To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.333
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.333
- Committer: Teddy Hogeborn
- Date: 2015-08-10 09:00:23 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 325.
- Revision ID: teddy@recompile.se-20150810090023-fz6vjqr7zf33e2tf
Support the standard org.freedesktop.DBus.ObjectManager interface.
Now that the D-Bus standard has an interface to keep track of new and
removed objects, use that instead of our own methods. This deprecates
our D-Bus methods "GetAllClients" and "GetAllClientsWithProperties"
and the signals "ClientAdded" and "ClientRemoved", all on the server
interface "se.recompile.Mandos".
* DBUS-API: Removed references to deprecated methods and signals;
insert reference to the org.freedesktop.DBus.ObjectManager
interface.
* mandos (DBusObjectWithProperties._get_all_interface_names): New.
(dbus.OBJECT_MANAGER_IFACE): If not present, monkey patch.
(DBusObjectWithObjectManager): New.
(main/MandosDBusService): Inherit from DBusObjectWithObjectManager.
(main/MandosDBusService.ClientRemoved): Annotate as deprecated.
(main/MandosDBusService.GetAllClients): - '' -
(main/MandosDBusService.GetAllClientsWithProperties): Annotate as
deprecated.
Also only
return
properties on
client
interface.
(main/MandosDBusService.RemoveClient): Call client_removed_signal
instead of ClientRemoved.
(main/MandosDBusService.GetManagedObjects): New.
(main/MandosDBusService.client_added_signal): New.
(main/MandosDBusService.client_removed_signal): - '' -
(main/cleanup): Call "client_removed_signal" instead of sending
"ClientRemoved" signal directly.
(main): Call "client_added_signal" instead of sending "ClientAdded"
signal directly.
* mandos-ctl: Use GetManagedObjects instead of
GetAllClientsWithProperties. Also, show better error
message in case of failure to connect to the D-Bus
* mandos-monitor (MandosClientPropertyCache.properties_changed):
Bug fix; only update properties on client interface.
(UserInterface.find_and_remove_client): Change to accept arguments
from InterfacesRemoved
signal. Also, bug fix:
working error message when
removing unknown client.
(UserInterface.add_new_client): Change to accept arguments from
InterfacesRemoved signal. Pass
properties to MandosClientWidget
constructor.
(UserInterface.run): Connect find_and_remove_client method to
InterfacesRemoved signal and the add_new_client
method to the InterfacesAdded signal.
Now that the D-Bus standard has an interface to keep track of new and
removed objects, use that instead of our own methods. This deprecates
our D-Bus methods "GetAllClients" and "GetAllClientsWithProperties"
and the signals "ClientAdded" and "ClientRemoved", all on the server
interface "se.recompile.Mandos".
* DBUS-API: Removed references to deprecated methods and signals;
insert reference to the org.freedesktop.DBus.ObjectManager
interface.
* mandos (DBusObjectWithProperties._get_all_interface_names): New.
(dbus.OBJECT_MANAGER_IFACE): If not present, monkey patch.
(DBusObjectWithObjectManager): New.
(main/MandosDBusService): Inherit from DBusObjectWithObjectManager.
(main/MandosDBusService.ClientRemoved): Annotate as deprecated.
(main/MandosDBusService.GetAllClients): - '' -
(main/MandosDBusService.GetAllClientsWithProperties): Annotate as
deprecated.
Also only
return
properties on
client
interface.
(main/MandosDBusService.RemoveClient): Call client_removed_signal
instead of ClientRemoved.
(main/MandosDBusService.GetManagedObjects): New.
(main/MandosDBusService.client_added_signal): New.
(main/MandosDBusService.client_removed_signal): - '' -
(main/cleanup): Call "client_removed_signal" instead of sending
"ClientRemoved" signal directly.
(main): Call "client_added_signal" instead of sending "ClientAdded"
signal directly.
* mandos-ctl: Use GetManagedObjects instead of
GetAllClientsWithProperties. Also, show better error
message in case of failure to connect to the D-Bus
* mandos-monitor (MandosClientPropertyCache.properties_changed):
Bug fix; only update properties on client interface.
(UserInterface.find_and_remove_client): Change to accept arguments
from InterfacesRemoved
signal. Also, bug fix:
working error message when
removing unknown client.
(UserInterface.add_new_client): Change to accept arguments from
InterfacesRemoved signal. Pass
properties to MandosClientWidget
constructor.
(UserInterface.run): Connect find_and_remove_client method to
InterfacesRemoved signal and the add_new_client
method to the InterfacesAdded signal.
- files added:
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
71
80
import collections
81
import codecs
72
82
73
83
import dbus
74
84
import dbus.service
75
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
76
89
import avahi
77
90
from dbus.mainloop.glib import DBusGMainLoop
78
91
import ctypes
91
104
if sys.version_info.major == 2:
92
105
str = unicode
93
106
94
version = "1.6.8"
107
version = "1.6.9"
95
108
stored_state_file = "clients.pickle"
96
109
97
110
logger = logging.getLogger()
98
111
syslogger = None
99
112
100
113
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
104
116
except (OSError, AttributeError):
117
105
118
def if_nametoindex(interface):
106
119
"Get an interface index the hard way, i.e. using fcntl()"
107
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
116
129
"""init logger and add loglevel"""
117
130
118
131
global syslogger
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
123
135
syslogger.setFormatter(logging.Formatter
124
136
('Mandos [%(process)d]: %(levelname)s:'
125
137
' %(message)s'))
142
154
143
155
class PGPEngine(object):
144
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
145
158
def __init__(self):
146
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
160
self.gnupgargs = ['--batch',
186
199
187
200
def encrypt(self, data, password):
188
201
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
191
204
passfile.write(passphrase)
192
205
passfile.flush()
193
206
proc = subprocess.Popen(['gpg', '--symmetric',
204
217
205
218
def decrypt(self, data, password):
206
219
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
209
222
passfile.write(passphrase)
210
223
passfile.flush()
211
224
proc = subprocess.Popen(['gpg', '--decrypt',
215
228
stdin = subprocess.PIPE,
216
229
stdout = subprocess.PIPE,
217
230
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
231
decrypted_plaintext, err = proc.communicate(input = data)
220
232
if proc.returncode != 0:
221
233
raise PGPError(err)
222
234
return decrypted_plaintext
228
240
return super(AvahiError, self).__init__(value, *args,
229
241
**kwargs)
230
242
243
231
244
class AvahiServiceError(AvahiError):
232
245
pass
233
246
247
234
248
class AvahiGroupError(AvahiError):
235
249
pass
236
250
256
270
bus: dbus.SystemBus()
257
271
"""
258
272
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
263
284
self.interface = interface
264
285
self.name = name
265
286
self.type = servicetype
275
296
self.bus = bus
276
297
self.entry_group_state_changed_match = None
277
298
278
def rename(self):
299
def rename(self, remove=True):
279
300
"""Derived from the Avahi example code"""
280
301
if self.rename_count >= self.max_renames:
281
302
logger.critical("No suitable Zeroconf service name found"
282
303
" after %i retries, exiting.",
283
304
self.rename_count)
284
305
raise AvahiServiceError("Too many renames")
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
287
309
logger.info("Changing Zeroconf service name to %r ...",
288
310
self.name)
289
self.remove()
311
if remove:
312
self.remove()
290
313
try:
291
314
self.add()
292
315
except dbus.exceptions.DBusException as error:
293
logger.critical("D-Bus Exception", exc_info=error)
294
self.cleanup()
295
os._exit(1)
296
self.rename_count += 1
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
297
324
298
325
def remove(self):
299
326
"""Derived from the Avahi example code"""
338
365
elif state == avahi.ENTRY_GROUP_FAILURE:
339
366
logger.critical("Avahi: Error in group state changed %s",
340
367
str(error))
341
raise AvahiGroupError("State changed: {!s}"
342
.format(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
343
369
344
370
def cleanup(self):
345
371
"""Derived from the Avahi example code"""
355
381
def server_state_changed(self, state, error=None):
356
382
"""Derived from the Avahi example code"""
357
383
logger.debug("Avahi server state change: %i", state)
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
365
390
if state in bad_states:
366
391
if bad_states[state] is not None:
367
392
if error is None:
370
395
logger.error(bad_states[state] + ": %r", error)
371
396
self.cleanup()
372
397
elif state == avahi.SERVER_RUNNING:
373
self.add()
398
try:
399
self.add()
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
404
" collision.")
405
return self.rename(remove=False)
406
else:
407
logger.critical("D-Bus Exception", exc_info=error)
408
self.cleanup()
409
os._exit(1)
374
410
else:
375
411
if error is None:
376
412
logger.debug("Unknown state: %r", state)
386
422
follow_name_owner_changes=True),
387
423
avahi.DBUS_INTERFACE_SERVER)
388
424
self.server.connect_to_signal("StateChanged",
389
self.server_state_changed)
425
self.server_state_changed)
390
426
self.server_state_changed(self.server.GetState())
391
427
392
428
393
429
class AvahiServiceToSyslog(AvahiService):
394
def rename(self):
430
def rename(self, *args, **kwargs):
395
431
"""Add the new name to the syslog messages"""
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
.format(self.name)))
401
436
return ret
402
437
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
441
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
444
"""
445
connection.send(func(*args, **kwargs))
446
connection.close()
403
447
404
448
class Client(object):
405
449
"""A representation of a client host served by this server.
432
476
last_checker_status: integer between 0 and 255 reflecting exit
433
477
status of last checker. -1 reflects crashed
434
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
435
481
last_enabled: datetime.datetime(); (UTC) or None
436
482
name: string; from the config file, used in log messages and
437
483
D-Bus identifiers
450
496
"fingerprint", "host", "interval",
451
497
"last_approval_request", "last_checked_ok",
452
498
"last_enabled", "name", "timeout")
453
client_defaults = { "timeout": "PT5M",
454
"extended_timeout": "PT15M",
455
"interval": "PT2M",
456
"checker": "fping -q -- %%(host)s",
457
"host": "",
458
"approval_delay": "PT0S",
459
"approval_duration": "PT1S",
460
"approved_by_default": "True",
461
"enabled": "True",
462
}
499
client_defaults = {
500
"timeout": "PT5M",
501
"extended_timeout": "PT15M",
502
"interval": "PT2M",
503
"checker": "fping -q -- %%(host)s",
504
"host": "",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
508
"enabled": "True",
509
}
463
510
464
511
@staticmethod
465
512
def config_parser(config):
481
528
client["enabled"] = config.getboolean(client_name,
482
529
"enabled")
483
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
484
534
client["fingerprint"] = (section["fingerprint"].upper()
485
535
.replace(" ", ""))
486
536
if "secret" in section:
528
578
self.expires = None
529
579
530
580
logger.debug("Creating client %r", self.name)
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the fingerprint()
533
# function
534
581
logger.debug(" Fingerprint: %s", self.fingerprint)
535
582
self.created = settings.get("created",
536
583
datetime.datetime.utcnow())
543
590
self.current_checker_command = None
544
591
self.approved = None
545
592
self.approvals_pending = 0
546
self.changedstate = (multiprocessing_manager
547
.Condition(multiprocessing_manager
548
.Lock()))
549
self.client_structure = [attr for attr in
550
self.__dict__.iterkeys()
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
551
597
if not attr.startswith("_")]
552
598
self.client_structure.append("client_structure")
553
599
554
for name, t in inspect.getmembers(type(self),
555
lambda obj:
556
isinstance(obj,
557
property)):
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
558
602
if not name.startswith("_"):
559
603
self.client_structure.append(name)
560
604
602
646
# and every interval from then on.
603
647
if self.checker_initiator_tag is not None:
604
648
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
606
(int(self.interval
607
.total_seconds() * 1000),
608
self.start_checker))
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
609
652
# Schedule a disable() when 'timeout' has passed
610
653
if self.disable_initiator_tag is not None:
611
654
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
613
(int(self.timeout
614
.total_seconds() * 1000),
615
self.disable))
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
616
657
# Also start a new checker *right now*.
617
658
self.start_checker()
618
659
619
def checker_callback(self, pid, condition, command):
660
def checker_callback(self, source, condition, connection,
661
command):
620
662
"""The checker has completed, so take appropriate actions."""
621
663
self.checker_callback_tag = None
622
664
self.checker = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
667
connection.close()
668
669
if returncode >= 0:
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
625
672
if self.last_checker_status == 0:
626
673
logger.info("Checker for %(name)s succeeded",
627
674
vars(self))
628
675
self.checked_ok()
629
676
else:
630
logger.info("Checker for %(name)s failed",
631
vars(self))
677
logger.info("Checker for %(name)s failed", vars(self))
632
678
else:
633
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
634
681
logger.warning("Checker for %(name)s crashed?",
635
682
vars(self))
683
return False
636
684
637
685
def checked_ok(self):
638
686
"""Assert that the client has been seen, alive and well."""
639
687
self.last_checked_ok = datetime.datetime.utcnow()
640
688
self.last_checker_status = 0
689
self.last_checker_signal = None
641
690
self.bump_timeout()
642
691
643
692
def bump_timeout(self, timeout=None):
648
697
gobject.source_remove(self.disable_initiator_tag)
649
698
self.disable_initiator_tag = None
650
699
if getattr(self, "enabled", False):
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
654
702
self.expires = datetime.datetime.utcnow() + timeout
655
703
656
704
def need_approval(self):
670
718
# than 'timeout' for the client to be disabled, which is as it
671
719
# should be.
672
720
673
# If a checker exists, make sure it is not a zombie
674
try:
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
677
pass
678
except OSError as error:
679
if error.errno != errno.ECHILD:
680
raise
681
else:
682
if pid:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
723
self.checker.join()
724
self.checker = None
687
725
# Start a new checker if needed
688
726
if self.checker is None:
689
727
# Escape attributes for the shell
690
escaped_attrs = { attr:
691
re.escape(str(getattr(self, attr)))
692
for attr in self.runtime_expansions }
728
escaped_attrs = {
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
693
731
try:
694
732
command = self.checker_command % escaped_attrs
695
733
except TypeError as error:
696
734
logger.error('Could not format string "%s"',
697
self.checker_command, exc_info=error)
698
return True # Try again later
735
self.checker_command,
736
exc_info=error)
737
return True # Try again later
699
738
self.current_checker_command = command
700
try:
701
logger.info("Starting checker %r for %s",
702
command, self.name)
703
# We don't need to redirect stdout and stderr, since
704
# in normal mode, that is already done by daemon(),
705
# and in debug mode we don't want to. (Stdin is
706
# always replaced by /dev/null.)
707
# The exception is when not debugging but nevertheless
708
# running in the foreground; use the previously
709
# created wnull.
710
popen_args = {}
711
if (not self.server_settings["debug"]
712
and self.server_settings["foreground"]):
713
popen_args.update({"stdout": wnull,
714
"stderr": wnull })
715
self.checker = subprocess.Popen(command,
716
close_fds=True,
717
shell=True, cwd="/",
718
**popen_args)
719
except OSError as error:
720
logger.error("Failed to start subprocess",
721
exc_info=error)
722
return True
723
self.checker_callback_tag = (gobject.child_watch_add
724
(self.checker.pid,
725
self.checker_callback,
726
data=command))
727
# The checker may have completed before the gobject
728
# watch was added. Check for this.
729
try:
730
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
731
except OSError as error:
732
if error.errno == errno.ECHILD:
733
# This should never happen
734
logger.error("Child process vanished",
735
exc_info=error)
736
return True
737
raise
738
if pid:
739
gobject.source_remove(self.checker_callback_tag)
740
self.checker_callback(pid, status, command)
739
logger.info("Starting checker %r for %s", command,
740
self.name)
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
747
# created wnull.
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
760
self.checker.start()
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
741
764
# Re-run this periodically if run by gobject.timeout_add
742
765
return True
743
766
749
772
if getattr(self, "checker", None) is None:
750
773
return
751
774
logger.debug("Stopping checker for %(name)s", vars(self))
752
try:
753
self.checker.terminate()
754
#time.sleep(0.5)
755
#if self.checker.poll() is None:
756
# self.checker.kill()
757
except OSError as error:
758
if error.errno != errno.ESRCH: # No such process
759
raise
775
self.checker.terminate()
760
776
self.checker = None
761
777
762
778
763
def dbus_service_property(dbus_interface, signature="v",
764
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
765
783
"""Decorators for marking methods of a DBusObjectWithProperties to
766
784
become properties on the D-Bus.
767
785
777
795
if byte_arrays and signature != "ay":
778
796
raise ValueError("Byte arrays not supported for non-'ay'"
779
797
" signature {!r}".format(signature))
798
780
799
def decorator(func):
781
800
func._dbus_is_property = True
782
801
func._dbus_interface = dbus_interface
787
806
func._dbus_name = func._dbus_name[:-14]
788
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
789
808
return func
809
790
810
return decorator
791
811
792
812
801
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
802
822
"false"}
803
823
"""
824
804
825
def decorator(func):
805
826
func._dbus_is_interface = True
806
827
func._dbus_interface = dbus_interface
807
828
func._dbus_name = dbus_interface
808
829
return func
830
809
831
return decorator
810
832
811
833
820
842
access="r")
821
843
def Property_dbus_property(self):
822
844
return dbus.Boolean(False)
845
846
See also the DBusObjectWithAnnotations class.
823
847
"""
848
824
849
def decorator(func):
825
850
func._dbus_annotations = annotations
826
851
return func
852
827
853
return decorator
828
854
829
855
832
858
"""
833
859
pass
834
860
861
835
862
class DBusPropertyAccessException(DBusPropertyException):
836
863
"""A property's access permissions disallows an operation.
837
864
"""
844
871
pass
845
872
846
873
847
class DBusObjectWithProperties(dbus.service.Object):
848
"""A D-Bus object with properties.
874
class DBusObjectWithAnnotations(dbus.service.Object):
875
"""A D-Bus object with annotations.
849
876
850
Classes inheriting from this can use the dbus_service_property
851
decorator to expose methods as D-Bus properties. It exposes the
852
standard Get(), Set(), and GetAll() methods on the D-Bus.
877
Classes inheriting from this can use the dbus_annotations
878
decorator to add annotations to methods or signals.
853
879
"""
854
880
855
881
@staticmethod
865
891
def _get_all_dbus_things(self, thing):
866
892
"""Returns a generator of (name, attribute) pairs
867
893
"""
868
return ((getattr(athing.__get__(self), "_dbus_name",
869
name),
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
870
895
athing.__get__(self))
871
896
for cls in self.__class__.__mro__
872
897
for name, athing in
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
899
900
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
901
out_signature = "s",
902
path_keyword = 'object_path',
903
connection_keyword = 'connection')
904
def Introspect(self, object_path, connection):
905
"""Overloading of standard D-Bus method.
906
907
Inserts annotation tags on methods and signals.
908
"""
909
xmlstring = dbus.service.Object.Introspect(self, object_path,
910
connection)
911
try:
912
document = xml.dom.minidom.parseString(xmlstring)
913
914
for if_tag in document.getElementsByTagName("interface"):
915
# Add annotation tags
916
for typ in ("method", "signal"):
917
for tag in if_tag.getElementsByTagName(typ):
918
annots = dict()
919
for name, prop in (self.
920
_get_all_dbus_things(typ)):
921
if (name == tag.getAttribute("name")
922
and prop._dbus_interface
923
== if_tag.getAttribute("name")):
924
annots.update(getattr(
925
prop, "_dbus_annotations", {}))
926
for name, value in annots.items():
927
ann_tag = document.createElement(
928
"annotation")
929
ann_tag.setAttribute("name", name)
930
ann_tag.setAttribute("value", value)
931
tag.appendChild(ann_tag)
932
# Add interface annotation tags
933
for annotation, value in dict(
934
itertools.chain.from_iterable(
935
annotations().items()
936
for name, annotations
937
in self._get_all_dbus_things("interface")
938
if name == if_tag.getAttribute("name")
939
)).items():
940
ann_tag = document.createElement("annotation")
941
ann_tag.setAttribute("name", annotation)
942
ann_tag.setAttribute("value", value)
943
if_tag.appendChild(ann_tag)
944
# Fix argument name for the Introspect method itself
945
if (if_tag.getAttribute("name")
946
== dbus.INTROSPECTABLE_IFACE):
947
for cn in if_tag.getElementsByTagName("method"):
948
if cn.getAttribute("name") == "Introspect":
949
for arg in cn.getElementsByTagName("arg"):
950
if (arg.getAttribute("direction")
951
== "out"):
952
arg.setAttribute("name",
953
"xml_data")
954
xmlstring = document.toxml("utf-8")
955
document.unlink()
956
except (AttributeError, xml.dom.DOMException,
957
xml.parsers.expat.ExpatError) as error:
958
logger.error("Failed to override Introspection method",
959
exc_info=error)
960
return xmlstring
961
962
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
964
"""A D-Bus object with properties.
965
966
Classes inheriting from this can use the dbus_service_property
967
decorator to expose methods as D-Bus properties. It exposes the
968
standard Get(), Set(), and GetAll() methods on the D-Bus.
969
"""
875
970
876
971
def _get_dbus_property(self, interface_name, property_name):
877
972
"""Returns a bound method if one exists which is a D-Bus
878
973
property with the specified name and interface.
879
974
"""
880
for cls in self.__class__.__mro__:
881
for name, value in (inspect.getmembers
882
(cls,
883
self._is_dbus_thing("property"))):
975
for cls in self.__class__.__mro__:
976
for name, value in inspect.getmembers(
977
cls, self._is_dbus_thing("property")):
884
978
if (value._dbus_name == property_name
885
979
and value._dbus_interface == interface_name):
886
980
return value.__get__(self)
887
981
888
982
# No such property
889
raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
+ interface_name + "."
891
+ property_name)
892
893
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
983
raise DBusPropertyNotFound("{}:{}.{}".format(
984
self.dbus_object_path, interface_name, property_name))
985
986
@classmethod
987
def _get_all_interface_names(cls):
988
"""Get a sequence of all interfaces supported by an object"""
989
return (name for name in set(getattr(getattr(x, attr),
990
"_dbus_interface", None)
991
for x in (inspect.getmro(cls))
992
for attr in dir(x))
993
if name is not None)
994
995
@dbus.service.method(dbus.PROPERTIES_IFACE,
996
in_signature="ss",
894
997
out_signature="v")
895
998
def Get(self, interface_name, property_name):
896
999
"""Standard D-Bus property Get() method, see D-Bus standard.
921
1024
for byte in value))
922
1025
prop(value)
923
1026
924
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1027
@dbus.service.method(dbus.PROPERTIES_IFACE,
1028
in_signature="s",
925
1029
out_signature="a{sv}")
926
1030
def GetAll(self, interface_name):
927
1031
"""Standard D-Bus property GetAll() method, see D-Bus
942
1046
if not hasattr(value, "variant_level"):
943
1047
properties[name] = value
944
1048
continue
945
properties[name] = type(value)(value, variant_level=
946
value.variant_level+1)
1049
properties[name] = type(value)(
1050
value, variant_level = value.variant_level + 1)
947
1051
return dbus.Dictionary(properties, signature="sv")
948
1052
949
1053
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
963
1067
964
1068
Inserts property tags and interface annotation tags.
965
1069
"""
966
xmlstring = dbus.service.Object.Introspect(self, object_path,
967
connection)
1070
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1071
object_path,
1072
connection)
968
1073
try:
969
1074
document = xml.dom.minidom.parseString(xmlstring)
1075
970
1076
def make_tag(document, name, prop):
971
1077
e = document.createElement("property")
972
1078
e.setAttribute("name", name)
973
1079
e.setAttribute("type", prop._dbus_signature)
974
1080
e.setAttribute("access", prop._dbus_access)
975
1081
return e
1082
976
1083
for if_tag in document.getElementsByTagName("interface"):
977
1084
# Add property tags
978
1085
for tag in (make_tag(document, name, prop)
981
1088
if prop._dbus_interface
982
1089
== if_tag.getAttribute("name")):
983
1090
if_tag.appendChild(tag)
984
# Add annotation tags
985
for typ in ("method", "signal", "property"):
986
for tag in if_tag.getElementsByTagName(typ):
987
annots = dict()
988
for name, prop in (self.
989
_get_all_dbus_things(typ)):
990
if (name == tag.getAttribute("name")
991
and prop._dbus_interface
992
== if_tag.getAttribute("name")):
993
annots.update(getattr
994
(prop,
995
"_dbus_annotations",
996
{}))
997
for name, value in annots.items():
998
ann_tag = document.createElement(
999
"annotation")
1000
ann_tag.setAttribute("name", name)
1001
ann_tag.setAttribute("value", value)
1002
tag.appendChild(ann_tag)
1003
# Add interface annotation tags
1004
for annotation, value in dict(
1005
itertools.chain.from_iterable(
1006
annotations().items()
1007
for name, annotations in
1008
self._get_all_dbus_things("interface")
1009
if name == if_tag.getAttribute("name")
1010
)).items():
1011
ann_tag = document.createElement("annotation")
1012
ann_tag.setAttribute("name", annotation)
1013
ann_tag.setAttribute("value", value)
1014
if_tag.appendChild(ann_tag)
1091
# Add annotation tags for properties
1092
for tag in if_tag.getElementsByTagName("property"):
1093
annots = dict()
1094
for name, prop in self._get_all_dbus_things(
1095
"property"):
1096
if (name == tag.getAttribute("name")
1097
and prop._dbus_interface
1098
== if_tag.getAttribute("name")):
1099
annots.update(getattr(
1100
prop, "_dbus_annotations", {}))
1101
for name, value in annots.items():
1102
ann_tag = document.createElement(
1103
"annotation")
1104
ann_tag.setAttribute("name", name)
1105
ann_tag.setAttribute("value", value)
1106
tag.appendChild(ann_tag)
1015
1107
# Add the names to the return values for the
1016
1108
# "org.freedesktop.DBus.Properties" methods
1017
1109
if (if_tag.getAttribute("name")
1035
1127
exc_info=error)
1036
1128
return xmlstring
1037
1129
1130
try:
1131
dbus.OBJECT_MANAGER_IFACE
1132
except AttributeError:
1133
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1134
1135
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1136
"""A D-Bus object with an ObjectManager.
1137
1138
Classes inheriting from this exposes the standard
1139
GetManagedObjects call and the InterfacesAdded and
1140
InterfacesRemoved signals on the standard
1141
"org.freedesktop.DBus.ObjectManager" interface.
1142
1143
Note: No signals are sent automatically; they must be sent
1144
manually.
1145
"""
1146
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1147
out_signature = "a{oa{sa{sv}}}")
1148
def GetManagedObjects(self):
1149
"""This function must be overridden"""
1150
raise NotImplementedError()
1151
1152
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1153
signature = "oa{sa{sv}}")
1154
def InterfacesAdded(self, object_path, interfaces_and_properties):
1155
pass
1156
1157
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1158
signature = "oas")
1159
def InterfacesRemoved(self, object_path, interfaces):
1160
pass
1161
1162
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1163
out_signature = "s",
1164
path_keyword = 'object_path',
1165
connection_keyword = 'connection')
1166
def Introspect(self, object_path, connection):
1167
"""Overloading of standard D-Bus method.
1168
1169
Override return argument name of GetManagedObjects to be
1170
"objpath_interfaces_and_properties"
1171
"""
1172
xmlstring = DBusObjectWithAnnotations(self, object_path,
1173
connection)
1174
try:
1175
document = xml.dom.minidom.parseString(xmlstring)
1176
1177
for if_tag in document.getElementsByTagName("interface"):
1178
# Fix argument name for the GetManagedObjects method
1179
if (if_tag.getAttribute("name")
1180
== dbus.OBJECT_MANAGER_IFACE):
1181
for cn in if_tag.getElementsByTagName("method"):
1182
if (cn.getAttribute("name")
1183
== "GetManagedObjects"):
1184
for arg in cn.getElementsByTagName("arg"):
1185
if (arg.getAttribute("direction")
1186
== "out"):
1187
arg.setAttribute(
1188
"name",
1189
"objpath_interfaces"
1190
"_and_properties")
1191
xmlstring = document.toxml("utf-8")
1192
document.unlink()
1193
except (AttributeError, xml.dom.DOMException,
1194
xml.parsers.expat.ExpatError) as error:
1195
logger.error("Failed to override Introspection method",
1196
exc_info = error)
1197
return xmlstring
1038
1198
1039
1199
def datetime_to_dbus(dt, variant_level=0):
1040
1200
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1041
1201
if dt is None:
1042
1202
return dbus.String("", variant_level = variant_level)
1043
return dbus.String(dt.isoformat(),
1044
variant_level=variant_level)
1203
return dbus.String(dt.isoformat(), variant_level=variant_level)
1045
1204
1046
1205
1047
1206
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1067
1226
(from DBusObjectWithProperties) and interfaces (from the
1068
1227
dbus_interface_annotations decorator).
1069
1228
"""
1229
1070
1230
def wrapper(cls):
1071
1231
for orig_interface_name, alt_interface_name in (
1072
alt_interface_names.items()):
1232
alt_interface_names.items()):
1073
1233
attr = {}
1074
1234
interface_names = set()
1075
1235
# Go though all attributes of the class
1077
1237
# Ignore non-D-Bus attributes, and D-Bus attributes
1078
1238
# with the wrong interface name
1079
1239
if (not hasattr(attribute, "_dbus_interface")
1080
or not attribute._dbus_interface
1081
.startswith(orig_interface_name)):
1240
or not attribute._dbus_interface.startswith(
1241
orig_interface_name)):
1082
1242
continue
1083
1243
# Create an alternate D-Bus interface name based on
1084
1244
# the current name
1085
alt_interface = (attribute._dbus_interface
1086
.replace(orig_interface_name,
1087
alt_interface_name))
1245
alt_interface = attribute._dbus_interface.replace(
1246
orig_interface_name, alt_interface_name)
1088
1247
interface_names.add(alt_interface)
1089
1248
# Is this a D-Bus signal?
1090
1249
if getattr(attribute, "_dbus_is_signal", False):
1091
# Extract the original non-method undecorated
1092
# function by black magic
1093
nonmethod_func = (dict(
1250
if sys.version_info.major == 2:
1251
# Extract the original non-method undecorated
1252
# function by black magic
1253
nonmethod_func = (dict(
1094
1254
zip(attribute.func_code.co_freevars,
1095
attribute.__closure__))["func"]
1096
.cell_contents)
1255
attribute.__closure__))
1256
["func"].cell_contents)
1257
else:
1258
nonmethod_func = attribute
1097
1259
# Create a new, but exactly alike, function
1098
1260
# object, and decorate it to be a new D-Bus signal
1099
1261
# with the alternate D-Bus interface name
1100
new_function = (dbus.service.signal
1101
(alt_interface,
1102
attribute._dbus_signature)
1103
(types.FunctionType(
1104
nonmethod_func.func_code,
1105
nonmethod_func.func_globals,
1106
nonmethod_func.func_name,
1107
nonmethod_func.func_defaults,
1108
nonmethod_func.func_closure)))
1262
if sys.version_info.major == 2:
1263
new_function = types.FunctionType(
1264
nonmethod_func.func_code,
1265
nonmethod_func.func_globals,
1266
nonmethod_func.func_name,
1267
nonmethod_func.func_defaults,
1268
nonmethod_func.func_closure)
1269
else:
1270
new_function = types.FunctionType(
1271
nonmethod_func.__code__,
1272
nonmethod_func.__globals__,
1273
nonmethod_func.__name__,
1274
nonmethod_func.__defaults__,
1275
nonmethod_func.__closure__)
1276
new_function = (dbus.service.signal(
1277
alt_interface,
1278
attribute._dbus_signature)(new_function))
1109
1279
# Copy annotations, if any
1110
1280
try:
1111
new_function._dbus_annotations = (
1112
dict(attribute._dbus_annotations))
1281
new_function._dbus_annotations = dict(
1282
attribute._dbus_annotations)
1113
1283
except AttributeError:
1114
1284
pass
1115
1285
# Define a creator of a function to call both the
1120
1290
"""This function is a scope container to pass
1121
1291
func1 and func2 to the "call_both" function
1122
1292
outside of its arguments"""
1293
1123
1294
def call_both(*args, **kwargs):
1124
1295
"""This function will emit two D-Bus
1125
1296
signals by calling func1 and func2"""
1126
1297
func1(*args, **kwargs)
1127
1298
func2(*args, **kwargs)
1299
1128
1300
return call_both
1129
1301
# Create the "call_both" function and add it to
1130
1302
# the class
1135
1307
# object. Decorate it to be a new D-Bus method
1136
1308
# with the alternate D-Bus interface name. Add it
1137
1309
# to the class.
1138
attr[attrname] = (dbus.service.method
1139
(alt_interface,
1140
attribute._dbus_in_signature,
1141
attribute._dbus_out_signature)
1142
(types.FunctionType
1143
(attribute.func_code,
1144
attribute.func_globals,
1145
attribute.func_name,
1146
attribute.func_defaults,
1147
attribute.func_closure)))
1310
attr[attrname] = (
1311
dbus.service.method(
1312
alt_interface,
1313
attribute._dbus_in_signature,
1314
attribute._dbus_out_signature)
1315
(types.FunctionType(attribute.func_code,
1316
attribute.func_globals,
1317
attribute.func_name,
1318
attribute.func_defaults,
1319
attribute.func_closure)))
1148
1320
# Copy annotations, if any
1149
1321
try:
1150
attr[attrname]._dbus_annotations = (
1151
dict(attribute._dbus_annotations))
1322
attr[attrname]._dbus_annotations = dict(
1323
attribute._dbus_annotations)
1152
1324
except AttributeError:
1153
1325
pass
1154
1326
# Is this a D-Bus property?
1157
1329
# object, and decorate it to be a new D-Bus
1158
1330
# property with the alternate D-Bus interface
1159
1331
# name. Add it to the class.
1160
attr[attrname] = (dbus_service_property
1161
(alt_interface,
1162
attribute._dbus_signature,
1163
attribute._dbus_access,
1164
attribute
1165
._dbus_get_args_options
1166
["byte_arrays"])
1167
(types.FunctionType
1168
(attribute.func_code,
1169
attribute.func_globals,
1170
attribute.func_name,
1171
attribute.func_defaults,
1172
attribute.func_closure)))
1332
attr[attrname] = (dbus_service_property(
1333
alt_interface, attribute._dbus_signature,
1334
attribute._dbus_access,
1335
attribute._dbus_get_args_options
1336
["byte_arrays"])
1337
(types.FunctionType(
1338
attribute.func_code,
1339
attribute.func_globals,
1340
attribute.func_name,
1341
attribute.func_defaults,
1342
attribute.func_closure)))
1173
1343
# Copy annotations, if any
1174
1344
try:
1175
attr[attrname]._dbus_annotations = (
1176
dict(attribute._dbus_annotations))
1345
attr[attrname]._dbus_annotations = dict(
1346
attribute._dbus_annotations)
1177
1347
except AttributeError:
1178
1348
pass
1179
1349
# Is this a D-Bus interface?
1182
1352
# object. Decorate it to be a new D-Bus interface
1183
1353
# with the alternate D-Bus interface name. Add it
1184
1354
# to the class.
1185
attr[attrname] = (dbus_interface_annotations
1186
(alt_interface)
1187
(types.FunctionType
1188
(attribute.func_code,
1189
attribute.func_globals,
1190
attribute.func_name,
1191
attribute.func_defaults,
1192
attribute.func_closure)))
1355
attr[attrname] = (
1356
dbus_interface_annotations(alt_interface)
1357
(types.FunctionType(attribute.func_code,
1358
attribute.func_globals,
1359
attribute.func_name,
1360
attribute.func_defaults,
1361
attribute.func_closure)))
1193
1362
if deprecate:
1194
1363
# Deprecate all alternate interfaces
1195
1364
iname="_AlternateDBusNames_interface_annotation{}"
1196
1365
for interface_name in interface_names:
1366
1197
1367
@dbus_interface_annotations(interface_name)
1198
1368
def func(self):
1199
1369
return { "org.freedesktop.DBus.Deprecated":
1200
"true" }
1370
"true" }
1201
1371
# Find an unused name
1202
1372
for aname in (iname.format(i)
1203
1373
for i in itertools.count()):
1208
1378
# Replace the class with a new subclass of it with
1209
1379
# methods, signals, etc. as created above.
1210
1380
cls = type(b"{}Alternate".format(cls.__name__),
1211
(cls,), attr)
1381
(cls, ), attr)
1212
1382
return cls
1383
1213
1384
return wrapper
1214
1385
1215
1386
1216
1387
@alternate_dbus_interfaces({"se.recompile.Mandos":
1217
"se.bsnet.fukt.Mandos"})
1388
"se.bsnet.fukt.Mandos"})
1218
1389
class ClientDBus(Client, DBusObjectWithProperties):
1219
1390
"""A Client class using D-Bus
1220
1391
1224
1395
"""
1225
1396
1226
1397
runtime_expansions = (Client.runtime_expansions
1227
+ ("dbus_object_path",))
1398
+ ("dbus_object_path", ))
1228
1399
1229
1400
_interface = "se.recompile.Mandos.Client"
1230
1401
1238
1409
client_object_name = str(self.name).translate(
1239
1410
{ord("."): ord("_"),
1240
1411
ord("-"): ord("_")})
1241
self.dbus_object_path = (dbus.ObjectPath
1242
("/clients/" + client_object_name))
1412
self.dbus_object_path = dbus.ObjectPath(
1413
"/clients/" + client_object_name)
1243
1414
DBusObjectWithProperties.__init__(self, self.bus,
1244
1415
self.dbus_object_path)
1245
1416
1246
def notifychangeproperty(transform_func,
1247
dbus_name, type_func=lambda x: x,
1248
variant_level=1, invalidate_only=False,
1417
def notifychangeproperty(transform_func, dbus_name,
1418
type_func=lambda x: x,
1419
variant_level=1,
1420
invalidate_only=False,
1249
1421
_interface=_interface):
1250
1422
""" Modify a variable so that it's a property which announces
1251
1423
its changes to DBus.
1258
1430
variant_level: D-Bus variant level. Default: 1
1259
1431
"""
1260
1432
attrname = "_{}".format(dbus_name)
1433
1261
1434
def setter(self, value):
1262
1435
if hasattr(self, "dbus_object_path"):
1263
1436
if (not hasattr(self, attrname) or
1264
1437
type_func(getattr(self, attrname, None))
1265
1438
!= type_func(value)):
1266
1439
if invalidate_only:
1267
self.PropertiesChanged(_interface,
1268
dbus.Dictionary(),
1269
dbus.Array
1270
((dbus_name,)))
1440
self.PropertiesChanged(
1441
_interface, dbus.Dictionary(),
1442
dbus.Array((dbus_name, )))
1271
1443
else:
1272
dbus_value = transform_func(type_func(value),
1273
variant_level
1274
=variant_level)
1444
dbus_value = transform_func(
1445
type_func(value),
1446
variant_level = variant_level)
1275
1447
self.PropertyChanged(dbus.String(dbus_name),
1276
1448
dbus_value)
1277
self.PropertiesChanged(_interface,
1278
dbus.Dictionary({
1279
dbus.String(dbus_name):
1280
dbus_value }), dbus.Array())
1449
self.PropertiesChanged(
1450
_interface,
1451
dbus.Dictionary({ dbus.String(dbus_name):
1452
dbus_value }),
1453
dbus.Array())
1281
1454
setattr(self, attrname, value)
1282
1455
1283
1456
return property(lambda self: getattr(self, attrname), setter)
1289
1462
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1290
1463
last_enabled = notifychangeproperty(datetime_to_dbus,
1291
1464
"LastEnabled")
1292
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1293
type_func = lambda checker:
1294
checker is not None)
1465
checker = notifychangeproperty(
1466
dbus.Boolean, "CheckerRunning",
1467
type_func = lambda checker: checker is not None)
1295
1468
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1296
1469
"LastCheckedOK")
1297
1470
last_checker_status = notifychangeproperty(dbus.Int16,
1300
1473
datetime_to_dbus, "LastApprovalRequest")
1301
1474
approved_by_default = notifychangeproperty(dbus.Boolean,
1302
1475
"ApprovedByDefault")
1303
approval_delay = notifychangeproperty(dbus.UInt64,
1304
"ApprovalDelay",
1305
type_func =
1306
lambda td: td.total_seconds()
1307
* 1000)
1476
approval_delay = notifychangeproperty(
1477
dbus.UInt64, "ApprovalDelay",
1478
type_func = lambda td: td.total_seconds() * 1000)
1308
1479
approval_duration = notifychangeproperty(
1309
1480
dbus.UInt64, "ApprovalDuration",
1310
1481
type_func = lambda td: td.total_seconds() * 1000)
1311
1482
host = notifychangeproperty(dbus.String, "Host")
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func = lambda td:
1314
td.total_seconds() * 1000)
1483
timeout = notifychangeproperty(
1484
dbus.UInt64, "Timeout",
1485
type_func = lambda td: td.total_seconds() * 1000)
1315
1486
extended_timeout = notifychangeproperty(
1316
1487
dbus.UInt64, "ExtendedTimeout",
1317
1488
type_func = lambda td: td.total_seconds() * 1000)
1318
interval = notifychangeproperty(dbus.UInt64,
1319
"Interval",
1320
type_func =
1321
lambda td: td.total_seconds()
1322
* 1000)
1489
interval = notifychangeproperty(
1490
dbus.UInt64, "Interval",
1491
type_func = lambda td: td.total_seconds() * 1000)
1323
1492
checker_command = notifychangeproperty(dbus.String, "Checker")
1324
1493
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1325
1494
invalidate_only=True)
1335
1504
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1336
1505
Client.__del__(self, *args, **kwargs)
1337
1506
1338
def checker_callback(self, pid, condition, command,
1339
*args, **kwargs):
1340
self.checker_callback_tag = None
1341
self.checker = None
1342
if os.WIFEXITED(condition):
1343
exitstatus = os.WEXITSTATUS(condition)
1507
def checker_callback(self, source, condition,
1508
connection, command, *args, **kwargs):
1509
ret = Client.checker_callback(self, source, condition,
1510
connection, command, *args,
1511
**kwargs)
1512
exitstatus = self.last_checker_status
1513
if exitstatus >= 0:
1344
1514
# Emit D-Bus signal
1345
1515
self.CheckerCompleted(dbus.Int16(exitstatus),
1346
dbus.Int64(condition),
1516
# This is specific to GNU libC
1517
dbus.Int64(exitstatus << 8),
1347
1518
dbus.String(command))
1348
1519
else:
1349
1520
# Emit D-Bus signal
1350
1521
self.CheckerCompleted(dbus.Int16(-1),
1351
dbus.Int64(condition),
1522
dbus.Int64(
1523
# This is specific to GNU libC
1524
(exitstatus << 8)
1525
| self.last_checker_signal),
1352
1526
dbus.String(command))
1353
1354
return Client.checker_callback(self, pid, condition, command,
1355
*args, **kwargs)
1527
return ret
1356
1528
1357
1529
def start_checker(self, *args, **kwargs):
1358
1530
old_checker_pid = getattr(self.checker, "pid", None)
1433
1605
self.checked_ok()
1434
1606
1435
1607
# Enable - method
1608
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1436
1609
@dbus.service.method(_interface)
1437
1610
def Enable(self):
1438
1611
"D-Bus method"
1439
1612
self.enable()
1440
1613
1441
1614
# StartChecker - method
1615
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1442
1616
@dbus.service.method(_interface)
1443
1617
def StartChecker(self):
1444
1618
"D-Bus method"
1445
1619
self.start_checker()
1446
1620
1447
1621
# Disable - method
1622
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1448
1623
@dbus.service.method(_interface)
1449
1624
def Disable(self):
1450
1625
"D-Bus method"
1451
1626
self.disable()
1452
1627
1453
1628
# StopChecker - method
1629
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1454
1630
@dbus.service.method(_interface)
1455
1631
def StopChecker(self):
1456
1632
self.stop_checker()
1463
1639
return dbus.Boolean(bool(self.approvals_pending))
1464
1640
1465
1641
# ApprovedByDefault - property
1466
@dbus_service_property(_interface, signature="b",
1642
@dbus_service_property(_interface,
1643
signature="b",
1467
1644
access="readwrite")
1468
1645
def ApprovedByDefault_dbus_property(self, value=None):
1469
1646
if value is None: # get
1471
1648
self.approved_by_default = bool(value)
1472
1649
1473
1650
# ApprovalDelay - property
1474
@dbus_service_property(_interface, signature="t",
1651
@dbus_service_property(_interface,
1652
signature="t",
1475
1653
access="readwrite")
1476
1654
def ApprovalDelay_dbus_property(self, value=None):
1477
1655
if value is None: # get
1480
1658
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1481
1659
1482
1660
# ApprovalDuration - property
1483
@dbus_service_property(_interface, signature="t",
1661
@dbus_service_property(_interface,
1662
signature="t",
1484
1663
access="readwrite")
1485
1664
def ApprovalDuration_dbus_property(self, value=None):
1486
1665
if value is None: # get
1489
1668
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1490
1669
1491
1670
# Name - property
1671
@dbus_annotations(
1672
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1492
1673
@dbus_service_property(_interface, signature="s", access="read")
1493
1674
def Name_dbus_property(self):
1494
1675
return dbus.String(self.name)
1495
1676
1496
1677
# Fingerprint - property
1678
@dbus_annotations(
1679
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1497
1680
@dbus_service_property(_interface, signature="s", access="read")
1498
1681
def Fingerprint_dbus_property(self):
1499
1682
return dbus.String(self.fingerprint)
1500
1683
1501
1684
# Host - property
1502
@dbus_service_property(_interface, signature="s",
1685
@dbus_service_property(_interface,
1686
signature="s",
1503
1687
access="readwrite")
1504
1688
def Host_dbus_property(self, value=None):
1505
1689
if value is None: # get
1507
1691
self.host = str(value)
1508
1692
1509
1693
# Created - property
1694
@dbus_annotations(
1695
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1510
1696
@dbus_service_property(_interface, signature="s", access="read")
1511
1697
def Created_dbus_property(self):
1512
1698
return datetime_to_dbus(self.created)
1517
1703
return datetime_to_dbus(self.last_enabled)
1518
1704
1519
1705
# Enabled - property
1520
@dbus_service_property(_interface, signature="b",
1706
@dbus_service_property(_interface,
1707
signature="b",
1521
1708
access="readwrite")
1522
1709
def Enabled_dbus_property(self, value=None):
1523
1710
if value is None: # get
1528
1715
self.disable()
1529
1716
1530
1717
# LastCheckedOK - property
1531
@dbus_service_property(_interface, signature="s",
1718
@dbus_service_property(_interface,
1719
signature="s",
1532
1720
access="readwrite")
1533
1721
def LastCheckedOK_dbus_property(self, value=None):
1534
1722
if value is not None:
1537
1725
return datetime_to_dbus(self.last_checked_ok)
1538
1726
1539
1727
# LastCheckerStatus - property
1540
@dbus_service_property(_interface, signature="n",
1541
access="read")
1728
@dbus_service_property(_interface, signature="n", access="read")
1542
1729
def LastCheckerStatus_dbus_property(self):
1543
1730
return dbus.Int16(self.last_checker_status)
1544
1731
1553
1740
return datetime_to_dbus(self.last_approval_request)
1554
1741
1555
1742
# Timeout - property
1556
@dbus_service_property(_interface, signature="t",
1743
@dbus_service_property(_interface,
1744
signature="t",
1557
1745
access="readwrite")
1558
1746
def Timeout_dbus_property(self, value=None):
1559
1747
if value is None: # get
1572
1760
is None):
1573
1761
return
1574
1762
gobject.source_remove(self.disable_initiator_tag)
1575
self.disable_initiator_tag = (
1576
gobject.timeout_add(
1577
int((self.expires - now).total_seconds()
1578
* 1000), self.disable))
1763
self.disable_initiator_tag = gobject.timeout_add(
1764
int((self.expires - now).total_seconds() * 1000),
1765
self.disable)
1579
1766
1580
1767
# ExtendedTimeout - property
1581
@dbus_service_property(_interface, signature="t",
1768
@dbus_service_property(_interface,
1769
signature="t",
1582
1770
access="readwrite")
1583
1771
def ExtendedTimeout_dbus_property(self, value=None):
1584
1772
if value is None: # get
1587
1775
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1588
1776
1589
1777
# Interval - property
1590
@dbus_service_property(_interface, signature="t",
1778
@dbus_service_property(_interface,
1779
signature="t",
1591
1780
access="readwrite")
1592
1781
def Interval_dbus_property(self, value=None):
1593
1782
if value is None: # get
1598
1787
if self.enabled:
1599
1788
# Reschedule checker run
1600
1789
gobject.source_remove(self.checker_initiator_tag)
1601
self.checker_initiator_tag = (gobject.timeout_add
1602
(value, self.start_checker))
1603
self.start_checker() # Start one now, too
1790
self.checker_initiator_tag = gobject.timeout_add(
1791
value, self.start_checker)
1792
self.start_checker() # Start one now, too
1604
1793
1605
1794
# Checker - property
1606
@dbus_service_property(_interface, signature="s",
1795
@dbus_service_property(_interface,
1796
signature="s",
1607
1797
access="readwrite")
1608
1798
def Checker_dbus_property(self, value=None):
1609
1799
if value is None: # get
1611
1801
self.checker_command = str(value)
1612
1802
1613
1803
# CheckerRunning - property
1614
@dbus_service_property(_interface, signature="b",
1804
@dbus_service_property(_interface,
1805
signature="b",
1615
1806
access="readwrite")
1616
1807
def CheckerRunning_dbus_property(self, value=None):
1617
1808
if value is None: # get
1622
1813
self.stop_checker()
1623
1814
1624
1815
# ObjectPath - property
1816
@dbus_annotations(
1817
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
1818
"org.freedesktop.DBus.Deprecated": "true"})
1625
1819
@dbus_service_property(_interface, signature="o", access="read")
1626
1820
def ObjectPath_dbus_property(self):
1627
1821
return self.dbus_object_path # is already a dbus.ObjectPath
1628
1822
1629
1823
# Secret = property
1630
@dbus_service_property(_interface, signature="ay",
1631
access="write", byte_arrays=True)
1824
@dbus_annotations(
1825
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1826
"invalidates"})
1827
@dbus_service_property(_interface,
1828
signature="ay",
1829
access="write",
1830
byte_arrays=True)
1632
1831
def Secret_dbus_property(self, value):
1633
1832
self.secret = bytes(value)
1634
1833
1640
1839
self._pipe = child_pipe
1641
1840
self._pipe.send(('init', fpr, address))
1642
1841
if not self._pipe.recv():
1643
raise KeyError()
1842
raise KeyError(fpr)
1644
1843
1645
1844
def __getattribute__(self, name):
1646
1845
if name == '_pipe':
1650
1849
if data[0] == 'data':
1651
1850
return data[1]
1652
1851
if data[0] == 'function':
1852
1653
1853
def func(*args, **kwargs):
1654
1854
self._pipe.send(('funcall', name, args, kwargs))
1655
1855
return self._pipe.recv()[1]
1856
1656
1857
return func
1657
1858
1658
1859
def __setattr__(self, name, value):
1674
1875
logger.debug("Pipe FD: %d",
1675
1876
self.server.child_pipe.fileno())
1676
1877
1677
session = (gnutls.connection
1678
.ClientSession(self.request,
1679
gnutls.connection
1680
.X509Credentials()))
1878
session = gnutls.connection.ClientSession(
1879
self.request, gnutls.connection .X509Credentials())
1681
1880
1682
1881
# Note: gnutls.connection.X509Credentials is really a
1683
1882
# generic GnuTLS certificate credentials object so long as
1692
1891
priority = self.server.gnutls_priority
1693
1892
if priority is None:
1694
1893
priority = "NORMAL"
1695
(gnutls.library.functions
1696
.gnutls_priority_set_direct(session._c_object,
1697
priority, None))
1894
gnutls.library.functions.gnutls_priority_set_direct(
1895
session._c_object, priority, None)
1698
1896
1699
1897
# Start communication using the Mandos protocol
1700
1898
# Get protocol number
1720
1918
approval_required = False
1721
1919
try:
1722
1920
try:
1723
fpr = self.fingerprint(self.peer_certificate
1724
(session))
1921
fpr = self.fingerprint(
1922
self.peer_certificate(session))
1725
1923
except (TypeError,
1726
1924
gnutls.errors.GNUTLSError) as error:
1727
1925
logger.warning("Bad certificate: %s", error)
1742
1940
while True:
1743
1941
if not client.enabled:
1744
1942
logger.info("Client %s is disabled",
1745
client.name)
1943
client.name)
1746
1944
if self.server.use_dbus:
1747
1945
# Emit D-Bus signal
1748
1946
client.Rejected("Disabled")
1795
1993
logger.warning("gnutls send failed",
1796
1994
exc_info=error)
1797
1995
return
1798
logger.debug("Sent: %d, remaining: %d",
1799
sent, len(client.secret)
1800
- (sent_size + sent))
1996
logger.debug("Sent: %d, remaining: %d", sent,
1997
len(client.secret) - (sent_size
1998
+ sent))
1801
1999
sent_size += sent
1802
2000
1803
2001
logger.info("Sending secret to %s", client.name)
1820
2018
def peer_certificate(session):
1821
2019
"Return the peer's OpenPGP certificate as a bytestring"
1822
2020
# If not an OpenPGP certificate...
1823
if (gnutls.library.functions
1824
.gnutls_certificate_type_get(session._c_object)
2021
if (gnutls.library.functions.gnutls_certificate_type_get(
2022
session._c_object)
1825
2023
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1826
2024
# ...do the normal thing
1827
2025
return session.peer_certificate
1841
2039
def fingerprint(openpgp):
1842
2040
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1843
2041
# New GnuTLS "datum" with the OpenPGP public key
1844
datum = (gnutls.library.types
1845
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1846
ctypes.POINTER
1847
(ctypes.c_ubyte)),
1848
ctypes.c_uint(len(openpgp))))
2042
datum = gnutls.library.types.gnutls_datum_t(
2043
ctypes.cast(ctypes.c_char_p(openpgp),
2044
ctypes.POINTER(ctypes.c_ubyte)),
2045
ctypes.c_uint(len(openpgp)))
1849
2046
# New empty GnuTLS certificate
1850
2047
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1851
(gnutls.library.functions
1852
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2048
gnutls.library.functions.gnutls_openpgp_crt_init(
2049
ctypes.byref(crt))
1853
2050
# Import the OpenPGP public key into the certificate
1854
(gnutls.library.functions
1855
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1856
gnutls.library.constants
1857
.GNUTLS_OPENPGP_FMT_RAW))
2051
gnutls.library.functions.gnutls_openpgp_crt_import(
2052
crt, ctypes.byref(datum),
2053
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1858
2054
# Verify the self signature in the key
1859
2055
crtverify = ctypes.c_uint()
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_verify_self(crt, 0,
1862
ctypes.byref(crtverify)))
2056
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2057
crt, 0, ctypes.byref(crtverify))
1863
2058
if crtverify.value != 0:
1864
2059
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1865
raise (gnutls.errors.CertificateSecurityError
1866
("Verify failed"))
2060
raise gnutls.errors.CertificateSecurityError(
2061
"Verify failed")
1867
2062
# New buffer for the fingerprint
1868
2063
buf = ctypes.create_string_buffer(20)
1869
2064
buf_len = ctypes.c_size_t()
1870
2065
# Get the fingerprint from the certificate into the buffer
1871
(gnutls.library.functions
1872
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1873
ctypes.byref(buf_len)))
2066
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2067
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1874
2068
# Deinit the certificate
1875
2069
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1876
2070
# Convert the buffer to a Python bytestring
1882
2076
1883
2077
class MultiprocessingMixIn(object):
1884
2078
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2079
1885
2080
def sub_process_main(self, request, address):
1886
2081
try:
1887
2082
self.finish_request(request, address)
1899
2094
1900
2095
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1901
2096
""" adds a pipe to the MixIn """
2097
1902
2098
def process_request(self, request, client_address):
1903
2099
"""Overrides and wraps the original process_request().
1904
2100
1925
2121
interface: None or a network interface name (string)
1926
2122
use_ipv6: Boolean; to use IPv6 or not
1927
2123
"""
2124
1928
2125
def __init__(self, server_address, RequestHandlerClass,
1929
interface=None, use_ipv6=True, socketfd=None):
2126
interface=None,
2127
use_ipv6=True,
2128
socketfd=None):
1930
2129
"""If socketfd is set, use that file descriptor instead of
1931
2130
creating a new one with socket.socket().
1932
2131
"""
1973
2172
self.interface)
1974
2173
else:
1975
2174
try:
1976
self.socket.setsockopt(socket.SOL_SOCKET,
1977
SO_BINDTODEVICE,
1978
(self.interface + "\0")
1979
.encode("utf-8"))
2175
self.socket.setsockopt(
2176
socket.SOL_SOCKET, SO_BINDTODEVICE,
2177
(self.interface + "\0").encode("utf-8"))
1980
2178
except socket.error as error:
1981
2179
if error.errno == errno.EPERM:
1982
2180
logger.error("No permission to bind to"
2000
2198
self.server_address = (any_address,
2001
2199
self.server_address[1])
2002
2200
elif not self.server_address[1]:
2003
self.server_address = (self.server_address[0],
2004
0)
2201
self.server_address = (self.server_address[0], 0)
2005
2202
# if self.interface:
2006
2203
# self.server_address = (self.server_address[0],
2007
2204
# 0, # port
2021
2218
2022
2219
Assumes a gobject.MainLoop event loop.
2023
2220
"""
2221
2024
2222
def __init__(self, server_address, RequestHandlerClass,
2025
interface=None, use_ipv6=True, clients=None,
2026
gnutls_priority=None, use_dbus=True, socketfd=None):
2223
interface=None,
2224
use_ipv6=True,
2225
clients=None,
2226
gnutls_priority=None,
2227
use_dbus=True,
2228
socketfd=None):
2027
2229
self.enabled = False
2028
2230
self.clients = clients
2029
2231
if self.clients is None:
2035
2237
interface = interface,
2036
2238
use_ipv6 = use_ipv6,
2037
2239
socketfd = socketfd)
2240
2038
2241
def server_activate(self):
2039
2242
if self.enabled:
2040
2243
return socketserver.TCPServer.server_activate(self)
2044
2247
2045
2248
def add_pipe(self, parent_pipe, proc):
2046
2249
# Call "handle_ipc" for both data and EOF events
2047
gobject.io_add_watch(parent_pipe.fileno(),
2048
gobject.IO_IN | gobject.IO_HUP,
2049
functools.partial(self.handle_ipc,
2050
parent_pipe =
2051
parent_pipe,
2052
proc = proc))
2250
gobject.io_add_watch(
2251
parent_pipe.fileno(),
2252
gobject.IO_IN | gobject.IO_HUP,
2253
functools.partial(self.handle_ipc,
2254
parent_pipe = parent_pipe,
2255
proc = proc))
2053
2256
2054
def handle_ipc(self, source, condition, parent_pipe=None,
2055
proc = None, client_object=None):
2257
def handle_ipc(self, source, condition,
2258
parent_pipe=None,
2259
proc = None,
2260
client_object=None):
2056
2261
# error, or the other end of multiprocessing.Pipe has closed
2057
2262
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2058
2263
# Wait for other process to exit
2081
2286
parent_pipe.send(False)
2082
2287
return False
2083
2288
2084
gobject.io_add_watch(parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2086
functools.partial(self.handle_ipc,
2087
parent_pipe =
2088
parent_pipe,
2089
proc = proc,
2090
client_object =
2091
client))
2289
gobject.io_add_watch(
2290
parent_pipe.fileno(),
2291
gobject.IO_IN | gobject.IO_HUP,
2292
functools.partial(self.handle_ipc,
2293
parent_pipe = parent_pipe,
2294
proc = proc,
2295
client_object = client))
2092
2296
parent_pipe.send(True)
2093
2297
# remove the old hook in favor of the new above hook on
2094
2298
# same fileno
2100
2304
2101
2305
parent_pipe.send(('data', getattr(client_object,
2102
2306
funcname)(*args,
2103
**kwargs)))
2307
**kwargs)))
2104
2308
2105
2309
if command == 'getattr':
2106
2310
attrname = request[1]
2107
if callable(client_object.__getattribute__(attrname)):
2108
parent_pipe.send(('function',))
2311
if isinstance(client_object.__getattribute__(attrname),
2312
collections.Callable):
2313
parent_pipe.send(('function', ))
2109
2314
else:
2110
parent_pipe.send(('data', client_object
2111
.__getattribute__(attrname)))
2315
parent_pipe.send((
2316
'data', client_object.__getattribute__(attrname)))
2112
2317
2113
2318
if command == 'setattr':
2114
2319
attrname = request[1]
2145
2350
# avoid excessive use of external libraries.
2146
2351
2147
2352
# New type for defining tokens, syntax, and semantics all-in-one
2148
Token = collections.namedtuple("Token",
2149
("regexp", # To match token; if
2150
# "value" is not None,
2151
# must have a "group"
2152
# containing digits
2153
"value", # datetime.timedelta or
2154
# None
2155
"followers")) # Tokens valid after
2156
# this token
2353
Token = collections.namedtuple("Token", (
2354
"regexp", # To match token; if "value" is not None, must have
2355
# a "group" containing digits
2356
"value", # datetime.timedelta or None
2357
"followers")) # Tokens valid after this token
2157
2358
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2158
2359
# the "duration" ABNF definition in RFC 3339, Appendix A.
2159
2360
token_end = Token(re.compile(r"$"), None, frozenset())
2160
2361
token_second = Token(re.compile(r"(\d+)S"),
2161
2362
datetime.timedelta(seconds=1),
2162
frozenset((token_end,)))
2363
frozenset((token_end, )))
2163
2364
token_minute = Token(re.compile(r"(\d+)M"),
2164
2365
datetime.timedelta(minutes=1),
2165
2366
frozenset((token_second, token_end)))
2181
2382
frozenset((token_month, token_end)))
2182
2383
token_week = Token(re.compile(r"(\d+)W"),
2183
2384
datetime.timedelta(weeks=1),
2184
frozenset((token_end,)))
2385
frozenset((token_end, )))
2185
2386
token_duration = Token(re.compile(r"P"), None,
2186
2387
frozenset((token_year, token_month,
2187
2388
token_day, token_time,
2189
2390
# Define starting values
2190
2391
value = datetime.timedelta() # Value so far
2191
2392
found_token = None
2192
followers = frozenset((token_duration,)) # Following valid tokens
2393
followers = frozenset((token_duration, )) # Following valid tokens
2193
2394
s = duration # String left to parse
2194
2395
# Loop until end token is found
2195
2396
while found_token is not token_end:
2212
2413
break
2213
2414
else:
2214
2415
# No currently valid tokens were found
2215
raise ValueError("Invalid RFC 3339 duration")
2416
raise ValueError("Invalid RFC 3339 duration: {!r}"
2417
.format(duration))
2216
2418
# End token found
2217
2419
return value
2218
2420
2255
2457
elif suffix == "w":
2256
2458
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2257
2459
else:
2258
raise ValueError("Unknown suffix {!r}"
2259
.format(suffix))
2460
raise ValueError("Unknown suffix {!r}".format(suffix))
2260
2461
except IndexError as e:
2261
2462
raise ValueError(*(e.args))
2262
2463
timevalue += delta
2278
2479
# Close all standard open file descriptors
2279
2480
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2280
2481
if not stat.S_ISCHR(os.fstat(null).st_mode):
2281
raise OSError(errno.ENODEV, "{} not a character device"
2482
raise OSError(errno.ENODEV,
2483
"{} not a character device"
2282
2484
.format(os.devnull))
2283
2485
os.dup2(null, sys.stdin.fileno())
2284
2486
os.dup2(null, sys.stdout.fileno())
2350
2552
"port": "",
2351
2553
"debug": "False",
2352
2554
"priority":
2353
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2555
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2556
":+SIGN-DSA-SHA256",
2354
2557
"servicename": "Mandos",
2355
2558
"use_dbus": "True",
2356
2559
"use_ipv6": "True",
2360
2563
"statedir": "/var/lib/mandos",
2361
2564
"foreground": "False",
2362
2565
"zeroconf": "True",
2363
}
2566
}
2364
2567
2365
2568
# Parse config file for server-global settings
2366
2569
server_config = configparser.SafeConfigParser(server_defaults)
2367
2570
del server_defaults
2368
server_config.read(os.path.join(options.configdir,
2369
"mandos.conf"))
2571
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2370
2572
# Convert the SafeConfigParser object to a dict
2371
2573
server_settings = server_config.defaults()
2372
2574
# Use the appropriate methods on the non-string config options
2390
2592
# Override the settings from the config file with command line
2391
2593
# options, if set.
2392
2594
for option in ("interface", "address", "port", "debug",
2393
"priority", "servicename", "configdir",
2394
"use_dbus", "use_ipv6", "debuglevel", "restore",
2395
"statedir", "socket", "foreground", "zeroconf"):
2595
"priority", "servicename", "configdir", "use_dbus",
2596
"use_ipv6", "debuglevel", "restore", "statedir",
2597
"socket", "foreground", "zeroconf"):
2396
2598
value = getattr(options, option)
2397
2599
if value is not None:
2398
2600
server_settings[option] = value
2413
2615
2414
2616
##################################################################
2415
2617
2416
if (not server_settings["zeroconf"] and
2417
not (server_settings["port"]
2418
or server_settings["socket"] != "")):
2419
parser.error("Needs port or socket to work without"
2420
" Zeroconf")
2618
if (not server_settings["zeroconf"]
2619
and not (server_settings["port"]
2620
or server_settings["socket"] != "")):
2621
parser.error("Needs port or socket to work without Zeroconf")
2421
2622
2422
2623
# For convenience
2423
2624
debug = server_settings["debug"]
2439
2640
initlogger(debug, level)
2440
2641
2441
2642
if server_settings["servicename"] != "Mandos":
2442
syslogger.setFormatter(logging.Formatter
2443
('Mandos ({}) [%(process)d]:'
2444
' %(levelname)s: %(message)s'
2445
.format(server_settings
2446
["servicename"])))
2643
syslogger.setFormatter(
2644
logging.Formatter('Mandos ({}) [%(process)d]:'
2645
' %(levelname)s: %(message)s'.format(
2646
server_settings["servicename"])))
2447
2647
2448
2648
# Parse config file with clients
2449
2649
client_config = configparser.SafeConfigParser(Client
2457
2657
socketfd = None
2458
2658
if server_settings["socket"] != "":
2459
2659
socketfd = server_settings["socket"]
2460
tcp_server = MandosServer((server_settings["address"],
2461
server_settings["port"]),
2462
ClientHandler,
2463
interface=(server_settings["interface"]
2464
or None),
2465
use_ipv6=use_ipv6,
2466
gnutls_priority=
2467
server_settings["priority"],
2468
use_dbus=use_dbus,
2469
socketfd=socketfd)
2660
tcp_server = MandosServer(
2661
(server_settings["address"], server_settings["port"]),
2662
ClientHandler,
2663
interface=(server_settings["interface"] or None),
2664
use_ipv6=use_ipv6,
2665
gnutls_priority=server_settings["priority"],
2666
use_dbus=use_dbus,
2667
socketfd=socketfd)
2470
2668
if not foreground:
2471
2669
pidfilename = "/run/mandos.pid"
2472
2670
if not os.path.isdir("/run/."):
2473
2671
pidfilename = "/var/run/mandos.pid"
2474
2672
pidfile = None
2475
2673
try:
2476
pidfile = open(pidfilename, "w")
2674
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2477
2675
except IOError as e:
2478
2676
logger.error("Could not open file %r", pidfilename,
2479
2677
exc_info=e)
2506
2704
def debug_gnutls(level, string):
2507
2705
logger.debug("GnuTLS: %s", string[:-1])
2508
2706
2509
(gnutls.library.functions
2510
.gnutls_global_set_log_function(debug_gnutls))
2707
gnutls.library.functions.gnutls_global_set_log_function(
2708
debug_gnutls)
2511
2709
2512
2710
# Redirect stdin so all checkers get /dev/null
2513
2711
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2533
2731
if use_dbus:
2534
2732
try:
2535
2733
bus_name = dbus.service.BusName("se.recompile.Mandos",
2536
bus, do_not_queue=True)
2537
old_bus_name = (dbus.service.BusName
2538
("se.bsnet.fukt.Mandos", bus,
2539
do_not_queue=True))
2540
except dbus.exceptions.NameExistsException as e:
2734
bus,
2735
do_not_queue=True)
2736
old_bus_name = dbus.service.BusName(
2737
"se.bsnet.fukt.Mandos", bus,
2738
do_not_queue=True)
2739
except dbus.exceptions.DBusException as e:
2541
2740
logger.error("Disabling D-Bus:", exc_info=e)
2542
2741
use_dbus = False
2543
2742
server_settings["use_dbus"] = False
2544
2743
tcp_server.use_dbus = False
2545
2744
if zeroconf:
2546
2745
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2547
service = AvahiServiceToSyslog(name =
2548
server_settings["servicename"],
2549
servicetype = "_mandos._tcp",
2550
protocol = protocol, bus = bus)
2746
service = AvahiServiceToSyslog(
2747
name = server_settings["servicename"],
2748
servicetype = "_mandos._tcp",
2749
protocol = protocol,
2750
bus = bus)
2551
2751
if server_settings["interface"]:
2552
service.interface = (if_nametoindex
2553
(server_settings["interface"]
2554
.encode("utf-8")))
2752
service.interface = if_nametoindex(
2753
server_settings["interface"].encode("utf-8"))
2555
2754
2556
2755
global multiprocessing_manager
2557
2756
multiprocessing_manager = multiprocessing.Manager()
2576
2775
if server_settings["restore"]:
2577
2776
try:
2578
2777
with open(stored_state_path, "rb") as stored_state:
2579
clients_data, old_client_settings = (pickle.load
2580
(stored_state))
2778
clients_data, old_client_settings = pickle.load(
2779
stored_state)
2581
2780
os.remove(stored_state_path)
2582
2781
except IOError as e:
2583
2782
if e.errno == errno.ENOENT:
2584
logger.warning("Could not load persistent state: {}"
2585
.format(os.strerror(e.errno)))
2783
logger.warning("Could not load persistent state:"
2784
" {}".format(os.strerror(e.errno)))
2586
2785
else:
2587
2786
logger.critical("Could not load persistent state:",
2588
2787
exc_info=e)
2589
2788
raise
2590
2789
except EOFError as e:
2591
2790
logger.warning("Could not load persistent state: "
2592
"EOFError:", exc_info=e)
2791
"EOFError:",
2792
exc_info=e)
2593
2793
2594
2794
with PGPEngine() as pgp:
2595
2795
for client_name, client in clients_data.items():
2607
2807
# For each value in new config, check if it
2608
2808
# differs from the old config value (Except for
2609
2809
# the "secret" attribute)
2610
if (name != "secret" and
2611
value != old_client_settings[client_name]
2612
[name]):
2810
if (name != "secret"
2811
and (value !=
2812
old_client_settings[client_name][name])):
2613
2813
client[name] = value
2614
2814
except KeyError:
2615
2815
pass
2616
2816
2617
2817
# Clients who has passed its expire date can still be
2618
# enabled if its last checker was successful. Clients
2818
# enabled if its last checker was successful. A Client
2619
2819
# whose checker succeeded before we stored its state is
2620
2820
# assumed to have successfully run all checkers during
2621
2821
# downtime.
2624
2824
if not client["last_checked_ok"]:
2625
2825
logger.warning(
2626
2826
"disabling client {} - Client never "
2627
"performed a successful checker"
2628
.format(client_name))
2827
"performed a successful checker".format(
2828
client_name))
2629
2829
client["enabled"] = False
2630
2830
elif client["last_checker_status"] != 0:
2631
2831
logger.warning(
2632
2832
"disabling client {} - Client last"
2633
" checker failed with error code {}"
2634
.format(client_name,
2635
client["last_checker_status"]))
2833
" checker failed with error code"
2834
" {}".format(
2835
client_name,
2836
client["last_checker_status"]))
2636
2837
client["enabled"] = False
2637
2838
else:
2638
client["expires"] = (datetime.datetime
2639
.utcnow()
2640
+ client["timeout"])
2839
client["expires"] = (
2840
datetime.datetime.utcnow()
2841
+ client["timeout"])
2641
2842
logger.debug("Last checker succeeded,"
2642
" keeping {} enabled"
2643
.format(client_name))
2843
" keeping {} enabled".format(
2844
client_name))
2644
2845
try:
2645
client["secret"] = (
2646
pgp.decrypt(client["encrypted_secret"],
2647
client_settings[client_name]
2648
["secret"]))
2846
client["secret"] = pgp.decrypt(
2847
client["encrypted_secret"],
2848
client_settings[client_name]["secret"])
2649
2849
except PGPError:
2650
2850
# If decryption fails, we use secret from new settings
2651
logger.debug("Failed to decrypt {} old secret"
2652
.format(client_name))
2653
client["secret"] = (
2654
client_settings[client_name]["secret"])
2851
logger.debug("Failed to decrypt {} old secret".format(
2852
client_name))
2853
client["secret"] = (client_settings[client_name]
2854
["secret"])
2655
2855
2656
2856
# Add/remove clients based on new changes made to config
2657
2857
for client_name in (set(old_client_settings)
2664
2864
# Create all client objects
2665
2865
for client_name, client in clients_data.items():
2666
2866
tcp_server.clients[client_name] = client_class(
2667
name = client_name, settings = client,
2867
name = client_name,
2868
settings = client,
2668
2869
server_settings = server_settings)
2669
2870
2670
2871
if not tcp_server.clients:
2672
2873
2673
2874
if not foreground:
2674
2875
if pidfile is not None:
2876
pid = os.getpid()
2675
2877
try:
2676
2878
with pidfile:
2677
pid = os.getpid()
2678
pidfile.write("{}\n".format(pid).encode("utf-8"))
2879
print(pid, file=pidfile)
2679
2880
except IOError:
2680
2881
logger.error("Could not write to file %r with PID %d",
2681
2882
pidfilename, pid)
2686
2887
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2687
2888
2688
2889
if use_dbus:
2689
@alternate_dbus_interfaces({"se.recompile.Mandos":
2690
"se.bsnet.fukt.Mandos"})
2691
class MandosDBusService(DBusObjectWithProperties):
2890
2891
@alternate_dbus_interfaces(
2892
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2893
class MandosDBusService(DBusObjectWithObjectManager):
2692
2894
"""A D-Bus proxy object"""
2895
2693
2896
def __init__(self):
2694
2897
dbus.service.Object.__init__(self, bus, "/")
2898
2695
2899
_interface = "se.recompile.Mandos"
2696
2900
2697
@dbus_interface_annotations(_interface)
2698
def _foo(self):
2699
return { "org.freedesktop.DBus.Property"
2700
".EmitsChangedSignal":
2701
"false"}
2702
2703
2901
@dbus.service.signal(_interface, signature="o")
2704
2902
def ClientAdded(self, objpath):
2705
2903
"D-Bus signal"
2710
2908
"D-Bus signal"
2711
2909
pass
2712
2910
2911
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2912
"true"})
2713
2913
@dbus.service.signal(_interface, signature="os")
2714
2914
def ClientRemoved(self, objpath, name):
2715
2915
"D-Bus signal"
2716
2916
pass
2717
2917
2918
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2919
"true"})
2718
2920
@dbus.service.method(_interface, out_signature="ao")
2719
2921
def GetAllClients(self):
2720
2922
"D-Bus method"
2721
return dbus.Array(c.dbus_object_path
2722
for c in
2923
return dbus.Array(c.dbus_object_path for c in
2723
2924
tcp_server.clients.itervalues())
2724
2925
2926
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2927
"true"})
2725
2928
@dbus.service.method(_interface,
2726
2929
out_signature="a{oa{sv}}")
2727
2930
def GetAllClientsWithProperties(self):
2728
2931
"D-Bus method"
2729
2932
return dbus.Dictionary(
2730
{ c.dbus_object_path: c.GetAll("")
2933
{ c.dbus_object_path: c.GetAll(
2934
"se.recompile.Mandos.Client")
2731
2935
for c in tcp_server.clients.itervalues() },
2732
2936
signature="oa{sv}")
2733
2937
2738
2942
if c.dbus_object_path == object_path:
2739
2943
del tcp_server.clients[c.name]
2740
2944
c.remove_from_connection()
2741
# Don't signal anything except ClientRemoved
2945
# Don't signal the disabling
2742
2946
c.disable(quiet=True)
2743
# Emit D-Bus signal
2744
self.ClientRemoved(object_path, c.name)
2947
# Emit D-Bus signal for removal
2948
self.client_removed_signal(c)
2745
2949
return
2746
2950
raise KeyError(object_path)
2747
2951
2748
2952
del _interface
2953
2954
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
2955
out_signature = "a{oa{sa{sv}}}")
2956
def GetManagedObjects(self):
2957
"""D-Bus method"""
2958
return dbus.Dictionary(
2959
{ client.dbus_object_path:
2960
dbus.Dictionary(
2961
{ interface: client.GetAll(interface)
2962
for interface in
2963
client._get_all_interface_names()})
2964
for client in tcp_server.clients.values()})
2965
2966
def client_added_signal(self, client):
2967
"""Send the new standard signal and the old signal"""
2968
if use_dbus:
2969
# New standard signal
2970
self.InterfacesAdded(
2971
client.dbus_object_path,
2972
dbus.Dictionary(
2973
{ interface: client.GetAll(interface)
2974
for interface in
2975
client._get_all_interface_names()}))
2976
# Old signal
2977
self.ClientAdded(client.dbus_object_path)
2978
2979
def client_removed_signal(self, client):
2980
"""Send the new standard signal and the old signal"""
2981
if use_dbus:
2982
# New standard signal
2983
self.InterfacesRemoved(
2984
client.dbus_object_path,
2985
client._get_all_interface_names())
2986
# Old signal
2987
self.ClientRemoved(client.dbus_object_path,
2988
client.name)
2749
2989
2750
2990
mandos_dbus_service = MandosDBusService()
2751
2991
2774
3014
# + secret.
2775
3015
exclude = { "bus", "changedstate", "secret",
2776
3016
"checker", "server_settings" }
2777
for name, typ in (inspect.getmembers
2778
(dbus.service.Object)):
3017
for name, typ in inspect.getmembers(dbus.service
3018
.Object):
2779
3019
exclude.add(name)
2780
3020
2781
3021
client_dict["encrypted_secret"] = (client
2788
3028
del client_settings[client.name]["secret"]
2789
3029
2790
3030
try:
2791
with (tempfile.NamedTemporaryFile
2792
(mode='wb', suffix=".pickle", prefix='clients-',
2793
dir=os.path.dirname(stored_state_path),
2794
delete=False)) as stored_state:
3031
with tempfile.NamedTemporaryFile(
3032
mode='wb',
3033
suffix=".pickle",
3034
prefix='clients-',
3035
dir=os.path.dirname(stored_state_path),
3036
delete=False) as stored_state:
2795
3037
pickle.dump((clients, client_settings), stored_state)
2796
tempname=stored_state.name
3038
tempname = stored_state.name
2797
3039
os.rename(tempname, stored_state_path)
2798
3040
except (IOError, OSError) as e:
2799
3041
if not debug:
2814
3056
name, client = tcp_server.clients.popitem()
2815
3057
if use_dbus:
2816
3058
client.remove_from_connection()
2817
# Don't signal anything except ClientRemoved
3059
# Don't signal the disabling
2818
3060
client.disable(quiet=True)
2819
if use_dbus:
2820
# Emit D-Bus signal
2821
mandos_dbus_service.ClientRemoved(client
2822
.dbus_object_path,
2823
client.name)
3061
# Emit D-Bus signal for removal
3062
mandos_dbus_service.client_removed_signal(client)
2824
3063
client_settings.clear()
2825
3064
2826
3065
atexit.register(cleanup)
2827
3066
2828
3067
for client in tcp_server.clients.itervalues():
2829
3068
if use_dbus:
2830
# Emit D-Bus signal
2831
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3069
# Emit D-Bus signal for adding
3070
mandos_dbus_service.client_added_signal(client)
2832
3071
# Need to initiate checking of clients
2833
3072
if client.enabled:
2834
3073
client.init_checker()
2879
3118
# Must run before the D-Bus bus name gets deregistered
2880
3119
cleanup()
2881
3120
3121
2882
3122
if __name__ == '__main__':
2883
3123
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0