To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.333
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.333
- Committer: Teddy Hogeborn
- Date: 2015-08-10 09:00:23 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 325.
- Revision ID: teddy@recompile.se-20150810090023-fz6vjqr7zf33e2tf
Support the standard org.freedesktop.DBus.ObjectManager interface.
Now that the D-Bus standard has an interface to keep track of new and
removed objects, use that instead of our own methods. This deprecates
our D-Bus methods "GetAllClients" and "GetAllClientsWithProperties"
and the signals "ClientAdded" and "ClientRemoved", all on the server
interface "se.recompile.Mandos".
* DBUS-API: Removed references to deprecated methods and signals;
insert reference to the org.freedesktop.DBus.ObjectManager
interface.
* mandos (DBusObjectWithProperties._get_all_interface_names): New.
(dbus.OBJECT_MANAGER_IFACE): If not present, monkey patch.
(DBusObjectWithObjectManager): New.
(main/MandosDBusService): Inherit from DBusObjectWithObjectManager.
(main/MandosDBusService.ClientRemoved): Annotate as deprecated.
(main/MandosDBusService.GetAllClients): - '' -
(main/MandosDBusService.GetAllClientsWithProperties): Annotate as
deprecated.
Also only
return
properties on
client
interface.
(main/MandosDBusService.RemoveClient): Call client_removed_signal
instead of ClientRemoved.
(main/MandosDBusService.GetManagedObjects): New.
(main/MandosDBusService.client_added_signal): New.
(main/MandosDBusService.client_removed_signal): - '' -
(main/cleanup): Call "client_removed_signal" instead of sending
"ClientRemoved" signal directly.
(main): Call "client_added_signal" instead of sending "ClientAdded"
signal directly.
* mandos-ctl: Use GetManagedObjects instead of
GetAllClientsWithProperties. Also, show better error
message in case of failure to connect to the D-Bus
* mandos-monitor (MandosClientPropertyCache.properties_changed):
Bug fix; only update properties on client interface.
(UserInterface.find_and_remove_client): Change to accept arguments
from InterfacesRemoved
signal. Also, bug fix:
working error message when
removing unknown client.
(UserInterface.add_new_client): Change to accept arguments from
InterfacesRemoved signal. Pass
properties to MandosClientWidget
constructor.
(UserInterface.run): Connect find_and_remove_client method to
InterfacesRemoved signal and the add_new_client
method to the InterfacesAdded signal.
Now that the D-Bus standard has an interface to keep track of new and
removed objects, use that instead of our own methods. This deprecates
our D-Bus methods "GetAllClients" and "GetAllClientsWithProperties"
and the signals "ClientAdded" and "ClientRemoved", all on the server
interface "se.recompile.Mandos".
* DBUS-API: Removed references to deprecated methods and signals;
insert reference to the org.freedesktop.DBus.ObjectManager
interface.
* mandos (DBusObjectWithProperties._get_all_interface_names): New.
(dbus.OBJECT_MANAGER_IFACE): If not present, monkey patch.
(DBusObjectWithObjectManager): New.
(main/MandosDBusService): Inherit from DBusObjectWithObjectManager.
(main/MandosDBusService.ClientRemoved): Annotate as deprecated.
(main/MandosDBusService.GetAllClients): - '' -
(main/MandosDBusService.GetAllClientsWithProperties): Annotate as
deprecated.
Also only
return
properties on
client
interface.
(main/MandosDBusService.RemoveClient): Call client_removed_signal
instead of ClientRemoved.
(main/MandosDBusService.GetManagedObjects): New.
(main/MandosDBusService.client_added_signal): New.
(main/MandosDBusService.client_removed_signal): - '' -
(main/cleanup): Call "client_removed_signal" instead of sending
"ClientRemoved" signal directly.
(main): Call "client_added_signal" instead of sending "ClientAdded"
signal directly.
* mandos-ctl: Use GetManagedObjects instead of
GetAllClientsWithProperties. Also, show better error
message in case of failure to connect to the D-Bus
* mandos-monitor (MandosClientPropertyCache.properties_changed):
Bug fix; only update properties on client interface.
(UserInterface.find_and_remove_client): Change to accept arguments
from InterfacesRemoved
signal. Also, bug fix:
working error message when
removing unknown client.
(UserInterface.add_new_client): Change to accept arguments from
InterfacesRemoved signal. Pass
properties to MandosClientWidget
constructor.
(UserInterface.run): Connect find_and_remove_client method to
InterfacesRemoved signal and the add_new_client
method to the InterfacesAdded signal.
- files added:
- plugin-helpers/mandos-client-iprouteadddel.c
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
71
80
import collections
81
import codecs
72
82
73
83
import dbus
74
84
import dbus.service
75
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
76
89
import avahi
77
90
from dbus.mainloop.glib import DBusGMainLoop
78
91
import ctypes
98
111
syslogger = None
99
112
100
113
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
104
116
except (OSError, AttributeError):
117
105
118
def if_nametoindex(interface):
106
119
"Get an interface index the hard way, i.e. using fcntl()"
107
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
116
129
"""init logger and add loglevel"""
117
130
118
131
global syslogger
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
123
135
syslogger.setFormatter(logging.Formatter
124
136
('Mandos [%(process)d]: %(levelname)s:'
125
137
' %(message)s'))
142
154
143
155
class PGPEngine(object):
144
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
145
158
def __init__(self):
146
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
160
self.gnupgargs = ['--batch',
186
199
187
200
def encrypt(self, data, password):
188
201
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
191
204
passfile.write(passphrase)
192
205
passfile.flush()
193
206
proc = subprocess.Popen(['gpg', '--symmetric',
204
217
205
218
def decrypt(self, data, password):
206
219
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
209
222
passfile.write(passphrase)
210
223
passfile.flush()
211
224
proc = subprocess.Popen(['gpg', '--decrypt',
215
228
stdin = subprocess.PIPE,
216
229
stdout = subprocess.PIPE,
217
230
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
231
decrypted_plaintext, err = proc.communicate(input = data)
220
232
if proc.returncode != 0:
221
233
raise PGPError(err)
222
234
return decrypted_plaintext
228
240
return super(AvahiError, self).__init__(value, *args,
229
241
**kwargs)
230
242
243
231
244
class AvahiServiceError(AvahiError):
232
245
pass
233
246
247
234
248
class AvahiGroupError(AvahiError):
235
249
pass
236
250
256
270
bus: dbus.SystemBus()
257
271
"""
258
272
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
263
284
self.interface = interface
264
285
self.name = name
265
286
self.type = servicetype
282
303
" after %i retries, exiting.",
283
304
self.rename_count)
284
305
raise AvahiServiceError("Too many renames")
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
287
308
self.rename_count += 1
288
309
logger.info("Changing Zeroconf service name to %r ...",
289
310
self.name)
344
365
elif state == avahi.ENTRY_GROUP_FAILURE:
345
366
logger.critical("Avahi: Error in group state changed %s",
346
367
str(error))
347
raise AvahiGroupError("State changed: {!s}"
348
.format(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
349
369
350
370
def cleanup(self):
351
371
"""Derived from the Avahi example code"""
361
381
def server_state_changed(self, state, error=None):
362
382
"""Derived from the Avahi example code"""
363
383
logger.debug("Avahi server state change: %i", state)
364
bad_states = { avahi.SERVER_INVALID:
365
"Zeroconf server invalid",
366
avahi.SERVER_REGISTERING: None,
367
avahi.SERVER_COLLISION:
368
"Zeroconf server name collision",
369
avahi.SERVER_FAILURE:
370
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
371
390
if state in bad_states:
372
391
if bad_states[state] is not None:
373
392
if error is None:
376
395
logger.error(bad_states[state] + ": %r", error)
377
396
self.cleanup()
378
397
elif state == avahi.SERVER_RUNNING:
379
self.add()
398
try:
399
self.add()
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
404
" collision.")
405
return self.rename(remove=False)
406
else:
407
logger.critical("D-Bus Exception", exc_info=error)
408
self.cleanup()
409
os._exit(1)
380
410
else:
381
411
if error is None:
382
412
logger.debug("Unknown state: %r", state)
392
422
follow_name_owner_changes=True),
393
423
avahi.DBUS_INTERFACE_SERVER)
394
424
self.server.connect_to_signal("StateChanged",
395
self.server_state_changed)
425
self.server_state_changed)
396
426
self.server_state_changed(self.server.GetState())
397
427
398
428
400
430
def rename(self, *args, **kwargs):
401
431
"""Add the new name to the syslog messages"""
402
432
ret = AvahiService.rename(self, *args, **kwargs)
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
406
.format(self.name)))
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
.format(self.name)))
407
436
return ret
408
437
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
441
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
444
"""
445
connection.send(func(*args, **kwargs))
446
connection.close()
409
447
410
448
class Client(object):
411
449
"""A representation of a client host served by this server.
438
476
last_checker_status: integer between 0 and 255 reflecting exit
439
477
status of last checker. -1 reflects crashed
440
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
441
481
last_enabled: datetime.datetime(); (UTC) or None
442
482
name: string; from the config file, used in log messages and
443
483
D-Bus identifiers
456
496
"fingerprint", "host", "interval",
457
497
"last_approval_request", "last_checked_ok",
458
498
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
499
client_defaults = {
500
"timeout": "PT5M",
501
"extended_timeout": "PT15M",
502
"interval": "PT2M",
503
"checker": "fping -q -- %%(host)s",
504
"host": "",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
508
"enabled": "True",
509
}
469
510
470
511
@staticmethod
471
512
def config_parser(config):
487
528
client["enabled"] = config.getboolean(client_name,
488
529
"enabled")
489
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
490
534
client["fingerprint"] = (section["fingerprint"].upper()
491
535
.replace(" ", ""))
492
536
if "secret" in section:
534
578
self.expires = None
535
579
536
580
logger.debug("Creating client %r", self.name)
537
# Uppercase and remove spaces from fingerprint for later
538
# comparison purposes with return value from the fingerprint()
539
# function
540
581
logger.debug(" Fingerprint: %s", self.fingerprint)
541
582
self.created = settings.get("created",
542
583
datetime.datetime.utcnow())
549
590
self.current_checker_command = None
550
591
self.approved = None
551
592
self.approvals_pending = 0
552
self.changedstate = (multiprocessing_manager
553
.Condition(multiprocessing_manager
554
.Lock()))
555
self.client_structure = [attr for attr in
556
self.__dict__.iterkeys()
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
557
597
if not attr.startswith("_")]
558
598
self.client_structure.append("client_structure")
559
599
560
for name, t in inspect.getmembers(type(self),
561
lambda obj:
562
isinstance(obj,
563
property)):
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
564
602
if not name.startswith("_"):
565
603
self.client_structure.append(name)
566
604
608
646
# and every interval from then on.
609
647
if self.checker_initiator_tag is not None:
610
648
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
612
(int(self.interval
613
.total_seconds() * 1000),
614
self.start_checker))
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
615
652
# Schedule a disable() when 'timeout' has passed
616
653
if self.disable_initiator_tag is not None:
617
654
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
619
(int(self.timeout
620
.total_seconds() * 1000),
621
self.disable))
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
622
657
# Also start a new checker *right now*.
623
658
self.start_checker()
624
659
625
def checker_callback(self, pid, condition, command):
660
def checker_callback(self, source, condition, connection,
661
command):
626
662
"""The checker has completed, so take appropriate actions."""
627
663
self.checker_callback_tag = None
628
664
self.checker = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
667
connection.close()
668
669
if returncode >= 0:
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
631
672
if self.last_checker_status == 0:
632
673
logger.info("Checker for %(name)s succeeded",
633
674
vars(self))
634
675
self.checked_ok()
635
676
else:
636
logger.info("Checker for %(name)s failed",
637
vars(self))
677
logger.info("Checker for %(name)s failed", vars(self))
638
678
else:
639
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
640
681
logger.warning("Checker for %(name)s crashed?",
641
682
vars(self))
683
return False
642
684
643
685
def checked_ok(self):
644
686
"""Assert that the client has been seen, alive and well."""
645
687
self.last_checked_ok = datetime.datetime.utcnow()
646
688
self.last_checker_status = 0
689
self.last_checker_signal = None
647
690
self.bump_timeout()
648
691
649
692
def bump_timeout(self, timeout=None):
654
697
gobject.source_remove(self.disable_initiator_tag)
655
698
self.disable_initiator_tag = None
656
699
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
660
702
self.expires = datetime.datetime.utcnow() + timeout
661
703
662
704
def need_approval(self):
676
718
# than 'timeout' for the client to be disabled, which is as it
677
719
# should be.
678
720
679
# If a checker exists, make sure it is not a zombie
680
try:
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except AttributeError:
683
pass
684
except OSError as error:
685
if error.errno != errno.ECHILD:
686
raise
687
else:
688
if pid:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
723
self.checker.join()
724
self.checker = None
693
725
# Start a new checker if needed
694
726
if self.checker is None:
695
727
# Escape attributes for the shell
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
728
escaped_attrs = {
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
699
731
try:
700
732
command = self.checker_command % escaped_attrs
701
733
except TypeError as error:
702
734
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
735
self.checker_command,
736
exc_info=error)
737
return True # Try again later
705
738
self.current_checker_command = command
706
try:
707
logger.info("Starting checker %r for %s",
708
command, self.name)
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
# The exception is when not debugging but nevertheless
714
# running in the foreground; use the previously
715
# created wnull.
716
popen_args = {}
717
if (not self.server_settings["debug"]
718
and self.server_settings["foreground"]):
719
popen_args.update({"stdout": wnull,
720
"stderr": wnull })
721
self.checker = subprocess.Popen(command,
722
close_fds=True,
723
shell=True, cwd="/",
724
**popen_args)
725
except OSError as error:
726
logger.error("Failed to start subprocess",
727
exc_info=error)
728
return True
729
self.checker_callback_tag = (gobject.child_watch_add
730
(self.checker.pid,
731
self.checker_callback,
732
data=command))
733
# The checker may have completed before the gobject
734
# watch was added. Check for this.
735
try:
736
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
737
except OSError as error:
738
if error.errno == errno.ECHILD:
739
# This should never happen
740
logger.error("Child process vanished",
741
exc_info=error)
742
return True
743
raise
744
if pid:
745
gobject.source_remove(self.checker_callback_tag)
746
self.checker_callback(pid, status, command)
739
logger.info("Starting checker %r for %s", command,
740
self.name)
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
747
# created wnull.
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
760
self.checker.start()
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
747
764
# Re-run this periodically if run by gobject.timeout_add
748
765
return True
749
766
755
772
if getattr(self, "checker", None) is None:
756
773
return
757
774
logger.debug("Stopping checker for %(name)s", vars(self))
758
try:
759
self.checker.terminate()
760
#time.sleep(0.5)
761
#if self.checker.poll() is None:
762
# self.checker.kill()
763
except OSError as error:
764
if error.errno != errno.ESRCH: # No such process
765
raise
775
self.checker.terminate()
766
776
self.checker = None
767
777
768
778
769
def dbus_service_property(dbus_interface, signature="v",
770
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
771
783
"""Decorators for marking methods of a DBusObjectWithProperties to
772
784
become properties on the D-Bus.
773
785
783
795
if byte_arrays and signature != "ay":
784
796
raise ValueError("Byte arrays not supported for non-'ay'"
785
797
" signature {!r}".format(signature))
798
786
799
def decorator(func):
787
800
func._dbus_is_property = True
788
801
func._dbus_interface = dbus_interface
793
806
func._dbus_name = func._dbus_name[:-14]
794
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
795
808
return func
809
796
810
return decorator
797
811
798
812
807
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
808
822
"false"}
809
823
"""
824
810
825
def decorator(func):
811
826
func._dbus_is_interface = True
812
827
func._dbus_interface = dbus_interface
813
828
func._dbus_name = dbus_interface
814
829
return func
830
815
831
return decorator
816
832
817
833
826
842
access="r")
827
843
def Property_dbus_property(self):
828
844
return dbus.Boolean(False)
845
846
See also the DBusObjectWithAnnotations class.
829
847
"""
848
830
849
def decorator(func):
831
850
func._dbus_annotations = annotations
832
851
return func
852
833
853
return decorator
834
854
835
855
838
858
"""
839
859
pass
840
860
861
841
862
class DBusPropertyAccessException(DBusPropertyException):
842
863
"""A property's access permissions disallows an operation.
843
864
"""
850
871
pass
851
872
852
873
853
class DBusObjectWithProperties(dbus.service.Object):
854
"""A D-Bus object with properties.
874
class DBusObjectWithAnnotations(dbus.service.Object):
875
"""A D-Bus object with annotations.
855
876
856
Classes inheriting from this can use the dbus_service_property
857
decorator to expose methods as D-Bus properties. It exposes the
858
standard Get(), Set(), and GetAll() methods on the D-Bus.
877
Classes inheriting from this can use the dbus_annotations
878
decorator to add annotations to methods or signals.
859
879
"""
860
880
861
881
@staticmethod
871
891
def _get_all_dbus_things(self, thing):
872
892
"""Returns a generator of (name, attribute) pairs
873
893
"""
874
return ((getattr(athing.__get__(self), "_dbus_name",
875
name),
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
876
895
athing.__get__(self))
877
896
for cls in self.__class__.__mro__
878
897
for name, athing in
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
900
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
901
out_signature = "s",
902
path_keyword = 'object_path',
903
connection_keyword = 'connection')
904
def Introspect(self, object_path, connection):
905
"""Overloading of standard D-Bus method.
906
907
Inserts annotation tags on methods and signals.
908
"""
909
xmlstring = dbus.service.Object.Introspect(self, object_path,
910
connection)
911
try:
912
document = xml.dom.minidom.parseString(xmlstring)
913
914
for if_tag in document.getElementsByTagName("interface"):
915
# Add annotation tags
916
for typ in ("method", "signal"):
917
for tag in if_tag.getElementsByTagName(typ):
918
annots = dict()
919
for name, prop in (self.
920
_get_all_dbus_things(typ)):
921
if (name == tag.getAttribute("name")
922
and prop._dbus_interface
923
== if_tag.getAttribute("name")):
924
annots.update(getattr(
925
prop, "_dbus_annotations", {}))
926
for name, value in annots.items():
927
ann_tag = document.createElement(
928
"annotation")
929
ann_tag.setAttribute("name", name)
930
ann_tag.setAttribute("value", value)
931
tag.appendChild(ann_tag)
932
# Add interface annotation tags
933
for annotation, value in dict(
934
itertools.chain.from_iterable(
935
annotations().items()
936
for name, annotations
937
in self._get_all_dbus_things("interface")
938
if name == if_tag.getAttribute("name")
939
)).items():
940
ann_tag = document.createElement("annotation")
941
ann_tag.setAttribute("name", annotation)
942
ann_tag.setAttribute("value", value)
943
if_tag.appendChild(ann_tag)
944
# Fix argument name for the Introspect method itself
945
if (if_tag.getAttribute("name")
946
== dbus.INTROSPECTABLE_IFACE):
947
for cn in if_tag.getElementsByTagName("method"):
948
if cn.getAttribute("name") == "Introspect":
949
for arg in cn.getElementsByTagName("arg"):
950
if (arg.getAttribute("direction")
951
== "out"):
952
arg.setAttribute("name",
953
"xml_data")
954
xmlstring = document.toxml("utf-8")
955
document.unlink()
956
except (AttributeError, xml.dom.DOMException,
957
xml.parsers.expat.ExpatError) as error:
958
logger.error("Failed to override Introspection method",
959
exc_info=error)
960
return xmlstring
961
962
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
964
"""A D-Bus object with properties.
965
966
Classes inheriting from this can use the dbus_service_property
967
decorator to expose methods as D-Bus properties. It exposes the
968
standard Get(), Set(), and GetAll() methods on the D-Bus.
969
"""
881
970
882
971
def _get_dbus_property(self, interface_name, property_name):
883
972
"""Returns a bound method if one exists which is a D-Bus
884
973
property with the specified name and interface.
885
974
"""
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
888
(cls,
889
self._is_dbus_thing("property"))):
975
for cls in self.__class__.__mro__:
976
for name, value in inspect.getmembers(
977
cls, self._is_dbus_thing("property")):
890
978
if (value._dbus_name == property_name
891
979
and value._dbus_interface == interface_name):
892
980
return value.__get__(self)
893
981
894
982
# No such property
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
897
+ property_name)
898
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
983
raise DBusPropertyNotFound("{}:{}.{}".format(
984
self.dbus_object_path, interface_name, property_name))
985
986
@classmethod
987
def _get_all_interface_names(cls):
988
"""Get a sequence of all interfaces supported by an object"""
989
return (name for name in set(getattr(getattr(x, attr),
990
"_dbus_interface", None)
991
for x in (inspect.getmro(cls))
992
for attr in dir(x))
993
if name is not None)
994
995
@dbus.service.method(dbus.PROPERTIES_IFACE,
996
in_signature="ss",
900
997
out_signature="v")
901
998
def Get(self, interface_name, property_name):
902
999
"""Standard D-Bus property Get() method, see D-Bus standard.
927
1024
for byte in value))
928
1025
prop(value)
929
1026
930
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1027
@dbus.service.method(dbus.PROPERTIES_IFACE,
1028
in_signature="s",
931
1029
out_signature="a{sv}")
932
1030
def GetAll(self, interface_name):
933
1031
"""Standard D-Bus property GetAll() method, see D-Bus
948
1046
if not hasattr(value, "variant_level"):
949
1047
properties[name] = value
950
1048
continue
951
properties[name] = type(value)(value, variant_level=
952
value.variant_level+1)
1049
properties[name] = type(value)(
1050
value, variant_level = value.variant_level + 1)
953
1051
return dbus.Dictionary(properties, signature="sv")
954
1052
955
1053
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
969
1067
970
1068
Inserts property tags and interface annotation tags.
971
1069
"""
972
xmlstring = dbus.service.Object.Introspect(self, object_path,
973
connection)
1070
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1071
object_path,
1072
connection)
974
1073
try:
975
1074
document = xml.dom.minidom.parseString(xmlstring)
1075
976
1076
def make_tag(document, name, prop):
977
1077
e = document.createElement("property")
978
1078
e.setAttribute("name", name)
979
1079
e.setAttribute("type", prop._dbus_signature)
980
1080
e.setAttribute("access", prop._dbus_access)
981
1081
return e
1082
982
1083
for if_tag in document.getElementsByTagName("interface"):
983
1084
# Add property tags
984
1085
for tag in (make_tag(document, name, prop)
987
1088
if prop._dbus_interface
988
1089
== if_tag.getAttribute("name")):
989
1090
if_tag.appendChild(tag)
990
# Add annotation tags
991
for typ in ("method", "signal", "property"):
992
for tag in if_tag.getElementsByTagName(typ):
993
annots = dict()
994
for name, prop in (self.
995
_get_all_dbus_things(typ)):
996
if (name == tag.getAttribute("name")
997
and prop._dbus_interface
998
== if_tag.getAttribute("name")):
999
annots.update(getattr
1000
(prop,
1001
"_dbus_annotations",
1002
{}))
1003
for name, value in annots.items():
1004
ann_tag = document.createElement(
1005
"annotation")
1006
ann_tag.setAttribute("name", name)
1007
ann_tag.setAttribute("value", value)
1008
tag.appendChild(ann_tag)
1009
# Add interface annotation tags
1010
for annotation, value in dict(
1011
itertools.chain.from_iterable(
1012
annotations().items()
1013
for name, annotations in
1014
self._get_all_dbus_things("interface")
1015
if name == if_tag.getAttribute("name")
1016
)).items():
1017
ann_tag = document.createElement("annotation")
1018
ann_tag.setAttribute("name", annotation)
1019
ann_tag.setAttribute("value", value)
1020
if_tag.appendChild(ann_tag)
1091
# Add annotation tags for properties
1092
for tag in if_tag.getElementsByTagName("property"):
1093
annots = dict()
1094
for name, prop in self._get_all_dbus_things(
1095
"property"):
1096
if (name == tag.getAttribute("name")
1097
and prop._dbus_interface
1098
== if_tag.getAttribute("name")):
1099
annots.update(getattr(
1100
prop, "_dbus_annotations", {}))
1101
for name, value in annots.items():
1102
ann_tag = document.createElement(
1103
"annotation")
1104
ann_tag.setAttribute("name", name)
1105
ann_tag.setAttribute("value", value)
1106
tag.appendChild(ann_tag)
1021
1107
# Add the names to the return values for the
1022
1108
# "org.freedesktop.DBus.Properties" methods
1023
1109
if (if_tag.getAttribute("name")
1041
1127
exc_info=error)
1042
1128
return xmlstring
1043
1129
1130
try:
1131
dbus.OBJECT_MANAGER_IFACE
1132
except AttributeError:
1133
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1134
1135
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1136
"""A D-Bus object with an ObjectManager.
1137
1138
Classes inheriting from this exposes the standard
1139
GetManagedObjects call and the InterfacesAdded and
1140
InterfacesRemoved signals on the standard
1141
"org.freedesktop.DBus.ObjectManager" interface.
1142
1143
Note: No signals are sent automatically; they must be sent
1144
manually.
1145
"""
1146
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1147
out_signature = "a{oa{sa{sv}}}")
1148
def GetManagedObjects(self):
1149
"""This function must be overridden"""
1150
raise NotImplementedError()
1151
1152
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1153
signature = "oa{sa{sv}}")
1154
def InterfacesAdded(self, object_path, interfaces_and_properties):
1155
pass
1156
1157
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1158
signature = "oas")
1159
def InterfacesRemoved(self, object_path, interfaces):
1160
pass
1161
1162
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1163
out_signature = "s",
1164
path_keyword = 'object_path',
1165
connection_keyword = 'connection')
1166
def Introspect(self, object_path, connection):
1167
"""Overloading of standard D-Bus method.
1168
1169
Override return argument name of GetManagedObjects to be
1170
"objpath_interfaces_and_properties"
1171
"""
1172
xmlstring = DBusObjectWithAnnotations(self, object_path,
1173
connection)
1174
try:
1175
document = xml.dom.minidom.parseString(xmlstring)
1176
1177
for if_tag in document.getElementsByTagName("interface"):
1178
# Fix argument name for the GetManagedObjects method
1179
if (if_tag.getAttribute("name")
1180
== dbus.OBJECT_MANAGER_IFACE):
1181
for cn in if_tag.getElementsByTagName("method"):
1182
if (cn.getAttribute("name")
1183
== "GetManagedObjects"):
1184
for arg in cn.getElementsByTagName("arg"):
1185
if (arg.getAttribute("direction")
1186
== "out"):
1187
arg.setAttribute(
1188
"name",
1189
"objpath_interfaces"
1190
"_and_properties")
1191
xmlstring = document.toxml("utf-8")
1192
document.unlink()
1193
except (AttributeError, xml.dom.DOMException,
1194
xml.parsers.expat.ExpatError) as error:
1195
logger.error("Failed to override Introspection method",
1196
exc_info = error)
1197
return xmlstring
1044
1198
1045
1199
def datetime_to_dbus(dt, variant_level=0):
1046
1200
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1047
1201
if dt is None:
1048
1202
return dbus.String("", variant_level = variant_level)
1049
return dbus.String(dt.isoformat(),
1050
variant_level=variant_level)
1203
return dbus.String(dt.isoformat(), variant_level=variant_level)
1051
1204
1052
1205
1053
1206
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1073
1226
(from DBusObjectWithProperties) and interfaces (from the
1074
1227
dbus_interface_annotations decorator).
1075
1228
"""
1229
1076
1230
def wrapper(cls):
1077
1231
for orig_interface_name, alt_interface_name in (
1078
alt_interface_names.items()):
1232
alt_interface_names.items()):
1079
1233
attr = {}
1080
1234
interface_names = set()
1081
1235
# Go though all attributes of the class
1083
1237
# Ignore non-D-Bus attributes, and D-Bus attributes
1084
1238
# with the wrong interface name
1085
1239
if (not hasattr(attribute, "_dbus_interface")
1086
or not attribute._dbus_interface
1087
.startswith(orig_interface_name)):
1240
or not attribute._dbus_interface.startswith(
1241
orig_interface_name)):
1088
1242
continue
1089
1243
# Create an alternate D-Bus interface name based on
1090
1244
# the current name
1091
alt_interface = (attribute._dbus_interface
1092
.replace(orig_interface_name,
1093
alt_interface_name))
1245
alt_interface = attribute._dbus_interface.replace(
1246
orig_interface_name, alt_interface_name)
1094
1247
interface_names.add(alt_interface)
1095
1248
# Is this a D-Bus signal?
1096
1249
if getattr(attribute, "_dbus_is_signal", False):
1097
# Extract the original non-method undecorated
1098
# function by black magic
1099
nonmethod_func = (dict(
1250
if sys.version_info.major == 2:
1251
# Extract the original non-method undecorated
1252
# function by black magic
1253
nonmethod_func = (dict(
1100
1254
zip(attribute.func_code.co_freevars,
1101
attribute.__closure__))["func"]
1102
.cell_contents)
1255
attribute.__closure__))
1256
["func"].cell_contents)
1257
else:
1258
nonmethod_func = attribute
1103
1259
# Create a new, but exactly alike, function
1104
1260
# object, and decorate it to be a new D-Bus signal
1105
1261
# with the alternate D-Bus interface name
1106
new_function = (dbus.service.signal
1107
(alt_interface,
1108
attribute._dbus_signature)
1109
(types.FunctionType(
1110
nonmethod_func.func_code,
1111
nonmethod_func.func_globals,
1112
nonmethod_func.func_name,
1113
nonmethod_func.func_defaults,
1114
nonmethod_func.func_closure)))
1262
if sys.version_info.major == 2:
1263
new_function = types.FunctionType(
1264
nonmethod_func.func_code,
1265
nonmethod_func.func_globals,
1266
nonmethod_func.func_name,
1267
nonmethod_func.func_defaults,
1268
nonmethod_func.func_closure)
1269
else:
1270
new_function = types.FunctionType(
1271
nonmethod_func.__code__,
1272
nonmethod_func.__globals__,
1273
nonmethod_func.__name__,
1274
nonmethod_func.__defaults__,
1275
nonmethod_func.__closure__)
1276
new_function = (dbus.service.signal(
1277
alt_interface,
1278
attribute._dbus_signature)(new_function))
1115
1279
# Copy annotations, if any
1116
1280
try:
1117
new_function._dbus_annotations = (
1118
dict(attribute._dbus_annotations))
1281
new_function._dbus_annotations = dict(
1282
attribute._dbus_annotations)
1119
1283
except AttributeError:
1120
1284
pass
1121
1285
# Define a creator of a function to call both the
1126
1290
"""This function is a scope container to pass
1127
1291
func1 and func2 to the "call_both" function
1128
1292
outside of its arguments"""
1293
1129
1294
def call_both(*args, **kwargs):
1130
1295
"""This function will emit two D-Bus
1131
1296
signals by calling func1 and func2"""
1132
1297
func1(*args, **kwargs)
1133
1298
func2(*args, **kwargs)
1299
1134
1300
return call_both
1135
1301
# Create the "call_both" function and add it to
1136
1302
# the class
1141
1307
# object. Decorate it to be a new D-Bus method
1142
1308
# with the alternate D-Bus interface name. Add it
1143
1309
# to the class.
1144
attr[attrname] = (dbus.service.method
1145
(alt_interface,
1146
attribute._dbus_in_signature,
1147
attribute._dbus_out_signature)
1148
(types.FunctionType
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1310
attr[attrname] = (
1311
dbus.service.method(
1312
alt_interface,
1313
attribute._dbus_in_signature,
1314
attribute._dbus_out_signature)
1315
(types.FunctionType(attribute.func_code,
1316
attribute.func_globals,
1317
attribute.func_name,
1318
attribute.func_defaults,
1319
attribute.func_closure)))
1154
1320
# Copy annotations, if any
1155
1321
try:
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1322
attr[attrname]._dbus_annotations = dict(
1323
attribute._dbus_annotations)
1158
1324
except AttributeError:
1159
1325
pass
1160
1326
# Is this a D-Bus property?
1163
1329
# object, and decorate it to be a new D-Bus
1164
1330
# property with the alternate D-Bus interface
1165
1331
# name. Add it to the class.
1166
attr[attrname] = (dbus_service_property
1167
(alt_interface,
1168
attribute._dbus_signature,
1169
attribute._dbus_access,
1170
attribute
1171
._dbus_get_args_options
1172
["byte_arrays"])
1173
(types.FunctionType
1174
(attribute.func_code,
1175
attribute.func_globals,
1176
attribute.func_name,
1177
attribute.func_defaults,
1178
attribute.func_closure)))
1332
attr[attrname] = (dbus_service_property(
1333
alt_interface, attribute._dbus_signature,
1334
attribute._dbus_access,
1335
attribute._dbus_get_args_options
1336
["byte_arrays"])
1337
(types.FunctionType(
1338
attribute.func_code,
1339
attribute.func_globals,
1340
attribute.func_name,
1341
attribute.func_defaults,
1342
attribute.func_closure)))
1179
1343
# Copy annotations, if any
1180
1344
try:
1181
attr[attrname]._dbus_annotations = (
1182
dict(attribute._dbus_annotations))
1345
attr[attrname]._dbus_annotations = dict(
1346
attribute._dbus_annotations)
1183
1347
except AttributeError:
1184
1348
pass
1185
1349
# Is this a D-Bus interface?
1188
1352
# object. Decorate it to be a new D-Bus interface
1189
1353
# with the alternate D-Bus interface name. Add it
1190
1354
# to the class.
1191
attr[attrname] = (dbus_interface_annotations
1192
(alt_interface)
1193
(types.FunctionType
1194
(attribute.func_code,
1195
attribute.func_globals,
1196
attribute.func_name,
1197
attribute.func_defaults,
1198
attribute.func_closure)))
1355
attr[attrname] = (
1356
dbus_interface_annotations(alt_interface)
1357
(types.FunctionType(attribute.func_code,
1358
attribute.func_globals,
1359
attribute.func_name,
1360
attribute.func_defaults,
1361
attribute.func_closure)))
1199
1362
if deprecate:
1200
1363
# Deprecate all alternate interfaces
1201
1364
iname="_AlternateDBusNames_interface_annotation{}"
1202
1365
for interface_name in interface_names:
1366
1203
1367
@dbus_interface_annotations(interface_name)
1204
1368
def func(self):
1205
1369
return { "org.freedesktop.DBus.Deprecated":
1206
"true" }
1370
"true" }
1207
1371
# Find an unused name
1208
1372
for aname in (iname.format(i)
1209
1373
for i in itertools.count()):
1214
1378
# Replace the class with a new subclass of it with
1215
1379
# methods, signals, etc. as created above.
1216
1380
cls = type(b"{}Alternate".format(cls.__name__),
1217
(cls,), attr)
1381
(cls, ), attr)
1218
1382
return cls
1383
1219
1384
return wrapper
1220
1385
1221
1386
1222
1387
@alternate_dbus_interfaces({"se.recompile.Mandos":
1223
"se.bsnet.fukt.Mandos"})
1388
"se.bsnet.fukt.Mandos"})
1224
1389
class ClientDBus(Client, DBusObjectWithProperties):
1225
1390
"""A Client class using D-Bus
1226
1391
1230
1395
"""
1231
1396
1232
1397
runtime_expansions = (Client.runtime_expansions
1233
+ ("dbus_object_path",))
1398
+ ("dbus_object_path", ))
1234
1399
1235
1400
_interface = "se.recompile.Mandos.Client"
1236
1401
1244
1409
client_object_name = str(self.name).translate(
1245
1410
{ord("."): ord("_"),
1246
1411
ord("-"): ord("_")})
1247
self.dbus_object_path = (dbus.ObjectPath
1248
("/clients/" + client_object_name))
1412
self.dbus_object_path = dbus.ObjectPath(
1413
"/clients/" + client_object_name)
1249
1414
DBusObjectWithProperties.__init__(self, self.bus,
1250
1415
self.dbus_object_path)
1251
1416
1252
def notifychangeproperty(transform_func,
1253
dbus_name, type_func=lambda x: x,
1254
variant_level=1, invalidate_only=False,
1417
def notifychangeproperty(transform_func, dbus_name,
1418
type_func=lambda x: x,
1419
variant_level=1,
1420
invalidate_only=False,
1255
1421
_interface=_interface):
1256
1422
""" Modify a variable so that it's a property which announces
1257
1423
its changes to DBus.
1264
1430
variant_level: D-Bus variant level. Default: 1
1265
1431
"""
1266
1432
attrname = "_{}".format(dbus_name)
1433
1267
1434
def setter(self, value):
1268
1435
if hasattr(self, "dbus_object_path"):
1269
1436
if (not hasattr(self, attrname) or
1270
1437
type_func(getattr(self, attrname, None))
1271
1438
!= type_func(value)):
1272
1439
if invalidate_only:
1273
self.PropertiesChanged(_interface,
1274
dbus.Dictionary(),
1275
dbus.Array
1276
((dbus_name,)))
1440
self.PropertiesChanged(
1441
_interface, dbus.Dictionary(),
1442
dbus.Array((dbus_name, )))
1277
1443
else:
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1444
dbus_value = transform_func(
1445
type_func(value),
1446
variant_level = variant_level)
1281
1447
self.PropertyChanged(dbus.String(dbus_name),
1282
1448
dbus_value)
1283
self.PropertiesChanged(_interface,
1284
dbus.Dictionary({
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1449
self.PropertiesChanged(
1450
_interface,
1451
dbus.Dictionary({ dbus.String(dbus_name):
1452
dbus_value }),
1453
dbus.Array())
1287
1454
setattr(self, attrname, value)
1288
1455
1289
1456
return property(lambda self: getattr(self, attrname), setter)
1295
1462
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1296
1463
last_enabled = notifychangeproperty(datetime_to_dbus,
1297
1464
"LastEnabled")
1298
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
type_func = lambda checker:
1300
checker is not None)
1465
checker = notifychangeproperty(
1466
dbus.Boolean, "CheckerRunning",
1467
type_func = lambda checker: checker is not None)
1301
1468
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1302
1469
"LastCheckedOK")
1303
1470
last_checker_status = notifychangeproperty(dbus.Int16,
1306
1473
datetime_to_dbus, "LastApprovalRequest")
1307
1474
approved_by_default = notifychangeproperty(dbus.Boolean,
1308
1475
"ApprovedByDefault")
1309
approval_delay = notifychangeproperty(dbus.UInt64,
1310
"ApprovalDelay",
1311
type_func =
1312
lambda td: td.total_seconds()
1313
* 1000)
1476
approval_delay = notifychangeproperty(
1477
dbus.UInt64, "ApprovalDelay",
1478
type_func = lambda td: td.total_seconds() * 1000)
1314
1479
approval_duration = notifychangeproperty(
1315
1480
dbus.UInt64, "ApprovalDuration",
1316
1481
type_func = lambda td: td.total_seconds() * 1000)
1317
1482
host = notifychangeproperty(dbus.String, "Host")
1318
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1319
type_func = lambda td:
1320
td.total_seconds() * 1000)
1483
timeout = notifychangeproperty(
1484
dbus.UInt64, "Timeout",
1485
type_func = lambda td: td.total_seconds() * 1000)
1321
1486
extended_timeout = notifychangeproperty(
1322
1487
dbus.UInt64, "ExtendedTimeout",
1323
1488
type_func = lambda td: td.total_seconds() * 1000)
1324
interval = notifychangeproperty(dbus.UInt64,
1325
"Interval",
1326
type_func =
1327
lambda td: td.total_seconds()
1328
* 1000)
1489
interval = notifychangeproperty(
1490
dbus.UInt64, "Interval",
1491
type_func = lambda td: td.total_seconds() * 1000)
1329
1492
checker_command = notifychangeproperty(dbus.String, "Checker")
1330
1493
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1331
1494
invalidate_only=True)
1341
1504
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1342
1505
Client.__del__(self, *args, **kwargs)
1343
1506
1344
def checker_callback(self, pid, condition, command,
1345
*args, **kwargs):
1346
self.checker_callback_tag = None
1347
self.checker = None
1348
if os.WIFEXITED(condition):
1349
exitstatus = os.WEXITSTATUS(condition)
1507
def checker_callback(self, source, condition,
1508
connection, command, *args, **kwargs):
1509
ret = Client.checker_callback(self, source, condition,
1510
connection, command, *args,
1511
**kwargs)
1512
exitstatus = self.last_checker_status
1513
if exitstatus >= 0:
1350
1514
# Emit D-Bus signal
1351
1515
self.CheckerCompleted(dbus.Int16(exitstatus),
1352
dbus.Int64(condition),
1516
# This is specific to GNU libC
1517
dbus.Int64(exitstatus << 8),
1353
1518
dbus.String(command))
1354
1519
else:
1355
1520
# Emit D-Bus signal
1356
1521
self.CheckerCompleted(dbus.Int16(-1),
1357
dbus.Int64(condition),
1522
dbus.Int64(
1523
# This is specific to GNU libC
1524
(exitstatus << 8)
1525
| self.last_checker_signal),
1358
1526
dbus.String(command))
1359
1360
return Client.checker_callback(self, pid, condition, command,
1361
*args, **kwargs)
1527
return ret
1362
1528
1363
1529
def start_checker(self, *args, **kwargs):
1364
1530
old_checker_pid = getattr(self.checker, "pid", None)
1439
1605
self.checked_ok()
1440
1606
1441
1607
# Enable - method
1608
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1442
1609
@dbus.service.method(_interface)
1443
1610
def Enable(self):
1444
1611
"D-Bus method"
1445
1612
self.enable()
1446
1613
1447
1614
# StartChecker - method
1615
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1448
1616
@dbus.service.method(_interface)
1449
1617
def StartChecker(self):
1450
1618
"D-Bus method"
1451
1619
self.start_checker()
1452
1620
1453
1621
# Disable - method
1622
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1454
1623
@dbus.service.method(_interface)
1455
1624
def Disable(self):
1456
1625
"D-Bus method"
1457
1626
self.disable()
1458
1627
1459
1628
# StopChecker - method
1629
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1460
1630
@dbus.service.method(_interface)
1461
1631
def StopChecker(self):
1462
1632
self.stop_checker()
1469
1639
return dbus.Boolean(bool(self.approvals_pending))
1470
1640
1471
1641
# ApprovedByDefault - property
1472
@dbus_service_property(_interface, signature="b",
1642
@dbus_service_property(_interface,
1643
signature="b",
1473
1644
access="readwrite")
1474
1645
def ApprovedByDefault_dbus_property(self, value=None):
1475
1646
if value is None: # get
1477
1648
self.approved_by_default = bool(value)
1478
1649
1479
1650
# ApprovalDelay - property
1480
@dbus_service_property(_interface, signature="t",
1651
@dbus_service_property(_interface,
1652
signature="t",
1481
1653
access="readwrite")
1482
1654
def ApprovalDelay_dbus_property(self, value=None):
1483
1655
if value is None: # get
1486
1658
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
1659
1488
1660
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1661
@dbus_service_property(_interface,
1662
signature="t",
1490
1663
access="readwrite")
1491
1664
def ApprovalDuration_dbus_property(self, value=None):
1492
1665
if value is None: # get
1495
1668
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1496
1669
1497
1670
# Name - property
1671
@dbus_annotations(
1672
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
1673
@dbus_service_property(_interface, signature="s", access="read")
1499
1674
def Name_dbus_property(self):
1500
1675
return dbus.String(self.name)
1501
1676
1502
1677
# Fingerprint - property
1678
@dbus_annotations(
1679
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1503
1680
@dbus_service_property(_interface, signature="s", access="read")
1504
1681
def Fingerprint_dbus_property(self):
1505
1682
return dbus.String(self.fingerprint)
1506
1683
1507
1684
# Host - property
1508
@dbus_service_property(_interface, signature="s",
1685
@dbus_service_property(_interface,
1686
signature="s",
1509
1687
access="readwrite")
1510
1688
def Host_dbus_property(self, value=None):
1511
1689
if value is None: # get
1513
1691
self.host = str(value)
1514
1692
1515
1693
# Created - property
1694
@dbus_annotations(
1695
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1516
1696
@dbus_service_property(_interface, signature="s", access="read")
1517
1697
def Created_dbus_property(self):
1518
1698
return datetime_to_dbus(self.created)
1523
1703
return datetime_to_dbus(self.last_enabled)
1524
1704
1525
1705
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
1706
@dbus_service_property(_interface,
1707
signature="b",
1527
1708
access="readwrite")
1528
1709
def Enabled_dbus_property(self, value=None):
1529
1710
if value is None: # get
1534
1715
self.disable()
1535
1716
1536
1717
# LastCheckedOK - property
1537
@dbus_service_property(_interface, signature="s",
1718
@dbus_service_property(_interface,
1719
signature="s",
1538
1720
access="readwrite")
1539
1721
def LastCheckedOK_dbus_property(self, value=None):
1540
1722
if value is not None:
1543
1725
return datetime_to_dbus(self.last_checked_ok)
1544
1726
1545
1727
# LastCheckerStatus - property
1546
@dbus_service_property(_interface, signature="n",
1547
access="read")
1728
@dbus_service_property(_interface, signature="n", access="read")
1548
1729
def LastCheckerStatus_dbus_property(self):
1549
1730
return dbus.Int16(self.last_checker_status)
1550
1731
1559
1740
return datetime_to_dbus(self.last_approval_request)
1560
1741
1561
1742
# Timeout - property
1562
@dbus_service_property(_interface, signature="t",
1743
@dbus_service_property(_interface,
1744
signature="t",
1563
1745
access="readwrite")
1564
1746
def Timeout_dbus_property(self, value=None):
1565
1747
if value is None: # get
1578
1760
is None):
1579
1761
return
1580
1762
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
int((self.expires - now).total_seconds()
1584
* 1000), self.disable))
1763
self.disable_initiator_tag = gobject.timeout_add(
1764
int((self.expires - now).total_seconds() * 1000),
1765
self.disable)
1585
1766
1586
1767
# ExtendedTimeout - property
1587
@dbus_service_property(_interface, signature="t",
1768
@dbus_service_property(_interface,
1769
signature="t",
1588
1770
access="readwrite")
1589
1771
def ExtendedTimeout_dbus_property(self, value=None):
1590
1772
if value is None: # get
1593
1775
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1594
1776
1595
1777
# Interval - property
1596
@dbus_service_property(_interface, signature="t",
1778
@dbus_service_property(_interface,
1779
signature="t",
1597
1780
access="readwrite")
1598
1781
def Interval_dbus_property(self, value=None):
1599
1782
if value is None: # get
1604
1787
if self.enabled:
1605
1788
# Reschedule checker run
1606
1789
gobject.source_remove(self.checker_initiator_tag)
1607
self.checker_initiator_tag = (gobject.timeout_add
1608
(value, self.start_checker))
1609
self.start_checker() # Start one now, too
1790
self.checker_initiator_tag = gobject.timeout_add(
1791
value, self.start_checker)
1792
self.start_checker() # Start one now, too
1610
1793
1611
1794
# Checker - property
1612
@dbus_service_property(_interface, signature="s",
1795
@dbus_service_property(_interface,
1796
signature="s",
1613
1797
access="readwrite")
1614
1798
def Checker_dbus_property(self, value=None):
1615
1799
if value is None: # get
1617
1801
self.checker_command = str(value)
1618
1802
1619
1803
# CheckerRunning - property
1620
@dbus_service_property(_interface, signature="b",
1804
@dbus_service_property(_interface,
1805
signature="b",
1621
1806
access="readwrite")
1622
1807
def CheckerRunning_dbus_property(self, value=None):
1623
1808
if value is None: # get
1628
1813
self.stop_checker()
1629
1814
1630
1815
# ObjectPath - property
1816
@dbus_annotations(
1817
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
1818
"org.freedesktop.DBus.Deprecated": "true"})
1631
1819
@dbus_service_property(_interface, signature="o", access="read")
1632
1820
def ObjectPath_dbus_property(self):
1633
1821
return self.dbus_object_path # is already a dbus.ObjectPath
1634
1822
1635
1823
# Secret = property
1636
@dbus_service_property(_interface, signature="ay",
1637
access="write", byte_arrays=True)
1824
@dbus_annotations(
1825
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1826
"invalidates"})
1827
@dbus_service_property(_interface,
1828
signature="ay",
1829
access="write",
1830
byte_arrays=True)
1638
1831
def Secret_dbus_property(self, value):
1639
1832
self.secret = bytes(value)
1640
1833
1646
1839
self._pipe = child_pipe
1647
1840
self._pipe.send(('init', fpr, address))
1648
1841
if not self._pipe.recv():
1649
raise KeyError()
1842
raise KeyError(fpr)
1650
1843
1651
1844
def __getattribute__(self, name):
1652
1845
if name == '_pipe':
1656
1849
if data[0] == 'data':
1657
1850
return data[1]
1658
1851
if data[0] == 'function':
1852
1659
1853
def func(*args, **kwargs):
1660
1854
self._pipe.send(('funcall', name, args, kwargs))
1661
1855
return self._pipe.recv()[1]
1856
1662
1857
return func
1663
1858
1664
1859
def __setattr__(self, name, value):
1680
1875
logger.debug("Pipe FD: %d",
1681
1876
self.server.child_pipe.fileno())
1682
1877
1683
session = (gnutls.connection
1684
.ClientSession(self.request,
1685
gnutls.connection
1686
.X509Credentials()))
1878
session = gnutls.connection.ClientSession(
1879
self.request, gnutls.connection .X509Credentials())
1687
1880
1688
1881
# Note: gnutls.connection.X509Credentials is really a
1689
1882
# generic GnuTLS certificate credentials object so long as
1698
1891
priority = self.server.gnutls_priority
1699
1892
if priority is None:
1700
1893
priority = "NORMAL"
1701
(gnutls.library.functions
1702
.gnutls_priority_set_direct(session._c_object,
1703
priority, None))
1894
gnutls.library.functions.gnutls_priority_set_direct(
1895
session._c_object, priority, None)
1704
1896
1705
1897
# Start communication using the Mandos protocol
1706
1898
# Get protocol number
1726
1918
approval_required = False
1727
1919
try:
1728
1920
try:
1729
fpr = self.fingerprint(self.peer_certificate
1730
(session))
1921
fpr = self.fingerprint(
1922
self.peer_certificate(session))
1731
1923
except (TypeError,
1732
1924
gnutls.errors.GNUTLSError) as error:
1733
1925
logger.warning("Bad certificate: %s", error)
1748
1940
while True:
1749
1941
if not client.enabled:
1750
1942
logger.info("Client %s is disabled",
1751
client.name)
1943
client.name)
1752
1944
if self.server.use_dbus:
1753
1945
# Emit D-Bus signal
1754
1946
client.Rejected("Disabled")
1801
1993
logger.warning("gnutls send failed",
1802
1994
exc_info=error)
1803
1995
return
1804
logger.debug("Sent: %d, remaining: %d",
1805
sent, len(client.secret)
1806
- (sent_size + sent))
1996
logger.debug("Sent: %d, remaining: %d", sent,
1997
len(client.secret) - (sent_size
1998
+ sent))
1807
1999
sent_size += sent
1808
2000
1809
2001
logger.info("Sending secret to %s", client.name)
1826
2018
def peer_certificate(session):
1827
2019
"Return the peer's OpenPGP certificate as a bytestring"
1828
2020
# If not an OpenPGP certificate...
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
2021
if (gnutls.library.functions.gnutls_certificate_type_get(
2022
session._c_object)
1831
2023
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
2024
# ...do the normal thing
1833
2025
return session.peer_certificate
1847
2039
def fingerprint(openpgp):
1848
2040
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
2041
# New GnuTLS "datum" with the OpenPGP public key
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.POINTER
1853
(ctypes.c_ubyte)),
1854
ctypes.c_uint(len(openpgp))))
2042
datum = gnutls.library.types.gnutls_datum_t(
2043
ctypes.cast(ctypes.c_char_p(openpgp),
2044
ctypes.POINTER(ctypes.c_ubyte)),
2045
ctypes.c_uint(len(openpgp)))
1855
2046
# New empty GnuTLS certificate
1856
2047
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2048
gnutls.library.functions.gnutls_openpgp_crt_init(
2049
ctypes.byref(crt))
1859
2050
# Import the OpenPGP public key into the certificate
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
2051
gnutls.library.functions.gnutls_openpgp_crt_import(
2052
crt, ctypes.byref(datum),
2053
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1864
2054
# Verify the self signature in the key
1865
2055
crtverify = ctypes.c_uint()
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
2056
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2057
crt, 0, ctypes.byref(crtverify))
1869
2058
if crtverify.value != 0:
1870
2059
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
1872
("Verify failed"))
2060
raise gnutls.errors.CertificateSecurityError(
2061
"Verify failed")
1873
2062
# New buffer for the fingerprint
1874
2063
buf = ctypes.create_string_buffer(20)
1875
2064
buf_len = ctypes.c_size_t()
1876
2065
# Get the fingerprint from the certificate into the buffer
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
2066
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2067
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1880
2068
# Deinit the certificate
1881
2069
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1882
2070
# Convert the buffer to a Python bytestring
1888
2076
1889
2077
class MultiprocessingMixIn(object):
1890
2078
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2079
1891
2080
def sub_process_main(self, request, address):
1892
2081
try:
1893
2082
self.finish_request(request, address)
1905
2094
1906
2095
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1907
2096
""" adds a pipe to the MixIn """
2097
1908
2098
def process_request(self, request, client_address):
1909
2099
"""Overrides and wraps the original process_request().
1910
2100
1931
2121
interface: None or a network interface name (string)
1932
2122
use_ipv6: Boolean; to use IPv6 or not
1933
2123
"""
2124
1934
2125
def __init__(self, server_address, RequestHandlerClass,
1935
interface=None, use_ipv6=True, socketfd=None):
2126
interface=None,
2127
use_ipv6=True,
2128
socketfd=None):
1936
2129
"""If socketfd is set, use that file descriptor instead of
1937
2130
creating a new one with socket.socket().
1938
2131
"""
1979
2172
self.interface)
1980
2173
else:
1981
2174
try:
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1983
SO_BINDTODEVICE,
1984
(self.interface + "\0")
1985
.encode("utf-8"))
2175
self.socket.setsockopt(
2176
socket.SOL_SOCKET, SO_BINDTODEVICE,
2177
(self.interface + "\0").encode("utf-8"))
1986
2178
except socket.error as error:
1987
2179
if error.errno == errno.EPERM:
1988
2180
logger.error("No permission to bind to"
2006
2198
self.server_address = (any_address,
2007
2199
self.server_address[1])
2008
2200
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2010
0)
2201
self.server_address = (self.server_address[0], 0)
2011
2202
# if self.interface:
2012
2203
# self.server_address = (self.server_address[0],
2013
2204
# 0, # port
2027
2218
2028
2219
Assumes a gobject.MainLoop event loop.
2029
2220
"""
2221
2030
2222
def __init__(self, server_address, RequestHandlerClass,
2031
interface=None, use_ipv6=True, clients=None,
2032
gnutls_priority=None, use_dbus=True, socketfd=None):
2223
interface=None,
2224
use_ipv6=True,
2225
clients=None,
2226
gnutls_priority=None,
2227
use_dbus=True,
2228
socketfd=None):
2033
2229
self.enabled = False
2034
2230
self.clients = clients
2035
2231
if self.clients is None:
2041
2237
interface = interface,
2042
2238
use_ipv6 = use_ipv6,
2043
2239
socketfd = socketfd)
2240
2044
2241
def server_activate(self):
2045
2242
if self.enabled:
2046
2243
return socketserver.TCPServer.server_activate(self)
2050
2247
2051
2248
def add_pipe(self, parent_pipe, proc):
2052
2249
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2056
parent_pipe =
2057
parent_pipe,
2058
proc = proc))
2250
gobject.io_add_watch(
2251
parent_pipe.fileno(),
2252
gobject.IO_IN | gobject.IO_HUP,
2253
functools.partial(self.handle_ipc,
2254
parent_pipe = parent_pipe,
2255
proc = proc))
2059
2256
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2257
def handle_ipc(self, source, condition,
2258
parent_pipe=None,
2259
proc = None,
2260
client_object=None):
2062
2261
# error, or the other end of multiprocessing.Pipe has closed
2063
2262
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2064
2263
# Wait for other process to exit
2087
2286
parent_pipe.send(False)
2088
2287
return False
2089
2288
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2093
parent_pipe =
2094
parent_pipe,
2095
proc = proc,
2096
client_object =
2097
client))
2289
gobject.io_add_watch(
2290
parent_pipe.fileno(),
2291
gobject.IO_IN | gobject.IO_HUP,
2292
functools.partial(self.handle_ipc,
2293
parent_pipe = parent_pipe,
2294
proc = proc,
2295
client_object = client))
2098
2296
parent_pipe.send(True)
2099
2297
# remove the old hook in favor of the new above hook on
2100
2298
# same fileno
2106
2304
2107
2305
parent_pipe.send(('data', getattr(client_object,
2108
2306
funcname)(*args,
2109
**kwargs)))
2307
**kwargs)))
2110
2308
2111
2309
if command == 'getattr':
2112
2310
attrname = request[1]
2113
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2311
if isinstance(client_object.__getattribute__(attrname),
2312
collections.Callable):
2313
parent_pipe.send(('function', ))
2115
2314
else:
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2315
parent_pipe.send((
2316
'data', client_object.__getattribute__(attrname)))
2118
2317
2119
2318
if command == 'setattr':
2120
2319
attrname = request[1]
2151
2350
# avoid excessive use of external libraries.
2152
2351
2153
2352
# New type for defining tokens, syntax, and semantics all-in-one
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2158
# containing digits
2159
"value", # datetime.timedelta or
2160
# None
2161
"followers")) # Tokens valid after
2162
# this token
2353
Token = collections.namedtuple("Token", (
2354
"regexp", # To match token; if "value" is not None, must have
2355
# a "group" containing digits
2356
"value", # datetime.timedelta or None
2357
"followers")) # Tokens valid after this token
2163
2358
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2359
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2360
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2361
token_second = Token(re.compile(r"(\d+)S"),
2167
2362
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2363
frozenset((token_end, )))
2169
2364
token_minute = Token(re.compile(r"(\d+)M"),
2170
2365
datetime.timedelta(minutes=1),
2171
2366
frozenset((token_second, token_end)))
2187
2382
frozenset((token_month, token_end)))
2188
2383
token_week = Token(re.compile(r"(\d+)W"),
2189
2384
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2385
frozenset((token_end, )))
2191
2386
token_duration = Token(re.compile(r"P"), None,
2192
2387
frozenset((token_year, token_month,
2193
2388
token_day, token_time,
2195
2390
# Define starting values
2196
2391
value = datetime.timedelta() # Value so far
2197
2392
found_token = None
2198
followers = frozenset((token_duration,)) # Following valid tokens
2393
followers = frozenset((token_duration, )) # Following valid tokens
2199
2394
s = duration # String left to parse
2200
2395
# Loop until end token is found
2201
2396
while found_token is not token_end:
2218
2413
break
2219
2414
else:
2220
2415
# No currently valid tokens were found
2221
raise ValueError("Invalid RFC 3339 duration")
2416
raise ValueError("Invalid RFC 3339 duration: {!r}"
2417
.format(duration))
2222
2418
# End token found
2223
2419
return value
2224
2420
2261
2457
elif suffix == "w":
2262
2458
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
2459
else:
2264
raise ValueError("Unknown suffix {!r}"
2265
.format(suffix))
2460
raise ValueError("Unknown suffix {!r}".format(suffix))
2266
2461
except IndexError as e:
2267
2462
raise ValueError(*(e.args))
2268
2463
timevalue += delta
2284
2479
# Close all standard open file descriptors
2285
2480
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2481
if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
raise OSError(errno.ENODEV, "{} not a character device"
2482
raise OSError(errno.ENODEV,
2483
"{} not a character device"
2288
2484
.format(os.devnull))
2289
2485
os.dup2(null, sys.stdin.fileno())
2290
2486
os.dup2(null, sys.stdout.fileno())
2356
2552
"port": "",
2357
2553
"debug": "False",
2358
2554
"priority":
2359
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2555
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2556
":+SIGN-DSA-SHA256",
2360
2557
"servicename": "Mandos",
2361
2558
"use_dbus": "True",
2362
2559
"use_ipv6": "True",
2366
2563
"statedir": "/var/lib/mandos",
2367
2564
"foreground": "False",
2368
2565
"zeroconf": "True",
2369
}
2566
}
2370
2567
2371
2568
# Parse config file for server-global settings
2372
2569
server_config = configparser.SafeConfigParser(server_defaults)
2373
2570
del server_defaults
2374
server_config.read(os.path.join(options.configdir,
2375
"mandos.conf"))
2571
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2376
2572
# Convert the SafeConfigParser object to a dict
2377
2573
server_settings = server_config.defaults()
2378
2574
# Use the appropriate methods on the non-string config options
2396
2592
# Override the settings from the config file with command line
2397
2593
# options, if set.
2398
2594
for option in ("interface", "address", "port", "debug",
2399
"priority", "servicename", "configdir",
2400
"use_dbus", "use_ipv6", "debuglevel", "restore",
2401
"statedir", "socket", "foreground", "zeroconf"):
2595
"priority", "servicename", "configdir", "use_dbus",
2596
"use_ipv6", "debuglevel", "restore", "statedir",
2597
"socket", "foreground", "zeroconf"):
2402
2598
value = getattr(options, option)
2403
2599
if value is not None:
2404
2600
server_settings[option] = value
2419
2615
2420
2616
##################################################################
2421
2617
2422
if (not server_settings["zeroconf"] and
2423
not (server_settings["port"]
2424
or server_settings["socket"] != "")):
2425
parser.error("Needs port or socket to work without"
2426
" Zeroconf")
2618
if (not server_settings["zeroconf"]
2619
and not (server_settings["port"]
2620
or server_settings["socket"] != "")):
2621
parser.error("Needs port or socket to work without Zeroconf")
2427
2622
2428
2623
# For convenience
2429
2624
debug = server_settings["debug"]
2445
2640
initlogger(debug, level)
2446
2641
2447
2642
if server_settings["servicename"] != "Mandos":
2448
syslogger.setFormatter(logging.Formatter
2449
('Mandos ({}) [%(process)d]:'
2450
' %(levelname)s: %(message)s'
2451
.format(server_settings
2452
["servicename"])))
2643
syslogger.setFormatter(
2644
logging.Formatter('Mandos ({}) [%(process)d]:'
2645
' %(levelname)s: %(message)s'.format(
2646
server_settings["servicename"])))
2453
2647
2454
2648
# Parse config file with clients
2455
2649
client_config = configparser.SafeConfigParser(Client
2463
2657
socketfd = None
2464
2658
if server_settings["socket"] != "":
2465
2659
socketfd = server_settings["socket"]
2466
tcp_server = MandosServer((server_settings["address"],
2467
server_settings["port"]),
2468
ClientHandler,
2469
interface=(server_settings["interface"]
2470
or None),
2471
use_ipv6=use_ipv6,
2472
gnutls_priority=
2473
server_settings["priority"],
2474
use_dbus=use_dbus,
2475
socketfd=socketfd)
2660
tcp_server = MandosServer(
2661
(server_settings["address"], server_settings["port"]),
2662
ClientHandler,
2663
interface=(server_settings["interface"] or None),
2664
use_ipv6=use_ipv6,
2665
gnutls_priority=server_settings["priority"],
2666
use_dbus=use_dbus,
2667
socketfd=socketfd)
2476
2668
if not foreground:
2477
2669
pidfilename = "/run/mandos.pid"
2478
2670
if not os.path.isdir("/run/."):
2479
2671
pidfilename = "/var/run/mandos.pid"
2480
2672
pidfile = None
2481
2673
try:
2482
pidfile = open(pidfilename, "w")
2674
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2483
2675
except IOError as e:
2484
2676
logger.error("Could not open file %r", pidfilename,
2485
2677
exc_info=e)
2512
2704
def debug_gnutls(level, string):
2513
2705
logger.debug("GnuTLS: %s", string[:-1])
2514
2706
2515
(gnutls.library.functions
2516
.gnutls_global_set_log_function(debug_gnutls))
2707
gnutls.library.functions.gnutls_global_set_log_function(
2708
debug_gnutls)
2517
2709
2518
2710
# Redirect stdin so all checkers get /dev/null
2519
2711
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2539
2731
if use_dbus:
2540
2732
try:
2541
2733
bus_name = dbus.service.BusName("se.recompile.Mandos",
2542
bus, do_not_queue=True)
2543
old_bus_name = (dbus.service.BusName
2544
("se.bsnet.fukt.Mandos", bus,
2545
do_not_queue=True))
2546
except dbus.exceptions.NameExistsException as e:
2734
bus,
2735
do_not_queue=True)
2736
old_bus_name = dbus.service.BusName(
2737
"se.bsnet.fukt.Mandos", bus,
2738
do_not_queue=True)
2739
except dbus.exceptions.DBusException as e:
2547
2740
logger.error("Disabling D-Bus:", exc_info=e)
2548
2741
use_dbus = False
2549
2742
server_settings["use_dbus"] = False
2550
2743
tcp_server.use_dbus = False
2551
2744
if zeroconf:
2552
2745
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2553
service = AvahiServiceToSyslog(name =
2554
server_settings["servicename"],
2555
servicetype = "_mandos._tcp",
2556
protocol = protocol, bus = bus)
2746
service = AvahiServiceToSyslog(
2747
name = server_settings["servicename"],
2748
servicetype = "_mandos._tcp",
2749
protocol = protocol,
2750
bus = bus)
2557
2751
if server_settings["interface"]:
2558
service.interface = (if_nametoindex
2559
(server_settings["interface"]
2560
.encode("utf-8")))
2752
service.interface = if_nametoindex(
2753
server_settings["interface"].encode("utf-8"))
2561
2754
2562
2755
global multiprocessing_manager
2563
2756
multiprocessing_manager = multiprocessing.Manager()
2582
2775
if server_settings["restore"]:
2583
2776
try:
2584
2777
with open(stored_state_path, "rb") as stored_state:
2585
clients_data, old_client_settings = (pickle.load
2586
(stored_state))
2778
clients_data, old_client_settings = pickle.load(
2779
stored_state)
2587
2780
os.remove(stored_state_path)
2588
2781
except IOError as e:
2589
2782
if e.errno == errno.ENOENT:
2590
logger.warning("Could not load persistent state: {}"
2591
.format(os.strerror(e.errno)))
2783
logger.warning("Could not load persistent state:"
2784
" {}".format(os.strerror(e.errno)))
2592
2785
else:
2593
2786
logger.critical("Could not load persistent state:",
2594
2787
exc_info=e)
2595
2788
raise
2596
2789
except EOFError as e:
2597
2790
logger.warning("Could not load persistent state: "
2598
"EOFError:", exc_info=e)
2791
"EOFError:",
2792
exc_info=e)
2599
2793
2600
2794
with PGPEngine() as pgp:
2601
2795
for client_name, client in clients_data.items():
2613
2807
# For each value in new config, check if it
2614
2808
# differs from the old config value (Except for
2615
2809
# the "secret" attribute)
2616
if (name != "secret" and
2617
value != old_client_settings[client_name]
2618
[name]):
2810
if (name != "secret"
2811
and (value !=
2812
old_client_settings[client_name][name])):
2619
2813
client[name] = value
2620
2814
except KeyError:
2621
2815
pass
2622
2816
2623
2817
# Clients who has passed its expire date can still be
2624
# enabled if its last checker was successful. Clients
2818
# enabled if its last checker was successful. A Client
2625
2819
# whose checker succeeded before we stored its state is
2626
2820
# assumed to have successfully run all checkers during
2627
2821
# downtime.
2630
2824
if not client["last_checked_ok"]:
2631
2825
logger.warning(
2632
2826
"disabling client {} - Client never "
2633
"performed a successful checker"
2634
.format(client_name))
2827
"performed a successful checker".format(
2828
client_name))
2635
2829
client["enabled"] = False
2636
2830
elif client["last_checker_status"] != 0:
2637
2831
logger.warning(
2638
2832
"disabling client {} - Client last"
2639
" checker failed with error code {}"
2640
.format(client_name,
2641
client["last_checker_status"]))
2833
" checker failed with error code"
2834
" {}".format(
2835
client_name,
2836
client["last_checker_status"]))
2642
2837
client["enabled"] = False
2643
2838
else:
2644
client["expires"] = (datetime.datetime
2645
.utcnow()
2646
+ client["timeout"])
2839
client["expires"] = (
2840
datetime.datetime.utcnow()
2841
+ client["timeout"])
2647
2842
logger.debug("Last checker succeeded,"
2648
" keeping {} enabled"
2649
.format(client_name))
2843
" keeping {} enabled".format(
2844
client_name))
2650
2845
try:
2651
client["secret"] = (
2652
pgp.decrypt(client["encrypted_secret"],
2653
client_settings[client_name]
2654
["secret"]))
2846
client["secret"] = pgp.decrypt(
2847
client["encrypted_secret"],
2848
client_settings[client_name]["secret"])
2655
2849
except PGPError:
2656
2850
# If decryption fails, we use secret from new settings
2657
logger.debug("Failed to decrypt {} old secret"
2658
.format(client_name))
2659
client["secret"] = (
2660
client_settings[client_name]["secret"])
2851
logger.debug("Failed to decrypt {} old secret".format(
2852
client_name))
2853
client["secret"] = (client_settings[client_name]
2854
["secret"])
2661
2855
2662
2856
# Add/remove clients based on new changes made to config
2663
2857
for client_name in (set(old_client_settings)
2670
2864
# Create all client objects
2671
2865
for client_name, client in clients_data.items():
2672
2866
tcp_server.clients[client_name] = client_class(
2673
name = client_name, settings = client,
2867
name = client_name,
2868
settings = client,
2674
2869
server_settings = server_settings)
2675
2870
2676
2871
if not tcp_server.clients:
2678
2873
2679
2874
if not foreground:
2680
2875
if pidfile is not None:
2876
pid = os.getpid()
2681
2877
try:
2682
2878
with pidfile:
2683
pid = os.getpid()
2684
pidfile.write("{}\n".format(pid).encode("utf-8"))
2879
print(pid, file=pidfile)
2685
2880
except IOError:
2686
2881
logger.error("Could not write to file %r with PID %d",
2687
2882
pidfilename, pid)
2692
2887
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2693
2888
2694
2889
if use_dbus:
2695
@alternate_dbus_interfaces({"se.recompile.Mandos":
2696
"se.bsnet.fukt.Mandos"})
2697
class MandosDBusService(DBusObjectWithProperties):
2890
2891
@alternate_dbus_interfaces(
2892
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2893
class MandosDBusService(DBusObjectWithObjectManager):
2698
2894
"""A D-Bus proxy object"""
2895
2699
2896
def __init__(self):
2700
2897
dbus.service.Object.__init__(self, bus, "/")
2898
2701
2899
_interface = "se.recompile.Mandos"
2702
2900
2703
@dbus_interface_annotations(_interface)
2704
def _foo(self):
2705
return { "org.freedesktop.DBus.Property"
2706
".EmitsChangedSignal":
2707
"false"}
2708
2709
2901
@dbus.service.signal(_interface, signature="o")
2710
2902
def ClientAdded(self, objpath):
2711
2903
"D-Bus signal"
2716
2908
"D-Bus signal"
2717
2909
pass
2718
2910
2911
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2912
"true"})
2719
2913
@dbus.service.signal(_interface, signature="os")
2720
2914
def ClientRemoved(self, objpath, name):
2721
2915
"D-Bus signal"
2722
2916
pass
2723
2917
2918
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2919
"true"})
2724
2920
@dbus.service.method(_interface, out_signature="ao")
2725
2921
def GetAllClients(self):
2726
2922
"D-Bus method"
2727
return dbus.Array(c.dbus_object_path
2728
for c in
2923
return dbus.Array(c.dbus_object_path for c in
2729
2924
tcp_server.clients.itervalues())
2730
2925
2926
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2927
"true"})
2731
2928
@dbus.service.method(_interface,
2732
2929
out_signature="a{oa{sv}}")
2733
2930
def GetAllClientsWithProperties(self):
2734
2931
"D-Bus method"
2735
2932
return dbus.Dictionary(
2736
{ c.dbus_object_path: c.GetAll("")
2933
{ c.dbus_object_path: c.GetAll(
2934
"se.recompile.Mandos.Client")
2737
2935
for c in tcp_server.clients.itervalues() },
2738
2936
signature="oa{sv}")
2739
2937
2744
2942
if c.dbus_object_path == object_path:
2745
2943
del tcp_server.clients[c.name]
2746
2944
c.remove_from_connection()
2747
# Don't signal anything except ClientRemoved
2945
# Don't signal the disabling
2748
2946
c.disable(quiet=True)
2749
# Emit D-Bus signal
2750
self.ClientRemoved(object_path, c.name)
2947
# Emit D-Bus signal for removal
2948
self.client_removed_signal(c)
2751
2949
return
2752
2950
raise KeyError(object_path)
2753
2951
2754
2952
del _interface
2953
2954
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
2955
out_signature = "a{oa{sa{sv}}}")
2956
def GetManagedObjects(self):
2957
"""D-Bus method"""
2958
return dbus.Dictionary(
2959
{ client.dbus_object_path:
2960
dbus.Dictionary(
2961
{ interface: client.GetAll(interface)
2962
for interface in
2963
client._get_all_interface_names()})
2964
for client in tcp_server.clients.values()})
2965
2966
def client_added_signal(self, client):
2967
"""Send the new standard signal and the old signal"""
2968
if use_dbus:
2969
# New standard signal
2970
self.InterfacesAdded(
2971
client.dbus_object_path,
2972
dbus.Dictionary(
2973
{ interface: client.GetAll(interface)
2974
for interface in
2975
client._get_all_interface_names()}))
2976
# Old signal
2977
self.ClientAdded(client.dbus_object_path)
2978
2979
def client_removed_signal(self, client):
2980
"""Send the new standard signal and the old signal"""
2981
if use_dbus:
2982
# New standard signal
2983
self.InterfacesRemoved(
2984
client.dbus_object_path,
2985
client._get_all_interface_names())
2986
# Old signal
2987
self.ClientRemoved(client.dbus_object_path,
2988
client.name)
2755
2989
2756
2990
mandos_dbus_service = MandosDBusService()
2757
2991
2780
3014
# + secret.
2781
3015
exclude = { "bus", "changedstate", "secret",
2782
3016
"checker", "server_settings" }
2783
for name, typ in (inspect.getmembers
2784
(dbus.service.Object)):
3017
for name, typ in inspect.getmembers(dbus.service
3018
.Object):
2785
3019
exclude.add(name)
2786
3020
2787
3021
client_dict["encrypted_secret"] = (client
2794
3028
del client_settings[client.name]["secret"]
2795
3029
2796
3030
try:
2797
with (tempfile.NamedTemporaryFile
2798
(mode='wb', suffix=".pickle", prefix='clients-',
2799
dir=os.path.dirname(stored_state_path),
2800
delete=False)) as stored_state:
3031
with tempfile.NamedTemporaryFile(
3032
mode='wb',
3033
suffix=".pickle",
3034
prefix='clients-',
3035
dir=os.path.dirname(stored_state_path),
3036
delete=False) as stored_state:
2801
3037
pickle.dump((clients, client_settings), stored_state)
2802
tempname=stored_state.name
3038
tempname = stored_state.name
2803
3039
os.rename(tempname, stored_state_path)
2804
3040
except (IOError, OSError) as e:
2805
3041
if not debug:
2820
3056
name, client = tcp_server.clients.popitem()
2821
3057
if use_dbus:
2822
3058
client.remove_from_connection()
2823
# Don't signal anything except ClientRemoved
3059
# Don't signal the disabling
2824
3060
client.disable(quiet=True)
2825
if use_dbus:
2826
# Emit D-Bus signal
2827
mandos_dbus_service.ClientRemoved(client
2828
.dbus_object_path,
2829
client.name)
3061
# Emit D-Bus signal for removal
3062
mandos_dbus_service.client_removed_signal(client)
2830
3063
client_settings.clear()
2831
3064
2832
3065
atexit.register(cleanup)
2833
3066
2834
3067
for client in tcp_server.clients.itervalues():
2835
3068
if use_dbus:
2836
# Emit D-Bus signal
2837
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3069
# Emit D-Bus signal for adding
3070
mandos_dbus_service.client_added_signal(client)
2838
3071
# Need to initiate checking of clients
2839
3072
if client.enabled:
2840
3073
client.init_checker()
2885
3118
# Must run before the D-Bus bus name gets deregistered
2886
3119
cleanup()
2887
3120
3121
2888
3122
if __name__ == '__main__':
2889
3123
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0