/mandos/release : revision 237.7.332

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

38

43

import socket

39

44

import argparse

40

45

import datetime

45

50

import gnutls.library.functions

46

51

import gnutls.library.constants

47

52

import gnutls.library.types

48

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

49

57

import sys

50

58

import re

51

59

import os

60

68

import struct

61

69

import fcntl

62

70

import functools

63

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

64

75

import multiprocessing

65

76

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

81

import codecs

66

82

67

83

import dbus

68

84

import dbus.service

69

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

70

89

import avahi

71

90

from dbus.mainloop.glib import DBusGMainLoop

72

91

import ctypes

82

101

except ImportError:

83

102

SO_BINDTODEVICE = None

84

103

85

86

version = "1.4.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

90

syslogger = (logging.handlers.SysLogHandler

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

108

stored_state_file = "clients.pickle"

109

110

logger = logging.getLogger()

111

syslogger = None

112

113

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

116

except (OSError, AttributeError):

117

118

def if_nametoindex(interface):

119

"Get an interface index the hard way, i.e. using fcntl()"

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

with contextlib.closing(socket.socket()) as s:

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

125

return interface_index

126

127

128

def initlogger(debug, level=logging.WARNING):

129

"""init logger and add loglevel"""

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

syslogger.setFormatter(logging.Formatter

136

('Mandos [%(process)d]: %(levelname)s:'

137

' %(message)s'))

138

logger.addHandler(syslogger)

139

140

if debug:

141

console = logging.StreamHandler()

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

147

logger.setLevel(level)

148

149

150

class PGPError(Exception):

151

"""Exception if encryption/decryption fails"""

152

pass

153

154

155

class PGPEngine(object):

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

def __init__(self):

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

165

166

def __enter__(self):

167

return self

168

169

def __exit__(self, exc_type, exc_value, traceback):

170

self._cleanup()

171

return False

172

173

def __del__(self):

174

self._cleanup()

175

176

def _cleanup(self):

177

if self.tempdir is not None:

178

# Delete contents of tempdir

179

for root, dirs, files in os.walk(self.tempdir,

180

topdown = False):

181

for filename in files:

182

os.remove(os.path.join(root, filename))

183

for dirname in dirs:

184

os.rmdir(os.path.join(root, dirname))

185

# Remove tempdir

186

os.rmdir(self.tempdir)

187

self.tempdir = None

188

189

def password_encode(self, password):

190

# Passphrase can not be empty and can not contain newlines or

191

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

199

200

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

216

return ciphertext

217

218

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

234

return decrypted_plaintext

235

103

236

104

237

class AvahiError(Exception):

105

238

def __init__(self, value, *args, **kwargs):

106

239

self.value = value

107

super(AvahiError, self).__init__(value, *args, **kwargs)

108

def __unicode__(self):

109

return unicode(repr(self.value))

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

110

243

111

244

class AvahiServiceError(AvahiError):

112

245

pass

113

246

247

114

248

class AvahiGroupError(AvahiError):

115

249

pass

116

250

123

257

Used to optionally bind to the specified interface.

124

258

name: string; Example: 'Mandos'

125

259

type: string; Example: '_mandos._tcp'.

126

See <http://www.dns-sd.org/ServiceTypes.html>

260

See <https://www.iana.org/assignments/service-names-port-numbers>

127

261

port: integer; what port to announce

128

262

TXT: list of strings; TXT record for the service

129

263

domain: string; Domain to publish on, default to .local if empty.

135

269

server: D-Bus Server

136

270

bus: dbus.SystemBus()

137

271

"""

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

141

protocol = avahi.PROTO_UNSPEC, bus = None):

272

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

142

284

self.interface = interface

143

285

self.name = name

144

286

self.type = servicetype

153

295

self.server = None

154

296

self.bus = bus

155

297

self.entry_group_state_changed_match = None

156

def rename(self):

298

299

def rename(self, remove=True):

157

300

"""Derived from the Avahi example code"""

158

301

if self.rename_count >= self.max_renames:

159

302

logger.critical("No suitable Zeroconf service name found"

160

303

" after %i retries, exiting.",

161

304

self.rename_count)

162

305

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

165

309

logger.info("Changing Zeroconf service name to %r ...",

166

310

self.name)

167

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

170

% self.name))

171

self.remove()

311

if remove:

312

self.remove()

172

313

try:

173

314

self.add()

174

315

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

176

self.cleanup()

177

os._exit(1)

178

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

324

179

325

def remove(self):

180

326

"""Derived from the Avahi example code"""

181

327

if self.entry_group_state_changed_match is not None:

183

329

self.entry_group_state_changed_match = None

184

330

if self.group is not None:

185

331

self.group.Reset()

332

186

333

def add(self):

187

334

"""Derived from the Avahi example code"""

188

335

self.remove()

193

340

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

341

self.entry_group_state_changed_match = (

195

342

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

343

'StateChanged', self.entry_group_state_changed))

197

344

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

198

345

self.name, self.type)

199

346

self.group.AddService(

205

352

dbus.UInt16(self.port),

206

353

avahi.string_array_to_txt_array(self.TXT))

207

354

self.group.Commit()

355

208

356

def entry_group_state_changed(self, state, error):

209

357

"""Derived from the Avahi example code"""

210

358

logger.debug("Avahi entry group state change: %i", state)

216

364

self.rename()

217

365

elif state == avahi.ENTRY_GROUP_FAILURE:

218

366

logger.critical("Avahi: Error in group state changed %s",

219

unicode(error))

220

raise AvahiGroupError("State changed: %s"

221

% unicode(error))

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

369

222

370

def cleanup(self):

223

371

"""Derived from the Avahi example code"""

224

372

if self.group is not None:

225

373

try:

226

374

self.group.Free()

227

375

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

376

dbus.exceptions.DBusException):

229

377

pass

230

378

self.group = None

231

379

self.remove()

380

232

381

def server_state_changed(self, state, error=None):

233

382

"""Derived from the Avahi example code"""

234

383

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

242

390

if state in bad_states:

243

391

if bad_states[state] is not None:

244

392

if error is None:

247

395

logger.error(bad_states[state] + ": %r", error)

248

396

self.cleanup()

249

397

elif state == avahi.SERVER_RUNNING:

250

self.add()

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

251

410

else:

252

411

if error is None:

253

412

logger.debug("Unknown state: %r", state)

254

413

else:

255

414

logger.debug("Unknown state: %r: %r", state, error)

415

256

416

def activate(self):

257

417

"""Derived from the Avahi example code"""

258

418

if self.server is None:

262

422

follow_name_owner_changes=True),

263

423

avahi.DBUS_INTERFACE_SERVER)

264

424

self.server.connect_to_signal("StateChanged",

265

self.server_state_changed)

425

self.server_state_changed)

266

426

self.server_state_changed(self.server.GetState())

267

427

268

428

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

429

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

431

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

436

return ret

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

275

448

class Client(object):

276

449

"""A representation of a client host served by this server.

277

450

278

451

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

452

approved: bool(); 'None' if not yet approved/disapproved

280

453

approval_delay: datetime.timedelta(); Time to wait for approval

281

454

approval_duration: datetime.timedelta(); Duration of one approval

282

455

checker: subprocess.Popen(); a running checker process used

289

462

instance %(name)s can be used in the command.

290

463

checker_initiator_tag: a gobject event source tag, or None

291

464

created: datetime.datetime(); (UTC) object creation

465

client_structure: Object describing what attributes a client has

466

and is used for storing the client at exit

292

467

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

468

disable_initiator_tag: a gobject event source tag, or None

295

469

enabled: bool()

296

470

fingerprint: string (40 or 32 hexadecimal digits); used to

299

473

interval: datetime.timedelta(); How often to start a new checker

300

474

last_approval_request: datetime.datetime(); (UTC) or None

301

475

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

476

last_checker_status: integer between 0 and 255 reflecting exit

477

status of last checker. -1 reflects crashed

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

last_enabled: datetime.datetime(); (UTC) or None

303

482

name: string; from the config file, used in log messages and

304

483

D-Bus identifiers

305

484

secret: bytestring; sent verbatim (over TLS) to client

306

485

timeout: datetime.timedelta(); How long from last_checked_ok

307

486

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

487

extended_timeout: extra long timeout when secret has been sent

309

488

runtime_expansions: Allowed attributes for runtime expansion.

310

489

expires: datetime.datetime(); time (UTC) when a client will be

311

490

disabled, or None

491

server_settings: The server_settings dict from main()

312

492

"""

313

493

314

494

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

495

"created", "enabled", "expires",

496

"fingerprint", "host", "interval",

497

"last_approval_request", "last_checked_ok",

317

498

"last_enabled", "name", "timeout")

318

319

def timeout_milliseconds(self):

320

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

326

327

def interval_milliseconds(self):

328

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

333

334

def __init__(self, name = None, disable_hook=None, config=None):

335

"""Note: the 'checker' key in 'config' sets the

336

'checker_command' attribute and *not* the 'checker'

337

attribute."""

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

510

511

@staticmethod

512

def config_parser(config):

513

"""Construct a new dict of client settings of this form:

514

{ client_name: {setting_name: value, ...}, ...}

515

with exceptions for any special settings as defined above.

516

NOTE: Must be a pure function. Must return the same result

517

value given the same arguments.

518

"""

519

settings = {}

520

for client_name in config.sections():

521

section = dict(config.items(client_name))

522

client = settings[client_name] = {}

523

524

client["host"] = section["host"]

525

# Reformat values from string types to Python types

526

client["approved_by_default"] = config.getboolean(

527

client_name, "approved_by_default")

528

client["enabled"] = config.getboolean(client_name,

529

"enabled")

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

535

.replace(" ", ""))

536

if "secret" in section:

537

client["secret"] = section["secret"].decode("base64")

538

elif "secfile" in section:

539

with open(os.path.expanduser(os.path.expandvars

540

(section["secfile"])),

541

"rb") as secfile:

542

client["secret"] = secfile.read()

543

else:

544

raise TypeError("No secret or secfile for section {}"

545

.format(section))

546

client["timeout"] = string_to_delta(section["timeout"])

547

client["extended_timeout"] = string_to_delta(

548

section["extended_timeout"])

549

client["interval"] = string_to_delta(section["interval"])

550

client["approval_delay"] = string_to_delta(

551

section["approval_delay"])

552

client["approval_duration"] = string_to_delta(

553

section["approval_duration"])

554

client["checker_command"] = section["checker"]

555

client["last_approval_request"] = None

556

client["last_checked_ok"] = None

557

client["last_checker_status"] = -2

558

559

return settings

560

561

def __init__(self, settings, name = None, server_settings=None):

338

562

self.name = name

339

if config is None:

340

config = {}

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

566

# adding all client settings

567

for setting, value in settings.items():

568

setattr(self, setting, value)

569

570

if self.enabled:

571

if not hasattr(self, "last_enabled"):

572

self.last_enabled = datetime.datetime.utcnow()

573

if not hasattr(self, "expires"):

574

self.expires = (datetime.datetime.utcnow()

575

+ self.timeout)

576

else:

577

self.last_enabled = None

578

self.expires = None

579

341

580

logger.debug("Creating client %r", self.name)

342

# Uppercase and remove spaces from fingerprint for later

343

# comparison purposes with return value from the fingerprint()

344

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

581

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

351

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

353

"rb") as secfile:

354

self.secret = secfile.read()

355

else:

356

raise TypeError("No secret or secfile for client %s"

357

% self.name)

358

self.host = config.get("host", "")

359

self.created = datetime.datetime.utcnow()

360

self.enabled = False

361

self.last_approval_request = None

362

self.last_enabled = None

363

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

368

self.disable_hook = disable_hook

582

self.created = settings.get("created",

583

datetime.datetime.utcnow())

584

585

# attributes specific for this server instance

369

586

self.checker = None

370

587

self.checker_initiator_tag = None

371

588

self.disable_initiator_tag = None

372

self.expires = None

373

589

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

375

590

self.current_checker_command = None

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

591

self.approved = None

380

592

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

597

if not attr.startswith("_")]

598

self.client_structure.append("client_structure")

599

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

602

if not name.startswith("_"):

603

self.client_structure.append(name)

388

604

605

# Send notice to process children that client state has changed

389

606

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

607

with self.changedstate:

608

self.changedstate.notify_all()

393

609

394

610

def enable(self):

395

611

"""Start this client's checker and timeout hooks"""

396

612

if getattr(self, "enabled", False):

397

613

# Already enabled

398

614

return

399

self.send_changedstate()

400

# Schedule a new checker to be started an 'interval' from now,

401

# and every interval from then on.

402

self.checker_initiator_tag = (gobject.timeout_add

403

(self.interval_milliseconds(),

404

self.start_checker))

405

# Schedule a disable() when 'timeout' has passed

406

615

self.expires = datetime.datetime.utcnow() + self.timeout

407

self.disable_initiator_tag = (gobject.timeout_add

408

(self.timeout_milliseconds(),

409

self.disable))

410

616

self.enabled = True

411

617

self.last_enabled = datetime.datetime.utcnow()

412

# Also start a new checker *right now*.

413

self.start_checker()

618

self.init_checker()

619

self.send_changedstate()

414

620

415

621

def disable(self, quiet=True):

416

622

"""Disable this client."""

417

623

if not getattr(self, "enabled", False):

418

624

return False

419

625

if not quiet:

420

self.send_changedstate()

421

if not quiet:

422

626

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

627

if getattr(self, "disable_initiator_tag", None) is not None:

424

628

gobject.source_remove(self.disable_initiator_tag)

425

629

self.disable_initiator_tag = None

426

630

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

631

if getattr(self, "checker_initiator_tag", None) is not None:

428

632

gobject.source_remove(self.checker_initiator_tag)

429

633

self.checker_initiator_tag = None

430

634

self.stop_checker()

431

if self.disable_hook:

432

self.disable_hook(self)

433

635

self.enabled = False

636

if not quiet:

637

self.send_changedstate()

434

638

# Do not run this again if called by a gobject.timeout_add

435

639

return False

436

640

437

641

def __del__(self):

438

self.disable_hook = None

439

642

self.disable()

440

643

441

def checker_callback(self, pid, condition, command):

644

def init_checker(self):

645

# Schedule a new checker to be started an 'interval' from now,

646

# and every interval from then on.

647

if self.checker_initiator_tag is not None:

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

652

# Schedule a disable() when 'timeout' has passed

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

657

# Also start a new checker *right now*.

658

self.start_checker()

659

660

def checker_callback(self, source, condition, connection,

661

command):

442

662

"""The checker has completed, so take appropriate actions."""

443

663

self.checker_callback_tag = None

444

664

self.checker = None

445

if os.WIFEXITED(condition):

446

exitstatus = os.WEXITSTATUS(condition)

447

if exitstatus == 0:

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

672

if self.last_checker_status == 0:

448

673

logger.info("Checker for %(name)s succeeded",

449

674

vars(self))

450

675

self.checked_ok()

451

676

else:

452

logger.info("Checker for %(name)s failed",

453

vars(self))

677

logger.info("Checker for %(name)s failed", vars(self))

454

678

else:

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

455

681

logger.warning("Checker for %(name)s crashed?",

456

682

vars(self))

457

458

def checked_ok(self, timeout=None):

459

"""Bump up the timeout for this client.

460

461

This should only be called when the client has been seen,

462

alive and well.

463

"""

683

return False

684

685

def checked_ok(self):

686

"""Assert that the client has been seen, alive and well."""

687

self.last_checked_ok = datetime.datetime.utcnow()

688

self.last_checker_status = 0

689

self.last_checker_signal = None

690

self.bump_timeout()

691

692

def bump_timeout(self, timeout=None):

693

"""Bump up the timeout for this client."""

464

694

if timeout is None:

465

695

timeout = self.timeout

466

self.last_checked_ok = datetime.datetime.utcnow()

467

696

if self.disable_initiator_tag is not None:

468

697

gobject.source_remove(self.disable_initiator_tag)

698

self.disable_initiator_tag = None

469

699

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

473

702

self.expires = datetime.datetime.utcnow() + timeout

474

703

475

704

def need_approval(self):

481

710

If a checker already exists, leave it running and do

482

711

nothing."""

483

712

# The reason for not killing a running checker is that if we

484

# did that, then if a checker (for some reason) started

485

# running slowly and taking more than 'interval' time, the

486

# client would inevitably timeout, since no checker would get

487

# a chance to run to completion. If we instead leave running

713

# did that, and if a checker (for some reason) started running

714

# slowly and taking more than 'interval' time, then the client

715

# would inevitably timeout, since no checker would get a

716

# chance to run to completion. If we instead leave running

488

717

# checkers alone, the checker would have to take more time

489

718

# than 'timeout' for the client to be disabled, which is as it

490

719

# should be.

491

720

492

# If a checker exists, make sure it is not a zombie

493

try:

494

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

495

except (AttributeError, OSError) as error:

496

if (isinstance(error, OSError)

497

and error.errno != errno.ECHILD):

498

raise error

499

else:

500

if pid:

501

logger.warning("Checker was a zombie")

502

gobject.source_remove(self.checker_callback_tag)

503

self.checker_callback(pid, status,

504

self.current_checker_command)

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

505

725

# Start a new checker if needed

506

726

if self.checker is None:

727

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

507

731

try:

508

# In case checker_command has exactly one % operator

509

command = self.checker_command % self.host

510

except TypeError:

511

# Escape attributes for the shell

512

escaped_attrs = dict(

513

(attr,

514

re.escape(unicode(str(getattr(self, attr, "")),

515

errors=

516

'replace')))

517

for attr in

518

self.runtime_expansions)

519

520

try:

521

command = self.checker_command % escaped_attrs

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

525

return True # Try again later

732

command = self.checker_command % escaped_attrs

733

except TypeError as error:

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

526

738

self.current_checker_command = command

527

try:

528

logger.info("Starting checker %r for %s",

529

command, self.name)

530

# We don't need to redirect stdout and stderr, since

531

# in normal mode, that is already done by daemon(),

532

# and in debug mode we don't want to. (Stdin is

533

# always replaced by /dev/null.)

534

self.checker = subprocess.Popen(command,

535

close_fds=True,

536

shell=True, cwd="/")

537

self.checker_callback_tag = (gobject.child_watch_add

538

(self.checker.pid,

539

self.checker_callback,

540

data=command))

541

# The checker may have completed before the gobject

542

# watch was added. Check for this.

543

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

544

if pid:

545

gobject.source_remove(self.checker_callback_tag)

546

self.checker_callback(pid, status, command)

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

549

error)

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

550

764

# Re-run this periodically if run by gobject.timeout_add

551

765

return True

552

766

558

772

if getattr(self, "checker", None) is None:

559

773

return

560

774

logger.debug("Stopping checker for %(name)s", vars(self))

561

try:

562

os.kill(self.checker.pid, signal.SIGTERM)

563

#time.sleep(0.5)

564

#if self.checker.poll() is None:

565

# os.kill(self.checker.pid, signal.SIGKILL)

566

except OSError as error:

567

if error.errno != errno.ESRCH: # No such process

568

raise

775

self.checker.terminate()

569

776

self.checker = None

570

777

571

778

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

574

783

"""Decorators for marking methods of a DBusObjectWithProperties to

575

784

become properties on the D-Bus.

576

785

585

794

# "Set" method, so we fail early here:

586

795

if byte_arrays and signature != "ay":

587

796

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

797

" signature {!r}".format(signature))

798

589

799

def decorator(func):

590

800

func._dbus_is_property = True

591

801

func._dbus_interface = dbus_interface

596

806

func._dbus_name = func._dbus_name[:-14]

597

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

598

808

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

"""

848

849

def decorator(func):

850

func._dbus_annotations = annotations

851

return func

852

599

853

return decorator

600

854

601

855

602

856

class DBusPropertyException(dbus.exceptions.DBusException):

603

857

"""A base class for D-Bus property-related exceptions

604

858

"""

605

def __unicode__(self):

606

return unicode(str(self))

859

pass

607

860

608

861

609

862

class DBusPropertyAccessException(DBusPropertyException):

618

871

pass

619

872

620

873

621

class DBusObjectWithProperties(dbus.service.Object):

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

876

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

879

"""

880

881

@staticmethod

882

def _is_dbus_thing(thing):

883

"""Returns a function testing if an attribute is a D-Bus thing

884

885

If called like _is_dbus_thing("method") it returns a function

886

suitable for use as predicate to inspect.getmembers().

887

"""

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

889

False)

890

891

def _get_all_dbus_things(self, thing):

892

"""Returns a generator of (name, attribute) pairs

893

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

895

athing.__get__(self))

896

for cls in self.__class__.__mro__

897

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

622

964

"""A D-Bus object with properties.

623

965

624

966

Classes inheriting from this can use the dbus_service_property

626

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

627

969

"""

628

970

629

@staticmethod

630

def _is_dbus_property(obj):

631

return getattr(obj, "_dbus_is_property", False)

632

633

def _get_all_dbus_properties(self):

634

"""Returns a generator of (name, attribute) pairs

635

"""

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

638

for name, prop in

639

inspect.getmembers(cls, self._is_dbus_property))

640

641

971

def _get_dbus_property(self, interface_name, property_name):

642

972

"""Returns a bound method if one exists which is a D-Bus

643

973

property with the specified name and interface.

644

974

"""

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

648

978

if (value._dbus_name == property_name

649

979

and value._dbus_interface == interface_name):

650

980

return value.__get__(self)

651

981

652

982

# No such property

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

655

+ property_name)

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

656

985

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

986

@dbus.service.method(dbus.PROPERTIES_IFACE,

987

in_signature="ss",

658

988

out_signature="v")

659

989

def Get(self, interface_name, property_name):

660

990

"""Standard D-Bus property Get() method, see D-Bus standard.

678

1008

# The byte_arrays option is not supported yet on

679

1009

# signatures other than "ay".

680

1010

if prop._dbus_signature != "ay":

681

raise ValueError

682

value = dbus.ByteArray(''.join(unichr(byte)

683

for byte in value))

1011

raise ValueError("Byte arrays not supported for non-"

1012

"'ay' signature {!r}"

1013

.format(prop._dbus_signature))

1014

value = dbus.ByteArray(b''.join(chr(byte)

1015

for byte in value))

684

1016

prop(value)

685

1017

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1018

@dbus.service.method(dbus.PROPERTIES_IFACE,

1019

in_signature="s",

687

1020

out_signature="a{sv}")

688

1021

def GetAll(self, interface_name):

689

1022

"""Standard D-Bus property GetAll() method, see D-Bus

691

1024

692

1025

Note: Will not include properties with access="write".

693

1026

"""

694

all = {}

695

for name, prop in self._get_all_dbus_properties():

1027

properties = {}

1028

for name, prop in self._get_all_dbus_things("property"):

696

1029

if (interface_name

697

1030

and interface_name != prop._dbus_interface):

698

1031

# Interface non-empty but did not match

702

1035

continue

703

1036

value = prop()

704

1037

if not hasattr(value, "variant_level"):

705

all[name] = value

1038

properties[name] = value

706

1039

continue

707

all[name] = type(value)(value, variant_level=

708

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

1040

properties[name] = type(value)(

1041

value, variant_level = value.variant_level + 1)

1042

return dbus.Dictionary(properties, signature="sv")

1043

1044

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1045

def PropertiesChanged(self, interface_name, changed_properties,

1046

invalidated_properties):

1047

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1048

standard.

1049

"""

1050

pass

710

1051

711

1052

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

712

1053

out_signature="s",

713

1054

path_keyword='object_path',

714

1055

connection_keyword='connection')

715

1056

def Introspect(self, object_path, connection):

716

"""Standard D-Bus method, overloaded to insert property tags.

1057

"""Overloading of standard D-Bus method.

1058

1059

Inserts property tags and interface annotation tags.

717

1060

"""

718

xmlstring = dbus.service.Object.Introspect(self, object_path,

719

connection)

1061

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1062

object_path,

1063

connection)

720

1064

try:

721

1065

document = xml.dom.minidom.parseString(xmlstring)

1066

722

1067

def make_tag(document, name, prop):

723

1068

e = document.createElement("property")

724

1069

e.setAttribute("name", name)

725

1070

e.setAttribute("type", prop._dbus_signature)

726

1071

e.setAttribute("access", prop._dbus_access)

727

1072

return e

1073

728

1074

for if_tag in document.getElementsByTagName("interface"):

1075

# Add property tags

729

1076

for tag in (make_tag(document, name, prop)

730

1077

for name, prop

731

in self._get_all_dbus_properties()

1078

in self._get_all_dbus_things("property")

732

1079

if prop._dbus_interface

733

1080

== if_tag.getAttribute("name")):

734

1081

if_tag.appendChild(tag)

1082

# Add annotation tags for properties

1083

for tag in if_tag.getElementsByTagName("property"):

1084

annots = dict()

1085

for name, prop in self._get_all_dbus_things(

1086

"property"):

1087

if (name == tag.getAttribute("name")

1088

and prop._dbus_interface

1089

== if_tag.getAttribute("name")):

1090

annots.update(getattr(

1091

prop, "_dbus_annotations", {}))

1092

for name, value in annots.items():

1093

ann_tag = document.createElement(

1094

"annotation")

1095

ann_tag.setAttribute("name", name)

1096

ann_tag.setAttribute("value", value)

1097

tag.appendChild(ann_tag)

735

1098

# Add the names to the return values for the

736

1099

# "org.freedesktop.DBus.Properties" methods

737

1100

if (if_tag.getAttribute("name")

752

1115

except (AttributeError, xml.dom.DOMException,

753

1116

xml.parsers.expat.ExpatError) as error:

754

1117

logger.error("Failed to override Introspection method",

755

error)

1118

exc_info=error)

756

1119

return xmlstring

757

1120

758

1121

759

def datetime_to_dbus (dt, variant_level=0):

1122

def datetime_to_dbus(dt, variant_level=0):

760

1123

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

1124

if dt is None:

762

1125

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

1126

return dbus.String(dt.isoformat(), variant_level=variant_level)

1127

1128

1129

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1130

"""A class decorator; applied to a subclass of

1131

dbus.service.Object, it will add alternate D-Bus attributes with

1132

interface names according to the "alt_interface_names" mapping.

1133

Usage:

1134

1135

@alternate_dbus_interfaces({"org.example.Interface":

1136

"net.example.AlternateInterface"})

1137

class SampleDBusObject(dbus.service.Object):

1138

@dbus.service.method("org.example.Interface")

1139

def SampleDBusMethod():

1140

pass

1141

1142

The above "SampleDBusMethod" on "SampleDBusObject" will be

1143

reachable via two interfaces: "org.example.Interface" and

1144

"net.example.AlternateInterface", the latter of which will have

1145

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1146

"true", unless "deprecate" is passed with a False value.

1147

1148

This works for methods and signals, and also for D-Bus properties

1149

(from DBusObjectWithProperties) and interfaces (from the

1150

dbus_interface_annotations decorator).

770

1151

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

1152

1153

def wrapper(cls):

1154

for orig_interface_name, alt_interface_name in (

1155

alt_interface_names.items()):

1156

attr = {}

1157

interface_names = set()

1158

# Go though all attributes of the class

1159

for attrname, attribute in inspect.getmembers(cls):

778

1160

# Ignore non-D-Bus attributes, and D-Bus attributes

779

1161

# with the wrong interface name

780

1162

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

1163

or not attribute._dbus_interface.startswith(

1164

orig_interface_name)):

783

1165

continue

784

1166

# Create an alternate D-Bus interface name based on

785

1167

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

1168

alt_interface = attribute._dbus_interface.replace(

1169

orig_interface_name, alt_interface_name)

1170

interface_names.add(alt_interface)

789

1171

# Is this a D-Bus signal?

790

1172

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

1173

if sys.version_info.major == 2:

1174

# Extract the original non-method undecorated

1175

# function by black magic

1176

nonmethod_func = (dict(

794

1177

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

1178

attribute.__closure__))

1179

["func"].cell_contents)

1180

else:

1181

nonmethod_func = attribute

797

1182

# Create a new, but exactly alike, function

798

1183

# object, and decorate it to be a new D-Bus signal

799

1184

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

1185

if sys.version_info.major == 2:

1186

new_function = types.FunctionType(

1187

nonmethod_func.func_code,

1188

nonmethod_func.func_globals,

1189

nonmethod_func.func_name,

1190

nonmethod_func.func_defaults,

1191

nonmethod_func.func_closure)

1192

else:

1193

new_function = types.FunctionType(

1194

nonmethod_func.__code__,

1195

nonmethod_func.__globals__,

1196

nonmethod_func.__name__,

1197

nonmethod_func.__defaults__,

1198

nonmethod_func.__closure__)

1199

new_function = (dbus.service.signal(

1200

alt_interface,

1201

attribute._dbus_signature)(new_function))

1202

# Copy annotations, if any

1203

try:

1204

new_function._dbus_annotations = dict(

1205

attribute._dbus_annotations)

1206

except AttributeError:

1207

pass

809

1208

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

1209

# original and alternate functions, so both the

1210

# original and alternate signals gets sent when

1211

# the function is called

812

1212

def fixscope(func1, func2):

813

1213

"""This function is a scope container to pass

814

1214

func1 and func2 to the "call_both" function

815

1215

outside of its arguments"""

1216

816

1217

def call_both(*args, **kwargs):

817

1218

"""This function will emit two D-Bus

818

1219

signals by calling func1 and func2"""

819

1220

func1(*args, **kwargs)

820

1221

func2(*args, **kwargs)

1222

821

1223

return call_both

822

1224

# Create the "call_both" function and add it to

823

1225

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

1226

attr[attrname] = fixscope(attribute, new_function)

826

1227

# Is this a D-Bus method?

827

1228

elif getattr(attribute, "_dbus_is_method", False):

828

1229

# Create a new, but exactly alike, function

829

1230

# object. Decorate it to be a new D-Bus method

830

1231

# with the alternate D-Bus interface name. Add it

831

1232

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

1233

attr[attrname] = (

1234

dbus.service.method(

1235

alt_interface,

1236

attribute._dbus_in_signature,

1237

attribute._dbus_out_signature)

1238

(types.FunctionType(attribute.func_code,

1239

attribute.func_globals,

1240

attribute.func_name,

1241

attribute.func_defaults,

1242

attribute.func_closure)))

1243

# Copy annotations, if any

1244

try:

1245

attr[attrname]._dbus_annotations = dict(

1246

attribute._dbus_annotations)

1247

except AttributeError:

1248

pass

842

1249

# Is this a D-Bus property?

843

1250

elif getattr(attribute, "_dbus_is_property", False):

844

1251

# Create a new, but exactly alike, function

845

1252

# object, and decorate it to be a new D-Bus

846

1253

# property with the alternate D-Bus interface

847

1254

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

1255

attr[attrname] = (dbus_service_property(

1256

alt_interface, attribute._dbus_signature,

1257

attribute._dbus_access,

1258

attribute._dbus_get_args_options

1259

["byte_arrays"])

1260

(types.FunctionType(

1261

attribute.func_code,

1262

attribute.func_globals,

1263

attribute.func_name,

1264

attribute.func_defaults,

1265

attribute.func_closure)))

1266

# Copy annotations, if any

1267

try:

1268

attr[attrname]._dbus_annotations = dict(

1269

attribute._dbus_annotations)

1270

except AttributeError:

1271

pass

1272

# Is this a D-Bus interface?

1273

elif getattr(attribute, "_dbus_is_interface", False):

1274

# Create a new, but exactly alike, function

1275

# object. Decorate it to be a new D-Bus interface

1276

# with the alternate D-Bus interface name. Add it

1277

# to the class.

1278

attr[attrname] = (

1279

dbus_interface_annotations(alt_interface)

1280

(types.FunctionType(attribute.func_code,

1281

attribute.func_globals,

1282

attribute.func_name,

1283

attribute.func_defaults,

1284

attribute.func_closure)))

1285

if deprecate:

1286

# Deprecate all alternate interfaces

1287

iname="_AlternateDBusNames_interface_annotation{}"

1288

for interface_name in interface_names:

1289

1290

@dbus_interface_annotations(interface_name)

1291

def func(self):

1292

return { "org.freedesktop.DBus.Deprecated":

1293

"true" }

1294

# Find an unused name

1295

for aname in (iname.format(i)

1296

for i in itertools.count()):

1297

if aname not in attr:

1298

attr[aname] = func

1299

break

1300

if interface_names:

1301

# Replace the class with a new subclass of it with

1302

# methods, signals, etc. as created above.

1303

cls = type(b"{}Alternate".format(cls.__name__),

1304

(cls, ), attr)

1305

return cls

1306

1307

return wrapper

1308

1309

1310

@alternate_dbus_interfaces({"se.recompile.Mandos":

1311

"se.bsnet.fukt.Mandos"})

863

1312

class ClientDBus(Client, DBusObjectWithProperties):

864

1313

"""A Client class using D-Bus

865

1314

869

1318

"""

870

1319

871

1320

runtime_expansions = (Client.runtime_expansions

872

+ ("dbus_object_path",))

1321

+ ("dbus_object_path", ))

1322

1323

_interface = "se.recompile.Mandos.Client"

873

1324

874

1325

# dbus.service.Object doesn't use super(), so we can't either.

875

1326

876

1327

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

878

1328

self.bus = bus

879

1329

Client.__init__(self, *args, **kwargs)

880

1330

# Only now, when this client is initialized, can it show up on

881

1331

# the D-Bus

882

client_object_name = unicode(self.name).translate(

1332

client_object_name = str(self.name).translate(

883

1333

{ord("."): ord("_"),

884

1334

ord("-"): ord("_")})

885

self.dbus_object_path = (dbus.ObjectPath

886

("/clients/" + client_object_name))

1335

self.dbus_object_path = dbus.ObjectPath(

1336

"/clients/" + client_object_name)

887

1337

DBusObjectWithProperties.__init__(self, self.bus,

888

1338

self.dbus_object_path)

889

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

1339

1340

def notifychangeproperty(transform_func, dbus_name,

1341

type_func=lambda x: x,

1342

variant_level=1,

1343

invalidate_only=False,

1344

_interface=_interface):

893

1345

""" Modify a variable so that it's a property which announces

894

1346

its changes to DBus.

895

1347

896

1348

transform_fun: Function that takes a value and a variant_level

897

1349

and transforms it to a D-Bus type.

898

1350

dbus_name: D-Bus name of the variable

900

1352

to the D-Bus. Default: no transform

901

1353

variant_level: D-Bus variant level. Default: 1

902

1354

"""

903

attrname = "_{0}".format(dbus_name)

1355

attrname = "_{}".format(dbus_name)

1356

904

1357

def setter(self, value):

905

1358

if hasattr(self, "dbus_object_path"):

906

1359

if (not hasattr(self, attrname) or

907

1360

type_func(getattr(self, attrname, None))

908

1361

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

1362

if invalidate_only:

1363

self.PropertiesChanged(

1364

_interface, dbus.Dictionary(),

1365

dbus.Array((dbus_name, )))

1366

else:

1367

dbus_value = transform_func(

1368

type_func(value),

1369

variant_level = variant_level)

1370

self.PropertyChanged(dbus.String(dbus_name),

1371

dbus_value)

1372

self.PropertiesChanged(

1373

_interface,

1374

dbus.Dictionary({ dbus.String(dbus_name):

1375

dbus_value }),

1376

dbus.Array())

914

1377

setattr(self, attrname, value)

915

1378

916

1379

return property(lambda self: getattr(self, attrname), setter)

917

1380

918

919

1381

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

1382

approvals_pending = notifychangeproperty(dbus.Boolean,

921

1383

"ApprovalPending",

923

1385

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

1386

last_enabled = notifychangeproperty(datetime_to_dbus,

925

1387

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

1388

checker = notifychangeproperty(

1389

dbus.Boolean, "CheckerRunning",

1390

type_func = lambda checker: checker is not None)

929

1391

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

1392

"LastCheckedOK")

1393

last_checker_status = notifychangeproperty(dbus.Int16,

1394

"LastCheckerStatus")

931

1395

last_approval_request = notifychangeproperty(

932

1396

datetime_to_dbus, "LastApprovalRequest")

933

1397

approved_by_default = notifychangeproperty(dbus.Boolean,

934

1398

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

1399

approval_delay = notifychangeproperty(

1400

dbus.UInt64, "ApprovalDelay",

1401

type_func = lambda td: td.total_seconds() * 1000)

939

1402

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

1403

dbus.UInt64, "ApprovalDuration",

1404

type_func = lambda td: td.total_seconds() * 1000)

942

1405

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

1406

timeout = notifychangeproperty(

1407

dbus.UInt64, "Timeout",

1408

type_func = lambda td: td.total_seconds() * 1000)

946

1409

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

1410

dbus.UInt64, "ExtendedTimeout",

1411

type_func = lambda td: td.total_seconds() * 1000)

1412

interval = notifychangeproperty(

1413

dbus.UInt64, "Interval",

1414

type_func = lambda td: td.total_seconds() * 1000)

953

1415

checker_command = notifychangeproperty(dbus.String, "Checker")

1416

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1417

invalidate_only=True)

954

1418

955

1419

del notifychangeproperty

956

1420

963

1427

DBusObjectWithProperties.__del__(self, *args, **kwargs)

964

1428

Client.__del__(self, *args, **kwargs)

965

1429

966

def checker_callback(self, pid, condition, command,

967

*args, **kwargs):

968

self.checker_callback_tag = None

969

self.checker = None

970

if os.WIFEXITED(condition):

971

exitstatus = os.WEXITSTATUS(condition)

1430

def checker_callback(self, source, condition,

1431

connection, command, *args, **kwargs):

1432

ret = Client.checker_callback(self, source, condition,

1433

connection, command, *args,

1434

**kwargs)

1435

exitstatus = self.last_checker_status

1436

if exitstatus >= 0:

972

1437

# Emit D-Bus signal

973

1438

self.CheckerCompleted(dbus.Int16(exitstatus),

974

dbus.Int64(condition),

1439

# This is specific to GNU libC

1440

dbus.Int64(exitstatus << 8),

975

1441

dbus.String(command))

976

1442

else:

977

1443

# Emit D-Bus signal

978

1444

self.CheckerCompleted(dbus.Int16(-1),

979

dbus.Int64(condition),

1445

dbus.Int64(

1446

# This is specific to GNU libC

1447

(exitstatus << 8)

1448

| self.last_checker_signal),

980

1449

dbus.String(command))

981

982

return Client.checker_callback(self, pid, condition, command,

983

*args, **kwargs)

1450

return ret

984

1451

985

1452

def start_checker(self, *args, **kwargs):

986

old_checker = self.checker

987

if self.checker is not None:

988

old_checker_pid = self.checker.pid

989

else:

990

old_checker_pid = None

1453

old_checker_pid = getattr(self.checker, "pid", None)

991

1454

r = Client.start_checker(self, *args, **kwargs)

992

1455

# Only if new checker process was started

993

1456

if (self.checker is not None

997

1460

return r

998

1461

999

1462

def _reset_approved(self):

1000

self._approved = None

1463

self.approved = None

1001

1464

return False

1002

1465

1003

1466

def approve(self, value=True):

1467

self.approved = value

1468

gobject.timeout_add(int(self.approval_duration.total_seconds()

1469

* 1000), self._reset_approved)

1004

1470

self.send_changedstate()

1005

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1007

(self.approval_duration),

1008

self._reset_approved)

1009

1010

1471

1011

1472

## D-Bus methods, signals & properties

1012

_interface = "se.recompile.Mandos.Client"

1473

1474

## Interfaces

1013

1475

1014

1476

## Signals

1015

1477

1026

1488

pass

1027

1489

1028

1490

# PropertyChanged - signal

1491

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1029

1492

@dbus.service.signal(_interface, signature="sv")

1030

1493

def PropertyChanged(self, property, value):

1031

1494

"D-Bus signal"

1065

1528

self.checked_ok()

1066

1529

1067

1530

# Enable - method

1531

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1068

1532

@dbus.service.method(_interface)

1069

1533

def Enable(self):

1070

1534

"D-Bus method"

1071

1535

self.enable()

1072

1536

1073

1537

# StartChecker - method

1538

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1074

1539

@dbus.service.method(_interface)

1075

1540

def StartChecker(self):

1076

1541

"D-Bus method"

1077

1542

self.start_checker()

1078

1543

1079

1544

# Disable - method

1545

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1080

1546

@dbus.service.method(_interface)

1081

1547

def Disable(self):

1082

1548

"D-Bus method"

1083

1549

self.disable()

1084

1550

1085

1551

# StopChecker - method

1552

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1086

1553

@dbus.service.method(_interface)

1087

1554

def StopChecker(self):

1088

1555

self.stop_checker()

1095

1562

return dbus.Boolean(bool(self.approvals_pending))

1096

1563

1097

1564

# ApprovedByDefault - property

1098

@dbus_service_property(_interface, signature="b",

1565

@dbus_service_property(_interface,

1566

signature="b",

1099

1567

access="readwrite")

1100

1568

def ApprovedByDefault_dbus_property(self, value=None):

1101

1569

if value is None: # get

1103

1571

self.approved_by_default = bool(value)

1104

1572

1105

1573

# ApprovalDelay - property

1106

@dbus_service_property(_interface, signature="t",

1574

@dbus_service_property(_interface,

1575

signature="t",

1107

1576

access="readwrite")

1108

1577

def ApprovalDelay_dbus_property(self, value=None):

1109

1578

if value is None: # get

1110

return dbus.UInt64(self.approval_delay_milliseconds())

1579

return dbus.UInt64(self.approval_delay.total_seconds()

1580

* 1000)

1111

1581

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1112

1582

1113

1583

# ApprovalDuration - property

1114

@dbus_service_property(_interface, signature="t",

1584

@dbus_service_property(_interface,

1585

signature="t",

1115

1586

access="readwrite")

1116

1587

def ApprovalDuration_dbus_property(self, value=None):

1117

1588

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1119

self.approval_duration))

1589

return dbus.UInt64(self.approval_duration.total_seconds()

1590

* 1000)

1120

1591

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1121

1592

1122

1593

# Name - property

1594

@dbus_annotations(

1595

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1123

1596

@dbus_service_property(_interface, signature="s", access="read")

1124

1597

def Name_dbus_property(self):

1125

1598

return dbus.String(self.name)

1126

1599

1127

1600

# Fingerprint - property

1601

@dbus_annotations(

1602

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1128

1603

@dbus_service_property(_interface, signature="s", access="read")

1129

1604

def Fingerprint_dbus_property(self):

1130

1605

return dbus.String(self.fingerprint)

1131

1606

1132

1607

# Host - property

1133

@dbus_service_property(_interface, signature="s",

1608

@dbus_service_property(_interface,

1609

signature="s",

1134

1610

access="readwrite")

1135

1611

def Host_dbus_property(self, value=None):

1136

1612

if value is None: # get

1137

1613

return dbus.String(self.host)

1138

self.host = value

1614

self.host = str(value)

1139

1615

1140

1616

# Created - property

1617

@dbus_annotations(

1618

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1141

1619

@dbus_service_property(_interface, signature="s", access="read")

1142

1620

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1621

return datetime_to_dbus(self.created)

1144

1622

1145

1623

# LastEnabled - property

1146

1624

@dbus_service_property(_interface, signature="s", access="read")

1148

1626

return datetime_to_dbus(self.last_enabled)

1149

1627

1150

1628

# Enabled - property

1151

@dbus_service_property(_interface, signature="b",

1629

@dbus_service_property(_interface,

1630

signature="b",

1152

1631

access="readwrite")

1153

1632

def Enabled_dbus_property(self, value=None):

1154

1633

if value is None: # get

1159

1638

self.disable()

1160

1639

1161

1640

# LastCheckedOK - property

1162

@dbus_service_property(_interface, signature="s",

1641

@dbus_service_property(_interface,

1642

signature="s",

1163

1643

access="readwrite")

1164

1644

def LastCheckedOK_dbus_property(self, value=None):

1165

1645

if value is not None:

1167

1647

return

1168

1648

return datetime_to_dbus(self.last_checked_ok)

1169

1649

1650

# LastCheckerStatus - property

1651

@dbus_service_property(_interface, signature="n", access="read")

1652

def LastCheckerStatus_dbus_property(self):

1653

return dbus.Int16(self.last_checker_status)

1654

1170

1655

# Expires - property

1171

1656

@dbus_service_property(_interface, signature="s", access="read")

1172

1657

def Expires_dbus_property(self):

1178

1663

return datetime_to_dbus(self.last_approval_request)

1179

1664

1180

1665

# Timeout - property

1181

@dbus_service_property(_interface, signature="t",

1666

@dbus_service_property(_interface,

1667

signature="t",

1182

1668

access="readwrite")

1183

1669

def Timeout_dbus_property(self, value=None):

1184

1670

if value is None: # get

1185

return dbus.UInt64(self.timeout_milliseconds())

1671

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1672

old_timeout = self.timeout

1186

1673

self.timeout = datetime.timedelta(0, 0, 0, value)

1187

if getattr(self, "disable_initiator_tag", None) is None:

1188

return

1189

# Reschedule timeout

1190

gobject.source_remove(self.disable_initiator_tag)

1191

self.disable_initiator_tag = None

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1198

if time_to_die <= 0:

1199

# The timeout has passed

1200

self.disable()

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1205

self.disable_initiator_tag = (gobject.timeout_add

1206

(time_to_die, self.disable))

1674

# Reschedule disabling

1675

if self.enabled:

1676

now = datetime.datetime.utcnow()

1677

self.expires += self.timeout - old_timeout

1678

if self.expires <= now:

1679

# The timeout has passed

1680

self.disable()

1681

else:

1682

if (getattr(self, "disable_initiator_tag", None)

1683

is None):

1684

return

1685

gobject.source_remove(self.disable_initiator_tag)

1686

self.disable_initiator_tag = gobject.timeout_add(

1687

int((self.expires - now).total_seconds() * 1000),

1688

self.disable)

1207

1689

1208

1690

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1691

@dbus_service_property(_interface,

1692

signature="t",

1210

1693

access="readwrite")

1211

1694

def ExtendedTimeout_dbus_property(self, value=None):

1212

1695

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1696

return dbus.UInt64(self.extended_timeout.total_seconds()

1697

* 1000)

1214

1698

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1699

1216

1700

# Interval - property

1217

@dbus_service_property(_interface, signature="t",

1701

@dbus_service_property(_interface,

1702

signature="t",

1218

1703

access="readwrite")

1219

1704

def Interval_dbus_property(self, value=None):

1220

1705

if value is None: # get

1221

return dbus.UInt64(self.interval_milliseconds())

1706

return dbus.UInt64(self.interval.total_seconds() * 1000)

1222

1707

self.interval = datetime.timedelta(0, 0, 0, value)

1223

1708

if getattr(self, "checker_initiator_tag", None) is None:

1224

1709

return

1225

# Reschedule checker run

1226

gobject.source_remove(self.checker_initiator_tag)

1227

self.checker_initiator_tag = (gobject.timeout_add

1228

(value, self.start_checker))

1229

self.start_checker() # Start one now, too

1710

if self.enabled:

1711

# Reschedule checker run

1712

gobject.source_remove(self.checker_initiator_tag)

1713

self.checker_initiator_tag = gobject.timeout_add(

1714

value, self.start_checker)

1715

self.start_checker() # Start one now, too

1230

1716

1231

1717

# Checker - property

1232

@dbus_service_property(_interface, signature="s",

1718

@dbus_service_property(_interface,

1719

signature="s",

1233

1720

access="readwrite")

1234

1721

def Checker_dbus_property(self, value=None):

1235

1722

if value is None: # get

1236

1723

return dbus.String(self.checker_command)

1237

self.checker_command = value

1724

self.checker_command = str(value)

1238

1725

1239

1726

# CheckerRunning - property

1240

@dbus_service_property(_interface, signature="b",

1727

@dbus_service_property(_interface,

1728

signature="b",

1241

1729

access="readwrite")

1242

1730

def CheckerRunning_dbus_property(self, value=None):

1243

1731

if value is None: # get

1248

1736

self.stop_checker()

1249

1737

1250

1738

# ObjectPath - property

1739

@dbus_annotations(

1740

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1741

"org.freedesktop.DBus.Deprecated": "true"})

1251

1742

@dbus_service_property(_interface, signature="o", access="read")

1252

1743

def ObjectPath_dbus_property(self):

1253

1744

return self.dbus_object_path # is already a dbus.ObjectPath

1254

1745

1255

1746

# Secret = property

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1747

@dbus_annotations(

1748

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1749

"invalidates"})

1750

@dbus_service_property(_interface,

1751

signature="ay",

1752

access="write",

1753

byte_arrays=True)

1258

1754

def Secret_dbus_property(self, value):

1259

self.secret = str(value)

1755

self.secret = bytes(value)

1260

1756

1261

1757

del _interface

1262

1758

1266

1762

self._pipe = child_pipe

1267

1763

self._pipe.send(('init', fpr, address))

1268

1764

if not self._pipe.recv():

1269

raise KeyError()

1765

raise KeyError(fpr)

1270

1766

1271

1767

def __getattribute__(self, name):

1272

if(name == '_pipe'):

1768

if name == '_pipe':

1273

1769

return super(ProxyClient, self).__getattribute__(name)

1274

1770

self._pipe.send(('getattr', name))

1275

1771

data = self._pipe.recv()

1276

1772

if data[0] == 'data':

1277

1773

return data[1]

1278

1774

if data[0] == 'function':

1775

1279

1776

def func(*args, **kwargs):

1280

1777

self._pipe.send(('funcall', name, args, kwargs))

1281

1778

return self._pipe.recv()[1]

1779

1282

1780

return func

1283

1781

1284

1782

def __setattr__(self, name, value):

1285

if(name == '_pipe'):

1783

if name == '_pipe':

1286

1784

return super(ProxyClient, self).__setattr__(name, value)

1287

1785

self._pipe.send(('setattr', name, value))

1288

1786

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1291

1787

1292

1788

class ClientHandler(socketserver.BaseRequestHandler, object):

1293

1789

"""A class to handle client connections.

1298

1794

def handle(self):

1299

1795

with contextlib.closing(self.server.child_pipe) as child_pipe:

1300

1796

logger.info("TCP connection from: %s",

1301

unicode(self.client_address))

1797

str(self.client_address))

1302

1798

logger.debug("Pipe FD: %d",

1303

1799

self.server.child_pipe.fileno())

1304

1800

1305

session = (gnutls.connection

1306

.ClientSession(self.request,

1307

gnutls.connection

1308

.X509Credentials()))

1801

session = gnutls.connection.ClientSession(

1802

self.request, gnutls.connection .X509Credentials())

1309

1803

1310

1804

# Note: gnutls.connection.X509Credentials is really a

1311

1805

# generic GnuTLS certificate credentials object so long as

1320

1814

priority = self.server.gnutls_priority

1321

1815

if priority is None:

1322

1816

priority = "NORMAL"

1323

(gnutls.library.functions

1324

.gnutls_priority_set_direct(session._c_object,

1325

priority, None))

1817

gnutls.library.functions.gnutls_priority_set_direct(

1818

session._c_object, priority, None)

1326

1819

1327

1820

# Start communication using the Mandos protocol

1328

1821

# Get protocol number

1330

1823

logger.debug("Protocol version: %r", line)

1331

1824

try:

1332

1825

if int(line.strip().split()[0]) > 1:

1333

raise RuntimeError

1826

raise RuntimeError(line)

1334

1827

except (ValueError, IndexError, RuntimeError) as error:

1335

1828

logger.error("Unknown protocol version: %s", error)

1336

1829

return

1348

1841

approval_required = False

1349

1842

try:

1350

1843

try:

1351

fpr = self.fingerprint(self.peer_certificate

1352

(session))

1844

fpr = self.fingerprint(

1845

self.peer_certificate(session))

1353

1846

except (TypeError,

1354

1847

gnutls.errors.GNUTLSError) as error:

1355

1848

logger.warning("Bad certificate: %s", error)

1370

1863

while True:

1371

1864

if not client.enabled:

1372

1865

logger.info("Client %s is disabled",

1373

client.name)

1866

client.name)

1374

1867

if self.server.use_dbus:

1375

1868

# Emit D-Bus signal

1376

1869

client.Rejected("Disabled")

1377

1870

return

1378

1871

1379

if client._approved or not client.approval_delay:

1872

if client.approved or not client.approval_delay:

1380

1873

#We are approved or approval is disabled

1381

1874

break

1382

elif client._approved is None:

1875

elif client.approved is None:

1383

1876

logger.info("Client %s needs approval",

1384

1877

client.name)

1385

1878

if self.server.use_dbus:

1386

1879

# Emit D-Bus signal

1387

1880

client.NeedApproval(

1388

client.approval_delay_milliseconds(),

1389

client.approved_by_default)

1881

client.approval_delay.total_seconds()

1882

* 1000, client.approved_by_default)

1390

1883

else:

1391

1884

logger.warning("Client %s was not approved",

1392

1885

client.name)

1398

1891

#wait until timeout or approved

1399

1892

time = datetime.datetime.now()

1400

1893

client.changedstate.acquire()

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1894

client.changedstate.wait(delay.total_seconds())

1404

1895

client.changedstate.release()

1405

1896

time2 = datetime.datetime.now()

1406

1897

if (time2 - time) >= delay:

1422

1913

try:

1423

1914

sent = session.send(client.secret[sent_size:])

1424

1915

except gnutls.errors.GNUTLSError as error:

1425

logger.warning("gnutls send failed")

1916

logger.warning("gnutls send failed",

1917

exc_info=error)

1426

1918

return

1427

logger.debug("Sent: %d, remaining: %d",

1428

sent, len(client.secret)

1429

- (sent_size + sent))

1919

logger.debug("Sent: %d, remaining: %d", sent,

1920

len(client.secret) - (sent_size

1921

+ sent))

1430

1922

sent_size += sent

1431

1923

1432

1924

logger.info("Sending secret to %s", client.name)

1433

1925

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1926

client.bump_timeout(client.extended_timeout)

1435

1927

if self.server.use_dbus:

1436

1928

# Emit D-Bus signal

1437

1929

client.GotSecret()

1442

1934

try:

1443

1935

session.bye()

1444

1936

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1937

logger.warning("GnuTLS bye failed",

1938

exc_info=error)

1446

1939

1447

1940

@staticmethod

1448

1941

def peer_certificate(session):

1449

1942

"Return the peer's OpenPGP certificate as a bytestring"

1450

1943

# If not an OpenPGP certificate...

1451

if (gnutls.library.functions

1452

.gnutls_certificate_type_get(session._c_object)

1944

if (gnutls.library.functions.gnutls_certificate_type_get(

1945

session._c_object)

1453

1946

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1454

1947

# ...do the normal thing

1455

1948

return session.peer_certificate

1469

1962

def fingerprint(openpgp):

1470

1963

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1471

1964

# New GnuTLS "datum" with the OpenPGP public key

1472

datum = (gnutls.library.types

1473

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1474

ctypes.POINTER

1475

(ctypes.c_ubyte)),

1476

ctypes.c_uint(len(openpgp))))

1965

datum = gnutls.library.types.gnutls_datum_t(

1966

ctypes.cast(ctypes.c_char_p(openpgp),

1967

ctypes.POINTER(ctypes.c_ubyte)),

1968

ctypes.c_uint(len(openpgp)))

1477

1969

# New empty GnuTLS certificate

1478

1970

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1479

(gnutls.library.functions

1480

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1971

gnutls.library.functions.gnutls_openpgp_crt_init(

1972

ctypes.byref(crt))

1481

1973

# Import the OpenPGP public key into the certificate

1482

(gnutls.library.functions

1483

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1484

gnutls.library.constants

1485

.GNUTLS_OPENPGP_FMT_RAW))

1974

gnutls.library.functions.gnutls_openpgp_crt_import(

1975

crt, ctypes.byref(datum),

1976

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1486

1977

# Verify the self signature in the key

1487

1978

crtverify = ctypes.c_uint()

1488

(gnutls.library.functions

1489

.gnutls_openpgp_crt_verify_self(crt, 0,

1490

ctypes.byref(crtverify)))

1979

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1980

crt, 0, ctypes.byref(crtverify))

1491

1981

if crtverify.value != 0:

1492

1982

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1493

raise (gnutls.errors.CertificateSecurityError

1494

("Verify failed"))

1983

raise gnutls.errors.CertificateSecurityError(

1984

"Verify failed")

1495

1985

# New buffer for the fingerprint

1496

1986

buf = ctypes.create_string_buffer(20)

1497

1987

buf_len = ctypes.c_size_t()

1498

1988

# Get the fingerprint from the certificate into the buffer

1499

(gnutls.library.functions

1500

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1501

ctypes.byref(buf_len)))

1989

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1990

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1502

1991

# Deinit the certificate

1503

1992

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1504

1993

# Convert the buffer to a Python bytestring

1505

1994

fpr = ctypes.string_at(buf, buf_len.value)

1506

1995

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1996

hex_fpr = binascii.hexlify(fpr).upper()

1508

1997

return hex_fpr

1509

1998

1510

1999

1511

2000

class MultiprocessingMixIn(object):

1512

2001

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2002

1513

2003

def sub_process_main(self, request, address):

1514

2004

try:

1515

2005

self.finish_request(request, address)

1516

except:

2006

except Exception:

1517

2007

self.handle_error(request, address)

1518

2008

self.close_request(request)

1519

2009

1520

2010

def process_request(self, request, address):

1521

2011

"""Start a new process to process the request."""

1522

2012

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

2013

args = (request, address))

1525

2014

proc.start()

1526

2015

return proc

1527

2016

1528

2017

1529

2018

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1530

2019

""" adds a pipe to the MixIn """

2020

1531

2021

def process_request(self, request, client_address):

1532

2022

"""Overrides and wraps the original process_request().

1533

2023

1542

2032

1543

2033

def add_pipe(self, parent_pipe, proc):

1544

2034

"""Dummy function; override as necessary"""

1545

raise NotImplementedError

2035

raise NotImplementedError()

1546

2036

1547

2037

1548

2038

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1554

2044

interface: None or a network interface name (string)

1555

2045

use_ipv6: Boolean; to use IPv6 or not

1556

2046

"""

2047

1557

2048

def __init__(self, server_address, RequestHandlerClass,

1558

interface=None, use_ipv6=True):

2049

interface=None,

2050

use_ipv6=True,

2051

socketfd=None):

2052

"""If socketfd is set, use that file descriptor instead of

2053

creating a new one with socket.socket().

2054

"""

1559

2055

self.interface = interface

1560

2056

if use_ipv6:

1561

2057

self.address_family = socket.AF_INET6

2058

if socketfd is not None:

2059

# Save the file descriptor

2060

self.socketfd = socketfd

2061

# Save the original socket.socket() function

2062

self.socket_socket = socket.socket

2063

# To implement --socket, we monkey patch socket.socket.

2064

#

2065

# (When socketserver.TCPServer is a new-style class, we

2066

# could make self.socket into a property instead of monkey

2067

# patching socket.socket.)

2068

#

2069

# Create a one-time-only replacement for socket.socket()

2070

@functools.wraps(socket.socket)

2071

def socket_wrapper(*args, **kwargs):

2072

# Restore original function so subsequent calls are

2073

# not affected.

2074

socket.socket = self.socket_socket

2075

del self.socket_socket

2076

# This time only, return a new socket object from the

2077

# saved file descriptor.

2078

return socket.fromfd(self.socketfd, *args, **kwargs)

2079

# Replace socket.socket() function with wrapper

2080

socket.socket = socket_wrapper

2081

# The socketserver.TCPServer.__init__ will call

2082

# socket.socket(), which might be our replacement,

2083

# socket_wrapper(), if socketfd was set.

1562

2084

socketserver.TCPServer.__init__(self, server_address,

1563

2085

RequestHandlerClass)

2086

1564

2087

def server_bind(self):

1565

2088

"""This overrides the normal server_bind() function

1566

2089

to bind to an interface if one was specified, and also NOT to

1572

2095

self.interface)

1573

2096

else:

1574

2097

try:

1575

self.socket.setsockopt(socket.SOL_SOCKET,

1576

SO_BINDTODEVICE,

1577

str(self.interface

1578

+ '\0'))

2098

self.socket.setsockopt(

2099

socket.SOL_SOCKET, SO_BINDTODEVICE,

2100

(self.interface + "\0").encode("utf-8"))

1579

2101

except socket.error as error:

1580

if error[0] == errno.EPERM:

1581

logger.error("No permission to"

1582

" bind to interface %s",

1583

self.interface)

1584

elif error[0] == errno.ENOPROTOOPT:

2102

if error.errno == errno.EPERM:

2103

logger.error("No permission to bind to"

2104

" interface %s", self.interface)

2105

elif error.errno == errno.ENOPROTOOPT:

1585

2106

logger.error("SO_BINDTODEVICE not available;"

1586

2107

" cannot bind to interface %s",

1587

2108

self.interface)

2109

elif error.errno == errno.ENODEV:

2110

logger.error("Interface %s does not exist,"

2111

" cannot bind", self.interface)

1588

2112

else:

1589

2113

raise

1590

2114

# Only bind(2) the socket if we really need to.

1593

2117

if self.address_family == socket.AF_INET6:

1594

2118

any_address = "::" # in6addr_any

1595

2119

else:

1596

any_address = socket.INADDR_ANY

2120

any_address = "0.0.0.0" # INADDR_ANY

1597

2121

self.server_address = (any_address,

1598

2122

self.server_address[1])

1599

2123

elif not self.server_address[1]:

1600

self.server_address = (self.server_address[0],

1601

0)

2124

self.server_address = (self.server_address[0], 0)

1602

2125

# if self.interface:

1603

2126

# self.server_address = (self.server_address[0],

1604

2127

# 0, # port

1618

2141

1619

2142

Assumes a gobject.MainLoop event loop.

1620

2143

"""

2144

1621

2145

def __init__(self, server_address, RequestHandlerClass,

1622

interface=None, use_ipv6=True, clients=None,

1623

gnutls_priority=None, use_dbus=True):

2146

interface=None,

2147

use_ipv6=True,

2148

clients=None,

2149

gnutls_priority=None,

2150

use_dbus=True,

2151

socketfd=None):

1624

2152

self.enabled = False

1625

2153

self.clients = clients

1626

2154

if self.clients is None:

1627

self.clients = set()

2155

self.clients = {}

1628

2156

self.use_dbus = use_dbus

1629

2157

self.gnutls_priority = gnutls_priority

1630

2158

IPv6_TCPServer.__init__(self, server_address,

1631

2159

RequestHandlerClass,

1632

2160

interface = interface,

1633

use_ipv6 = use_ipv6)

2161

use_ipv6 = use_ipv6,

2162

socketfd = socketfd)

2163

1634

2164

def server_activate(self):

1635

2165

if self.enabled:

1636

2166

return socketserver.TCPServer.server_activate(self)

1640

2170

1641

2171

def add_pipe(self, parent_pipe, proc):

1642

2172

# Call "handle_ipc" for both data and EOF events

1643

gobject.io_add_watch(parent_pipe.fileno(),

1644

gobject.IO_IN | gobject.IO_HUP,

1645

functools.partial(self.handle_ipc,

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

2173

gobject.io_add_watch(

2174

parent_pipe.fileno(),

2175

gobject.IO_IN | gobject.IO_HUP,

2176

functools.partial(self.handle_ipc,

2177

parent_pipe = parent_pipe,

2178

proc = proc))

1649

2179

1650

def handle_ipc(self, source, condition, parent_pipe=None,

1651

proc = None, client_object=None):

1652

condition_names = {

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1655

# blocking).

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1659

# broken, usually for pipes and

1660

# sockets).

1661

}

1662

conditions_string = ' | '.join(name

1663

for cond, name in

1664

condition_names.iteritems()

1665

if cond & condition)

2180

def handle_ipc(self, source, condition,

2181

parent_pipe=None,

2182

proc = None,

2183

client_object=None):

1666

2184

# error, or the other end of multiprocessing.Pipe has closed

1667

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2185

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1668

2186

# Wait for other process to exit

1669

2187

proc.join()

1670

2188

return False

1677

2195

fpr = request[1]

1678

2196

address = request[2]

1679

2197

1680

for c in self.clients:

2198

for c in self.clients.itervalues():

1681

2199

if c.fingerprint == fpr:

1682

2200

client = c

1683

2201

break

1691

2209

parent_pipe.send(False)

1692

2210

return False

1693

2211

1694

gobject.io_add_watch(parent_pipe.fileno(),

1695

gobject.IO_IN | gobject.IO_HUP,

1696

functools.partial(self.handle_ipc,

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

2212

gobject.io_add_watch(

2213

parent_pipe.fileno(),

2214

gobject.IO_IN | gobject.IO_HUP,

2215

functools.partial(self.handle_ipc,

2216

parent_pipe = parent_pipe,

2217

proc = proc,

2218

client_object = client))

1702

2219

parent_pipe.send(True)

1703

2220

# remove the old hook in favor of the new above hook on

1704

2221

# same fileno

1710

2227

1711

2228

parent_pipe.send(('data', getattr(client_object,

1712

2229

funcname)(*args,

1713

**kwargs)))

2230

**kwargs)))

1714

2231

1715

2232

if command == 'getattr':

1716

2233

attrname = request[1]

1717

if callable(client_object.__getattribute__(attrname)):

1718

parent_pipe.send(('function',))

2234

if isinstance(client_object.__getattribute__(attrname),

2235

collections.Callable):

2236

parent_pipe.send(('function', ))

1719

2237

else:

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

2238

parent_pipe.send((

2239

'data', client_object.__getattribute__(attrname)))

1722

2240

1723

2241

if command == 'setattr':

1724

2242

attrname = request[1]

1728

2246

return True

1729

2247

1730

2248

2249

def rfc3339_duration_to_delta(duration):

2250

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2251

2252

>>> rfc3339_duration_to_delta("P7D")

2253

datetime.timedelta(7)

2254

>>> rfc3339_duration_to_delta("PT60S")

2255

datetime.timedelta(0, 60)

2256

>>> rfc3339_duration_to_delta("PT60M")

2257

datetime.timedelta(0, 3600)

2258

>>> rfc3339_duration_to_delta("PT24H")

2259

datetime.timedelta(1)

2260

>>> rfc3339_duration_to_delta("P1W")

2261

datetime.timedelta(7)

2262

>>> rfc3339_duration_to_delta("PT5M30S")

2263

datetime.timedelta(0, 330)

2264

>>> rfc3339_duration_to_delta("P1DT3M20S")

2265

datetime.timedelta(1, 200)

2266

"""

2267

2268

# Parsing an RFC 3339 duration with regular expressions is not

2269

# possible - there would have to be multiple places for the same

2270

# values, like seconds. The current code, while more esoteric, is

2271

# cleaner without depending on a parsing library. If Python had a

2272

# built-in library for parsing we would use it, but we'd like to

2273

# avoid excessive use of external libraries.

2274

2275

# New type for defining tokens, syntax, and semantics all-in-one

2276

Token = collections.namedtuple("Token", (

2277

"regexp", # To match token; if "value" is not None, must have

2278

# a "group" containing digits

2279

"value", # datetime.timedelta or None

2280

"followers")) # Tokens valid after this token

2281

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2282

# the "duration" ABNF definition in RFC 3339, Appendix A.

2283

token_end = Token(re.compile(r"$"), None, frozenset())

2284

token_second = Token(re.compile(r"(\d+)S"),

2285

datetime.timedelta(seconds=1),

2286

frozenset((token_end, )))

2287

token_minute = Token(re.compile(r"(\d+)M"),

2288

datetime.timedelta(minutes=1),

2289

frozenset((token_second, token_end)))

2290

token_hour = Token(re.compile(r"(\d+)H"),

2291

datetime.timedelta(hours=1),

2292

frozenset((token_minute, token_end)))

2293

token_time = Token(re.compile(r"T"),

2294

None,

2295

frozenset((token_hour, token_minute,

2296

token_second)))

2297

token_day = Token(re.compile(r"(\d+)D"),

2298

datetime.timedelta(days=1),

2299

frozenset((token_time, token_end)))

2300

token_month = Token(re.compile(r"(\d+)M"),

2301

datetime.timedelta(weeks=4),

2302

frozenset((token_day, token_end)))

2303

token_year = Token(re.compile(r"(\d+)Y"),

2304

datetime.timedelta(weeks=52),

2305

frozenset((token_month, token_end)))

2306

token_week = Token(re.compile(r"(\d+)W"),

2307

datetime.timedelta(weeks=1),

2308

frozenset((token_end, )))

2309

token_duration = Token(re.compile(r"P"), None,

2310

frozenset((token_year, token_month,

2311

token_day, token_time,

2312

token_week)))

2313

# Define starting values

2314

value = datetime.timedelta() # Value so far

2315

found_token = None

2316

followers = frozenset((token_duration, )) # Following valid tokens

2317

s = duration # String left to parse

2318

# Loop until end token is found

2319

while found_token is not token_end:

2320

# Search for any currently valid tokens

2321

for token in followers:

2322

match = token.regexp.match(s)

2323

if match is not None:

2324

# Token found

2325

if token.value is not None:

2326

# Value found, parse digits

2327

factor = int(match.group(1), 10)

2328

# Add to value so far

2329

value += factor * token.value

2330

# Strip token from string

2331

s = token.regexp.sub("", s, 1)

2332

# Go to found token

2333

found_token = token

2334

# Set valid next tokens

2335

followers = found_token.followers

2336

break

2337

else:

2338

# No currently valid tokens were found

2339

raise ValueError("Invalid RFC 3339 duration: {!r}"

2340

.format(duration))

2341

# End token found

2342

return value

2343

2344

1731

2345

def string_to_delta(interval):

1732

2346

"""Parse a string and return a datetime.timedelta

1733

2347

1744

2358

>>> string_to_delta('5m 30s')

1745

2359

datetime.timedelta(0, 330)

1746

2360

"""

2361

2362

try:

2363

return rfc3339_duration_to_delta(interval)

2364

except ValueError:

2365

pass

2366

1747

2367

timevalue = datetime.timedelta(0)

1748

2368

for s in interval.split():

1749

2369

try:

1750

suffix = unicode(s[-1])

2370

suffix = s[-1]

1751

2371

value = int(s[:-1])

1752

2372

if suffix == "d":

1753

2373

delta = datetime.timedelta(value)

1760

2380

elif suffix == "w":

1761

2381

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1762

2382

else:

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

2383

raise ValueError("Unknown suffix {!r}".format(suffix))

2384

except IndexError as e:

1765

2385

raise ValueError(*(e.args))

1766

2386

timevalue += delta

1767

2387

return timevalue

1768

2388

1769

2389

1770

def if_nametoindex(interface):

1771

"""Call the C function if_nametoindex(), or equivalent

1772

1773

Note: This function cannot accept a unicode string."""

1774

global if_nametoindex

1775

try:

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1778

.if_nametoindex)

1779

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1781

def if_nametoindex(interface):

1782

"Get an interface index the hard way, i.e. using fcntl()"

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

with contextlib.closing(socket.socket()) as s:

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1787

interface))

1788

interface_index = struct.unpack(str("I"),

1789

ifreq[16:20])[0]

1790

return interface_index

1791

return if_nametoindex(interface)

1792

1793

1794

2390

def daemon(nochdir = False, noclose = False):

1795

2391

"""See daemon(3). Standard BSD Unix function.

1796

2392

1804

2400

sys.exit()

1805

2401

if not noclose:

1806

2402

# Close all standard open file descriptors

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2403

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1808

2404

if not stat.S_ISCHR(os.fstat(null).st_mode):

1809

2405

raise OSError(errno.ENODEV,

1810

"%s not a character device"

1811

% os.path.devnull)

2406

"{} not a character device"

2407

.format(os.devnull))

1812

2408

os.dup2(null, sys.stdin.fileno())

1813

2409

os.dup2(null, sys.stdout.fileno())

1814

2410

os.dup2(null, sys.stderr.fileno())

1823

2419

1824

2420

parser = argparse.ArgumentParser()

1825

2421

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

2422

version = "%(prog)s {}".format(version),

1827

2423

help="show version number and exit")

1828

2424

parser.add_argument("-i", "--interface", metavar="IF",

1829

2425

help="Bind to interface IF")

1835

2431

help="Run self-test")

1836

2432

parser.add_argument("--debug", action="store_true",

1837

2433

help="Debug mode; run in foreground and log"

1838

" to terminal")

2434

" to terminal", default=None)

1839

2435

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

2436

help="Debug level for stdout output")

1841

2437

parser.add_argument("--priority", help="GnuTLS"

1848

2444

" files")

1849

2445

parser.add_argument("--no-dbus", action="store_false",

1850

2446

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

2447

" system bus interface", default=None)

1852

2448

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

2449

dest="use_ipv6", help="Do not use IPv6",

2450

default=None)

2451

parser.add_argument("--no-restore", action="store_false",

2452

dest="restore", help="Do not restore stored"

2453

" state", default=None)

2454

parser.add_argument("--socket", type=int,

2455

help="Specify a file descriptor to a network"

2456

" socket to use instead of creating one")

2457

parser.add_argument("--statedir", metavar="DIR",

2458

help="Directory to save/restore state in")

2459

parser.add_argument("--foreground", action="store_true",

2460

help="Run in foreground", default=None)

2461

parser.add_argument("--no-zeroconf", action="store_false",

2462

dest="zeroconf", help="Do not use Zeroconf",

2463

default=None)

2464

1854

2465

options = parser.parse_args()

1855

2466

1856

2467

if options.check:

1857

2468

import doctest

1858

doctest.testmod()

1859

sys.exit()

2469

fail_count, test_count = doctest.testmod()

2470

sys.exit(os.EX_OK if fail_count == 0 else 1)

1860

2471

1861

2472

# Default values for config file for server-global settings

1862

2473

server_defaults = { "interface": "",

1864

2475

"port": "",

1865

2476

"debug": "False",

1866

2477

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2478

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2479

":+SIGN-DSA-SHA256",

1868

2480

"servicename": "Mandos",

1869

2481

"use_dbus": "True",

1870

2482

"use_ipv6": "True",

1871

2483

"debuglevel": "",

1872

}

2484

"restore": "True",

2485

"socket": "",

2486

"statedir": "/var/lib/mandos",

2487

"foreground": "False",

2488

"zeroconf": "True",

2489

}

1873

2490

1874

2491

# Parse config file for server-global settings

1875

2492

server_config = configparser.SafeConfigParser(server_defaults)

1876

2493

del server_defaults

1877

server_config.read(os.path.join(options.configdir,

1878

"mandos.conf"))

2494

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1879

2495

# Convert the SafeConfigParser object to a dict

1880

2496

server_settings = server_config.defaults()

1881

2497

# Use the appropriate methods on the non-string config options

1882

for option in ("debug", "use_dbus", "use_ipv6"):

2498

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1883

2499

server_settings[option] = server_config.getboolean("DEFAULT",

1884

2500

option)

1885

2501

if server_settings["port"]:

1886

2502

server_settings["port"] = server_config.getint("DEFAULT",

1887

2503

"port")

2504

if server_settings["socket"]:

2505

server_settings["socket"] = server_config.getint("DEFAULT",

2506

"socket")

2507

# Later, stdin will, and stdout and stderr might, be dup'ed

2508

# over with an opened os.devnull. But we don't want this to

2509

# happen with a supplied network socket.

2510

if 0 <= server_settings["socket"] <= 2:

2511

server_settings["socket"] = os.dup(server_settings

2512

["socket"])

1888

2513

del server_config

1889

2514

1890

2515

# Override the settings from the config file with command line

1891

2516

# options, if set.

1892

2517

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

2518

"priority", "servicename", "configdir", "use_dbus",

2519

"use_ipv6", "debuglevel", "restore", "statedir",

2520

"socket", "foreground", "zeroconf"):

1895

2521

value = getattr(options, option)

1896

2522

if value is not None:

1897

2523

server_settings[option] = value

1898

2524

del options

1899

2525

# Force all strings to be unicode

1900

2526

for option in server_settings.keys():

1901

if type(server_settings[option]) is str:

1902

server_settings[option] = unicode(server_settings[option])

2527

if isinstance(server_settings[option], bytes):

2528

server_settings[option] = (server_settings[option]

2529

.decode("utf-8"))

2530

# Force all boolean options to be boolean

2531

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2532

"foreground", "zeroconf"):

2533

server_settings[option] = bool(server_settings[option])

2534

# Debug implies foreground

2535

if server_settings["debug"]:

2536

server_settings["foreground"] = True

1903

2537

# Now we have our good server settings in "server_settings"

1904

2538

1905

2539

##################################################################

1906

2540

2541

if (not server_settings["zeroconf"]

2542

and not (server_settings["port"]

2543

or server_settings["socket"] != "")):

2544

parser.error("Needs port or socket to work without Zeroconf")

2545

1907

2546

# For convenience

1908

2547

debug = server_settings["debug"]

1909

2548

debuglevel = server_settings["debuglevel"]

1910

2549

use_dbus = server_settings["use_dbus"]

1911

2550

use_ipv6 = server_settings["use_ipv6"]

2551

stored_state_path = os.path.join(server_settings["statedir"],

2552

stored_state_file)

2553

foreground = server_settings["foreground"]

2554

zeroconf = server_settings["zeroconf"]

2555

2556

if debug:

2557

initlogger(debug, logging.DEBUG)

2558

else:

2559

if not debuglevel:

2560

initlogger(debug)

2561

else:

2562

level = getattr(logging, debuglevel.upper())

2563

initlogger(debug, level)

1912

2564

1913

2565

if server_settings["servicename"] != "Mandos":

1914

syslogger.setFormatter(logging.Formatter

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

2566

syslogger.setFormatter(

2567

logging.Formatter('Mandos ({}) [%(process)d]:'

2568

' %(levelname)s: %(message)s'.format(

2569

server_settings["servicename"])))

1918

2570

1919

2571

# Parse config file with clients

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1927

}

1928

client_config = configparser.SafeConfigParser(client_defaults)

2572

client_config = configparser.SafeConfigParser(Client

2573

.client_defaults)

1929

2574

client_config.read(os.path.join(server_settings["configdir"],

1930

2575

"clients.conf"))

1931

2576

1932

2577

global mandos_dbus_service

1933

2578

mandos_dbus_service = None

1934

2579

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1937

ClientHandler,

1938

interface=(server_settings["interface"]

1939

or None),

1940

use_ipv6=use_ipv6,

1941

gnutls_priority=

1942

server_settings["priority"],

1943

use_dbus=use_dbus)

1944

if not debug:

1945

pidfilename = "/var/run/mandos.pid"

2580

socketfd = None

2581

if server_settings["socket"] != "":

2582

socketfd = server_settings["socket"]

2583

tcp_server = MandosServer(

2584

(server_settings["address"], server_settings["port"]),

2585

ClientHandler,

2586

interface=(server_settings["interface"] or None),

2587

use_ipv6=use_ipv6,

2588

gnutls_priority=server_settings["priority"],

2589

use_dbus=use_dbus,

2590

socketfd=socketfd)

2591

if not foreground:

2592

pidfilename = "/run/mandos.pid"

2593

if not os.path.isdir("/run/."):

2594

pidfilename = "/var/run/mandos.pid"

2595

pidfile = None

1946

2596

try:

1947

pidfile = open(pidfilename, "w")

1948

except IOError:

1949

logger.error("Could not open file %r", pidfilename)

2597

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2598

except IOError as e:

2599

logger.error("Could not open file %r", pidfilename,

2600

exc_info=e)

1950

2601

1951

try:

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1954

except KeyError:

2602

for name in ("_mandos", "mandos", "nobody"):

1955

2603

try:

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

2604

uid = pwd.getpwnam(name).pw_uid

2605

gid = pwd.getpwnam(name).pw_gid

2606

break

1958

2607

except KeyError:

1959

try:

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1962

except KeyError:

1963

uid = 65534

1964

gid = 65534

2608

continue

2609

else:

2610

uid = 65534

2611

gid = 65534

1965

2612

try:

1966

2613

os.setgid(gid)

1967

2614

os.setuid(uid)

1968

2615

except OSError as error:

1969

if error[0] != errno.EPERM:

1970

raise error

1971

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

2616

if error.errno != errno.EPERM:

2617

raise

1979

2618

1980

2619

if debug:

1981

2620

# Enable all possible GnuTLS debugging

1988

2627

def debug_gnutls(level, string):

1989

2628

logger.debug("GnuTLS: %s", string[:-1])

1990

2629

1991

(gnutls.library.functions

1992

.gnutls_global_set_log_function(debug_gnutls))

2630

gnutls.library.functions.gnutls_global_set_log_function(

2631

debug_gnutls)

1993

2632

1994

2633

# Redirect stdin so all checkers get /dev/null

1995

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2634

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1996

2635

os.dup2(null, sys.stdin.fileno())

1997

2636

if null > 2:

1998

2637

os.close(null)

1999

else:

2000

# No console logging

2001

logger.removeHandler(console)

2002

2638

2003

2639

# Need to fork before connecting to D-Bus

2004

if not debug:

2640

if not foreground:

2005

2641

# Close all input and output, do double fork, etc.

2006

2642

daemon()

2007

2643

2644

# multiprocessing will use threads, so before we use gobject we

2645

# need to inform gobject that threads will be used.

2646

gobject.threads_init()

2647

2008

2648

global main_loop

2009

2649

# From the Avahi example code

2010

DBusGMainLoop(set_as_default=True )

2650

DBusGMainLoop(set_as_default=True)

2011

2651

main_loop = gobject.MainLoop()

2012

2652

bus = dbus.SystemBus()

2013

2653

# End of Avahi example code

2014

2654

if use_dbus:

2015

2655

try:

2016

2656

bus_name = dbus.service.BusName("se.recompile.Mandos",

2017

bus, do_not_queue=True)

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

2657

bus,

2658

do_not_queue=True)

2659

old_bus_name = dbus.service.BusName(

2660

"se.bsnet.fukt.Mandos", bus,

2661

do_not_queue=True)

2662

except dbus.exceptions.DBusException as e:

2663

logger.error("Disabling D-Bus:", exc_info=e)

2023

2664

use_dbus = False

2024

2665

server_settings["use_dbus"] = False

2025

2666

tcp_server.use_dbus = False

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

2029

protocol = protocol, bus = bus)

2030

if server_settings["interface"]:

2031

service.interface = (if_nametoindex

2032

(str(server_settings["interface"])))

2667

if zeroconf:

2668

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2669

service = AvahiServiceToSyslog(

2670

name = server_settings["servicename"],

2671

servicetype = "_mandos._tcp",

2672

protocol = protocol,

2673

bus = bus)

2674

if server_settings["interface"]:

2675

service.interface = if_nametoindex(

2676

server_settings["interface"].encode("utf-8"))

2033

2677

2034

2678

global multiprocessing_manager

2035

2679

multiprocessing_manager = multiprocessing.Manager()

2036

2680

2037

2681

client_class = Client

2038

2682

if use_dbus:

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

2041

def client_config_items(config, section):

2042

special_settings = {

2043

"approved_by_default":

2044

lambda: config.getboolean(section,

2045

"approved_by_default"),

2046

}

2047

for name, value in config.items(section):

2683

client_class = functools.partial(ClientDBus, bus = bus)

2684

2685

client_settings = Client.config_parser(client_config)

2686

old_client_settings = {}

2687

clients_data = {}

2688

2689

# This is used to redirect stdout and stderr for checker processes

2690

global wnull

2691

wnull = open(os.devnull, "w") # A writable /dev/null

2692

# Only used if server is running in foreground but not in debug

2693

# mode

2694

if debug or not foreground:

2695

wnull.close()

2696

2697

# Get client data and settings from last running state.

2698

if server_settings["restore"]:

2699

try:

2700

with open(stored_state_path, "rb") as stored_state:

2701

clients_data, old_client_settings = pickle.load(

2702

stored_state)

2703

os.remove(stored_state_path)

2704

except IOError as e:

2705

if e.errno == errno.ENOENT:

2706

logger.warning("Could not load persistent state:"

2707

" {}".format(os.strerror(e.errno)))

2708

else:

2709

logger.critical("Could not load persistent state:",

2710

exc_info=e)

2711

raise

2712

except EOFError as e:

2713

logger.warning("Could not load persistent state: "

2714

"EOFError:",

2715

exc_info=e)

2716

2717

with PGPEngine() as pgp:

2718

for client_name, client in clients_data.items():

2719

# Skip removed clients

2720

if client_name not in client_settings:

2721

continue

2722

2723

# Decide which value to use after restoring saved state.

2724

# We have three different values: Old config file,

2725

# new config file, and saved state.

2726

# New config value takes precedence if it differs from old

2727

# config value, otherwise use saved state.

2728

for name, value in client_settings[client_name].items():

2729

try:

2730

# For each value in new config, check if it

2731

# differs from the old config value (Except for

2732

# the "secret" attribute)

2733

if (name != "secret"

2734

and (value !=

2735

old_client_settings[client_name][name])):

2736

client[name] = value

2737

except KeyError:

2738

pass

2739

2740

# Clients who has passed its expire date can still be

2741

# enabled if its last checker was successful. A Client

2742

# whose checker succeeded before we stored its state is

2743

# assumed to have successfully run all checkers during

2744

# downtime.

2745

if client["enabled"]:

2746

if datetime.datetime.utcnow() >= client["expires"]:

2747

if not client["last_checked_ok"]:

2748

logger.warning(

2749

"disabling client {} - Client never "

2750

"performed a successful checker".format(

2751

client_name))

2752

client["enabled"] = False

2753

elif client["last_checker_status"] != 0:

2754

logger.warning(

2755

"disabling client {} - Client last"

2756

" checker failed with error code"

2757

" {}".format(

2758

client_name,

2759

client["last_checker_status"]))

2760

client["enabled"] = False

2761

else:

2762

client["expires"] = (

2763

datetime.datetime.utcnow()

2764

+ client["timeout"])

2765

logger.debug("Last checker succeeded,"

2766

" keeping {} enabled".format(

2767

client_name))

2048

2768

try:

2049

yield (name, special_settings[name]())

2050

except KeyError:

2051

yield (name, value)

2052

2053

tcp_server.clients.update(set(

2054

client_class(name = section,

2055

config= dict(client_config_items(

2056

client_config, section)))

2057

for section in client_config.sections()))

2769

client["secret"] = pgp.decrypt(

2770

client["encrypted_secret"],

2771

client_settings[client_name]["secret"])

2772

except PGPError:

2773

# If decryption fails, we use secret from new settings

2774

logger.debug("Failed to decrypt {} old secret".format(

2775

client_name))

2776

client["secret"] = (client_settings[client_name]

2777

["secret"])

2778

2779

# Add/remove clients based on new changes made to config

2780

for client_name in (set(old_client_settings)

2781

- set(client_settings)):

2782

del clients_data[client_name]

2783

for client_name in (set(client_settings)

2784

- set(old_client_settings)):

2785

clients_data[client_name] = client_settings[client_name]

2786

2787

# Create all client objects

2788

for client_name, client in clients_data.items():

2789

tcp_server.clients[client_name] = client_class(

2790

name = client_name,

2791

settings = client,

2792

server_settings = server_settings)

2793

2058

2794

if not tcp_server.clients:

2059

2795

logger.warning("No clients defined")

2060

2061

if not debug:

2062

try:

2063

with pidfile:

2064

pid = os.getpid()

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

2066

del pidfile

2067

except IOError:

2068

logger.error("Could not write to file %r with PID %d",

2069

pidfilename, pid)

2070

except NameError:

2071

# "pidfile" was never created

2072

pass

2796

2797

if not foreground:

2798

if pidfile is not None:

2799

pid = os.getpid()

2800

try:

2801

with pidfile:

2802

print(pid, file=pidfile)

2803

except IOError:

2804

logger.error("Could not write to file %r with PID %d",

2805

pidfilename, pid)

2806

del pidfile

2073

2807

del pidfilename

2074

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

2808

2077

2809

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2078

2810

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2079

2811

2080

2812

if use_dbus:

2081

class MandosDBusService(dbus.service.Object):

2813

2814

@alternate_dbus_interfaces(

2815

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2816

class MandosDBusService(DBusObjectWithAnnotations):

2082

2817

"""A D-Bus proxy object"""

2818

2083

2819

def __init__(self):

2084

2820

dbus.service.Object.__init__(self, bus, "/")

2821

2085

2822

_interface = "se.recompile.Mandos"

2086

2823

2087

2824

@dbus.service.signal(_interface, signature="o")

2102

2839

@dbus.service.method(_interface, out_signature="ao")

2103

2840

def GetAllClients(self):

2104

2841

"D-Bus method"

2105

return dbus.Array(c.dbus_object_path

2106

for c in tcp_server.clients)

2842

return dbus.Array(c.dbus_object_path for c in

2843

tcp_server.clients.itervalues())

2107

2844

2108

2845

@dbus.service.method(_interface,

2109

2846

out_signature="a{oa{sv}}")

2110

2847

def GetAllClientsWithProperties(self):

2111

2848

"D-Bus method"

2112

2849

return dbus.Dictionary(

2113

((c.dbus_object_path, c.GetAll(""))

2114

for c in tcp_server.clients),

2850

{ c.dbus_object_path: c.GetAll("")

2851

for c in tcp_server.clients.itervalues() },

2115

2852

signature="oa{sv}")

2116

2853

2117

2854

@dbus.service.method(_interface, in_signature="o")

2118

2855

def RemoveClient(self, object_path):

2119

2856

"D-Bus method"

2120

for c in tcp_server.clients:

2857

for c in tcp_server.clients.itervalues():

2121

2858

if c.dbus_object_path == object_path:

2122

tcp_server.clients.remove(c)

2859

del tcp_server.clients[c.name]

2123

2860

c.remove_from_connection()

2124

2861

# Don't signal anything except ClientRemoved

2125

2862

c.disable(quiet=True)

2130

2867

2131

2868

del _interface

2132

2869

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

2870

mandos_dbus_service = MandosDBusService()

2136

2871

2137

2872

def cleanup():

2138

2873

"Cleanup function; run on exit"

2139

service.cleanup()

2874

if zeroconf:

2875

service.cleanup()

2140

2876

2141

2877

multiprocessing.active_children()

2878

wnull.close()

2879

if not (tcp_server.clients or client_settings):

2880

return

2881

2882

# Store client before exiting. Secrets are encrypted with key

2883

# based on what config file has. If config file is

2884

# removed/edited, old secret will thus be unrecovable.

2885

clients = {}

2886

with PGPEngine() as pgp:

2887

for client in tcp_server.clients.itervalues():

2888

key = client_settings[client.name]["secret"]

2889

client.encrypted_secret = pgp.encrypt(client.secret,

2890

key)

2891

client_dict = {}

2892

2893

# A list of attributes that can not be pickled

2894

# + secret.

2895

exclude = { "bus", "changedstate", "secret",

2896

"checker", "server_settings" }

2897

for name, typ in inspect.getmembers(dbus.service

2898

.Object):

2899

exclude.add(name)

2900

2901

client_dict["encrypted_secret"] = (client

2902

.encrypted_secret)

2903

for attr in client.client_structure:

2904

if attr not in exclude:

2905

client_dict[attr] = getattr(client, attr)

2906

2907

clients[client.name] = client_dict

2908

del client_settings[client.name]["secret"]

2909

2910

try:

2911

with tempfile.NamedTemporaryFile(

2912

mode='wb',

2913

suffix=".pickle",

2914

prefix='clients-',

2915

dir=os.path.dirname(stored_state_path),

2916

delete=False) as stored_state:

2917

pickle.dump((clients, client_settings), stored_state)

2918

tempname = stored_state.name

2919

os.rename(tempname, stored_state_path)

2920

except (IOError, OSError) as e:

2921

if not debug:

2922

try:

2923

os.remove(tempname)

2924

except NameError:

2925

pass

2926

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2927

logger.warning("Could not save persistent state: {}"

2928

.format(os.strerror(e.errno)))

2929

else:

2930

logger.warning("Could not save persistent state:",

2931

exc_info=e)

2932

raise

2933

2934

# Delete all clients, and settings from config

2142

2935

while tcp_server.clients:

2143

client = tcp_server.clients.pop()

2936

name, client = tcp_server.clients.popitem()

2144

2937

if use_dbus:

2145

2938

client.remove_from_connection()

2146

client.disable_hook = None

2147

2939

# Don't signal anything except ClientRemoved

2148

2940

client.disable(quiet=True)

2149

2941

if use_dbus:

2150

2942

# Emit D-Bus signal

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

2153

client.name)

2943

mandos_dbus_service.ClientRemoved(

2944

client.dbus_object_path, client.name)

2945

client_settings.clear()

2154

2946

2155

2947

atexit.register(cleanup)

2156

2948

2157

for client in tcp_server.clients:

2949

for client in tcp_server.clients.itervalues():

2158

2950

if use_dbus:

2159

2951

# Emit D-Bus signal

2160

2952

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2161

client.enable()

2953

# Need to initiate checking of clients

2954

if client.enabled:

2955

client.init_checker()

2162

2956

2163

2957

tcp_server.enable()

2164

2958

tcp_server.server_activate()

2165

2959

2166

2960

# Find out what port we got

2167

service.port = tcp_server.socket.getsockname()[1]

2961

if zeroconf:

2962

service.port = tcp_server.socket.getsockname()[1]

2168

2963

if use_ipv6:

2169

2964

logger.info("Now listening on address %r, port %d,"

2170

" flowinfo %d, scope_id %d"

2171

% tcp_server.socket.getsockname())

2965

" flowinfo %d, scope_id %d",

2966

*tcp_server.socket.getsockname())

2172

2967

else: # IPv4

2173

logger.info("Now listening on address %r, port %d"

2174

% tcp_server.socket.getsockname())

2968

logger.info("Now listening on address %r, port %d",

2969

*tcp_server.socket.getsockname())

2175

2970

2176

2971

#service.interface = tcp_server.socket.getsockname()[3]

2177

2972

2178

2973

try:

2179

# From the Avahi example code

2180

try:

2181

service.activate()

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

2184

cleanup()

2185

sys.exit(1)

2186

# End of Avahi example code

2974

if zeroconf:

2975

# From the Avahi example code

2976

try:

2977

service.activate()

2978

except dbus.exceptions.DBusException as error:

2979

logger.critical("D-Bus Exception", exc_info=error)

2980

cleanup()

2981

sys.exit(1)

2982

# End of Avahi example code

2187

2983

2188

2984

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2189

2985

lambda *args, **kwargs:

2193

2989

logger.debug("Starting main loop")

2194

2990

main_loop.run()

2195

2991

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

2992

logger.critical("Avahi Error", exc_info=error)

2197

2993

cleanup()

2198

2994

sys.exit(1)

2199

2995

except KeyboardInterrupt: