")

1488

timeout = notifychangeproperty(

1489

dbus.UInt64, "Timeout",

1490

type_func = lambda td: td.total_seconds() * 1000)

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func =

1314

timedelta_to_milliseconds)

1491

1315

extended_timeout = notifychangeproperty(

1492

1316

dbus.UInt64, "ExtendedTimeout",

1493

type_func = lambda td: td.total_seconds() * 1000)

1494

interval = notifychangeproperty(

1495

dbus.UInt64, "Interval",

1496

type_func = lambda td: td.total_seconds() * 1000)

1317

type_func = timedelta_to_milliseconds)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

timedelta_to_milliseconds)

1497

1322

checker_command = notifychangeproperty(dbus.String, "Checker")

1498

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1499

invalidate_only=True)

1500

1323

1501

1324

del notifychangeproperty

1502

1325

1509

1332

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1510

1333

Client.__del__(self, *args, **kwargs)

1511

1334

1512

def checker_callback(self, source, condition,

1513

connection, command, *args, **kwargs):

1514

ret = Client.checker_callback(self, source, condition,

1515

connection, command, *args,

1516

**kwargs)

1517

exitstatus = self.last_checker_status

1518

if exitstatus >= 0:

1335

def checker_callback(self, pid, condition, command,

1336

*args, **kwargs):

1337

self.checker_callback_tag = None

1338

self.checker = None

1339

if os.WIFEXITED(condition):

1340

exitstatus = os.WEXITSTATUS(condition)

1519

1341

# Emit D-Bus signal

1520

1342

self.CheckerCompleted(dbus.Int16(exitstatus),

1521

# This is specific to GNU libC

1522

dbus.Int64(exitstatus << 8),

1343

dbus.Int64(condition),

1523

1344

dbus.String(command))

1524

1345

else:

1525

1346

# Emit D-Bus signal

1526

1347

self.CheckerCompleted(dbus.Int16(-1),

1527

dbus.Int64(

1528

# This is specific to GNU libC

1529

(exitstatus << 8)

1530

| self.last_checker_signal),

1348

dbus.Int64(condition),

1531

1349

dbus.String(command))

1532

return ret

1350

1351

return Client.checker_callback(self, pid, condition, command,

1352

*args, **kwargs)

1533

1353

1534

1354

def start_checker(self, *args, **kwargs):

1535

1355

old_checker_pid = getattr(self.checker, "pid", None)

1547

1367

1548

1368

def approve(self, value=True):

1549

1369

self.approved = value

1550

gobject.timeout_add(int(self.approval_duration.total_seconds()

1551

* 1000), self._reset_approved)

1370

gobject.timeout_add(timedelta_to_milliseconds

1371

(self.approval_duration),

1372

self._reset_approved)

1552

1373

self.send_changedstate()

1553

1374

1554

1375

## D-Bus methods, signals & properties

1376

_interface = "se.recompile.Mandos.Client"

1555

1377

1556

1378

## Interfaces

1557

1379

1380

@dbus_interface_annotations(_interface)

1381

def _foo(self):

1382

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1383

"false"}

1384

1558

1385

## Signals

1559

1386

1560

1387

# CheckerCompleted - signal

1570

1397

pass

1571

1398

1572

1399

# PropertyChanged - signal

1573

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1574

1400

@dbus.service.signal(_interface, signature="sv")

1575

1401

def PropertyChanged(self, property, value):

1576

1402

"D-Bus signal"

1610

1436

self.checked_ok()

1611

1437

1612

1438

# Enable - method

1613

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1614

1439

@dbus.service.method(_interface)

1615

1440

def Enable(self):

1616

1441

"D-Bus method"

1617

1442

self.enable()

1618

1443

1619

1444

# StartChecker - method

1620

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1621

1445

@dbus.service.method(_interface)

1622

1446

def StartChecker(self):

1623

1447

"D-Bus method"

1624

1448

self.start_checker()

1625

1449

1626

1450

# Disable - method

1627

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1628

1451

@dbus.service.method(_interface)

1629

1452

def Disable(self):

1630

1453

"D-Bus method"

1631

1454

self.disable()

1632

1455

1633

1456

# StopChecker - method

1634

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1635

1457

@dbus.service.method(_interface)

1636

1458

def StopChecker(self):

1637

1459

self.stop_checker()

1644

1466

return dbus.Boolean(bool(self.approvals_pending))

1645

1467

1646

1468

# ApprovedByDefault - property

1647

@dbus_service_property(_interface,

1648

signature="b",

1469

@dbus_service_property(_interface, signature="b",

1649

1470

access="readwrite")

1650

1471

def ApprovedByDefault_dbus_property(self, value=None):

1651

1472

if value is None: # get

1653

1474

self.approved_by_default = bool(value)

1654

1475

1655

1476

# ApprovalDelay - property

1656

@dbus_service_property(_interface,

1657

signature="t",

1477

@dbus_service_property(_interface, signature="t",

1658

1478

access="readwrite")

1659

1479

def ApprovalDelay_dbus_property(self, value=None):

1660

1480

if value is None: # get

1661

return dbus.UInt64(self.approval_delay.total_seconds()

1662

* 1000)

1481

return dbus.UInt64(self.approval_delay_milliseconds())

1663

1482

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1664

1483

1665

1484

# ApprovalDuration - property

1666

@dbus_service_property(_interface,

1667

signature="t",

1485

@dbus_service_property(_interface, signature="t",

1668

1486

access="readwrite")

1669

1487

def ApprovalDuration_dbus_property(self, value=None):

1670

1488

if value is None: # get

1671

return dbus.UInt64(self.approval_duration.total_seconds()

1672

* 1000)

1489

return dbus.UInt64(timedelta_to_milliseconds(

1490

self.approval_duration))

1673

1491

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1674

1492

1675

1493

# Name - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1678

1494

@dbus_service_property(_interface, signature="s", access="read")

1679

1495

def Name_dbus_property(self):

1680

1496

return dbus.String(self.name)

1681

1497

1682

1498

# Fingerprint - property

1683

@dbus_annotations(

1684

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1685

1499

@dbus_service_property(_interface, signature="s", access="read")

1686

1500

def Fingerprint_dbus_property(self):

1687

1501

return dbus.String(self.fingerprint)

1688

1502

1689

1503

# Host - property

1690

@dbus_service_property(_interface,

1691

signature="s",

1504

@dbus_service_property(_interface, signature="s",

1692

1505

access="readwrite")

1693

1506

def Host_dbus_property(self, value=None):

1694

1507

if value is None: # get

1695

1508

return dbus.String(self.host)

1696

self.host = str(value)

1509

self.host = unicode(value)

1697

1510

1698

1511

# Created - property

1699

@dbus_annotations(

1700

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1701

1512

@dbus_service_property(_interface, signature="s", access="read")

1702

1513

def Created_dbus_property(self):

1703

1514

return datetime_to_dbus(self.created)

1708

1519

return datetime_to_dbus(self.last_enabled)

1709

1520

1710

1521

# Enabled - property

1711

@dbus_service_property(_interface,

1712

signature="b",

1522

@dbus_service_property(_interface, signature="b",

1713

1523

access="readwrite")

1714

1524

def Enabled_dbus_property(self, value=None):

1715

1525

if value is None: # get

1720

1530

self.disable()

1721

1531

1722

1532

# LastCheckedOK - property

1723

@dbus_service_property(_interface,

1724

signature="s",

1533

@dbus_service_property(_interface, signature="s",

1725

1534

access="readwrite")

1726

1535

def LastCheckedOK_dbus_property(self, value=None):

1727

1536

if value is not None:

1730

1539

return datetime_to_dbus(self.last_checked_ok)

1731

1540

1732

1541

# LastCheckerStatus - property

1733

@dbus_service_property(_interface, signature="n", access="read")

1542

@dbus_service_property(_interface, signature="n",

1543

access="read")

1734

1544

def LastCheckerStatus_dbus_property(self):

1735

1545

return dbus.Int16(self.last_checker_status)

1736

1546

1745

1555

return datetime_to_dbus(self.last_approval_request)

1746

1556

1747

1557

# Timeout - property

1748

@dbus_service_property(_interface,

1749

signature="t",

1558

@dbus_service_property(_interface, signature="t",

1750

1559

access="readwrite")

1751

1560

def Timeout_dbus_property(self, value=None):

1752

1561

if value is None: # get

1753

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

return dbus.UInt64(self.timeout_milliseconds())

1754

1563

old_timeout = self.timeout

1755

1564

self.timeout = datetime.timedelta(0, 0, 0, value)

1756

1565

# Reschedule disabling

1765

1574

is None):

1766

1575

return

1767

1576

gobject.source_remove(self.disable_initiator_tag)

1768

self.disable_initiator_tag = gobject.timeout_add(

1769

int((self.expires - now).total_seconds() * 1000),

1770

self.disable)

1577

self.disable_initiator_tag = (

1578

gobject.timeout_add(

1579

timedelta_to_milliseconds(self.expires - now),

1580

self.disable))

1771

1581

1772

1582

# ExtendedTimeout - property

1773

@dbus_service_property(_interface,

1774

signature="t",

1583

@dbus_service_property(_interface, signature="t",

1775

1584

access="readwrite")

1776

1585

def ExtendedTimeout_dbus_property(self, value=None):

1777

1586

if value is None: # get

1778

return dbus.UInt64(self.extended_timeout.total_seconds()

1779

* 1000)

1587

return dbus.UInt64(self.extended_timeout_milliseconds())

1780

1588

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1781

1589

1782

1590

# Interval - property

1783

@dbus_service_property(_interface,

1784

signature="t",

1591

@dbus_service_property(_interface, signature="t",

1785

1592

access="readwrite")

1786

1593

def Interval_dbus_property(self, value=None):

1787

1594

if value is None: # get

1788

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

return dbus.UInt64(self.interval_milliseconds())

1789

1596

self.interval = datetime.timedelta(0, 0, 0, value)

1790

1597

if getattr(self, "checker_initiator_tag", None) is None:

1791

1598

return

1792

1599

if self.enabled:

1793

1600

# Reschedule checker run

1794

1601

gobject.source_remove(self.checker_initiator_tag)

1795

self.checker_initiator_tag = gobject.timeout_add(

1796

value, self.start_checker)

1797

self.start_checker() # Start one now, too

1602

self.checker_initiator_tag = (gobject.timeout_add

1603

(value, self.start_checker))

1604

self.start_checker() # Start one now, too

1798

1605

1799

1606

# Checker - property

1800

@dbus_service_property(_interface,

1801

signature="s",

1607

@dbus_service_property(_interface, signature="s",

1802

1608

access="readwrite")

1803

1609

def Checker_dbus_property(self, value=None):

1804

1610

if value is None: # get

1805

1611

return dbus.String(self.checker_command)

1806

self.checker_command = str(value)

1612

self.checker_command = unicode(value)

1807

1613

1808

1614

# CheckerRunning - property

1809

@dbus_service_property(_interface,

1810

signature="b",

1615

@dbus_service_property(_interface, signature="b",

1811

1616

access="readwrite")

1812

1617

def CheckerRunning_dbus_property(self, value=None):

1813

1618

if value is None: # get

1818

1623

self.stop_checker()

1819

1624

1820

1625

# ObjectPath - property

1821

@dbus_annotations(

1822

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1823

"org.freedesktop.DBus.Deprecated": "true"})

1824

1626

@dbus_service_property(_interface, signature="o", access="read")

1825

1627

def ObjectPath_dbus_property(self):

1826

1628

return self.dbus_object_path # is already a dbus.ObjectPath

1827

1629

1828

1630

# Secret = property

1829

@dbus_annotations(

1830

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1831

"invalidates"})

1832

@dbus_service_property(_interface,

1833

signature="ay",

1834

access="write",

1835

byte_arrays=True)

1631

@dbus_service_property(_interface, signature="ay",

1632

access="write", byte_arrays=True)

1836

1633

def Secret_dbus_property(self, value):

1837

self.secret = bytes(value)

1634

self.secret = str(value)

1838

1635

1839

1636

del _interface

1840

1637

1844

1641

self._pipe = child_pipe

1845

1642

self._pipe.send(('init', fpr, address))

1846

1643

if not self._pipe.recv():

1847

raise KeyError(fpr)

1644

raise KeyError()

1848

1645

1849

1646

def __getattribute__(self, name):

1850

1647

if name == '_pipe':

1854

1651

if data[0] == 'data':

1855

1652

return data[1]

1856

1653

if data[0] == 'function':

1857

1858

1654

def func(*args, **kwargs):

1859

1655

self._pipe.send(('funcall', name, args, kwargs))

1860

1656

return self._pipe.recv()[1]

1861

1862

1657

return func

1863

1658

1864

1659

def __setattr__(self, name, value):

1876

1671

def handle(self):

1877

1672

with contextlib.closing(self.server.child_pipe) as child_pipe:

1878

1673

logger.info("TCP connection from: %s",

1879

str(self.client_address))

1674

unicode(self.client_address))

1880

1675

logger.debug("Pipe FD: %d",

1881

1676

self.server.child_pipe.fileno())

1882

1677

1883

session = gnutls.connection.ClientSession(

1884

self.request, gnutls.connection .X509Credentials())

1678

session = (gnutls.connection

1679

.ClientSession(self.request,

1680

gnutls.connection

1681

.X509Credentials()))

1885

1682

1886

1683

# Note: gnutls.connection.X509Credentials is really a

1887

1684

# generic GnuTLS certificate credentials object so long as

1896

1693

priority = self.server.gnutls_priority

1897

1694

if priority is None:

1898

1695

priority = "NORMAL"

1899

gnutls.library.functions.gnutls_priority_set_direct(

1900

session._c_object, priority, None)

1696

(gnutls.library.functions

1697

.gnutls_priority_set_direct(session._c_object,

1698

priority, None))

1901

1699

1902

1700

# Start communication using the Mandos protocol

1903

1701

# Get protocol number

1923

1721

approval_required = False

1924

1722

try:

1925

1723

try:

1926

fpr = self.fingerprint(

1927

self.peer_certificate(session))

1724

fpr = self.fingerprint(self.peer_certificate

1725

(session))

1928

1726

except (TypeError,

1929

1727

gnutls.errors.GNUTLSError) as error:

1930

1728

logger.warning("Bad certificate: %s", error)

1945

1743

while True:

1946

1744

if not client.enabled:

1947

1745

logger.info("Client %s is disabled",

1948

client.name)

1746

client.name)

1949

1747

if self.server.use_dbus:

1950

1748

# Emit D-Bus signal

1951

1749

client.Rejected("Disabled")

1960

1758

if self.server.use_dbus:

1961

1759

# Emit D-Bus signal

1962

1760

client.NeedApproval(

1963

client.approval_delay.total_seconds()

1964

* 1000, client.approved_by_default)

1761

client.approval_delay_milliseconds(),

1762

client.approved_by_default)

1965

1763

else:

1966

1764

logger.warning("Client %s was not approved",

1967

1765

client.name)

1973

1771

#wait until timeout or approved

1974

1772

time = datetime.datetime.now()

1975

1773

client.changedstate.acquire()

1976

client.changedstate.wait(delay.total_seconds())

1774

client.changedstate.wait(

1775

float(timedelta_to_milliseconds(delay)

1776

/ 1000))

1977

1777

client.changedstate.release()

1978

1778

time2 = datetime.datetime.now()

1979

1779

if (time2 - time) >= delay:

1998

1798

logger.warning("gnutls send failed",

1999

1799

exc_info=error)

2000

1800

return

2001

logger.debug("Sent: %d, remaining: %d", sent,

2002

len(client.secret) - (sent_size

2003

+ sent))

1801

logger.debug("Sent: %d, remaining: %d",

1802

sent, len(client.secret)

1803

- (sent_size + sent))

2004

1804

sent_size += sent

2005

1805

2006

1806

logger.info("Sending secret to %s", client.name)

2023

1823

def peer_certificate(session):

2024

1824

"Return the peer's OpenPGP certificate as a bytestring"

2025

1825

# If not an OpenPGP certificate...

2026

if (gnutls.library.functions.gnutls_certificate_type_get(

2027

session._c_object)

1826

if (gnutls.library.functions

1827

.gnutls_certificate_type_get(session._c_object)

2028

1828

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

2029

1829

# ...do the normal thing

2030

1830

return session.peer_certificate

2044

1844

def fingerprint(openpgp):

2045

1845

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2046

1846

# New GnuTLS "datum" with the OpenPGP public key

2047

datum = gnutls.library.types.gnutls_datum_t(

2048

ctypes.cast(ctypes.c_char_p(openpgp),

2049

ctypes.POINTER(ctypes.c_ubyte)),

2050

ctypes.c_uint(len(openpgp)))

1847

datum = (gnutls.library.types

1848

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1849

ctypes.POINTER

1850

(ctypes.c_ubyte)),

1851

ctypes.c_uint(len(openpgp))))

2051

1852

# New empty GnuTLS certificate

2052

1853

crt = gnutls.library.types.gnutls_openpgp_crt_t()

2053

gnutls.library.functions.gnutls_openpgp_crt_init(

2054

ctypes.byref(crt))

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2055

1856

# Import the OpenPGP public key into the certificate

2056

gnutls.library.functions.gnutls_openpgp_crt_import(

2057

crt, ctypes.byref(datum),

2058

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1859

gnutls.library.constants

1860

.GNUTLS_OPENPGP_FMT_RAW))

2059

1861

# Verify the self signature in the key

2060

1862

crtverify = ctypes.c_uint()

2061

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2062

crt, 0, ctypes.byref(crtverify))

1863

(gnutls.library.functions

1864

.gnutls_openpgp_crt_verify_self(crt, 0,

1865

ctypes.byref(crtverify)))

2063

1866

if crtverify.value != 0:

2064

1867

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2065

raise gnutls.errors.CertificateSecurityError(

2066

"Verify failed")

1868

raise (gnutls.errors.CertificateSecurityError

1869

("Verify failed"))

2067

1870

# New buffer for the fingerprint

2068

1871

buf = ctypes.create_string_buffer(20)

2069

1872

buf_len = ctypes.c_size_t()

2070

1873

# Get the fingerprint from the certificate into the buffer

2071

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2072

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1874

(gnutls.library.functions

1875

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1876

ctypes.byref(buf_len)))

2073

1877

# Deinit the certificate

2074

1878

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2075

1879

# Convert the buffer to a Python bytestring

2081

1885

2082

1886

class MultiprocessingMixIn(object):

2083

1887

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2084

2085

1888

def sub_process_main(self, request, address):

2086

1889

try:

2087

1890

self.finish_request(request, address)

2099

1902

2100

1903

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2101

1904

""" adds a pipe to the MixIn """

2102

2103

1905

def process_request(self, request, client_address):

2104

1906

"""Overrides and wraps the original process_request().

2105

1907

2126

1928

interface: None or a network interface name (string)

2127

1929

use_ipv6: Boolean; to use IPv6 or not

2128

1930

"""

2129

2130

1931

def __init__(self, server_address, RequestHandlerClass,

2131

interface=None,

2132

use_ipv6=True,

2133

socketfd=None):

1932

interface=None, use_ipv6=True, socketfd=None):

2134

1933

"""If socketfd is set, use that file descriptor instead of

2135

1934

creating a new one with socket.socket().

2136

1935

"""

2177

1976

self.interface)

2178

1977

else:

2179

1978

try:

2180

self.socket.setsockopt(

2181

socket.SOL_SOCKET, SO_BINDTODEVICE,

2182

(self.interface + "\0").encode("utf-8"))

1979

self.socket.setsockopt(socket.SOL_SOCKET,

1980

SO_BINDTODEVICE,

1981

str(self.interface + '\0'))

2183

1982

except socket.error as error:

2184

1983

if error.errno == errno.EPERM:

2185

1984

logger.error("No permission to bind to"

2203

2002

self.server_address = (any_address,

2204

2003

self.server_address[1])

2205

2004

elif not self.server_address[1]:

2206

self.server_address = (self.server_address[0], 0)

2005

self.server_address = (self.server_address[0],

2006

0)

2207

2007

# if self.interface:

2208

2008

# self.server_address = (self.server_address[0],

2209

2009

# 0, # port

2223

2023

2224

2024

Assumes a gobject.MainLoop event loop.

2225

2025

"""

2226

2227

2026

def __init__(self, server_address, RequestHandlerClass,

2228

interface=None,

2229

use_ipv6=True,

2230

clients=None,

2231

gnutls_priority=None,

2232

use_dbus=True,

2233

socketfd=None):

2027

interface=None, use_ipv6=True, clients=None,

2028

gnutls_priority=None, use_dbus=True, socketfd=None):

2234

2029

self.enabled = False

2235

2030

self.clients = clients

2236

2031

if self.clients is None:

2242

2037

interface = interface,

2243

2038

use_ipv6 = use_ipv6,

2244

2039

socketfd = socketfd)

2245

2246

2040

def server_activate(self):

2247

2041

if self.enabled:

2248

2042

return socketserver.TCPServer.server_activate(self)

2252

2046

2253

2047

def add_pipe(self, parent_pipe, proc):

2254

2048

# Call "handle_ipc" for both data and EOF events

2255

gobject.io_add_watch(

2256

parent_pipe.fileno(),

2257

gobject.IO_IN | gobject.IO_HUP,

2258

functools.partial(self.handle_ipc,

2259

parent_pipe = parent_pipe,

2260

proc = proc))

2049

gobject.io_add_watch(parent_pipe.fileno(),

2050

gobject.IO_IN | gobject.IO_HUP,

2051

functools.partial(self.handle_ipc,

2052

parent_pipe =

2053

parent_pipe,

2054

proc = proc))

2261

2055

2262

def handle_ipc(self, source, condition,

2263

parent_pipe=None,

2264

proc = None,

2265

client_object=None):

2056

def handle_ipc(self, source, condition, parent_pipe=None,

2057

proc = None, client_object=None):

2266

2058

# error, or the other end of multiprocessing.Pipe has closed

2267

2059

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2268

2060

# Wait for other process to exit

2291

2083

parent_pipe.send(False)

2292

2084

return False

2293

2085

2294

gobject.io_add_watch(

2295

parent_pipe.fileno(),

2296

gobject.IO_IN | gobject.IO_HUP,

2297

functools.partial(self.handle_ipc,

2298

parent_pipe = parent_pipe,

2299

proc = proc,

2300

client_object = client))

2086

gobject.io_add_watch(parent_pipe.fileno(),

2087

gobject.IO_IN | gobject.IO_HUP,

2088

functools.partial(self.handle_ipc,

2089

parent_pipe =

2090

parent_pipe,

2091

proc = proc,

2092

client_object =

2093

client))

2301

2094

parent_pipe.send(True)

2302

2095

# remove the old hook in favor of the new above hook on

2303

2096

# same fileno

2309

2102

2310

2103

parent_pipe.send(('data', getattr(client_object,

2311

2104

funcname)(*args,

2312

**kwargs)))

2105

**kwargs)))

2313

2106

2314

2107

if command == 'getattr':

2315

2108

attrname = request[1]

2316

if isinstance(client_object.__getattribute__(attrname),

2317

collections.Callable):

2318

parent_pipe.send(('function', ))

2109

if callable(client_object.__getattribute__(attrname)):

2110

parent_pipe.send(('function',))

2319

2111

else:

2320

parent_pipe.send((

2321

'data', client_object.__getattribute__(attrname)))

2112

parent_pipe.send(('data', client_object

2113

.__getattribute__(attrname)))

2322

2114

2323

2115

if command == 'setattr':

2324

2116

attrname = request[1]

2355

2147

# avoid excessive use of external libraries.

2356

2148

2357

2149

# New type for defining tokens, syntax, and semantics all-in-one

2358

Token = collections.namedtuple("Token", (

2359

"regexp", # To match token; if "value" is not None, must have

2360

# a "group" containing digits

2361

"value", # datetime.timedelta or None

2362

"followers")) # Tokens valid after this token

2150

Token = collections.namedtuple("Token",

2151

("regexp", # To match token; if

2152

# "value" is not None,

2153

# must have a "group"

2154

# containing digits

2155

"value", # datetime.timedelta or

2156

# None

2157

"followers")) # Tokens valid after

2158

# this token

2363

2159

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2364

2160

# the "duration" ABNF definition in RFC 3339, Appendix A.

2365

2161

token_end = Token(re.compile(r"$"), None, frozenset())

2366

2162

token_second = Token(re.compile(r"(\d+)S"),

2367

2163

datetime.timedelta(seconds=1),

2368

frozenset((token_end, )))

2164

frozenset((token_end,)))

2369

2165

token_minute = Token(re.compile(r"(\d+)M"),

2370

2166

datetime.timedelta(minutes=1),

2371

2167

frozenset((token_second, token_end)))

2387

2183

frozenset((token_month, token_end)))

2388

2184

token_week = Token(re.compile(r"(\d+)W"),

2389

2185

datetime.timedelta(weeks=1),

2390

frozenset((token_end, )))

2186

frozenset((token_end,)))

2391

2187

token_duration = Token(re.compile(r"P"), None,

2392

2188

frozenset((token_year, token_month,

2393

2189

token_day, token_time,

2394

token_week)))

2190

token_week))),

2395

2191

# Define starting values

2396

2192

value = datetime.timedelta() # Value so far

2397

2193

found_token = None

2398

followers = frozenset((token_duration, )) # Following valid tokens

2194

followers = frozenset(token_duration,) # Following valid tokens

2399

2195

s = duration # String left to parse

2400

2196

# Loop until end token is found

2401

2197

while found_token is not token_end:

2418

2214

break

2419

2215

else:

2420

2216

# No currently valid tokens were found

2421

raise ValueError("Invalid RFC 3339 duration: {!r}"

2422

.format(duration))

2217

raise ValueError("Invalid RFC 3339 duration")

2423

2218

# End token found

2424

2219

return value

2425

2220

2449

2244

timevalue = datetime.timedelta(0)

2450

2245

for s in interval.split():

2451

2246

try:

2452

suffix = s[-1]

2247

suffix = unicode(s[-1])

2453

2248

value = int(s[:-1])

2454

2249

if suffix == "d":

2455

2250

delta = datetime.timedelta(value)

2462

2257

elif suffix == "w":

2463

2258

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2464

2259

else:

2465

raise ValueError("Unknown suffix {!r}".format(suffix))

2260

raise ValueError("Unknown suffix {0!r}"

2261

.format(suffix))

2466

2262

except IndexError as e:

2467

2263

raise ValueError(*(e.args))

2468

2264

timevalue += delta

2485

2281

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2486

2282

if not stat.S_ISCHR(os.fstat(null).st_mode):

2487

2283

raise OSError(errno.ENODEV,

2488

"{} not a character device"

2284

"{0} not a character device"

2489

2285

.format(os.devnull))

2490

2286

os.dup2(null, sys.stdin.fileno())

2491

2287

os.dup2(null, sys.stdout.fileno())

2501

2297

2502

2298

parser = argparse.ArgumentParser()

2503

2299

parser.add_argument("-v", "--version", action="version",

2504

version = "%(prog)s {}".format(version),

2300

version = "%(prog)s {0}".format(version),

2505

2301

help="show version number and exit")

2506

2302

parser.add_argument("-i", "--interface", metavar="IF",

2507

2303

help="Bind to interface IF")

2540

2336

help="Directory to save/restore state in")

2541

2337

parser.add_argument("--foreground", action="store_true",

2542

2338

help="Run in foreground", default=None)

2543

parser.add_argument("--no-zeroconf", action="store_false",

2544

dest="zeroconf", help="Do not use Zeroconf",

2545

default=None)

2546

2339

2547

2340

options = parser.parse_args()

2548

2341

2557

2350

"port": "",

2558

2351

"debug": "False",

2559

2352

"priority":

2560

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2561

":+SIGN-DSA-SHA256",

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2562

2354

"servicename": "Mandos",

2563

2355

"use_dbus": "True",

2564

2356

"use_ipv6": "True",

2567

2359

"socket": "",

2568

2360

"statedir": "/var/lib/mandos",

2569

2361

"foreground": "False",

2570

"zeroconf": "True",

2571

}

2362

}

2572

2363

2573

2364

# Parse config file for server-global settings

2574

2365

server_config = configparser.SafeConfigParser(server_defaults)

2575

2366

del server_defaults

2576

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2367

server_config.read(os.path.join(options.configdir,

2368

"mandos.conf"))

2577

2369

# Convert the SafeConfigParser object to a dict

2578

2370

server_settings = server_config.defaults()

2579

2371

# Use the appropriate methods on the non-string config options

2597

2389

# Override the settings from the config file with command line

2598

2390

# options, if set.

2599

2391

for option in ("interface", "address", "port", "debug",

2600

"priority", "servicename", "configdir", "use_dbus",

2601

"use_ipv6", "debuglevel", "restore", "statedir",

2602

"socket", "foreground", "zeroconf"):

2392

"priority", "servicename", "configdir",

2393

"use_dbus", "use_ipv6", "debuglevel", "restore",

2394

"statedir", "socket", "foreground"):

2603

2395

value = getattr(options, option)

2604

2396

if value is not None:

2605

2397

server_settings[option] = value

2606

2398

del options

2607

2399

# Force all strings to be unicode

2608

2400

for option in server_settings.keys():

2609

if isinstance(server_settings[option], bytes):

2610

server_settings[option] = (server_settings[option]

2611

.decode("utf-8"))

2401

if type(server_settings[option]) is str:

2402

server_settings[option] = unicode(server_settings[option])

2612

2403

# Force all boolean options to be boolean

2613

2404

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2614

"foreground", "zeroconf"):

2405

"foreground"):

2615

2406

server_settings[option] = bool(server_settings[option])

2616

2407

# Debug implies foreground

2617

2408

if server_settings["debug"]:

2620

2411

2621

2412

##################################################################

2622

2413

2623

if (not server_settings["zeroconf"]

2624

and not (server_settings["port"]

2625

or server_settings["socket"] != "")):

2626

parser.error("Needs port or socket to work without Zeroconf")

2627

2628

2414

# For convenience

2629

2415

debug = server_settings["debug"]

2630

2416

debuglevel = server_settings["debuglevel"]

2633

2419

stored_state_path = os.path.join(server_settings["statedir"],

2634

2420

stored_state_file)

2635

2421

foreground = server_settings["foreground"]

2636

zeroconf = server_settings["zeroconf"]

2637

2422

2638

2423

if debug:

2639

2424

initlogger(debug, logging.DEBUG)

2645

2430

initlogger(debug, level)

2646

2431

2647

2432

if server_settings["servicename"] != "Mandos":

2648

syslogger.setFormatter(

2649

logging.Formatter('Mandos ({}) [%(process)d]:'

2650

' %(levelname)s: %(message)s'.format(

2651

server_settings["servicename"])))

2433

syslogger.setFormatter(logging.Formatter

2434

('Mandos ({0}) [%(process)d]:'

2435

' %(levelname)s: %(message)s'

2436

.format(server_settings

2437

["servicename"])))

2652

2438

2653

2439

# Parse config file with clients

2654

2440

client_config = configparser.SafeConfigParser(Client

2659

2445

global mandos_dbus_service

2660

2446

mandos_dbus_service = None

2661

2447

2662

socketfd = None

2663

if server_settings["socket"] != "":

2664

socketfd = server_settings["socket"]

2665

tcp_server = MandosServer(

2666

(server_settings["address"], server_settings["port"]),

2667

ClientHandler,

2668

interface=(server_settings["interface"] or None),

2669

use_ipv6=use_ipv6,

2670

gnutls_priority=server_settings["priority"],

2671

use_dbus=use_dbus,

2672

socketfd=socketfd)

2448

tcp_server = MandosServer((server_settings["address"],

2449

server_settings["port"]),

2450

ClientHandler,

2451

interface=(server_settings["interface"]

2452

or None),

2453

use_ipv6=use_ipv6,

2454

gnutls_priority=

2455

server_settings["priority"],

2456

use_dbus=use_dbus,

2457

socketfd=(server_settings["socket"]

2458

or None))

2673

2459

if not foreground:

2674

2460

pidfilename = "/run/mandos.pid"

2675

2461

if not os.path.isdir("/run/."):

2676

2462

pidfilename = "/var/run/mandos.pid"

2677

2463

pidfile = None

2678

2464

try:

2679

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2465

pidfile = open(pidfilename, "w")

2680

2466

except IOError as e:

2681

2467

logger.error("Could not open file %r", pidfilename,

2682

2468

exc_info=e)

2709

2495

def debug_gnutls(level, string):

2710

2496

logger.debug("GnuTLS: %s", string[:-1])

2711

2497

2712

gnutls.library.functions.gnutls_global_set_log_function(

2713

debug_gnutls)

2498

(gnutls.library.functions

2499

.gnutls_global_set_log_function(debug_gnutls))

2714

2500

2715

2501

# Redirect stdin so all checkers get /dev/null

2716

2502

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2736

2522

if use_dbus:

2737

2523

try:

2738

2524

bus_name = dbus.service.BusName("se.recompile.Mandos",

2739

bus,

2740

do_not_queue=True)

2741

old_bus_name = dbus.service.BusName(

2742

"se.bsnet.fukt.Mandos", bus,

2743

do_not_queue=True)

2744

except dbus.exceptions.DBusException as e:

2525

bus, do_not_queue=True)

2526

old_bus_name = (dbus.service.BusName

2527

("se.bsnet.fukt.Mandos", bus,

2528

do_not_queue=True))

2529

except dbus.exceptions.NameExistsException as e:

2745

2530

logger.error("Disabling D-Bus:", exc_info=e)

2746

2531

use_dbus = False

2747

2532

server_settings["use_dbus"] = False

2748

2533

tcp_server.use_dbus = False

2749

if zeroconf:

2750

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2751

service = AvahiServiceToSyslog(

2752

name = server_settings["servicename"],

2753

servicetype = "_mandos._tcp",

2754

protocol = protocol,

2755

bus = bus)

2756

if server_settings["interface"]:

2757

service.interface = if_nametoindex(

2758

server_settings["interface"].encode("utf-8"))

2534

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2535

service = AvahiServiceToSyslog(name =

2536

server_settings["servicename"],

2537

servicetype = "_mandos._tcp",

2538

protocol = protocol, bus = bus)

2539

if server_settings["interface"]:

2540

service.interface = (if_nametoindex

2541

(str(server_settings["interface"])))

2759

2542

2760

2543

global multiprocessing_manager

2761

2544

multiprocessing_manager = multiprocessing.Manager()

2780

2563

if server_settings["restore"]:

2781

2564

try:

2782

2565

with open(stored_state_path, "rb") as stored_state:

2783

clients_data, old_client_settings = pickle.load(

2784

stored_state)

2566

clients_data, old_client_settings = (pickle.load

2567

(stored_state))

2785

2568

os.remove(stored_state_path)

2786

2569

except IOError as e:

2787

2570

if e.errno == errno.ENOENT:

2788

logger.warning("Could not load persistent state:"

2789

" {}".format(os.strerror(e.errno)))

2571

logger.warning("Could not load persistent state: {0}"

2572

.format(os.strerror(e.errno)))

2790

2573

else:

2791

2574

logger.critical("Could not load persistent state:",

2792

2575

exc_info=e)

2793

2576

raise

2794

2577

except EOFError as e:

2795

2578

logger.warning("Could not load persistent state: "

2796

"EOFError:",

2797

exc_info=e)

2579

"EOFError:", exc_info=e)

2798

2580

2799

2581

with PGPEngine() as pgp:

2800

for client_name, client in clients_data.items():

2582

for client_name, client in clients_data.iteritems():

2801

2583

# Skip removed clients

2802

2584

if client_name not in client_settings:

2803

2585

continue

2812

2594

# For each value in new config, check if it

2813

2595

# differs from the old config value (Except for

2814

2596

# the "secret" attribute)

2815

if (name != "secret"

2816

and (value !=

2817

old_client_settings[client_name][name])):

2597

if (name != "secret" and

2598

value != old_client_settings[client_name]

2599

[name]):

2818

2600

client[name] = value

2819

2601

except KeyError:

2820

2602

pass

2821

2603

2822

2604

# Clients who has passed its expire date can still be

2823

# enabled if its last checker was successful. A Client

2605

# enabled if its last checker was successful. Clients

2824

2606

# whose checker succeeded before we stored its state is

2825

2607

# assumed to have successfully run all checkers during

2826

2608

# downtime.

2828

2610

if datetime.datetime.utcnow() >= client["expires"]:

2829

2611

if not client["last_checked_ok"]:

2830

2612

logger.warning(

2831

"disabling client {} - Client never "

2832

"performed a successful checker".format(

2833

client_name))

2613

"disabling client {0} - Client never "

2614

"performed a successful checker"

2615

.format(client_name))

2834

2616

client["enabled"] = False

2835

2617

elif client["last_checker_status"] != 0:

2836

2618

logger.warning(

2837

"disabling client {} - Client last"

2838

" checker failed with error code"

2839

" {}".format(

2840

client_name,

2841

client["last_checker_status"]))

2619

"disabling client {0} - Client "

2620

"last checker failed with error code {1}"

2621

.format(client_name,

2622

client["last_checker_status"]))

2842

2623

client["enabled"] = False

2843

2624

else:

2844

client["expires"] = (

2845

datetime.datetime.utcnow()

2846

+ client["timeout"])

2625

client["expires"] = (datetime.datetime

2626

.utcnow()

2627

+ client["timeout"])

2847

2628

logger.debug("Last checker succeeded,"

2848

" keeping {} enabled".format(

2849

client_name))

2629

" keeping {0} enabled"

2630

.format(client_name))

2850

2631

try:

2851

client["secret"] = pgp.decrypt(

2852

client["encrypted_secret"],

2853

client_settings[client_name]["secret"])

2632

client["secret"] = (

2633

pgp.decrypt(client["encrypted_secret"],

2634

client_settings[client_name]

2635

["secret"]))

2854

2636

except PGPError:

2855

2637

# If decryption fails, we use secret from new settings

2856

logger.debug("Failed to decrypt {} old secret".format(

2857

client_name))

2858

client["secret"] = (client_settings[client_name]

2859

["secret"])

2638

logger.debug("Failed to decrypt {0} old secret"

2639

.format(client_name))

2640

client["secret"] = (

2641

client_settings[client_name]["secret"])

2860

2642

2861

2643

# Add/remove clients based on new changes made to config

2862

2644

for client_name in (set(old_client_settings)

2867

2649

clients_data[client_name] = client_settings[client_name]

2868

2650

2869

2651

# Create all client objects

2870

for client_name, client in clients_data.items():

2652

for client_name, client in clients_data.iteritems():

2871

2653

tcp_server.clients[client_name] = client_class(

2872

name = client_name,

2873

settings = client,

2654

name = client_name, settings = client,

2874

2655

server_settings = server_settings)

2875

2656

2876

2657

if not tcp_server.clients:

2878

2659

2879

2660

if not foreground:

2880

2661

if pidfile is not None:

2881

pid = os.getpid()

2882

2662

try:

2883

2663

with pidfile:

2884

print(pid, file=pidfile)

2664

pid = os.getpid()

2665

pidfile.write(str(pid) + "\n".encode("utf-8"))

2885

2666

except IOError:

2886

2667

logger.error("Could not write to file %r with PID %d",

2887

2668

pidfilename, pid)

2892

2673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2893

2674

2894

2675

if use_dbus:

2895

2896

@alternate_dbus_interfaces(

2897

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2898

class MandosDBusService(DBusObjectWithObjectManager):

2676

@alternate_dbus_interfaces({"se.recompile.Mandos":

2677

"se.bsnet.fukt.Mandos"})

2678

class MandosDBusService(DBusObjectWithProperties):

2899

2679

"""A D-Bus proxy object"""

2900

2901

2680

def __init__(self):

2902

2681

dbus.service.Object.__init__(self, bus, "/")

2903

2904

2682

_interface = "se.recompile.Mandos"

2905

2683

2684

@dbus_interface_annotations(_interface)

2685

def _foo(self):

2686

return { "org.freedesktop.DBus.Property"

2687

".EmitsChangedSignal":

2688

"false"}

2689

2906

2690

@dbus.service.signal(_interface, signature="o")

2907

2691

def ClientAdded(self, objpath):

2908

2692

"D-Bus signal"

2913

2697

"D-Bus signal"

2914

2698

pass

2915

2699

2916

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2917

"true"})

2918

2700

@dbus.service.signal(_interface, signature="os")

2919

2701

def ClientRemoved(self, objpath, name):

2920

2702

"D-Bus signal"

2921

2703

pass

2922

2704

2923

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2924

"true"})

2925

2705

@dbus.service.method(_interface, out_signature="ao")

2926

2706

def GetAllClients(self):

2927

2707

"D-Bus method"

2928

return dbus.Array(c.dbus_object_path for c in

2708

return dbus.Array(c.dbus_object_path

2709

for c in

2929

2710

tcp_server.clients.itervalues())

2930

2711

2931

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2932

"true"})

2933

2712

@dbus.service.method(_interface,

2934

2713

out_signature="a{oa{sv}}")

2935

2714

def GetAllClientsWithProperties(self):

2936

2715

"D-Bus method"

2937

2716

return dbus.Dictionary(

2938

{ c.dbus_object_path: c.GetAll(

2939

"se.recompile.Mandos.Client")

2940

for c in tcp_server.clients.itervalues() },

2717

((c.dbus_object_path, c.GetAll(""))

2718

for c in tcp_server.clients.itervalues()),

2941

2719

signature="oa{sv}")

2942

2720

2943

2721

@dbus.service.method(_interface, in_signature="o")

2947

2725

if c.dbus_object_path == object_path:

2948

2726

del tcp_server.clients[c.name]

2949

2727

c.remove_from_connection()

2950

# Don't signal the disabling

2728

# Don't signal anything except ClientRemoved

2951

2729

c.disable(quiet=True)

2952

# Emit D-Bus signal for removal

2953

self.client_removed_signal(c)

2730

# Emit D-Bus signal

2731

self.ClientRemoved(object_path, c.name)

2954

2732

return

2955

2733

raise KeyError(object_path)

2956

2734

2957

2735

del _interface

2958

2959

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2960

out_signature = "a{oa{sa{sv}}}")

2961

def GetManagedObjects(self):

2962

"""D-Bus method"""

2963

return dbus.Dictionary(

2964

{ client.dbus_object_path:

2965

dbus.Dictionary(

2966

{ interface: client.GetAll(interface)

2967

for interface in

2968

client._get_all_interface_names()})

2969

for client in tcp_server.clients.values()})

2970

2971

def client_added_signal(self, client):

2972

"""Send the new standard signal and the old signal"""

2973

if use_dbus:

2974

# New standard signal

2975

self.InterfacesAdded(

2976

client.dbus_object_path,

2977

dbus.Dictionary(

2978

{ interface: client.GetAll(interface)

2979

for interface in

2980

client._get_all_interface_names()}))

2981

# Old signal

2982

self.ClientAdded(client.dbus_object_path)

2983

2984

def client_removed_signal(self, client):

2985

"""Send the new standard signal and the old signal"""

2986

if use_dbus:

2987

# New standard signal

2988

self.InterfacesRemoved(

2989

client.dbus_object_path,

2990

client._get_all_interface_names())

2991

# Old signal

2992

self.ClientRemoved(client.dbus_object_path,

2993

client.name)

2994

2736

2995

2737

mandos_dbus_service = MandosDBusService()

2996

2738

2997

2739

def cleanup():

2998

2740

"Cleanup function; run on exit"

2999

if zeroconf:

3000

service.cleanup()

2741

service.cleanup()

3001

2742

3002

2743

multiprocessing.active_children()

3003

2744

wnull.close()

3017

2758

3018

2759

# A list of attributes that can not be pickled

3019

2760

# + secret.

3020

exclude = { "bus", "changedstate", "secret",

3021

"checker", "server_settings" }

3022

for name, typ in inspect.getmembers(dbus.service

3023

.Object):

2761

exclude = set(("bus", "changedstate", "secret",

2762

"checker", "server_settings"))

2763

for name, typ in (inspect.getmembers

2764

(dbus.service.Object)):

3024

2765

exclude.add(name)

3025

2766

3026

2767

client_dict["encrypted_secret"] = (client

3033

2774

del client_settings[client.name]["secret"]

3034

2775

3035

2776

try:

3036

with tempfile.NamedTemporaryFile(

3037

mode='wb',

3038

suffix=".pickle",

3039

prefix='clients-',

3040

dir=os.path.dirname(stored_state_path),

3041

delete=False) as stored_state:

2777

with (tempfile.NamedTemporaryFile

2778

(mode='wb', suffix=".pickle", prefix='clients-',

2779

dir=os.path.dirname(stored_state_path),

2780

delete=False)) as stored_state:

3042

2781

pickle.dump((clients, client_settings), stored_state)

3043

tempname = stored_state.name

2782

tempname=stored_state.name

3044

2783

os.rename(tempname, stored_state_path)

3045

2784

except (IOError, OSError) as e:

3046

2785

if not debug:

3049

2788

except NameError:

3050

2789

pass

3051

2790

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3052

logger.warning("Could not save persistent state: {}"

2791

logger.warning("Could not save persistent state: {0}"

3053

2792

.format(os.strerror(e.errno)))

3054

2793

else:

3055

2794

logger.warning("Could not save persistent state:",

3061

2800

name, client = tcp_server.clients.popitem()

3062

2801

if use_dbus:

3063

2802

client.remove_from_connection()

3064

# Don't signal the disabling

2803

# Don't signal anything except ClientRemoved

3065

2804

client.disable(quiet=True)

3066

# Emit D-Bus signal for removal

3067

mandos_dbus_service.client_removed_signal(client)

2805

if use_dbus:

2806

# Emit D-Bus signal

2807

mandos_dbus_service.ClientRemoved(client

2808

.dbus_object_path,

2809

client.name)

3068

2810

client_settings.clear()

3069

2811

3070

2812

atexit.register(cleanup)

3071

2813

3072

2814

for client in tcp_server.clients.itervalues():

3073

2815

if use_dbus:

3074

# Emit D-Bus signal for adding

3075

mandos_dbus_service.client_added_signal(client)

2816

# Emit D-Bus signal

2817

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3076

2818

# Need to initiate checking of clients

3077

2819

if client.enabled:

3078

2820

client.init_checker()

3081

2823

tcp_server.server_activate()

3082

2824

3083

2825

# Find out what port we got

3084

if zeroconf:

3085

service.port = tcp_server.socket.getsockname()[1]

2826

service.port = tcp_server.socket.getsockname()[1]

3086

2827

if use_ipv6:

3087

2828

logger.info("Now listening on address %r, port %d,"

3088

2829

" flowinfo %d, scope_id %d",

3094

2835

#service.interface = tcp_server.socket.getsockname()[3]

3095

2836

3096

2837

try:

3097

if zeroconf:

3098

# From the Avahi example code

3099

try:

3100

service.activate()

3101

except dbus.exceptions.DBusException as error:

3102

logger.critical("D-Bus Exception", exc_info=error)

3103

cleanup()

3104

sys.exit(1)

3105

# End of Avahi example code

2838

# From the Avahi example code

2839

try:

2840

service.activate()

2841

except dbus.exceptions.DBusException as error:

2842

logger.critical("D-Bus Exception", exc_info=error)

2843

cleanup()

2844

sys.exit(1)

2845

# End of Avahi example code

3106

2846

3107

2847

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3108

2848

lambda *args, **kwargs:

3123

2863

# Must run before the D-Bus bus name gets deregistered

3124

2864

cleanup()

3125

2865

3126

3127

2866

if __name__ == '__main__':

3128

2867

main()