To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.269
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.269
- Committer: Teddy Hogeborn
- Date: 2014-07-24 01:35:55 UTC
- mto: (237.7.272 trunk)
- mto: This revision was merged to the branch mainline in revision 321.
- Revision ID: teddy@recompile.se-20140724013555-zrgds2ft5cmwhugb
Fix two mutually cancelling bugs.
* mandos (rfc3339_duration_to_delta): Set "token_duration" to be a
token (and not a tuple) by
removing the final comma.
Construct the needed tuple later
when initializing the
"followers" variable.
* mandos-ctl (rfc3339_duration_to_delta): - '' -
* mandos (rfc3339_duration_to_delta): Set "token_duration" to be a
token (and not a tuple) by
removing the final comma.
Construct the needed tuple later
when initializing the
"followers" variable.
* mandos-ctl (rfc3339_duration_to_delta): - '' -
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
try:
43
import SocketServer as socketserver
44
except ImportError:
45
import socketserver
39
import SocketServer as socketserver
46
40
import socket
47
41
import argparse
48
42
import datetime
49
43
import errno
50
try:
51
import ConfigParser as configparser
52
except ImportError:
53
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
54
51
import sys
55
52
import re
56
53
import os
65
62
import struct
66
63
import fcntl
67
64
import functools
68
try:
69
import cPickle as pickle
70
except ImportError:
71
import pickle
65
import cPickle as pickle
72
66
import multiprocessing
73
67
import types
74
68
import binascii
75
69
import tempfile
76
70
import itertools
77
71
import collections
78
import codecs
79
72
80
73
import dbus
81
74
import dbus.service
82
from gi.repository import GLib
75
import gobject
76
import avahi
83
77
from dbus.mainloop.glib import DBusGMainLoop
84
78
import ctypes
85
79
import ctypes.util
86
80
import xml.dom.minidom
87
81
import inspect
88
82
89
# Try to find the value of SO_BINDTODEVICE:
90
83
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
85
except AttributeError:
95
86
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
98
87
from IN import SO_BINDTODEVICE
99
88
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
113
114
if sys.version_info.major == 2:
115
str = unicode
116
117
version = "1.7.8"
89
SO_BINDTODEVICE = None
90
91
version = "1.6.7"
118
92
stored_state_file = "clients.pickle"
119
93
120
94
logger = logging.getLogger()
121
95
syslogger = None
122
96
123
97
try:
124
if_nametoindex = ctypes.cdll.LoadLibrary(
125
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
126
101
except (OSError, AttributeError):
127
128
102
def if_nametoindex(interface):
129
103
"Get an interface index the hard way, i.e. using fcntl()"
130
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
131
105
with contextlib.closing(socket.socket()) as s:
132
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
133
struct.pack(b"16s16x", interface))
134
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
135
111
return interface_index
136
112
137
113
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
154
114
def initlogger(debug, level=logging.WARNING):
155
115
"""init logger and add loglevel"""
156
116
157
117
global syslogger
158
syslogger = (logging.handlers.SysLogHandler(
159
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
160
address = "/dev/log"))
118
syslogger = (logging.handlers.SysLogHandler
119
(facility =
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
161
122
syslogger.setFormatter(logging.Formatter
162
123
('Mandos [%(process)d]: %(levelname)s:'
163
124
' %(message)s'))
180
141
181
142
class PGPEngine(object):
182
143
"""A simple class for OpenPGP symmetric encryption & decryption"""
183
184
144
def __init__(self):
185
145
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
self.gpg = "gpg"
187
try:
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
191
if name == "gpg":
192
self.gpg = path
193
break
194
except OSError as e:
195
if e.errno != errno.ENOENT:
196
raise
197
146
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
147
'--home', self.tempdir,
199
148
'--force-mdc',
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
149
'--quiet',
150
'--no-use-agent']
204
151
205
152
def __enter__(self):
206
153
return self
238
185
239
186
def encrypt(self, data, password):
240
187
passphrase = self.password_encode(password)
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
189
) as passfile:
243
190
passfile.write(passphrase)
244
191
passfile.flush()
245
proc = subprocess.Popen([self.gpg, '--symmetric',
192
proc = subprocess.Popen(['gpg', '--symmetric',
246
193
'--passphrase-file',
247
194
passfile.name]
248
195
+ self.gnupgargs,
256
203
257
204
def decrypt(self, data, password):
258
205
passphrase = self.password_encode(password)
259
with tempfile.NamedTemporaryFile(
260
dir = self.tempdir) as passfile:
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
207
) as passfile:
261
208
passfile.write(passphrase)
262
209
passfile.flush()
263
proc = subprocess.Popen([self.gpg, '--decrypt',
210
proc = subprocess.Popen(['gpg', '--decrypt',
264
211
'--passphrase-file',
265
212
passfile.name]
266
213
+ self.gnupgargs,
267
214
stdin = subprocess.PIPE,
268
215
stdout = subprocess.PIPE,
269
216
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
217
decrypted_plaintext, err = proc.communicate(input
218
= data)
271
219
if proc.returncode != 0:
272
220
raise PGPError(err)
273
221
return decrypted_plaintext
274
222
275
# Pretend that we have an Avahi module
276
class Avahi(object):
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
283
DBUS_NAME = "org.freedesktop.Avahi"
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
286
DBUS_PATH_SERVER = "/"
287
def string_array_to_txt_array(self, t):
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
289
for s in t), signature="ay")
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
298
avahi = Avahi()
299
223
300
224
class AvahiError(Exception):
301
225
def __init__(self, value, *args, **kwargs):
302
226
self.value = value
303
return super(AvahiError, self).__init__(value, *args,
304
**kwargs)
305
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
306
230
307
231
class AvahiServiceError(AvahiError):
308
232
pass
309
233
310
311
234
class AvahiGroupError(AvahiError):
312
235
pass
313
236
333
256
bus: dbus.SystemBus()
334
257
"""
335
258
336
def __init__(self,
337
interface = avahi.IF_UNSPEC,
338
name = None,
339
servicetype = None,
340
port = None,
341
TXT = None,
342
domain = "",
343
host = "",
344
max_renames = 32768,
345
protocol = avahi.PROTO_UNSPEC,
346
bus = None):
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
347
263
self.interface = interface
348
264
self.name = name
349
265
self.type = servicetype
359
275
self.bus = bus
360
276
self.entry_group_state_changed_match = None
361
277
362
def rename(self, remove=True):
278
def rename(self):
363
279
"""Derived from the Avahi example code"""
364
280
if self.rename_count >= self.max_renames:
365
281
logger.critical("No suitable Zeroconf service name found"
366
282
" after %i retries, exiting.",
367
283
self.rename_count)
368
284
raise AvahiServiceError("Too many renames")
369
self.name = str(
370
self.server.GetAlternativeServiceName(self.name))
371
self.rename_count += 1
285
self.name = unicode(self.server
286
.GetAlternativeServiceName(self.name))
372
287
logger.info("Changing Zeroconf service name to %r ...",
373
288
self.name)
374
if remove:
375
self.remove()
289
self.remove()
376
290
try:
377
291
self.add()
378
292
except dbus.exceptions.DBusException as error:
379
if (error.get_dbus_name()
380
== "org.freedesktop.Avahi.CollisionError"):
381
logger.info("Local Zeroconf service name collision.")
382
return self.rename(remove=False)
383
else:
384
logger.critical("D-Bus Exception", exc_info=error)
385
self.cleanup()
386
os._exit(1)
293
logger.critical("D-Bus Exception", exc_info=error)
294
self.cleanup()
295
os._exit(1)
296
self.rename_count += 1
387
297
388
298
def remove(self):
389
299
"""Derived from the Avahi example code"""
427
337
self.rename()
428
338
elif state == avahi.ENTRY_GROUP_FAILURE:
429
339
logger.critical("Avahi: Error in group state changed %s",
430
str(error))
431
raise AvahiGroupError("State changed: {!s}".format(error))
340
unicode(error))
341
raise AvahiGroupError("State changed: {0!s}"
342
.format(error))
432
343
433
344
def cleanup(self):
434
345
"""Derived from the Avahi example code"""
444
355
def server_state_changed(self, state, error=None):
445
356
"""Derived from the Avahi example code"""
446
357
logger.debug("Avahi server state change: %i", state)
447
bad_states = {
448
avahi.SERVER_INVALID: "Zeroconf server invalid",
449
avahi.SERVER_REGISTERING: None,
450
avahi.SERVER_COLLISION: "Zeroconf server name collision",
451
avahi.SERVER_FAILURE: "Zeroconf server failure",
452
}
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
453
365
if state in bad_states:
454
366
if bad_states[state] is not None:
455
367
if error is None:
458
370
logger.error(bad_states[state] + ": %r", error)
459
371
self.cleanup()
460
372
elif state == avahi.SERVER_RUNNING:
461
try:
462
self.add()
463
except dbus.exceptions.DBusException as error:
464
if (error.get_dbus_name()
465
== "org.freedesktop.Avahi.CollisionError"):
466
logger.info("Local Zeroconf service name"
467
" collision.")
468
return self.rename(remove=False)
469
else:
470
logger.critical("D-Bus Exception", exc_info=error)
471
self.cleanup()
472
os._exit(1)
373
self.add()
473
374
else:
474
375
if error is None:
475
376
logger.debug("Unknown state: %r", state)
485
386
follow_name_owner_changes=True),
486
387
avahi.DBUS_INTERFACE_SERVER)
487
388
self.server.connect_to_signal("StateChanged",
488
self.server_state_changed)
389
self.server_state_changed)
489
390
self.server_state_changed(self.server.GetState())
490
391
491
392
492
393
class AvahiServiceToSyslog(AvahiService):
493
def rename(self, *args, **kwargs):
394
def rename(self):
494
395
"""Add the new name to the syslog messages"""
495
ret = AvahiService.rename(self, *args, **kwargs)
496
syslogger.setFormatter(logging.Formatter(
497
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
498
.format(self.name)))
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({0}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
499
401
return ret
500
402
501
# Pretend that we have a GnuTLS module
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
505
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
509
def __init__(self):
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
512
# happens.
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
516
517
# Unless otherwise indicated, the constants and types below are
518
# all from the gnutls/gnutls.h C header file.
519
520
# Constants
521
E_SUCCESS = 0
522
E_INTERRUPTED = -52
523
E_AGAIN = -28
524
CRT_OPENPGP = 2
525
CLIENT = 2
526
SHUT_RDWR = 0
527
CRD_CERTIFICATE = 1
528
E_NO_CERTIFICATE_FOUND = -49
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
530
531
# Types
532
class session_int(ctypes.Structure):
533
_fields_ = []
534
session_t = ctypes.POINTER(session_int)
535
class certificate_credentials_st(ctypes.Structure):
536
_fields_ = []
537
certificate_credentials_t = ctypes.POINTER(
538
certificate_credentials_st)
539
certificate_type_t = ctypes.c_int
540
class datum_t(ctypes.Structure):
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
('size', ctypes.c_uint)]
543
class openpgp_crt_int(ctypes.Structure):
544
_fields_ = []
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
548
credentials_type_t = ctypes.c_int
549
transport_ptr_t = ctypes.c_void_p
550
close_request_t = ctypes.c_int
551
552
# Exceptions
553
class Error(Exception):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
559
# Default usage is by a message string, but if a return
560
# code is passed, convert it to a string with
561
# gnutls.strerror()
562
self.code = code
563
if message is None and code is not None:
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
566
message, *args)
567
568
class CertificateSecurityError(Error):
569
pass
570
571
# Classes
572
class Credentials(object):
573
def __init__(self):
574
self._c_object = gnutls.certificate_credentials_t()
575
gnutls.certificate_allocate_credentials(
576
ctypes.byref(self._c_object))
577
self.type = gnutls.CRD_CERTIFICATE
578
579
def __del__(self):
580
gnutls.certificate_free_credentials(self._c_object)
581
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
584
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
586
gnutls.set_default_priority(self._c_object)
587
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
gnutls.handshake_set_private_extensions(self._c_object,
589
True)
590
self.socket = socket
591
if credentials is None:
592
credentials = gnutls.Credentials()
593
gnutls.credentials_set(self._c_object, credentials.type,
594
ctypes.cast(credentials._c_object,
595
ctypes.c_void_p))
596
self.credentials = credentials
597
598
def __del__(self):
599
gnutls.deinit(self._c_object)
600
601
def handshake(self):
602
return gnutls.handshake(self._c_object)
603
604
def send(self, data):
605
data = bytes(data)
606
data_len = len(data)
607
while data_len > 0:
608
data_len -= gnutls.record_send(self._c_object,
609
data[-data_len:],
610
data_len)
611
612
def bye(self):
613
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
614
615
# Error handling functions
616
def _error_code(result):
617
"""A function to raise exceptions on errors, suitable
618
for the 'restype' attribute on ctypes functions"""
619
if result >= 0:
620
return result
621
if result == gnutls.E_NO_CERTIFICATE_FOUND:
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
624
625
def _retry_on_error(result, func, arguments):
626
"""A function to retry on some errors, suitable
627
for the 'errcheck' attribute on ctypes functions"""
628
while result < 0:
629
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
630
return _error_code(result)
631
result = func(*arguments)
632
return result
633
634
# Unless otherwise indicated, the function declarations below are
635
# all from the gnutls/gnutls.h C header file.
636
637
# Functions
638
priority_set_direct = _library.gnutls_priority_set_direct
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
640
ctypes.POINTER(ctypes.c_char_p)]
641
priority_set_direct.restype = _error_code
642
643
init = _library.gnutls_init
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
645
init.restype = _error_code
646
647
set_default_priority = _library.gnutls_set_default_priority
648
set_default_priority.argtypes = [session_t]
649
set_default_priority.restype = _error_code
650
651
record_send = _library.gnutls_record_send
652
record_send.argtypes = [session_t, ctypes.c_void_p,
653
ctypes.c_size_t]
654
record_send.restype = ctypes.c_ssize_t
655
record_send.errcheck = _retry_on_error
656
657
certificate_allocate_credentials = (
658
_library.gnutls_certificate_allocate_credentials)
659
certificate_allocate_credentials.argtypes = [
660
ctypes.POINTER(certificate_credentials_t)]
661
certificate_allocate_credentials.restype = _error_code
662
663
certificate_free_credentials = (
664
_library.gnutls_certificate_free_credentials)
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
666
certificate_free_credentials.restype = None
667
668
handshake_set_private_extensions = (
669
_library.gnutls_handshake_set_private_extensions)
670
handshake_set_private_extensions.argtypes = [session_t,
671
ctypes.c_int]
672
handshake_set_private_extensions.restype = None
673
674
credentials_set = _library.gnutls_credentials_set
675
credentials_set.argtypes = [session_t, credentials_type_t,
676
ctypes.c_void_p]
677
credentials_set.restype = _error_code
678
679
strerror = _library.gnutls_strerror
680
strerror.argtypes = [ctypes.c_int]
681
strerror.restype = ctypes.c_char_p
682
683
certificate_type_get = _library.gnutls_certificate_type_get
684
certificate_type_get.argtypes = [session_t]
685
certificate_type_get.restype = _error_code
686
687
certificate_get_peers = _library.gnutls_certificate_get_peers
688
certificate_get_peers.argtypes = [session_t,
689
ctypes.POINTER(ctypes.c_uint)]
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
691
692
global_set_log_level = _library.gnutls_global_set_log_level
693
global_set_log_level.argtypes = [ctypes.c_int]
694
global_set_log_level.restype = None
695
696
global_set_log_function = _library.gnutls_global_set_log_function
697
global_set_log_function.argtypes = [log_func]
698
global_set_log_function.restype = None
699
700
deinit = _library.gnutls_deinit
701
deinit.argtypes = [session_t]
702
deinit.restype = None
703
704
handshake = _library.gnutls_handshake
705
handshake.argtypes = [session_t]
706
handshake.restype = _error_code
707
handshake.errcheck = _retry_on_error
708
709
transport_set_ptr = _library.gnutls_transport_set_ptr
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
711
transport_set_ptr.restype = None
712
713
bye = _library.gnutls_bye
714
bye.argtypes = [session_t, close_request_t]
715
bye.restype = _error_code
716
bye.errcheck = _retry_on_error
717
718
check_version = _library.gnutls_check_version
719
check_version.argtypes = [ctypes.c_char_p]
720
check_version.restype = ctypes.c_char_p
721
722
# All the function declarations below are from gnutls/openpgp.h
723
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
727
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
731
openpgp_crt_fmt_t]
732
openpgp_crt_import.restype = _error_code
733
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
738
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
742
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
746
ctypes.c_void_p,
747
ctypes.POINTER(
748
ctypes.c_size_t)]
749
openpgp_crt_get_fingerprint.restype = _error_code
750
751
# Remove non-public functions
752
del _error_code, _retry_on_error
753
# Create the global "gnutls" object, simulating a module
754
gnutls = GnuTLS()
755
756
def call_pipe(connection, # : multiprocessing.Connection
757
func, *args, **kwargs):
758
"""This function is meant to be called by multiprocessing.Process
759
760
This function runs func(*args, **kwargs), and writes the resulting
761
return value on the provided multiprocessing.Connection.
762
"""
763
connection.send(func(*args, **kwargs))
764
connection.close()
403
404
def timedelta_to_milliseconds(td):
405
"Convert a datetime.timedelta() to milliseconds"
406
return ((td.days * 24 * 60 * 60 * 1000)
407
+ (td.seconds * 1000)
408
+ (td.microseconds // 1000))
409
765
410
766
411
class Client(object):
767
412
"""A representation of a client host served by this server.
773
418
checker: subprocess.Popen(); a running checker process used
774
419
to see if the client lives.
775
420
'None' if no process is running.
776
checker_callback_tag: a GLib event source tag, or None
421
checker_callback_tag: a gobject event source tag, or None
777
422
checker_command: string; External command which is run to check
778
423
if client lives. %() expansions are done at
779
424
runtime with vars(self) as dict, so that for
780
425
instance %(name)s can be used in the command.
781
checker_initiator_tag: a GLib event source tag, or None
426
checker_initiator_tag: a gobject event source tag, or None
782
427
created: datetime.datetime(); (UTC) object creation
783
428
client_structure: Object describing what attributes a client has
784
429
and is used for storing the client at exit
785
430
current_checker_command: string; current running checker_command
786
disable_initiator_tag: a GLib event source tag, or None
431
disable_initiator_tag: a gobject event source tag, or None
787
432
enabled: bool()
788
433
fingerprint: string (40 or 32 hexadecimal digits); used to
789
434
uniquely identify the client
794
439
last_checker_status: integer between 0 and 255 reflecting exit
795
440
status of last checker. -1 reflects crashed
796
441
checker, -2 means no checker completed yet.
797
last_checker_signal: The signal which killed the last checker, if
798
last_checker_status is -1
799
442
last_enabled: datetime.datetime(); (UTC) or None
800
443
name: string; from the config file, used in log messages and
801
444
D-Bus identifiers
814
457
"fingerprint", "host", "interval",
815
458
"last_approval_request", "last_checked_ok",
816
459
"last_enabled", "name", "timeout")
817
client_defaults = {
818
"timeout": "PT5M",
819
"extended_timeout": "PT15M",
820
"interval": "PT2M",
821
"checker": "fping -q -- %%(host)s",
822
"host": "",
823
"approval_delay": "PT0S",
824
"approval_duration": "PT1S",
825
"approved_by_default": "True",
826
"enabled": "True",
827
}
460
client_defaults = { "timeout": "PT5M",
461
"extended_timeout": "PT15M",
462
"interval": "PT2M",
463
"checker": "fping -q -- %%(host)s",
464
"host": "",
465
"approval_delay": "PT0S",
466
"approval_duration": "PT1S",
467
"approved_by_default": "True",
468
"enabled": "True",
469
}
470
471
def timeout_milliseconds(self):
472
"Return the 'timeout' attribute in milliseconds"
473
return timedelta_to_milliseconds(self.timeout)
474
475
def extended_timeout_milliseconds(self):
476
"Return the 'extended_timeout' attribute in milliseconds"
477
return timedelta_to_milliseconds(self.extended_timeout)
478
479
def interval_milliseconds(self):
480
"Return the 'interval' attribute in milliseconds"
481
return timedelta_to_milliseconds(self.interval)
482
483
def approval_delay_milliseconds(self):
484
return timedelta_to_milliseconds(self.approval_delay)
828
485
829
486
@staticmethod
830
487
def config_parser(config):
846
503
client["enabled"] = config.getboolean(client_name,
847
504
"enabled")
848
505
849
# Uppercase and remove spaces from fingerprint for later
850
# comparison purposes with return value from the
851
# fingerprint() function
852
506
client["fingerprint"] = (section["fingerprint"].upper()
853
507
.replace(" ", ""))
854
508
if "secret" in section:
855
client["secret"] = codecs.decode(section["secret"]
856
.encode("utf-8"),
857
"base64")
509
client["secret"] = section["secret"].decode("base64")
858
510
elif "secfile" in section:
859
511
with open(os.path.expanduser(os.path.expandvars
860
512
(section["secfile"])),
861
513
"rb") as secfile:
862
514
client["secret"] = secfile.read()
863
515
else:
864
raise TypeError("No secret or secfile for section {}"
516
raise TypeError("No secret or secfile for section {0}"
865
517
.format(section))
866
518
client["timeout"] = string_to_delta(section["timeout"])
867
519
client["extended_timeout"] = string_to_delta(
884
536
server_settings = {}
885
537
self.server_settings = server_settings
886
538
# adding all client settings
887
for setting, value in settings.items():
539
for setting, value in settings.iteritems():
888
540
setattr(self, setting, value)
889
541
890
542
if self.enabled:
898
550
self.expires = None
899
551
900
552
logger.debug("Creating client %r", self.name)
553
# Uppercase and remove spaces from fingerprint for later
554
# comparison purposes with return value from the fingerprint()
555
# function
901
556
logger.debug(" Fingerprint: %s", self.fingerprint)
902
557
self.created = settings.get("created",
903
558
datetime.datetime.utcnow())
910
565
self.current_checker_command = None
911
566
self.approved = None
912
567
self.approvals_pending = 0
913
self.changedstate = multiprocessing_manager.Condition(
914
multiprocessing_manager.Lock())
915
self.client_structure = [attr
916
for attr in self.__dict__.keys()
568
self.changedstate = (multiprocessing_manager
569
.Condition(multiprocessing_manager
570
.Lock()))
571
self.client_structure = [attr for attr in
572
self.__dict__.iterkeys()
917
573
if not attr.startswith("_")]
918
574
self.client_structure.append("client_structure")
919
575
920
for name, t in inspect.getmembers(
921
type(self), lambda obj: isinstance(obj, property)):
576
for name, t in inspect.getmembers(type(self),
577
lambda obj:
578
isinstance(obj,
579
property)):
922
580
if not name.startswith("_"):
923
581
self.client_structure.append(name)
924
582
945
603
if not quiet:
946
604
logger.info("Disabling client %s", self.name)
947
605
if getattr(self, "disable_initiator_tag", None) is not None:
948
GLib.source_remove(self.disable_initiator_tag)
606
gobject.source_remove(self.disable_initiator_tag)
949
607
self.disable_initiator_tag = None
950
608
self.expires = None
951
609
if getattr(self, "checker_initiator_tag", None) is not None:
952
GLib.source_remove(self.checker_initiator_tag)
610
gobject.source_remove(self.checker_initiator_tag)
953
611
self.checker_initiator_tag = None
954
612
self.stop_checker()
955
613
self.enabled = False
956
614
if not quiet:
957
615
self.send_changedstate()
958
# Do not run this again if called by a GLib.timeout_add
616
# Do not run this again if called by a gobject.timeout_add
959
617
return False
960
618
961
619
def __del__(self):
965
623
# Schedule a new checker to be started an 'interval' from now,
966
624
# and every interval from then on.
967
625
if self.checker_initiator_tag is not None:
968
GLib.source_remove(self.checker_initiator_tag)
969
self.checker_initiator_tag = GLib.timeout_add(
970
int(self.interval.total_seconds() * 1000),
971
self.start_checker)
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = (gobject.timeout_add
628
(self.interval_milliseconds(),
629
self.start_checker))
972
630
# Schedule a disable() when 'timeout' has passed
973
631
if self.disable_initiator_tag is not None:
974
GLib.source_remove(self.disable_initiator_tag)
975
self.disable_initiator_tag = GLib.timeout_add(
976
int(self.timeout.total_seconds() * 1000), self.disable)
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = (gobject.timeout_add
634
(self.timeout_milliseconds(),
635
self.disable))
977
636
# Also start a new checker *right now*.
978
637
self.start_checker()
979
638
980
def checker_callback(self, source, condition, connection,
981
command):
639
def checker_callback(self, pid, condition, command):
982
640
"""The checker has completed, so take appropriate actions."""
983
641
self.checker_callback_tag = None
984
642
self.checker = None
985
# Read return code from connection (see call_pipe)
986
returncode = connection.recv()
987
connection.close()
988
989
if returncode >= 0:
990
self.last_checker_status = returncode
991
self.last_checker_signal = None
643
if os.WIFEXITED(condition):
644
self.last_checker_status = os.WEXITSTATUS(condition)
992
645
if self.last_checker_status == 0:
993
646
logger.info("Checker for %(name)s succeeded",
994
647
vars(self))
995
648
self.checked_ok()
996
649
else:
997
logger.info("Checker for %(name)s failed", vars(self))
650
logger.info("Checker for %(name)s failed",
651
vars(self))
998
652
else:
999
653
self.last_checker_status = -1
1000
self.last_checker_signal = -returncode
1001
654
logger.warning("Checker for %(name)s crashed?",
1002
655
vars(self))
1003
return False
1004
656
1005
657
def checked_ok(self):
1006
658
"""Assert that the client has been seen, alive and well."""
1007
659
self.last_checked_ok = datetime.datetime.utcnow()
1008
660
self.last_checker_status = 0
1009
self.last_checker_signal = None
1010
661
self.bump_timeout()
1011
662
1012
663
def bump_timeout(self, timeout=None):
1014
665
if timeout is None:
1015
666
timeout = self.timeout
1016
667
if self.disable_initiator_tag is not None:
1017
GLib.source_remove(self.disable_initiator_tag)
668
gobject.source_remove(self.disable_initiator_tag)
1018
669
self.disable_initiator_tag = None
1019
670
if getattr(self, "enabled", False):
1020
self.disable_initiator_tag = GLib.timeout_add(
1021
int(timeout.total_seconds() * 1000), self.disable)
671
self.disable_initiator_tag = (gobject.timeout_add
672
(timedelta_to_milliseconds
673
(timeout), self.disable))
1022
674
self.expires = datetime.datetime.utcnow() + timeout
1023
675
1024
676
def need_approval(self):
1038
690
# than 'timeout' for the client to be disabled, which is as it
1039
691
# should be.
1040
692
1041
if self.checker is not None and not self.checker.is_alive():
1042
logger.warning("Checker was not alive; joining")
1043
self.checker.join()
1044
self.checker = None
693
# If a checker exists, make sure it is not a zombie
694
try:
695
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
696
except AttributeError:
697
pass
698
except OSError as error:
699
if error.errno != errno.ECHILD:
700
raise
701
else:
702
if pid:
703
logger.warning("Checker was a zombie")
704
gobject.source_remove(self.checker_callback_tag)
705
self.checker_callback(pid, status,
706
self.current_checker_command)
1045
707
# Start a new checker if needed
1046
708
if self.checker is None:
1047
709
# Escape attributes for the shell
1048
escaped_attrs = {
1049
attr: re.escape(str(getattr(self, attr)))
1050
for attr in self.runtime_expansions }
710
escaped_attrs = dict(
711
(attr, re.escape(unicode(getattr(self, attr))))
712
for attr in
713
self.runtime_expansions)
1051
714
try:
1052
715
command = self.checker_command % escaped_attrs
1053
716
except TypeError as error:
1054
717
logger.error('Could not format string "%s"',
1055
self.checker_command,
718
self.checker_command, exc_info=error)
719
return True # Try again later
720
self.current_checker_command = command
721
try:
722
logger.info("Starting checker %r for %s",
723
command, self.name)
724
# We don't need to redirect stdout and stderr, since
725
# in normal mode, that is already done by daemon(),
726
# and in debug mode we don't want to. (Stdin is
727
# always replaced by /dev/null.)
728
# The exception is when not debugging but nevertheless
729
# running in the foreground; use the previously
730
# created wnull.
731
popen_args = {}
732
if (not self.server_settings["debug"]
733
and self.server_settings["foreground"]):
734
popen_args.update({"stdout": wnull,
735
"stderr": wnull })
736
self.checker = subprocess.Popen(command,
737
close_fds=True,
738
shell=True, cwd="/",
739
**popen_args)
740
except OSError as error:
741
logger.error("Failed to start subprocess",
1056
742
exc_info=error)
1057
return True # Try again later
1058
self.current_checker_command = command
1059
logger.info("Starting checker %r for %s", command,
1060
self.name)
1061
# We don't need to redirect stdout and stderr, since
1062
# in normal mode, that is already done by daemon(),
1063
# and in debug mode we don't want to. (Stdin is
1064
# always replaced by /dev/null.)
1065
# The exception is when not debugging but nevertheless
1066
# running in the foreground; use the previously
1067
# created wnull.
1068
popen_args = { "close_fds": True,
1069
"shell": True,
1070
"cwd": "/" }
1071
if (not self.server_settings["debug"]
1072
and self.server_settings["foreground"]):
1073
popen_args.update({"stdout": wnull,
1074
"stderr": wnull })
1075
pipe = multiprocessing.Pipe(duplex = False)
1076
self.checker = multiprocessing.Process(
1077
target = call_pipe,
1078
args = (pipe[1], subprocess.call, command),
1079
kwargs = popen_args)
1080
self.checker.start()
1081
self.checker_callback_tag = GLib.io_add_watch(
1082
pipe[0].fileno(), GLib.IO_IN,
1083
self.checker_callback, pipe[0], command)
1084
# Re-run this periodically if run by GLib.timeout_add
743
return True
744
self.checker_callback_tag = (gobject.child_watch_add
745
(self.checker.pid,
746
self.checker_callback,
747
data=command))
748
# The checker may have completed before the gobject
749
# watch was added. Check for this.
750
try:
751
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
752
except OSError as error:
753
if error.errno == errno.ECHILD:
754
# This should never happen
755
logger.error("Child process vanished",
756
exc_info=error)
757
return True
758
raise
759
if pid:
760
gobject.source_remove(self.checker_callback_tag)
761
self.checker_callback(pid, status, command)
762
# Re-run this periodically if run by gobject.timeout_add
1085
763
return True
1086
764
1087
765
def stop_checker(self):
1088
766
"""Force the checker process, if any, to stop."""
1089
767
if self.checker_callback_tag:
1090
GLib.source_remove(self.checker_callback_tag)
768
gobject.source_remove(self.checker_callback_tag)
1091
769
self.checker_callback_tag = None
1092
770
if getattr(self, "checker", None) is None:
1093
771
return
1094
772
logger.debug("Stopping checker for %(name)s", vars(self))
1095
self.checker.terminate()
773
try:
774
self.checker.terminate()
775
#time.sleep(0.5)
776
#if self.checker.poll() is None:
777
# self.checker.kill()
778
except OSError as error:
779
if error.errno != errno.ESRCH: # No such process
780
raise
1096
781
self.checker = None
1097
782
1098
783
1099
def dbus_service_property(dbus_interface,
1100
signature="v",
1101
access="readwrite",
1102
byte_arrays=False):
784
def dbus_service_property(dbus_interface, signature="v",
785
access="readwrite", byte_arrays=False):
1103
786
"""Decorators for marking methods of a DBusObjectWithProperties to
1104
787
become properties on the D-Bus.
1105
788
1114
797
# "Set" method, so we fail early here:
1115
798
if byte_arrays and signature != "ay":
1116
799
raise ValueError("Byte arrays not supported for non-'ay'"
1117
" signature {!r}".format(signature))
1118
800
" signature {0!r}".format(signature))
1119
801
def decorator(func):
1120
802
func._dbus_is_property = True
1121
803
func._dbus_interface = dbus_interface
1126
808
func._dbus_name = func._dbus_name[:-14]
1127
809
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1128
810
return func
1129
1130
811
return decorator
1131
812
1132
813
1141
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1142
823
"false"}
1143
824
"""
1144
1145
825
def decorator(func):
1146
826
func._dbus_is_interface = True
1147
827
func._dbus_interface = dbus_interface
1148
828
func._dbus_name = dbus_interface
1149
829
return func
1150
1151
830
return decorator
1152
831
1153
832
1155
834
"""Decorator to annotate D-Bus methods, signals or properties
1156
835
Usage:
1157
836
1158
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1159
"org.freedesktop.DBus.Property."
1160
"EmitsChangedSignal": "false"})
1161
837
@dbus_service_property("org.example.Interface", signature="b",
1162
838
access="r")
839
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
1163
842
def Property_dbus_property(self):
1164
843
return dbus.Boolean(False)
1165
1166
See also the DBusObjectWithAnnotations class.
1167
844
"""
1168
1169
845
def decorator(func):
1170
846
func._dbus_annotations = annotations
1171
847
return func
1172
1173
848
return decorator
1174
849
1175
850
1176
851
class DBusPropertyException(dbus.exceptions.DBusException):
1177
852
"""A base class for D-Bus property-related exceptions
1178
853
"""
1179
pass
854
def __unicode__(self):
855
return unicode(str(self))
1180
856
1181
857
1182
858
class DBusPropertyAccessException(DBusPropertyException):
1191
867
pass
1192
868
1193
869
1194
class DBusObjectWithAnnotations(dbus.service.Object):
1195
"""A D-Bus object with annotations.
870
class DBusObjectWithProperties(dbus.service.Object):
871
"""A D-Bus object with properties.
1196
872
1197
Classes inheriting from this can use the dbus_annotations
1198
decorator to add annotations to methods or signals.
873
Classes inheriting from this can use the dbus_service_property
874
decorator to expose methods as D-Bus properties. It exposes the
875
standard Get(), Set(), and GetAll() methods on the D-Bus.
1199
876
"""
1200
877
1201
878
@staticmethod
1205
882
If called like _is_dbus_thing("method") it returns a function
1206
883
suitable for use as predicate to inspect.getmembers().
1207
884
"""
1208
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1209
886
False)
1210
887
1211
888
def _get_all_dbus_things(self, thing):
1212
889
"""Returns a generator of (name, attribute) pairs
1213
890
"""
1214
return ((getattr(athing.__get__(self), "_dbus_name", name),
891
return ((getattr(athing.__get__(self), "_dbus_name",
892
name),
1215
893
athing.__get__(self))
1216
894
for cls in self.__class__.__mro__
1217
895
for name, athing in
1218
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1219
1220
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1221
out_signature = "s",
1222
path_keyword = 'object_path',
1223
connection_keyword = 'connection')
1224
def Introspect(self, object_path, connection):
1225
"""Overloading of standard D-Bus method.
1226
1227
Inserts annotation tags on methods and signals.
1228
"""
1229
xmlstring = dbus.service.Object.Introspect(self, object_path,
1230
connection)
1231
try:
1232
document = xml.dom.minidom.parseString(xmlstring)
1233
1234
for if_tag in document.getElementsByTagName("interface"):
1235
# Add annotation tags
1236
for typ in ("method", "signal"):
1237
for tag in if_tag.getElementsByTagName(typ):
1238
annots = dict()
1239
for name, prop in (self.
1240
_get_all_dbus_things(typ)):
1241
if (name == tag.getAttribute("name")
1242
and prop._dbus_interface
1243
== if_tag.getAttribute("name")):
1244
annots.update(getattr(
1245
prop, "_dbus_annotations", {}))
1246
for name, value in annots.items():
1247
ann_tag = document.createElement(
1248
"annotation")
1249
ann_tag.setAttribute("name", name)
1250
ann_tag.setAttribute("value", value)
1251
tag.appendChild(ann_tag)
1252
# Add interface annotation tags
1253
for annotation, value in dict(
1254
itertools.chain.from_iterable(
1255
annotations().items()
1256
for name, annotations
1257
in self._get_all_dbus_things("interface")
1258
if name == if_tag.getAttribute("name")
1259
)).items():
1260
ann_tag = document.createElement("annotation")
1261
ann_tag.setAttribute("name", annotation)
1262
ann_tag.setAttribute("value", value)
1263
if_tag.appendChild(ann_tag)
1264
# Fix argument name for the Introspect method itself
1265
if (if_tag.getAttribute("name")
1266
== dbus.INTROSPECTABLE_IFACE):
1267
for cn in if_tag.getElementsByTagName("method"):
1268
if cn.getAttribute("name") == "Introspect":
1269
for arg in cn.getElementsByTagName("arg"):
1270
if (arg.getAttribute("direction")
1271
== "out"):
1272
arg.setAttribute("name",
1273
"xml_data")
1274
xmlstring = document.toxml("utf-8")
1275
document.unlink()
1276
except (AttributeError, xml.dom.DOMException,
1277
xml.parsers.expat.ExpatError) as error:
1278
logger.error("Failed to override Introspection method",
1279
exc_info=error)
1280
return xmlstring
1281
1282
1283
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1284
"""A D-Bus object with properties.
1285
1286
Classes inheriting from this can use the dbus_service_property
1287
decorator to expose methods as D-Bus properties. It exposes the
1288
standard Get(), Set(), and GetAll() methods on the D-Bus.
1289
"""
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
1290
898
1291
899
def _get_dbus_property(self, interface_name, property_name):
1292
900
"""Returns a bound method if one exists which is a D-Bus
1293
901
property with the specified name and interface.
1294
902
"""
1295
for cls in self.__class__.__mro__:
1296
for name, value in inspect.getmembers(
1297
cls, self._is_dbus_thing("property")):
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
905
(cls,
906
self._is_dbus_thing("property"))):
1298
907
if (value._dbus_name == property_name
1299
908
and value._dbus_interface == interface_name):
1300
909
return value.__get__(self)
1301
910
1302
911
# No such property
1303
raise DBusPropertyNotFound("{}:{}.{}".format(
1304
self.dbus_object_path, interface_name, property_name))
1305
1306
@classmethod
1307
def _get_all_interface_names(cls):
1308
"""Get a sequence of all interfaces supported by an object"""
1309
return (name for name in set(getattr(getattr(x, attr),
1310
"_dbus_interface", None)
1311
for x in (inspect.getmro(cls))
1312
for attr in dir(x))
1313
if name is not None)
1314
1315
@dbus.service.method(dbus.PROPERTIES_IFACE,
1316
in_signature="ss",
912
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
+ interface_name + "."
914
+ property_name)
915
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1317
917
out_signature="v")
1318
918
def Get(self, interface_name, property_name):
1319
919
"""Standard D-Bus property Get() method, see D-Bus standard.
1338
938
# signatures other than "ay".
1339
939
if prop._dbus_signature != "ay":
1340
940
raise ValueError("Byte arrays not supported for non-"
1341
"'ay' signature {!r}"
941
"'ay' signature {0!r}"
1342
942
.format(prop._dbus_signature))
1343
943
value = dbus.ByteArray(b''.join(chr(byte)
1344
944
for byte in value))
1345
945
prop(value)
1346
946
1347
@dbus.service.method(dbus.PROPERTIES_IFACE,
1348
in_signature="s",
947
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1349
948
out_signature="a{sv}")
1350
949
def GetAll(self, interface_name):
1351
950
"""Standard D-Bus property GetAll() method, see D-Bus
1366
965
if not hasattr(value, "variant_level"):
1367
966
properties[name] = value
1368
967
continue
1369
properties[name] = type(value)(
1370
value, variant_level = value.variant_level + 1)
968
properties[name] = type(value)(value, variant_level=
969
value.variant_level+1)
1371
970
return dbus.Dictionary(properties, signature="sv")
1372
971
1373
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1374
def PropertiesChanged(self, interface_name, changed_properties,
1375
invalidated_properties):
1376
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1377
standard.
1378
"""
1379
pass
1380
1381
972
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1382
973
out_signature="s",
1383
974
path_keyword='object_path',
1387
978
1388
979
Inserts property tags and interface annotation tags.
1389
980
"""
1390
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1391
object_path,
1392
connection)
981
xmlstring = dbus.service.Object.Introspect(self, object_path,
982
connection)
1393
983
try:
1394
984
document = xml.dom.minidom.parseString(xmlstring)
1395
1396
985
def make_tag(document, name, prop):
1397
986
e = document.createElement("property")
1398
987
e.setAttribute("name", name)
1399
988
e.setAttribute("type", prop._dbus_signature)
1400
989
e.setAttribute("access", prop._dbus_access)
1401
990
return e
1402
1403
991
for if_tag in document.getElementsByTagName("interface"):
1404
992
# Add property tags
1405
993
for tag in (make_tag(document, name, prop)
1408
996
if prop._dbus_interface
1409
997
== if_tag.getAttribute("name")):
1410
998
if_tag.appendChild(tag)
1411
# Add annotation tags for properties
1412
for tag in if_tag.getElementsByTagName("property"):
1413
annots = dict()
1414
for name, prop in self._get_all_dbus_things(
1415
"property"):
1416
if (name == tag.getAttribute("name")
1417
and prop._dbus_interface
1418
== if_tag.getAttribute("name")):
1419
annots.update(getattr(
1420
prop, "_dbus_annotations", {}))
1421
for name, value in annots.items():
1422
ann_tag = document.createElement(
1423
"annotation")
1424
ann_tag.setAttribute("name", name)
1425
ann_tag.setAttribute("value", value)
1426
tag.appendChild(ann_tag)
999
# Add annotation tags
1000
for typ in ("method", "signal", "property"):
1001
for tag in if_tag.getElementsByTagName(typ):
1002
annots = dict()
1003
for name, prop in (self.
1004
_get_all_dbus_things(typ)):
1005
if (name == tag.getAttribute("name")
1006
and prop._dbus_interface
1007
== if_tag.getAttribute("name")):
1008
annots.update(getattr
1009
(prop,
1010
"_dbus_annotations",
1011
{}))
1012
for name, value in annots.iteritems():
1013
ann_tag = document.createElement(
1014
"annotation")
1015
ann_tag.setAttribute("name", name)
1016
ann_tag.setAttribute("value", value)
1017
tag.appendChild(ann_tag)
1018
# Add interface annotation tags
1019
for annotation, value in dict(
1020
itertools.chain.from_iterable(
1021
annotations().iteritems()
1022
for name, annotations in
1023
self._get_all_dbus_things("interface")
1024
if name == if_tag.getAttribute("name")
1025
)).iteritems():
1026
ann_tag = document.createElement("annotation")
1027
ann_tag.setAttribute("name", annotation)
1028
ann_tag.setAttribute("value", value)
1029
if_tag.appendChild(ann_tag)
1427
1030
# Add the names to the return values for the
1428
1031
# "org.freedesktop.DBus.Properties" methods
1429
1032
if (if_tag.getAttribute("name")
1447
1050
exc_info=error)
1448
1051
return xmlstring
1449
1052
1450
try:
1451
dbus.OBJECT_MANAGER_IFACE
1452
except AttributeError:
1453
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1454
1455
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1456
"""A D-Bus object with an ObjectManager.
1457
1458
Classes inheriting from this exposes the standard
1459
GetManagedObjects call and the InterfacesAdded and
1460
InterfacesRemoved signals on the standard
1461
"org.freedesktop.DBus.ObjectManager" interface.
1462
1463
Note: No signals are sent automatically; they must be sent
1464
manually.
1465
"""
1466
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1467
out_signature = "a{oa{sa{sv}}}")
1468
def GetManagedObjects(self):
1469
"""This function must be overridden"""
1470
raise NotImplementedError()
1471
1472
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1473
signature = "oa{sa{sv}}")
1474
def InterfacesAdded(self, object_path, interfaces_and_properties):
1475
pass
1476
1477
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1478
def InterfacesRemoved(self, object_path, interfaces):
1479
pass
1480
1481
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1482
out_signature = "s",
1483
path_keyword = 'object_path',
1484
connection_keyword = 'connection')
1485
def Introspect(self, object_path, connection):
1486
"""Overloading of standard D-Bus method.
1487
1488
Override return argument name of GetManagedObjects to be
1489
"objpath_interfaces_and_properties"
1490
"""
1491
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1492
object_path,
1493
connection)
1494
try:
1495
document = xml.dom.minidom.parseString(xmlstring)
1496
1497
for if_tag in document.getElementsByTagName("interface"):
1498
# Fix argument name for the GetManagedObjects method
1499
if (if_tag.getAttribute("name")
1500
== dbus.OBJECT_MANAGER_IFACE):
1501
for cn in if_tag.getElementsByTagName("method"):
1502
if (cn.getAttribute("name")
1503
== "GetManagedObjects"):
1504
for arg in cn.getElementsByTagName("arg"):
1505
if (arg.getAttribute("direction")
1506
== "out"):
1507
arg.setAttribute(
1508
"name",
1509
"objpath_interfaces"
1510
"_and_properties")
1511
xmlstring = document.toxml("utf-8")
1512
document.unlink()
1513
except (AttributeError, xml.dom.DOMException,
1514
xml.parsers.expat.ExpatError) as error:
1515
logger.error("Failed to override Introspection method",
1516
exc_info = error)
1517
return xmlstring
1518
1053
1519
1054
def datetime_to_dbus(dt, variant_level=0):
1520
1055
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1521
1056
if dt is None:
1522
1057
return dbus.String("", variant_level = variant_level)
1523
return dbus.String(dt.isoformat(), variant_level=variant_level)
1058
return dbus.String(dt.isoformat(),
1059
variant_level=variant_level)
1524
1060
1525
1061
1526
1062
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1546
1082
(from DBusObjectWithProperties) and interfaces (from the
1547
1083
dbus_interface_annotations decorator).
1548
1084
"""
1549
1550
1085
def wrapper(cls):
1551
1086
for orig_interface_name, alt_interface_name in (
1552
alt_interface_names.items()):
1087
alt_interface_names.iteritems()):
1553
1088
attr = {}
1554
1089
interface_names = set()
1555
1090
# Go though all attributes of the class
1557
1092
# Ignore non-D-Bus attributes, and D-Bus attributes
1558
1093
# with the wrong interface name
1559
1094
if (not hasattr(attribute, "_dbus_interface")
1560
or not attribute._dbus_interface.startswith(
1561
orig_interface_name)):
1095
or not attribute._dbus_interface
1096
.startswith(orig_interface_name)):
1562
1097
continue
1563
1098
# Create an alternate D-Bus interface name based on
1564
1099
# the current name
1565
alt_interface = attribute._dbus_interface.replace(
1566
orig_interface_name, alt_interface_name)
1100
alt_interface = (attribute._dbus_interface
1101
.replace(orig_interface_name,
1102
alt_interface_name))
1567
1103
interface_names.add(alt_interface)
1568
1104
# Is this a D-Bus signal?
1569
1105
if getattr(attribute, "_dbus_is_signal", False):
1570
1106
# Extract the original non-method undecorated
1571
1107
# function by black magic
1572
if sys.version_info.major == 2:
1573
nonmethod_func = (dict(
1108
nonmethod_func = (dict(
1574
1109
zip(attribute.func_code.co_freevars,
1575
attribute.__closure__))
1576
["func"].cell_contents)
1577
else:
1578
nonmethod_func = (dict(
1579
zip(attribute.__code__.co_freevars,
1580
attribute.__closure__))
1581
["func"].cell_contents)
1110
attribute.__closure__))["func"]
1111
.cell_contents)
1582
1112
# Create a new, but exactly alike, function
1583
1113
# object, and decorate it to be a new D-Bus signal
1584
1114
# with the alternate D-Bus interface name
1585
new_function = copy_function(nonmethod_func)
1586
new_function = (dbus.service.signal(
1587
alt_interface,
1588
attribute._dbus_signature)(new_function))
1115
new_function = (dbus.service.signal
1116
(alt_interface,
1117
attribute._dbus_signature)
1118
(types.FunctionType(
1119
nonmethod_func.func_code,
1120
nonmethod_func.func_globals,
1121
nonmethod_func.func_name,
1122
nonmethod_func.func_defaults,
1123
nonmethod_func.func_closure)))
1589
1124
# Copy annotations, if any
1590
1125
try:
1591
new_function._dbus_annotations = dict(
1592
attribute._dbus_annotations)
1126
new_function._dbus_annotations = (
1127
dict(attribute._dbus_annotations))
1593
1128
except AttributeError:
1594
1129
pass
1595
1130
# Define a creator of a function to call both the
1600
1135
"""This function is a scope container to pass
1601
1136
func1 and func2 to the "call_both" function
1602
1137
outside of its arguments"""
1603
1604
@functools.wraps(func2)
1605
1138
def call_both(*args, **kwargs):
1606
1139
"""This function will emit two D-Bus
1607
1140
signals by calling func1 and func2"""
1608
1141
func1(*args, **kwargs)
1609
1142
func2(*args, **kwargs)
1610
# Make wrapper function look like a D-Bus signal
1611
for name, attr in inspect.getmembers(func2):
1612
if name.startswith("_dbus_"):
1613
setattr(call_both, name, attr)
1614
1615
1143
return call_both
1616
1144
# Create the "call_both" function and add it to
1617
1145
# the class
1622
1150
# object. Decorate it to be a new D-Bus method
1623
1151
# with the alternate D-Bus interface name. Add it
1624
1152
# to the class.
1625
attr[attrname] = (
1626
dbus.service.method(
1627
alt_interface,
1628
attribute._dbus_in_signature,
1629
attribute._dbus_out_signature)
1630
(copy_function(attribute)))
1153
attr[attrname] = (dbus.service.method
1154
(alt_interface,
1155
attribute._dbus_in_signature,
1156
attribute._dbus_out_signature)
1157
(types.FunctionType
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1631
1163
# Copy annotations, if any
1632
1164
try:
1633
attr[attrname]._dbus_annotations = dict(
1634
attribute._dbus_annotations)
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1635
1167
except AttributeError:
1636
1168
pass
1637
1169
# Is this a D-Bus property?
1640
1172
# object, and decorate it to be a new D-Bus
1641
1173
# property with the alternate D-Bus interface
1642
1174
# name. Add it to the class.
1643
attr[attrname] = (dbus_service_property(
1644
alt_interface, attribute._dbus_signature,
1645
attribute._dbus_access,
1646
attribute._dbus_get_args_options
1647
["byte_arrays"])
1648
(copy_function(attribute)))
1175
attr[attrname] = (dbus_service_property
1176
(alt_interface,
1177
attribute._dbus_signature,
1178
attribute._dbus_access,
1179
attribute
1180
._dbus_get_args_options
1181
["byte_arrays"])
1182
(types.FunctionType
1183
(attribute.func_code,
1184
attribute.func_globals,
1185
attribute.func_name,
1186
attribute.func_defaults,
1187
attribute.func_closure)))
1649
1188
# Copy annotations, if any
1650
1189
try:
1651
attr[attrname]._dbus_annotations = dict(
1652
attribute._dbus_annotations)
1190
attr[attrname]._dbus_annotations = (
1191
dict(attribute._dbus_annotations))
1653
1192
except AttributeError:
1654
1193
pass
1655
1194
# Is this a D-Bus interface?
1658
1197
# object. Decorate it to be a new D-Bus interface
1659
1198
# with the alternate D-Bus interface name. Add it
1660
1199
# to the class.
1661
attr[attrname] = (
1662
dbus_interface_annotations(alt_interface)
1663
(copy_function(attribute)))
1200
attr[attrname] = (dbus_interface_annotations
1201
(alt_interface)
1202
(types.FunctionType
1203
(attribute.func_code,
1204
attribute.func_globals,
1205
attribute.func_name,
1206
attribute.func_defaults,
1207
attribute.func_closure)))
1664
1208
if deprecate:
1665
1209
# Deprecate all alternate interfaces
1666
iname="_AlternateDBusNames_interface_annotation{}"
1210
iname="_AlternateDBusNames_interface_annotation{0}"
1667
1211
for interface_name in interface_names:
1668
1669
1212
@dbus_interface_annotations(interface_name)
1670
1213
def func(self):
1671
1214
return { "org.freedesktop.DBus.Deprecated":
1672
"true" }
1215
"true" }
1673
1216
# Find an unused name
1674
1217
for aname in (iname.format(i)
1675
1218
for i in itertools.count()):
1679
1222
if interface_names:
1680
1223
# Replace the class with a new subclass of it with
1681
1224
# methods, signals, etc. as created above.
1682
if sys.version_info.major == 2:
1683
cls = type(b"{}Alternate".format(cls.__name__),
1684
(cls, ), attr)
1685
else:
1686
cls = type("{}Alternate".format(cls.__name__),
1687
(cls, ), attr)
1225
cls = type(b"{0}Alternate".format(cls.__name__),
1226
(cls,), attr)
1688
1227
return cls
1689
1690
1228
return wrapper
1691
1229
1692
1230
1693
1231
@alternate_dbus_interfaces({"se.recompile.Mandos":
1694
"se.bsnet.fukt.Mandos"})
1232
"se.bsnet.fukt.Mandos"})
1695
1233
class ClientDBus(Client, DBusObjectWithProperties):
1696
1234
"""A Client class using D-Bus
1697
1235
1701
1239
"""
1702
1240
1703
1241
runtime_expansions = (Client.runtime_expansions
1704
+ ("dbus_object_path", ))
1705
1706
_interface = "se.recompile.Mandos.Client"
1242
+ ("dbus_object_path",))
1707
1243
1708
1244
# dbus.service.Object doesn't use super(), so we can't either.
1709
1245
1712
1248
Client.__init__(self, *args, **kwargs)
1713
1249
# Only now, when this client is initialized, can it show up on
1714
1250
# the D-Bus
1715
client_object_name = str(self.name).translate(
1251
client_object_name = unicode(self.name).translate(
1716
1252
{ord("."): ord("_"),
1717
1253
ord("-"): ord("_")})
1718
self.dbus_object_path = dbus.ObjectPath(
1719
"/clients/" + client_object_name)
1254
self.dbus_object_path = (dbus.ObjectPath
1255
("/clients/" + client_object_name))
1720
1256
DBusObjectWithProperties.__init__(self, self.bus,
1721
1257
self.dbus_object_path)
1722
1258
1723
def notifychangeproperty(transform_func, dbus_name,
1724
type_func=lambda x: x,
1725
variant_level=1,
1726
invalidate_only=False,
1727
_interface=_interface):
1259
def notifychangeproperty(transform_func,
1260
dbus_name, type_func=lambda x: x,
1261
variant_level=1):
1728
1262
""" Modify a variable so that it's a property which announces
1729
1263
its changes to DBus.
1730
1264
1735
1269
to the D-Bus. Default: no transform
1736
1270
variant_level: D-Bus variant level. Default: 1
1737
1271
"""
1738
attrname = "_{}".format(dbus_name)
1739
1272
attrname = "_{0}".format(dbus_name)
1740
1273
def setter(self, value):
1741
1274
if hasattr(self, "dbus_object_path"):
1742
1275
if (not hasattr(self, attrname) or
1743
1276
type_func(getattr(self, attrname, None))
1744
1277
!= type_func(value)):
1745
if invalidate_only:
1746
self.PropertiesChanged(
1747
_interface, dbus.Dictionary(),
1748
dbus.Array((dbus_name, )))
1749
else:
1750
dbus_value = transform_func(
1751
type_func(value),
1752
variant_level = variant_level)
1753
self.PropertyChanged(dbus.String(dbus_name),
1754
dbus_value)
1755
self.PropertiesChanged(
1756
_interface,
1757
dbus.Dictionary({ dbus.String(dbus_name):
1758
dbus_value }),
1759
dbus.Array())
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1281
self.PropertyChanged(dbus.String(dbus_name),
1282
dbus_value)
1760
1283
setattr(self, attrname, value)
1761
1284
1762
1285
return property(lambda self: getattr(self, attrname), setter)
1768
1291
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1769
1292
last_enabled = notifychangeproperty(datetime_to_dbus,
1770
1293
"LastEnabled")
1771
checker = notifychangeproperty(
1772
dbus.Boolean, "CheckerRunning",
1773
type_func = lambda checker: checker is not None)
1294
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1295
type_func = lambda checker:
1296
checker is not None)
1774
1297
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1775
1298
"LastCheckedOK")
1776
1299
last_checker_status = notifychangeproperty(dbus.Int16,
1779
1302
datetime_to_dbus, "LastApprovalRequest")
1780
1303
approved_by_default = notifychangeproperty(dbus.Boolean,
1781
1304
"ApprovedByDefault")
1782
approval_delay = notifychangeproperty(
1783
dbus.UInt64, "ApprovalDelay",
1784
type_func = lambda td: td.total_seconds() * 1000)
1305
approval_delay = notifychangeproperty(dbus.UInt64,
1306
"ApprovalDelay",
1307
type_func =
1308
timedelta_to_milliseconds)
1785
1309
approval_duration = notifychangeproperty(
1786
1310
dbus.UInt64, "ApprovalDuration",
1787
type_func = lambda td: td.total_seconds() * 1000)
1311
type_func = timedelta_to_milliseconds)
1788
1312
host = notifychangeproperty(dbus.String, "Host")
1789
timeout = notifychangeproperty(
1790
dbus.UInt64, "Timeout",
1791
type_func = lambda td: td.total_seconds() * 1000)
1313
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1314
type_func =
1315
timedelta_to_milliseconds)
1792
1316
extended_timeout = notifychangeproperty(
1793
1317
dbus.UInt64, "ExtendedTimeout",
1794
type_func = lambda td: td.total_seconds() * 1000)
1795
interval = notifychangeproperty(
1796
dbus.UInt64, "Interval",
1797
type_func = lambda td: td.total_seconds() * 1000)
1318
type_func = timedelta_to_milliseconds)
1319
interval = notifychangeproperty(dbus.UInt64,
1320
"Interval",
1321
type_func =
1322
timedelta_to_milliseconds)
1798
1323
checker_command = notifychangeproperty(dbus.String, "Checker")
1799
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1800
invalidate_only=True)
1801
1324
1802
1325
del notifychangeproperty
1803
1326
1810
1333
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1811
1334
Client.__del__(self, *args, **kwargs)
1812
1335
1813
def checker_callback(self, source, condition,
1814
connection, command, *args, **kwargs):
1815
ret = Client.checker_callback(self, source, condition,
1816
connection, command, *args,
1817
**kwargs)
1818
exitstatus = self.last_checker_status
1819
if exitstatus >= 0:
1336
def checker_callback(self, pid, condition, command,
1337
*args, **kwargs):
1338
self.checker_callback_tag = None
1339
self.checker = None
1340
if os.WIFEXITED(condition):
1341
exitstatus = os.WEXITSTATUS(condition)
1820
1342
# Emit D-Bus signal
1821
1343
self.CheckerCompleted(dbus.Int16(exitstatus),
1822
# This is specific to GNU libC
1823
dbus.Int64(exitstatus << 8),
1344
dbus.Int64(condition),
1824
1345
dbus.String(command))
1825
1346
else:
1826
1347
# Emit D-Bus signal
1827
1348
self.CheckerCompleted(dbus.Int16(-1),
1828
dbus.Int64(
1829
# This is specific to GNU libC
1830
(exitstatus << 8)
1831
| self.last_checker_signal),
1349
dbus.Int64(condition),
1832
1350
dbus.String(command))
1833
return ret
1351
1352
return Client.checker_callback(self, pid, condition, command,
1353
*args, **kwargs)
1834
1354
1835
1355
def start_checker(self, *args, **kwargs):
1836
1356
old_checker_pid = getattr(self.checker, "pid", None)
1848
1368
1849
1369
def approve(self, value=True):
1850
1370
self.approved = value
1851
GLib.timeout_add(int(self.approval_duration.total_seconds()
1852
* 1000), self._reset_approved)
1371
gobject.timeout_add(timedelta_to_milliseconds
1372
(self.approval_duration),
1373
self._reset_approved)
1853
1374
self.send_changedstate()
1854
1375
1855
1376
## D-Bus methods, signals & properties
1377
_interface = "se.recompile.Mandos.Client"
1856
1378
1857
1379
## Interfaces
1858
1380
1381
@dbus_interface_annotations(_interface)
1382
def _foo(self):
1383
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1384
"false"}
1385
1859
1386
## Signals
1860
1387
1861
1388
# CheckerCompleted - signal
1871
1398
pass
1872
1399
1873
1400
# PropertyChanged - signal
1874
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1875
1401
@dbus.service.signal(_interface, signature="sv")
1876
1402
def PropertyChanged(self, property, value):
1877
1403
"D-Bus signal"
1911
1437
self.checked_ok()
1912
1438
1913
1439
# Enable - method
1914
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1915
1440
@dbus.service.method(_interface)
1916
1441
def Enable(self):
1917
1442
"D-Bus method"
1918
1443
self.enable()
1919
1444
1920
1445
# StartChecker - method
1921
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1922
1446
@dbus.service.method(_interface)
1923
1447
def StartChecker(self):
1924
1448
"D-Bus method"
1925
1449
self.start_checker()
1926
1450
1927
1451
# Disable - method
1928
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1929
1452
@dbus.service.method(_interface)
1930
1453
def Disable(self):
1931
1454
"D-Bus method"
1932
1455
self.disable()
1933
1456
1934
1457
# StopChecker - method
1935
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1936
1458
@dbus.service.method(_interface)
1937
1459
def StopChecker(self):
1938
1460
self.stop_checker()
1945
1467
return dbus.Boolean(bool(self.approvals_pending))
1946
1468
1947
1469
# ApprovedByDefault - property
1948
@dbus_service_property(_interface,
1949
signature="b",
1470
@dbus_service_property(_interface, signature="b",
1950
1471
access="readwrite")
1951
1472
def ApprovedByDefault_dbus_property(self, value=None):
1952
1473
if value is None: # get
1954
1475
self.approved_by_default = bool(value)
1955
1476
1956
1477
# ApprovalDelay - property
1957
@dbus_service_property(_interface,
1958
signature="t",
1478
@dbus_service_property(_interface, signature="t",
1959
1479
access="readwrite")
1960
1480
def ApprovalDelay_dbus_property(self, value=None):
1961
1481
if value is None: # get
1962
return dbus.UInt64(self.approval_delay.total_seconds()
1963
* 1000)
1482
return dbus.UInt64(self.approval_delay_milliseconds())
1964
1483
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1965
1484
1966
1485
# ApprovalDuration - property
1967
@dbus_service_property(_interface,
1968
signature="t",
1486
@dbus_service_property(_interface, signature="t",
1969
1487
access="readwrite")
1970
1488
def ApprovalDuration_dbus_property(self, value=None):
1971
1489
if value is None: # get
1972
return dbus.UInt64(self.approval_duration.total_seconds()
1973
* 1000)
1490
return dbus.UInt64(timedelta_to_milliseconds(
1491
self.approval_duration))
1974
1492
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1975
1493
1976
1494
# Name - property
1977
@dbus_annotations(
1978
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1979
1495
@dbus_service_property(_interface, signature="s", access="read")
1980
1496
def Name_dbus_property(self):
1981
1497
return dbus.String(self.name)
1982
1498
1983
1499
# Fingerprint - property
1984
@dbus_annotations(
1985
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1986
1500
@dbus_service_property(_interface, signature="s", access="read")
1987
1501
def Fingerprint_dbus_property(self):
1988
1502
return dbus.String(self.fingerprint)
1989
1503
1990
1504
# Host - property
1991
@dbus_service_property(_interface,
1992
signature="s",
1505
@dbus_service_property(_interface, signature="s",
1993
1506
access="readwrite")
1994
1507
def Host_dbus_property(self, value=None):
1995
1508
if value is None: # get
1996
1509
return dbus.String(self.host)
1997
self.host = str(value)
1510
self.host = unicode(value)
1998
1511
1999
1512
# Created - property
2000
@dbus_annotations(
2001
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2002
1513
@dbus_service_property(_interface, signature="s", access="read")
2003
1514
def Created_dbus_property(self):
2004
1515
return datetime_to_dbus(self.created)
2009
1520
return datetime_to_dbus(self.last_enabled)
2010
1521
2011
1522
# Enabled - property
2012
@dbus_service_property(_interface,
2013
signature="b",
1523
@dbus_service_property(_interface, signature="b",
2014
1524
access="readwrite")
2015
1525
def Enabled_dbus_property(self, value=None):
2016
1526
if value is None: # get
2021
1531
self.disable()
2022
1532
2023
1533
# LastCheckedOK - property
2024
@dbus_service_property(_interface,
2025
signature="s",
1534
@dbus_service_property(_interface, signature="s",
2026
1535
access="readwrite")
2027
1536
def LastCheckedOK_dbus_property(self, value=None):
2028
1537
if value is not None:
2031
1540
return datetime_to_dbus(self.last_checked_ok)
2032
1541
2033
1542
# LastCheckerStatus - property
2034
@dbus_service_property(_interface, signature="n", access="read")
1543
@dbus_service_property(_interface, signature="n",
1544
access="read")
2035
1545
def LastCheckerStatus_dbus_property(self):
2036
1546
return dbus.Int16(self.last_checker_status)
2037
1547
2046
1556
return datetime_to_dbus(self.last_approval_request)
2047
1557
2048
1558
# Timeout - property
2049
@dbus_service_property(_interface,
2050
signature="t",
1559
@dbus_service_property(_interface, signature="t",
2051
1560
access="readwrite")
2052
1561
def Timeout_dbus_property(self, value=None):
2053
1562
if value is None: # get
2054
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1563
return dbus.UInt64(self.timeout_milliseconds())
2055
1564
old_timeout = self.timeout
2056
1565
self.timeout = datetime.timedelta(0, 0, 0, value)
2057
1566
# Reschedule disabling
2065
1574
if (getattr(self, "disable_initiator_tag", None)
2066
1575
is None):
2067
1576
return
2068
GLib.source_remove(self.disable_initiator_tag)
2069
self.disable_initiator_tag = GLib.timeout_add(
2070
int((self.expires - now).total_seconds() * 1000),
2071
self.disable)
1577
gobject.source_remove(self.disable_initiator_tag)
1578
self.disable_initiator_tag = (
1579
gobject.timeout_add(
1580
timedelta_to_milliseconds(self.expires - now),
1581
self.disable))
2072
1582
2073
1583
# ExtendedTimeout - property
2074
@dbus_service_property(_interface,
2075
signature="t",
1584
@dbus_service_property(_interface, signature="t",
2076
1585
access="readwrite")
2077
1586
def ExtendedTimeout_dbus_property(self, value=None):
2078
1587
if value is None: # get
2079
return dbus.UInt64(self.extended_timeout.total_seconds()
2080
* 1000)
1588
return dbus.UInt64(self.extended_timeout_milliseconds())
2081
1589
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2082
1590
2083
1591
# Interval - property
2084
@dbus_service_property(_interface,
2085
signature="t",
1592
@dbus_service_property(_interface, signature="t",
2086
1593
access="readwrite")
2087
1594
def Interval_dbus_property(self, value=None):
2088
1595
if value is None: # get
2089
return dbus.UInt64(self.interval.total_seconds() * 1000)
1596
return dbus.UInt64(self.interval_milliseconds())
2090
1597
self.interval = datetime.timedelta(0, 0, 0, value)
2091
1598
if getattr(self, "checker_initiator_tag", None) is None:
2092
1599
return
2093
1600
if self.enabled:
2094
1601
# Reschedule checker run
2095
GLib.source_remove(self.checker_initiator_tag)
2096
self.checker_initiator_tag = GLib.timeout_add(
2097
value, self.start_checker)
2098
self.start_checker() # Start one now, too
1602
gobject.source_remove(self.checker_initiator_tag)
1603
self.checker_initiator_tag = (gobject.timeout_add
1604
(value, self.start_checker))
1605
self.start_checker() # Start one now, too
2099
1606
2100
1607
# Checker - property
2101
@dbus_service_property(_interface,
2102
signature="s",
1608
@dbus_service_property(_interface, signature="s",
2103
1609
access="readwrite")
2104
1610
def Checker_dbus_property(self, value=None):
2105
1611
if value is None: # get
2106
1612
return dbus.String(self.checker_command)
2107
self.checker_command = str(value)
1613
self.checker_command = unicode(value)
2108
1614
2109
1615
# CheckerRunning - property
2110
@dbus_service_property(_interface,
2111
signature="b",
1616
@dbus_service_property(_interface, signature="b",
2112
1617
access="readwrite")
2113
1618
def CheckerRunning_dbus_property(self, value=None):
2114
1619
if value is None: # get
2119
1624
self.stop_checker()
2120
1625
2121
1626
# ObjectPath - property
2122
@dbus_annotations(
2123
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2124
"org.freedesktop.DBus.Deprecated": "true"})
2125
1627
@dbus_service_property(_interface, signature="o", access="read")
2126
1628
def ObjectPath_dbus_property(self):
2127
1629
return self.dbus_object_path # is already a dbus.ObjectPath
2128
1630
2129
1631
# Secret = property
2130
@dbus_annotations(
2131
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2132
"invalidates"})
2133
@dbus_service_property(_interface,
2134
signature="ay",
2135
access="write",
2136
byte_arrays=True)
1632
@dbus_service_property(_interface, signature="ay",
1633
access="write", byte_arrays=True)
2137
1634
def Secret_dbus_property(self, value):
2138
self.secret = bytes(value)
1635
self.secret = str(value)
2139
1636
2140
1637
del _interface
2141
1638
2145
1642
self._pipe = child_pipe
2146
1643
self._pipe.send(('init', fpr, address))
2147
1644
if not self._pipe.recv():
2148
raise KeyError(fpr)
1645
raise KeyError()
2149
1646
2150
1647
def __getattribute__(self, name):
2151
1648
if name == '_pipe':
2155
1652
if data[0] == 'data':
2156
1653
return data[1]
2157
1654
if data[0] == 'function':
2158
2159
1655
def func(*args, **kwargs):
2160
1656
self._pipe.send(('funcall', name, args, kwargs))
2161
1657
return self._pipe.recv()[1]
2162
2163
1658
return func
2164
1659
2165
1660
def __setattr__(self, name, value):
2177
1672
def handle(self):
2178
1673
with contextlib.closing(self.server.child_pipe) as child_pipe:
2179
1674
logger.info("TCP connection from: %s",
2180
str(self.client_address))
1675
unicode(self.client_address))
2181
1676
logger.debug("Pipe FD: %d",
2182
1677
self.server.child_pipe.fileno())
2183
1678
2184
session = gnutls.ClientSession(self.request)
1679
session = (gnutls.connection
1680
.ClientSession(self.request,
1681
gnutls.connection
1682
.X509Credentials()))
1683
1684
# Note: gnutls.connection.X509Credentials is really a
1685
# generic GnuTLS certificate credentials object so long as
1686
# no X.509 keys are added to it. Therefore, we can use it
1687
# here despite using OpenPGP certificates.
2185
1688
2186
1689
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
1690
# "+AES-256-CBC", "+SHA1",
2191
1694
priority = self.server.gnutls_priority
2192
1695
if priority is None:
2193
1696
priority = "NORMAL"
2194
gnutls.priority_set_direct(session._c_object,
2195
priority.encode("utf-8"),
2196
None)
1697
(gnutls.library.functions
1698
.gnutls_priority_set_direct(session._c_object,
1699
priority, None))
2197
1700
2198
1701
# Start communication using the Mandos protocol
2199
1702
# Get protocol number
2209
1712
# Start GnuTLS connection
2210
1713
try:
2211
1714
session.handshake()
2212
except gnutls.Error as error:
1715
except gnutls.errors.GNUTLSError as error:
2213
1716
logger.warning("Handshake failed: %s", error)
2214
1717
# Do not run session.bye() here: the session is not
2215
1718
# established. Just abandon the request.
2219
1722
approval_required = False
2220
1723
try:
2221
1724
try:
2222
fpr = self.fingerprint(
2223
self.peer_certificate(session))
2224
except (TypeError, gnutls.Error) as error:
1725
fpr = self.fingerprint(self.peer_certificate
1726
(session))
1727
except (TypeError,
1728
gnutls.errors.GNUTLSError) as error:
2225
1729
logger.warning("Bad certificate: %s", error)
2226
1730
return
2227
1731
logger.debug("Fingerprint: %s", fpr)
2240
1744
while True:
2241
1745
if not client.enabled:
2242
1746
logger.info("Client %s is disabled",
2243
client.name)
1747
client.name)
2244
1748
if self.server.use_dbus:
2245
1749
# Emit D-Bus signal
2246
1750
client.Rejected("Disabled")
2255
1759
if self.server.use_dbus:
2256
1760
# Emit D-Bus signal
2257
1761
client.NeedApproval(
2258
client.approval_delay.total_seconds()
2259
* 1000, client.approved_by_default)
1762
client.approval_delay_milliseconds(),
1763
client.approved_by_default)
2260
1764
else:
2261
1765
logger.warning("Client %s was not approved",
2262
1766
client.name)
2268
1772
#wait until timeout or approved
2269
1773
time = datetime.datetime.now()
2270
1774
client.changedstate.acquire()
2271
client.changedstate.wait(delay.total_seconds())
1775
client.changedstate.wait(
1776
float(timedelta_to_milliseconds(delay)
1777
/ 1000))
2272
1778
client.changedstate.release()
2273
1779
time2 = datetime.datetime.now()
2274
1780
if (time2 - time) >= delay:
2285
1791
else:
2286
1792
delay -= time2 - time
2287
1793
2288
try:
2289
session.send(client.secret)
2290
except gnutls.Error as error:
2291
logger.warning("gnutls send failed",
2292
exc_info = error)
2293
return
1794
sent_size = 0
1795
while sent_size < len(client.secret):
1796
try:
1797
sent = session.send(client.secret[sent_size:])
1798
except gnutls.errors.GNUTLSError as error:
1799
logger.warning("gnutls send failed",
1800
exc_info=error)
1801
return
1802
logger.debug("Sent: %d, remaining: %d",
1803
sent, len(client.secret)
1804
- (sent_size + sent))
1805
sent_size += sent
2294
1806
2295
1807
logger.info("Sending secret to %s", client.name)
2296
1808
# bump the timeout using extended_timeout
2304
1816
client.approvals_pending -= 1
2305
1817
try:
2306
1818
session.bye()
2307
except gnutls.Error as error:
1819
except gnutls.errors.GNUTLSError as error:
2308
1820
logger.warning("GnuTLS bye failed",
2309
1821
exc_info=error)
2310
1822
2312
1824
def peer_certificate(session):
2313
1825
"Return the peer's OpenPGP certificate as a bytestring"
2314
1826
# If not an OpenPGP certificate...
2315
if (gnutls.certificate_type_get(session._c_object)
2316
!= gnutls.CRT_OPENPGP):
2317
# ...return invalid data
2318
return b""
1827
if (gnutls.library.functions
1828
.gnutls_certificate_type_get(session._c_object)
1829
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1830
# ...do the normal thing
1831
return session.peer_certificate
2319
1832
list_size = ctypes.c_uint(1)
2320
cert_list = (gnutls.certificate_get_peers
1833
cert_list = (gnutls.library.functions
1834
.gnutls_certificate_get_peers
2321
1835
(session._c_object, ctypes.byref(list_size)))
2322
1836
if not bool(cert_list) and list_size.value != 0:
2323
raise gnutls.Error("error getting peer certificate")
1837
raise gnutls.errors.GNUTLSError("error getting peer"
1838
" certificate")
2324
1839
if list_size.value == 0:
2325
1840
return None
2326
1841
cert = cert_list[0]
2330
1845
def fingerprint(openpgp):
2331
1846
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2332
1847
# New GnuTLS "datum" with the OpenPGP public key
2333
datum = gnutls.datum_t(
2334
ctypes.cast(ctypes.c_char_p(openpgp),
2335
ctypes.POINTER(ctypes.c_ubyte)),
2336
ctypes.c_uint(len(openpgp)))
1848
datum = (gnutls.library.types
1849
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1850
ctypes.POINTER
1851
(ctypes.c_ubyte)),
1852
ctypes.c_uint(len(openpgp))))
2337
1853
# New empty GnuTLS certificate
2338
crt = gnutls.openpgp_crt_t()
2339
gnutls.openpgp_crt_init(ctypes.byref(crt))
1854
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1855
(gnutls.library.functions
1856
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2340
1857
# Import the OpenPGP public key into the certificate
2341
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2342
gnutls.OPENPGP_FMT_RAW)
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1860
gnutls.library.constants
1861
.GNUTLS_OPENPGP_FMT_RAW))
2343
1862
# Verify the self signature in the key
2344
1863
crtverify = ctypes.c_uint()
2345
gnutls.openpgp_crt_verify_self(crt, 0,
2346
ctypes.byref(crtverify))
1864
(gnutls.library.functions
1865
.gnutls_openpgp_crt_verify_self(crt, 0,
1866
ctypes.byref(crtverify)))
2347
1867
if crtverify.value != 0:
2348
gnutls.openpgp_crt_deinit(crt)
2349
raise gnutls.CertificateSecurityError("Verify failed")
1868
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1869
raise (gnutls.errors.CertificateSecurityError
1870
("Verify failed"))
2350
1871
# New buffer for the fingerprint
2351
1872
buf = ctypes.create_string_buffer(20)
2352
1873
buf_len = ctypes.c_size_t()
2353
1874
# Get the fingerprint from the certificate into the buffer
2354
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2355
ctypes.byref(buf_len))
1875
(gnutls.library.functions
1876
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1877
ctypes.byref(buf_len)))
2356
1878
# Deinit the certificate
2357
gnutls.openpgp_crt_deinit(crt)
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2358
1880
# Convert the buffer to a Python bytestring
2359
1881
fpr = ctypes.string_at(buf, buf_len.value)
2360
1882
# Convert the bytestring to hexadecimal notation
2364
1886
2365
1887
class MultiprocessingMixIn(object):
2366
1888
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2367
2368
1889
def sub_process_main(self, request, address):
2369
1890
try:
2370
1891
self.finish_request(request, address)
2382
1903
2383
1904
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2384
1905
""" adds a pipe to the MixIn """
2385
2386
1906
def process_request(self, request, client_address):
2387
1907
"""Overrides and wraps the original process_request().
2388
1908
2409
1929
interface: None or a network interface name (string)
2410
1930
use_ipv6: Boolean; to use IPv6 or not
2411
1931
"""
2412
2413
1932
def __init__(self, server_address, RequestHandlerClass,
2414
interface=None,
2415
use_ipv6=True,
2416
socketfd=None):
1933
interface=None, use_ipv6=True, socketfd=None):
2417
1934
"""If socketfd is set, use that file descriptor instead of
2418
1935
creating a new one with socket.socket().
2419
1936
"""
2455
1972
bind to an address or port if they were not specified."""
2456
1973
if self.interface is not None:
2457
1974
if SO_BINDTODEVICE is None:
2458
# Fall back to a hard-coded value which seems to be
2459
# common enough.
2460
logger.warning("SO_BINDTODEVICE not found, trying 25")
2461
SO_BINDTODEVICE = 25
2462
try:
2463
self.socket.setsockopt(
2464
socket.SOL_SOCKET, SO_BINDTODEVICE,
2465
(self.interface + "\0").encode("utf-8"))
2466
except socket.error as error:
2467
if error.errno == errno.EPERM:
2468
logger.error("No permission to bind to"
2469
" interface %s", self.interface)
2470
elif error.errno == errno.ENOPROTOOPT:
2471
logger.error("SO_BINDTODEVICE not available;"
2472
" cannot bind to interface %s",
2473
self.interface)
2474
elif error.errno == errno.ENODEV:
2475
logger.error("Interface %s does not exist,"
2476
" cannot bind", self.interface)
2477
else:
2478
raise
1975
logger.error("SO_BINDTODEVICE does not exist;"
1976
" cannot bind to interface %s",
1977
self.interface)
1978
else:
1979
try:
1980
self.socket.setsockopt(socket.SOL_SOCKET,
1981
SO_BINDTODEVICE,
1982
str(self.interface + '\0'))
1983
except socket.error as error:
1984
if error.errno == errno.EPERM:
1985
logger.error("No permission to bind to"
1986
" interface %s", self.interface)
1987
elif error.errno == errno.ENOPROTOOPT:
1988
logger.error("SO_BINDTODEVICE not available;"
1989
" cannot bind to interface %s",
1990
self.interface)
1991
elif error.errno == errno.ENODEV:
1992
logger.error("Interface %s does not exist,"
1993
" cannot bind", self.interface)
1994
else:
1995
raise
2479
1996
# Only bind(2) the socket if we really need to.
2480
1997
if self.server_address[0] or self.server_address[1]:
2481
1998
if not self.server_address[0]:
2486
2003
self.server_address = (any_address,
2487
2004
self.server_address[1])
2488
2005
elif not self.server_address[1]:
2489
self.server_address = (self.server_address[0], 0)
2006
self.server_address = (self.server_address[0],
2007
0)
2490
2008
# if self.interface:
2491
2009
# self.server_address = (self.server_address[0],
2492
2010
# 0, # port
2504
2022
gnutls_priority GnuTLS priority string
2505
2023
use_dbus: Boolean; to emit D-Bus signals or not
2506
2024
2507
Assumes a GLib.MainLoop event loop.
2025
Assumes a gobject.MainLoop event loop.
2508
2026
"""
2509
2510
2027
def __init__(self, server_address, RequestHandlerClass,
2511
interface=None,
2512
use_ipv6=True,
2513
clients=None,
2514
gnutls_priority=None,
2515
use_dbus=True,
2516
socketfd=None):
2028
interface=None, use_ipv6=True, clients=None,
2029
gnutls_priority=None, use_dbus=True, socketfd=None):
2517
2030
self.enabled = False
2518
2031
self.clients = clients
2519
2032
if self.clients is None:
2525
2038
interface = interface,
2526
2039
use_ipv6 = use_ipv6,
2527
2040
socketfd = socketfd)
2528
2529
2041
def server_activate(self):
2530
2042
if self.enabled:
2531
2043
return socketserver.TCPServer.server_activate(self)
2535
2047
2536
2048
def add_pipe(self, parent_pipe, proc):
2537
2049
# Call "handle_ipc" for both data and EOF events
2538
GLib.io_add_watch(
2539
parent_pipe.fileno(),
2540
GLib.IO_IN | GLib.IO_HUP,
2541
functools.partial(self.handle_ipc,
2542
parent_pipe = parent_pipe,
2543
proc = proc))
2050
gobject.io_add_watch(parent_pipe.fileno(),
2051
gobject.IO_IN | gobject.IO_HUP,
2052
functools.partial(self.handle_ipc,
2053
parent_pipe =
2054
parent_pipe,
2055
proc = proc))
2544
2056
2545
def handle_ipc(self, source, condition,
2546
parent_pipe=None,
2547
proc = None,
2548
client_object=None):
2057
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2549
2059
# error, or the other end of multiprocessing.Pipe has closed
2550
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2060
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2551
2061
# Wait for other process to exit
2552
2062
proc.join()
2553
2063
return False
2560
2070
fpr = request[1]
2561
2071
address = request[2]
2562
2072
2563
for c in self.clients.values():
2073
for c in self.clients.itervalues():
2564
2074
if c.fingerprint == fpr:
2565
2075
client = c
2566
2076
break
2574
2084
parent_pipe.send(False)
2575
2085
return False
2576
2086
2577
GLib.io_add_watch(
2578
parent_pipe.fileno(),
2579
GLib.IO_IN | GLib.IO_HUP,
2580
functools.partial(self.handle_ipc,
2581
parent_pipe = parent_pipe,
2582
proc = proc,
2583
client_object = client))
2087
gobject.io_add_watch(parent_pipe.fileno(),
2088
gobject.IO_IN | gobject.IO_HUP,
2089
functools.partial(self.handle_ipc,
2090
parent_pipe =
2091
parent_pipe,
2092
proc = proc,
2093
client_object =
2094
client))
2584
2095
parent_pipe.send(True)
2585
2096
# remove the old hook in favor of the new above hook on
2586
2097
# same fileno
2592
2103
2593
2104
parent_pipe.send(('data', getattr(client_object,
2594
2105
funcname)(*args,
2595
**kwargs)))
2106
**kwargs)))
2596
2107
2597
2108
if command == 'getattr':
2598
2109
attrname = request[1]
2599
if isinstance(client_object.__getattribute__(attrname),
2600
collections.Callable):
2601
parent_pipe.send(('function', ))
2110
if callable(client_object.__getattribute__(attrname)):
2111
parent_pipe.send(('function',))
2602
2112
else:
2603
parent_pipe.send((
2604
'data', client_object.__getattribute__(attrname)))
2113
parent_pipe.send(('data', client_object
2114
.__getattribute__(attrname)))
2605
2115
2606
2116
if command == 'setattr':
2607
2117
attrname = request[1]
2638
2148
# avoid excessive use of external libraries.
2639
2149
2640
2150
# New type for defining tokens, syntax, and semantics all-in-one
2641
Token = collections.namedtuple("Token", (
2642
"regexp", # To match token; if "value" is not None, must have
2643
# a "group" containing digits
2644
"value", # datetime.timedelta or None
2645
"followers")) # Tokens valid after this token
2151
Token = collections.namedtuple("Token",
2152
("regexp", # To match token; if
2153
# "value" is not None,
2154
# must have a "group"
2155
# containing digits
2156
"value", # datetime.timedelta or
2157
# None
2158
"followers")) # Tokens valid after
2159
# this token
2646
2160
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2647
2161
# the "duration" ABNF definition in RFC 3339, Appendix A.
2648
2162
token_end = Token(re.compile(r"$"), None, frozenset())
2649
2163
token_second = Token(re.compile(r"(\d+)S"),
2650
2164
datetime.timedelta(seconds=1),
2651
frozenset((token_end, )))
2165
frozenset((token_end,)))
2652
2166
token_minute = Token(re.compile(r"(\d+)M"),
2653
2167
datetime.timedelta(minutes=1),
2654
2168
frozenset((token_second, token_end)))
2670
2184
frozenset((token_month, token_end)))
2671
2185
token_week = Token(re.compile(r"(\d+)W"),
2672
2186
datetime.timedelta(weeks=1),
2673
frozenset((token_end, )))
2187
frozenset((token_end,)))
2674
2188
token_duration = Token(re.compile(r"P"), None,
2675
2189
frozenset((token_year, token_month,
2676
2190
token_day, token_time,
2678
2192
# Define starting values
2679
2193
value = datetime.timedelta() # Value so far
2680
2194
found_token = None
2681
followers = frozenset((token_duration, )) # Following valid tokens
2195
followers = frozenset((token_duration,)) # Following valid tokens
2682
2196
s = duration # String left to parse
2683
2197
# Loop until end token is found
2684
2198
while found_token is not token_end:
2701
2215
break
2702
2216
else:
2703
2217
# No currently valid tokens were found
2704
raise ValueError("Invalid RFC 3339 duration: {!r}"
2705
.format(duration))
2218
raise ValueError("Invalid RFC 3339 duration")
2706
2219
# End token found
2707
2220
return value
2708
2221
2732
2245
timevalue = datetime.timedelta(0)
2733
2246
for s in interval.split():
2734
2247
try:
2735
suffix = s[-1]
2248
suffix = unicode(s[-1])
2736
2249
value = int(s[:-1])
2737
2250
if suffix == "d":
2738
2251
delta = datetime.timedelta(value)
2745
2258
elif suffix == "w":
2746
2259
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2747
2260
else:
2748
raise ValueError("Unknown suffix {!r}".format(suffix))
2261
raise ValueError("Unknown suffix {0!r}"
2262
.format(suffix))
2749
2263
except IndexError as e:
2750
2264
raise ValueError(*(e.args))
2751
2265
timevalue += delta
2768
2282
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2769
2283
if not stat.S_ISCHR(os.fstat(null).st_mode):
2770
2284
raise OSError(errno.ENODEV,
2771
"{} not a character device"
2285
"{0} not a character device"
2772
2286
.format(os.devnull))
2773
2287
os.dup2(null, sys.stdin.fileno())
2774
2288
os.dup2(null, sys.stdout.fileno())
2784
2298
2785
2299
parser = argparse.ArgumentParser()
2786
2300
parser.add_argument("-v", "--version", action="version",
2787
version = "%(prog)s {}".format(version),
2301
version = "%(prog)s {0}".format(version),
2788
2302
help="show version number and exit")
2789
2303
parser.add_argument("-i", "--interface", metavar="IF",
2790
2304
help="Bind to interface IF")
2840
2354
"port": "",
2841
2355
"debug": "False",
2842
2356
"priority":
2843
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2844
":+SIGN-DSA-SHA256",
2357
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2845
2358
"servicename": "Mandos",
2846
2359
"use_dbus": "True",
2847
2360
"use_ipv6": "True",
2851
2364
"statedir": "/var/lib/mandos",
2852
2365
"foreground": "False",
2853
2366
"zeroconf": "True",
2854
}
2367
}
2855
2368
2856
2369
# Parse config file for server-global settings
2857
2370
server_config = configparser.SafeConfigParser(server_defaults)
2858
2371
del server_defaults
2859
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2372
server_config.read(os.path.join(options.configdir,
2373
"mandos.conf"))
2860
2374
# Convert the SafeConfigParser object to a dict
2861
2375
server_settings = server_config.defaults()
2862
2376
# Use the appropriate methods on the non-string config options
2880
2394
# Override the settings from the config file with command line
2881
2395
# options, if set.
2882
2396
for option in ("interface", "address", "port", "debug",
2883
"priority", "servicename", "configdir", "use_dbus",
2884
"use_ipv6", "debuglevel", "restore", "statedir",
2885
"socket", "foreground", "zeroconf"):
2397
"priority", "servicename", "configdir",
2398
"use_dbus", "use_ipv6", "debuglevel", "restore",
2399
"statedir", "socket", "foreground", "zeroconf"):
2886
2400
value = getattr(options, option)
2887
2401
if value is not None:
2888
2402
server_settings[option] = value
2889
2403
del options
2890
2404
# Force all strings to be unicode
2891
2405
for option in server_settings.keys():
2892
if isinstance(server_settings[option], bytes):
2893
server_settings[option] = (server_settings[option]
2894
.decode("utf-8"))
2406
if type(server_settings[option]) is str:
2407
server_settings[option] = unicode(server_settings[option])
2895
2408
# Force all boolean options to be boolean
2896
2409
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2897
2410
"foreground", "zeroconf"):
2903
2416
2904
2417
##################################################################
2905
2418
2906
if (not server_settings["zeroconf"]
2907
and not (server_settings["port"]
2908
or server_settings["socket"] != "")):
2909
parser.error("Needs port or socket to work without Zeroconf")
2419
if (not server_settings["zeroconf"] and
2420
not (server_settings["port"]
2421
or server_settings["socket"] != "")):
2422
parser.error("Needs port or socket to work without"
2423
" Zeroconf")
2910
2424
2911
2425
# For convenience
2912
2426
debug = server_settings["debug"]
2928
2442
initlogger(debug, level)
2929
2443
2930
2444
if server_settings["servicename"] != "Mandos":
2931
syslogger.setFormatter(
2932
logging.Formatter('Mandos ({}) [%(process)d]:'
2933
' %(levelname)s: %(message)s'.format(
2934
server_settings["servicename"])))
2445
syslogger.setFormatter(logging.Formatter
2446
('Mandos ({0}) [%(process)d]:'
2447
' %(levelname)s: %(message)s'
2448
.format(server_settings
2449
["servicename"])))
2935
2450
2936
2451
# Parse config file with clients
2937
2452
client_config = configparser.SafeConfigParser(Client
2945
2460
socketfd = None
2946
2461
if server_settings["socket"] != "":
2947
2462
socketfd = server_settings["socket"]
2948
tcp_server = MandosServer(
2949
(server_settings["address"], server_settings["port"]),
2950
ClientHandler,
2951
interface=(server_settings["interface"] or None),
2952
use_ipv6=use_ipv6,
2953
gnutls_priority=server_settings["priority"],
2954
use_dbus=use_dbus,
2955
socketfd=socketfd)
2463
tcp_server = MandosServer((server_settings["address"],
2464
server_settings["port"]),
2465
ClientHandler,
2466
interface=(server_settings["interface"]
2467
or None),
2468
use_ipv6=use_ipv6,
2469
gnutls_priority=
2470
server_settings["priority"],
2471
use_dbus=use_dbus,
2472
socketfd=socketfd)
2956
2473
if not foreground:
2957
2474
pidfilename = "/run/mandos.pid"
2958
2475
if not os.path.isdir("/run/."):
2959
2476
pidfilename = "/var/run/mandos.pid"
2960
2477
pidfile = None
2961
2478
try:
2962
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2479
pidfile = open(pidfilename, "w")
2963
2480
except IOError as e:
2964
2481
logger.error("Could not open file %r", pidfilename,
2965
2482
exc_info=e)
2966
2483
2967
for name, group in (("_mandos", "_mandos"),
2968
("mandos", "mandos"),
2969
("nobody", "nogroup")):
2484
for name in ("_mandos", "mandos", "nobody"):
2970
2485
try:
2971
2486
uid = pwd.getpwnam(name).pw_uid
2972
gid = pwd.getpwnam(group).pw_gid
2487
gid = pwd.getpwnam(name).pw_gid
2973
2488
break
2974
2489
except KeyError:
2975
2490
continue
2979
2494
try:
2980
2495
os.setgid(gid)
2981
2496
os.setuid(uid)
2982
if debug:
2983
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2984
gid))
2985
2497
except OSError as error:
2986
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2987
.format(uid, gid, os.strerror(error.errno)))
2988
2498
if error.errno != errno.EPERM:
2989
2499
raise
2990
2500
2993
2503
2994
2504
# "Use a log level over 10 to enable all debugging options."
2995
2505
# - GnuTLS manual
2996
gnutls.global_set_log_level(11)
2506
gnutls.library.functions.gnutls_global_set_log_level(11)
2997
2507
2998
@gnutls.log_func
2508
@gnutls.library.types.gnutls_log_func
2999
2509
def debug_gnutls(level, string):
3000
2510
logger.debug("GnuTLS: %s", string[:-1])
3001
2511
3002
gnutls.global_set_log_function(debug_gnutls)
2512
(gnutls.library.functions
2513
.gnutls_global_set_log_function(debug_gnutls))
3003
2514
3004
2515
# Redirect stdin so all checkers get /dev/null
3005
2516
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3012
2523
# Close all input and output, do double fork, etc.
3013
2524
daemon()
3014
2525
3015
# multiprocessing will use threads, so before we use GLib we need
3016
# to inform GLib that threads will be used.
3017
GLib.threads_init()
2526
# multiprocessing will use threads, so before we use gobject we
2527
# need to inform gobject that threads will be used.
2528
gobject.threads_init()
3018
2529
3019
2530
global main_loop
3020
2531
# From the Avahi example code
3021
2532
DBusGMainLoop(set_as_default=True)
3022
main_loop = GLib.MainLoop()
2533
main_loop = gobject.MainLoop()
3023
2534
bus = dbus.SystemBus()
3024
2535
# End of Avahi example code
3025
2536
if use_dbus:
3026
2537
try:
3027
2538
bus_name = dbus.service.BusName("se.recompile.Mandos",
3028
bus,
3029
do_not_queue=True)
3030
old_bus_name = dbus.service.BusName(
3031
"se.bsnet.fukt.Mandos", bus,
3032
do_not_queue=True)
3033
except dbus.exceptions.DBusException as e:
2539
bus, do_not_queue=True)
2540
old_bus_name = (dbus.service.BusName
2541
("se.bsnet.fukt.Mandos", bus,
2542
do_not_queue=True))
2543
except dbus.exceptions.NameExistsException as e:
3034
2544
logger.error("Disabling D-Bus:", exc_info=e)
3035
2545
use_dbus = False
3036
2546
server_settings["use_dbus"] = False
3037
2547
tcp_server.use_dbus = False
3038
2548
if zeroconf:
3039
2549
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3040
service = AvahiServiceToSyslog(
3041
name = server_settings["servicename"],
3042
servicetype = "_mandos._tcp",
3043
protocol = protocol,
3044
bus = bus)
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
3045
2554
if server_settings["interface"]:
3046
service.interface = if_nametoindex(
3047
server_settings["interface"].encode("utf-8"))
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
3048
2557
3049
2558
global multiprocessing_manager
3050
2559
multiprocessing_manager = multiprocessing.Manager()
3069
2578
if server_settings["restore"]:
3070
2579
try:
3071
2580
with open(stored_state_path, "rb") as stored_state:
3072
if sys.version_info.major == 2:
3073
clients_data, old_client_settings = pickle.load(
3074
stored_state)
3075
else:
3076
bytes_clients_data, bytes_old_client_settings = (
3077
pickle.load(stored_state, encoding = "bytes"))
3078
### Fix bytes to strings
3079
## clients_data
3080
# .keys()
3081
clients_data = { (key.decode("utf-8")
3082
if isinstance(key, bytes)
3083
else key): value
3084
for key, value in
3085
bytes_clients_data.items() }
3086
del bytes_clients_data
3087
for key in clients_data:
3088
value = { (k.decode("utf-8")
3089
if isinstance(k, bytes) else k): v
3090
for k, v in
3091
clients_data[key].items() }
3092
clients_data[key] = value
3093
# .client_structure
3094
value["client_structure"] = [
3095
(s.decode("utf-8")
3096
if isinstance(s, bytes)
3097
else s) for s in
3098
value["client_structure"] ]
3099
# .name & .host
3100
for k in ("name", "host"):
3101
if isinstance(value[k], bytes):
3102
value[k] = value[k].decode("utf-8")
3103
## old_client_settings
3104
# .keys()
3105
old_client_settings = {
3106
(key.decode("utf-8")
3107
if isinstance(key, bytes)
3108
else key): value
3109
for key, value in
3110
bytes_old_client_settings.items() }
3111
del bytes_old_client_settings
3112
# .host
3113
for value in old_client_settings.values():
3114
if isinstance(value["host"], bytes):
3115
value["host"] = (value["host"]
3116
.decode("utf-8"))
2581
clients_data, old_client_settings = (pickle.load
2582
(stored_state))
3117
2583
os.remove(stored_state_path)
3118
2584
except IOError as e:
3119
2585
if e.errno == errno.ENOENT:
3120
logger.warning("Could not load persistent state:"
3121
" {}".format(os.strerror(e.errno)))
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
3122
2588
else:
3123
2589
logger.critical("Could not load persistent state:",
3124
2590
exc_info=e)
3125
2591
raise
3126
2592
except EOFError as e:
3127
2593
logger.warning("Could not load persistent state: "
3128
"EOFError:",
3129
exc_info=e)
2594
"EOFError:", exc_info=e)
3130
2595
3131
2596
with PGPEngine() as pgp:
3132
for client_name, client in clients_data.items():
2597
for client_name, client in clients_data.iteritems():
3133
2598
# Skip removed clients
3134
2599
if client_name not in client_settings:
3135
2600
continue
3144
2609
# For each value in new config, check if it
3145
2610
# differs from the old config value (Except for
3146
2611
# the "secret" attribute)
3147
if (name != "secret"
3148
and (value !=
3149
old_client_settings[client_name][name])):
2612
if (name != "secret" and
2613
value != old_client_settings[client_name]
2614
[name]):
3150
2615
client[name] = value
3151
2616
except KeyError:
3152
2617
pass
3153
2618
3154
2619
# Clients who has passed its expire date can still be
3155
# enabled if its last checker was successful. A Client
2620
# enabled if its last checker was successful. Clients
3156
2621
# whose checker succeeded before we stored its state is
3157
2622
# assumed to have successfully run all checkers during
3158
2623
# downtime.
3160
2625
if datetime.datetime.utcnow() >= client["expires"]:
3161
2626
if not client["last_checked_ok"]:
3162
2627
logger.warning(
3163
"disabling client {} - Client never "
3164
"performed a successful checker".format(
3165
client_name))
2628
"disabling client {0} - Client never "
2629
"performed a successful checker"
2630
.format(client_name))
3166
2631
client["enabled"] = False
3167
2632
elif client["last_checker_status"] != 0:
3168
2633
logger.warning(
3169
"disabling client {} - Client last"
3170
" checker failed with error code"
3171
" {}".format(
3172
client_name,
3173
client["last_checker_status"]))
2634
"disabling client {0} - Client "
2635
"last checker failed with error code {1}"
2636
.format(client_name,
2637
client["last_checker_status"]))
3174
2638
client["enabled"] = False
3175
2639
else:
3176
client["expires"] = (
3177
datetime.datetime.utcnow()
3178
+ client["timeout"])
2640
client["expires"] = (datetime.datetime
2641
.utcnow()
2642
+ client["timeout"])
3179
2643
logger.debug("Last checker succeeded,"
3180
" keeping {} enabled".format(
3181
client_name))
2644
" keeping {0} enabled"
2645
.format(client_name))
3182
2646
try:
3183
client["secret"] = pgp.decrypt(
3184
client["encrypted_secret"],
3185
client_settings[client_name]["secret"])
2647
client["secret"] = (
2648
pgp.decrypt(client["encrypted_secret"],
2649
client_settings[client_name]
2650
["secret"]))
3186
2651
except PGPError:
3187
2652
# If decryption fails, we use secret from new settings
3188
logger.debug("Failed to decrypt {} old secret".format(
3189
client_name))
3190
client["secret"] = (client_settings[client_name]
3191
["secret"])
2653
logger.debug("Failed to decrypt {0} old secret"
2654
.format(client_name))
2655
client["secret"] = (
2656
client_settings[client_name]["secret"])
3192
2657
3193
2658
# Add/remove clients based on new changes made to config
3194
2659
for client_name in (set(old_client_settings)
3199
2664
clients_data[client_name] = client_settings[client_name]
3200
2665
3201
2666
# Create all client objects
3202
for client_name, client in clients_data.items():
2667
for client_name, client in clients_data.iteritems():
3203
2668
tcp_server.clients[client_name] = client_class(
3204
name = client_name,
3205
settings = client,
2669
name = client_name, settings = client,
3206
2670
server_settings = server_settings)
3207
2671
3208
2672
if not tcp_server.clients:
3210
2674
3211
2675
if not foreground:
3212
2676
if pidfile is not None:
3213
pid = os.getpid()
3214
2677
try:
3215
2678
with pidfile:
3216
print(pid, file=pidfile)
2679
pid = os.getpid()
2680
pidfile.write(str(pid) + "\n".encode("utf-8"))
3217
2681
except IOError:
3218
2682
logger.error("Could not write to file %r with PID %d",
3219
2683
pidfilename, pid)
3220
2684
del pidfile
3221
2685
del pidfilename
3222
2686
3223
for termsig in (signal.SIGHUP, signal.SIGTERM):
3224
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3225
lambda: main_loop.quit() and False)
2687
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2688
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3226
2689
3227
2690
if use_dbus:
3228
3229
@alternate_dbus_interfaces(
3230
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3231
class MandosDBusService(DBusObjectWithObjectManager):
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2693
class MandosDBusService(DBusObjectWithProperties):
3232
2694
"""A D-Bus proxy object"""
3233
3234
2695
def __init__(self):
3235
2696
dbus.service.Object.__init__(self, bus, "/")
3236
3237
2697
_interface = "se.recompile.Mandos"
3238
2698
2699
@dbus_interface_annotations(_interface)
2700
def _foo(self):
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
2703
"false"}
2704
3239
2705
@dbus.service.signal(_interface, signature="o")
3240
2706
def ClientAdded(self, objpath):
3241
2707
"D-Bus signal"
3246
2712
"D-Bus signal"
3247
2713
pass
3248
2714
3249
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3250
"true"})
3251
2715
@dbus.service.signal(_interface, signature="os")
3252
2716
def ClientRemoved(self, objpath, name):
3253
2717
"D-Bus signal"
3254
2718
pass
3255
2719
3256
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3257
"true"})
3258
2720
@dbus.service.method(_interface, out_signature="ao")
3259
2721
def GetAllClients(self):
3260
2722
"D-Bus method"
3261
return dbus.Array(c.dbus_object_path for c in
3262
tcp_server.clients.values())
2723
return dbus.Array(c.dbus_object_path
2724
for c in
2725
tcp_server.clients.itervalues())
3263
2726
3264
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3265
"true"})
3266
2727
@dbus.service.method(_interface,
3267
2728
out_signature="a{oa{sv}}")
3268
2729
def GetAllClientsWithProperties(self):
3269
2730
"D-Bus method"
3270
2731
return dbus.Dictionary(
3271
{ c.dbus_object_path: c.GetAll(
3272
"se.recompile.Mandos.Client")
3273
for c in tcp_server.clients.values() },
2732
((c.dbus_object_path, c.GetAll(""))
2733
for c in tcp_server.clients.itervalues()),
3274
2734
signature="oa{sv}")
3275
2735
3276
2736
@dbus.service.method(_interface, in_signature="o")
3277
2737
def RemoveClient(self, object_path):
3278
2738
"D-Bus method"
3279
for c in tcp_server.clients.values():
2739
for c in tcp_server.clients.itervalues():
3280
2740
if c.dbus_object_path == object_path:
3281
2741
del tcp_server.clients[c.name]
3282
2742
c.remove_from_connection()
3283
# Don't signal the disabling
2743
# Don't signal anything except ClientRemoved
3284
2744
c.disable(quiet=True)
3285
# Emit D-Bus signal for removal
3286
self.client_removed_signal(c)
2745
# Emit D-Bus signal
2746
self.ClientRemoved(object_path, c.name)
3287
2747
return
3288
2748
raise KeyError(object_path)
3289
2749
3290
2750
del _interface
3291
3292
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3293
out_signature = "a{oa{sa{sv}}}")
3294
def GetManagedObjects(self):
3295
"""D-Bus method"""
3296
return dbus.Dictionary(
3297
{ client.dbus_object_path:
3298
dbus.Dictionary(
3299
{ interface: client.GetAll(interface)
3300
for interface in
3301
client._get_all_interface_names()})
3302
for client in tcp_server.clients.values()})
3303
3304
def client_added_signal(self, client):
3305
"""Send the new standard signal and the old signal"""
3306
if use_dbus:
3307
# New standard signal
3308
self.InterfacesAdded(
3309
client.dbus_object_path,
3310
dbus.Dictionary(
3311
{ interface: client.GetAll(interface)
3312
for interface in
3313
client._get_all_interface_names()}))
3314
# Old signal
3315
self.ClientAdded(client.dbus_object_path)
3316
3317
def client_removed_signal(self, client):
3318
"""Send the new standard signal and the old signal"""
3319
if use_dbus:
3320
# New standard signal
3321
self.InterfacesRemoved(
3322
client.dbus_object_path,
3323
client._get_all_interface_names())
3324
# Old signal
3325
self.ClientRemoved(client.dbus_object_path,
3326
client.name)
3327
2751
3328
2752
mandos_dbus_service = MandosDBusService()
3329
2753
3330
# Save modules to variables to exempt the modules from being
3331
# unloaded before the function registered with atexit() is run.
3332
mp = multiprocessing
3333
wn = wnull
3334
2754
def cleanup():
3335
2755
"Cleanup function; run on exit"
3336
2756
if zeroconf:
3337
2757
service.cleanup()
3338
2758
3339
mp.active_children()
3340
wn.close()
2759
multiprocessing.active_children()
2760
wnull.close()
3341
2761
if not (tcp_server.clients or client_settings):
3342
2762
return
3343
2763
3346
2766
# removed/edited, old secret will thus be unrecovable.
3347
2767
clients = {}
3348
2768
with PGPEngine() as pgp:
3349
for client in tcp_server.clients.values():
2769
for client in tcp_server.clients.itervalues():
3350
2770
key = client_settings[client.name]["secret"]
3351
2771
client.encrypted_secret = pgp.encrypt(client.secret,
3352
2772
key)
3354
2774
3355
2775
# A list of attributes that can not be pickled
3356
2776
# + secret.
3357
exclude = { "bus", "changedstate", "secret",
3358
"checker", "server_settings" }
3359
for name, typ in inspect.getmembers(dbus.service
3360
.Object):
2777
exclude = set(("bus", "changedstate", "secret",
2778
"checker", "server_settings"))
2779
for name, typ in (inspect.getmembers
2780
(dbus.service.Object)):
3361
2781
exclude.add(name)
3362
2782
3363
2783
client_dict["encrypted_secret"] = (client
3370
2790
del client_settings[client.name]["secret"]
3371
2791
3372
2792
try:
3373
with tempfile.NamedTemporaryFile(
3374
mode='wb',
3375
suffix=".pickle",
3376
prefix='clients-',
3377
dir=os.path.dirname(stored_state_path),
3378
delete=False) as stored_state:
3379
pickle.dump((clients, client_settings), stored_state,
3380
protocol = 2)
3381
tempname = stored_state.name
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
2797
pickle.dump((clients, client_settings), stored_state)
2798
tempname=stored_state.name
3382
2799
os.rename(tempname, stored_state_path)
3383
2800
except (IOError, OSError) as e:
3384
2801
if not debug:
3387
2804
except NameError:
3388
2805
pass
3389
2806
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3390
logger.warning("Could not save persistent state: {}"
2807
logger.warning("Could not save persistent state: {0}"
3391
2808
.format(os.strerror(e.errno)))
3392
2809
else:
3393
2810
logger.warning("Could not save persistent state:",
3399
2816
name, client = tcp_server.clients.popitem()
3400
2817
if use_dbus:
3401
2818
client.remove_from_connection()
3402
# Don't signal the disabling
2819
# Don't signal anything except ClientRemoved
3403
2820
client.disable(quiet=True)
3404
# Emit D-Bus signal for removal
3405
2821
if use_dbus:
3406
mandos_dbus_service.client_removed_signal(client)
2822
# Emit D-Bus signal
2823
mandos_dbus_service.ClientRemoved(client
2824
.dbus_object_path,
2825
client.name)
3407
2826
client_settings.clear()
3408
2827
3409
2828
atexit.register(cleanup)
3410
2829
3411
for client in tcp_server.clients.values():
2830
for client in tcp_server.clients.itervalues():
3412
2831
if use_dbus:
3413
# Emit D-Bus signal for adding
3414
mandos_dbus_service.client_added_signal(client)
2832
# Emit D-Bus signal
2833
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3415
2834
# Need to initiate checking of clients
3416
2835
if client.enabled:
3417
2836
client.init_checker()
3443
2862
sys.exit(1)
3444
2863
# End of Avahi example code
3445
2864
3446
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3447
lambda *args, **kwargs:
3448
(tcp_server.handle_request
3449
(*args[2:], **kwargs) or True))
2865
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2866
lambda *args, **kwargs:
2867
(tcp_server.handle_request
2868
(*args[2:], **kwargs) or True))
3450
2869
3451
2870
logger.debug("Starting main loop")
3452
2871
main_loop.run()
3462
2881
# Must run before the D-Bus bus name gets deregistered
3463
2882
cleanup()
3464
2883
3465
3466
2884
if __name__ == '__main__':
3467
2885
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0