/mandos/release : revision 237.7.349

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

43

46

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

import cPickle as pickle

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

66

69

import multiprocessing

67

70

import types

68

71

import binascii

69

72

import tempfile

70

73

import itertools

71

74

import collections

75

import codecs

72

76

73

77

import dbus

74

78

import dbus.service

75

import gobject

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

76

83

import avahi

77

84

from dbus.mainloop.glib import DBusGMainLoop

78

85

import ctypes

91

98

if sys.version_info.major == 2:

92

99

str = unicode

93

100

94

version = "1.6.9"

101

version = "1.7.1"

95

102

stored_state_file = "clients.pickle"

96

103

97

104

logger = logging.getLogger()

98

105

syslogger = None

99

106

100

107

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

104

110

except (OSError, AttributeError):

111

105

112

def if_nametoindex(interface):

106

113

"Get an interface index the hard way, i.e. using fcntl()"

107

114

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

116

123

"""init logger and add loglevel"""

117

124

118

125

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

123

129

syslogger.setFormatter(logging.Formatter

124

130

('Mandos [%(process)d]: %(levelname)s:'

125

131

' %(message)s'))

142

148

143

149

class PGPEngine(object):

144

150

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

145

152

def __init__(self):

146

153

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

154

self.gnupgargs = ['--batch',

186

193

187

194

def encrypt(self, data, password):

188

195

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

196

with tempfile.NamedTemporaryFile(

197

dir=self.tempdir) as passfile:

191

198

passfile.write(passphrase)

192

199

passfile.flush()

193

200

proc = subprocess.Popen(['gpg', '--symmetric',

204

211

205

212

def decrypt(self, data, password):

206

213

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

214

with tempfile.NamedTemporaryFile(

215

dir = self.tempdir) as passfile:

209

216

passfile.write(passphrase)

210

217

passfile.flush()

211

218

proc = subprocess.Popen(['gpg', '--decrypt',

215

222

stdin = subprocess.PIPE,

216

223

stdout = subprocess.PIPE,

217

224

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

225

decrypted_plaintext, err = proc.communicate(input = data)

220

226

if proc.returncode != 0:

221

227

raise PGPError(err)

222

228

return decrypted_plaintext

228

234

return super(AvahiError, self).__init__(value, *args,

229

235

**kwargs)

230

236

237

231

238

class AvahiServiceError(AvahiError):

232

239

pass

233

240

241

234

242

class AvahiGroupError(AvahiError):

235

243

pass

236

244

256

264

bus: dbus.SystemBus()

257

265

"""

258

266

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

267

def __init__(self,

268

interface = avahi.IF_UNSPEC,

269

name = None,

270

servicetype = None,

271

port = None,

272

TXT = None,

273

domain = "",

274

host = "",

275

max_renames = 32768,

276

protocol = avahi.PROTO_UNSPEC,

277

bus = None):

263

278

self.interface = interface

264

279

self.name = name

265

280

self.type = servicetype

282

297

" after %i retries, exiting.",

283

298

self.rename_count)

284

299

raise AvahiServiceError("Too many renames")

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

300

self.name = str(

301

self.server.GetAlternativeServiceName(self.name))

287

302

self.rename_count += 1

288

303

logger.info("Changing Zeroconf service name to %r ...",

289

304

self.name)

344

359

elif state == avahi.ENTRY_GROUP_FAILURE:

345

360

logger.critical("Avahi: Error in group state changed %s",

346

361

str(error))

347

raise AvahiGroupError("State changed: {!s}"

348

.format(error))

362

raise AvahiGroupError("State changed: {!s}".format(error))

349

363

350

364

def cleanup(self):

351

365

"""Derived from the Avahi example code"""

361

375

def server_state_changed(self, state, error=None):

362

376

"""Derived from the Avahi example code"""

363

377

logger.debug("Avahi server state change: %i", state)

364

bad_states = { avahi.SERVER_INVALID:

365

"Zeroconf server invalid",

366

avahi.SERVER_REGISTERING: None,

367

avahi.SERVER_COLLISION:

368

"Zeroconf server name collision",

369

avahi.SERVER_FAILURE:

370

"Zeroconf server failure" }

378

bad_states = {

379

avahi.SERVER_INVALID: "Zeroconf server invalid",

380

avahi.SERVER_REGISTERING: None,

381

avahi.SERVER_COLLISION: "Zeroconf server name collision",

382

avahi.SERVER_FAILURE: "Zeroconf server failure",

383

}

371

384

if state in bad_states:

372

385

if bad_states[state] is not None:

373

386

if error is None:

376

389

logger.error(bad_states[state] + ": %r", error)

377

390

self.cleanup()

378

391

elif state == avahi.SERVER_RUNNING:

379

self.add()

392

try:

393

self.add()

394

except dbus.exceptions.DBusException as error:

395

if (error.get_dbus_name()

396

== "org.freedesktop.Avahi.CollisionError"):

397

logger.info("Local Zeroconf service name"

398

" collision.")

399

return self.rename(remove=False)

400

else:

401

logger.critical("D-Bus Exception", exc_info=error)

402

self.cleanup()

403

os._exit(1)

380

404

else:

381

405

if error is None:

382

406

logger.debug("Unknown state: %r", state)

392

416

follow_name_owner_changes=True),

393

417

avahi.DBUS_INTERFACE_SERVER)

394

418

self.server.connect_to_signal("StateChanged",

395

self.server_state_changed)

419

self.server_state_changed)

396

420

self.server_state_changed(self.server.GetState())

397

421

398

422

400

424

def rename(self, *args, **kwargs):

401

425

"""Add the new name to the syslog messages"""

402

426

ret = AvahiService.rename(self, *args, **kwargs)

403

syslogger.setFormatter(logging.Formatter

404

('Mandos ({}) [%(process)d]:'

405

' %(levelname)s: %(message)s'

406

.format(self.name)))

427

syslogger.setFormatter(logging.Formatter(

428

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

429

.format(self.name)))

407

430

return ret

408

431

432

# Pretend that we have a GnuTLS module

433

class GnuTLS(object):

434

"""This isn't so much a class as it is a module-like namespace.

435

It is instantiated once, and simulates having a GnuTLS module."""

436

437

_library = ctypes.cdll.LoadLibrary(

438

ctypes.util.find_library("gnutls"))

439

_need_version = "3.3.0"

440

def __init__(self):

441

# Need to use class name "GnuTLS" here, since this method is

442

# called before the assignment to the "gnutls" global variable

443

# happens.

444

if GnuTLS.check_version(self._need_version) is None:

445

raise GnuTLS.Error("Needs GnuTLS {} or later"

446

.format(self._need_version))

447

448

# Unless otherwise indicated, the constants and types below are

449

# all from the gnutls/gnutls.h C header file.

450

451

# Constants

452

E_SUCCESS = 0

453

CRT_OPENPGP = 2

454

CLIENT = 2

455

SHUT_RDWR = 0

456

CRD_CERTIFICATE = 1

457

E_NO_CERTIFICATE_FOUND = -49

458

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

459

460

# Types

461

class session_int(ctypes.Structure):

462

_fields_ = []

463

session_t = ctypes.POINTER(session_int)

464

class certificate_credentials_st(ctypes.Structure):

465

_fields_ = []

466

certificate_credentials_t = ctypes.POINTER(

467

certificate_credentials_st)

468

certificate_type_t = ctypes.c_int

469

class datum_t(ctypes.Structure):

470

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

471

('size', ctypes.c_uint)]

472

class openpgp_crt_int(ctypes.Structure):

473

_fields_ = []

474

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

475

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

476

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

477

credentials_type_t = ctypes.c_int #

478

transport_ptr_t = ctypes.c_void_p

479

close_request_t = ctypes.c_int

480

481

# Exceptions

482

class Error(Exception):

483

# We need to use the class name "GnuTLS" here, since this

484

# exception might be raised from within GnuTLS.__init__,

485

# which is called before the assignment to the "gnutls"

486

# global variable happens.

487

def __init__(self, message = None, code = None, args=()):

488

# Default usage is by a message string, but if a return

489

# code is passed, convert it to a string with

490

# gnutls.strerror()

491

if message is None and code is not None:

492

message = GnuTLS.strerror(code)

493

return super(GnuTLS.Error, self).__init__(

494

message, *args)

495

496

class CertificateSecurityError(Error):

497

pass

498

499

# Classes

500

class Credentials(object):

501

def __init__(self):

502

self._c_object = gnutls.certificate_credentials_t()

503

gnutls.certificate_allocate_credentials(

504

ctypes.byref(self._c_object))

505

self.type = gnutls.CRD_CERTIFICATE

506

507

def __del__(self):

508

gnutls.certificate_free_credentials(self._c_object)

509

510

class ClientSession(object):

511

def __init__(self, socket, credentials = None):

512

self._c_object = gnutls.session_t()

513

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

514

gnutls.set_default_priority(self._c_object)

515

gnutls.transport_set_ptr(self._c_object, socket.fileno())

516

gnutls.handshake_set_private_extensions(self._c_object,

517

True)

518

self.socket = socket

519

if credentials is None:

520

credentials = gnutls.Credentials()

521

gnutls.credentials_set(self._c_object, credentials.type,

522

ctypes.cast(credentials._c_object,

523

ctypes.c_void_p))

524

self.credentials = credentials

525

526

def __del__(self):

527

gnutls.deinit(self._c_object)

528

529

def handshake(self):

530

return gnutls.handshake(self._c_object)

531

532

def send(self, data):

533

data = bytes(data)

534

if not data:

535

return 0

536

return gnutls.record_send(self._c_object, data, len(data))

537

538

def bye(self):

539

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

540

541

# Error handling function

542

def _error_code(result):

543

"""A function to raise exceptions on errors, suitable

544

for the 'restype' attribute on ctypes functions"""

545

if result >= 0:

546

return result

547

if result == gnutls.E_NO_CERTIFICATE_FOUND:

548

raise gnutls.CertificateSecurityError(code = result)

549

raise gnutls.Error(code = result)

550

551

# Unless otherwise indicated, the function declarations below are

552

# all from the gnutls/gnutls.h C header file.

553

554

# Functions

555

priority_set_direct = _library.gnutls_priority_set_direct

556

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

557

ctypes.POINTER(ctypes.c_char_p)]

558

priority_set_direct.restype = _error_code

559

560

init = _library.gnutls_init

561

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

562

init.restype = _error_code

563

564

set_default_priority = _library.gnutls_set_default_priority

565

set_default_priority.argtypes = [session_t]

566

set_default_priority.restype = _error_code

567

568

record_send = _library.gnutls_record_send

569

record_send.argtypes = [session_t, ctypes.c_void_p,

570

ctypes.c_size_t]

571

record_send.restype = ctypes.c_ssize_t

572

573

certificate_allocate_credentials = (

574

_library.gnutls_certificate_allocate_credentials)

575

certificate_allocate_credentials.argtypes = [

576

ctypes.POINTER(certificate_credentials_t)]

577

certificate_allocate_credentials.restype = _error_code

578

579

certificate_free_credentials = (

580

_library.gnutls_certificate_free_credentials)

581

certificate_free_credentials.argtypes = [certificate_credentials_t]

582

certificate_free_credentials.restype = None

583

584

handshake_set_private_extensions = (

585

_library.gnutls_handshake_set_private_extensions)

586

handshake_set_private_extensions.argtypes = [session_t,

587

ctypes.c_int]

588

handshake_set_private_extensions.restype = None

589

590

credentials_set = _library.gnutls_credentials_set

591

credentials_set.argtypes = [session_t, credentials_type_t,

592

ctypes.c_void_p]

593

credentials_set.restype = _error_code

594

595

strerror = _library.gnutls_strerror

596

strerror.argtypes = [ctypes.c_int]

597

strerror.restype = ctypes.c_char_p

598

599

certificate_type_get = _library.gnutls_certificate_type_get

600

certificate_type_get.argtypes = [session_t]

601

certificate_type_get.restype = _error_code

602

603

certificate_get_peers = _library.gnutls_certificate_get_peers

604

certificate_get_peers.argtypes = [session_t,

605

ctypes.POINTER(ctypes.c_uint)]

606

certificate_get_peers.restype = ctypes.POINTER(datum_t)

607

608

global_set_log_level = _library.gnutls_global_set_log_level

609

global_set_log_level.argtypes = [ctypes.c_int]

610

global_set_log_level.restype = None

611

612

global_set_log_function = _library.gnutls_global_set_log_function

613

global_set_log_function.argtypes = [log_func]

614

global_set_log_function.restype = None

615

616

deinit = _library.gnutls_deinit

617

deinit.argtypes = [session_t]

618

deinit.restype = None

619

620

handshake = _library.gnutls_handshake

621

handshake.argtypes = [session_t]

622

handshake.restype = _error_code

623

624

transport_set_ptr = _library.gnutls_transport_set_ptr

625

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

626

transport_set_ptr.restype = None

627

628

bye = _library.gnutls_bye

629

bye.argtypes = [session_t, close_request_t]

630

bye.restype = _error_code

631

632

check_version = _library.gnutls_check_version

633

check_version.argtypes = [ctypes.c_char_p]

634

check_version.restype = ctypes.c_char_p

635

636

# All the function declarations below are from gnutls/openpgp.h

637

638

openpgp_crt_init = _library.gnutls_openpgp_crt_init

639

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

640

openpgp_crt_init.restype = _error_code

641

642

openpgp_crt_import = _library.gnutls_openpgp_crt_import

643

openpgp_crt_import.argtypes = [openpgp_crt_t,

644

ctypes.POINTER(datum_t),

645

openpgp_crt_fmt_t]

646

openpgp_crt_import.restype = _error_code

647

648

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

649

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

650

ctypes.POINTER(ctypes.c_uint)]

651

openpgp_crt_verify_self.restype = _error_code

652

653

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

654

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

655

openpgp_crt_deinit.restype = None

656

657

openpgp_crt_get_fingerprint = (

658

_library.gnutls_openpgp_crt_get_fingerprint)

659

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

660

ctypes.c_void_p,

661

ctypes.POINTER(

662

ctypes.c_size_t)]

663

openpgp_crt_get_fingerprint.restype = _error_code

664

665

# Remove non-public function

666

del _error_code

667

# Create the global "gnutls" object, simulating a module

668

gnutls = GnuTLS()

669

670

def call_pipe(connection, # : multiprocessing.Connection

671

func, *args, **kwargs):

672

"""This function is meant to be called by multiprocessing.Process

673

674

This function runs func(*args, **kwargs), and writes the resulting

675

return value on the provided multiprocessing.Connection.

676

"""

677

connection.send(func(*args, **kwargs))

678

connection.close()

409

679

410

680

class Client(object):

411

681

"""A representation of a client host served by this server.

438

708

last_checker_status: integer between 0 and 255 reflecting exit

439

709

status of last checker. -1 reflects crashed

440

710

checker, -2 means no checker completed yet.

711

last_checker_signal: The signal which killed the last checker, if

712

last_checker_status is -1

441

713

last_enabled: datetime.datetime(); (UTC) or None

442

714

name: string; from the config file, used in log messages and

443

715

D-Bus identifiers

456

728

"fingerprint", "host", "interval",

457

729

"last_approval_request", "last_checked_ok",

458

730

"last_enabled", "name", "timeout")

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

731

client_defaults = {

732

"timeout": "PT5M",

733

"extended_timeout": "PT15M",

734

"interval": "PT2M",

735

"checker": "fping -q -- %%(host)s",

736

"host": "",

737

"approval_delay": "PT0S",

738

"approval_duration": "PT1S",

739

"approved_by_default": "True",

740

"enabled": "True",

741

}

469

742

470

743

@staticmethod

471

744

def config_parser(config):

487

760

client["enabled"] = config.getboolean(client_name,

488

761

"enabled")

489

762

763

# Uppercase and remove spaces from fingerprint for later

764

# comparison purposes with return value from the

765

# fingerprint() function

490

766

client["fingerprint"] = (section["fingerprint"].upper()

491

767

.replace(" ", ""))

492

768

if "secret" in section:

534

810

self.expires = None

535

811

536

812

logger.debug("Creating client %r", self.name)

537

# Uppercase and remove spaces from fingerprint for later

538

# comparison purposes with return value from the fingerprint()

539

# function

540

813

logger.debug(" Fingerprint: %s", self.fingerprint)

541

814

self.created = settings.get("created",

542

815

datetime.datetime.utcnow())

549

822

self.current_checker_command = None

550

823

self.approved = None

551

824

self.approvals_pending = 0

552

self.changedstate = (multiprocessing_manager

553

.Condition(multiprocessing_manager

554

.Lock()))

555

self.client_structure = [attr for attr in

556

self.__dict__.iterkeys()

825

self.changedstate = multiprocessing_manager.Condition(

826

multiprocessing_manager.Lock())

827

self.client_structure = [attr

828

for attr in self.__dict__.iterkeys()

557

829

if not attr.startswith("_")]

558

830

self.client_structure.append("client_structure")

559

831

560

for name, t in inspect.getmembers(type(self),

561

lambda obj:

562

isinstance(obj,

563

property)):

832

for name, t in inspect.getmembers(

833

type(self), lambda obj: isinstance(obj, property)):

564

834

if not name.startswith("_"):

565

835

self.client_structure.append(name)

566

836

608

878

# and every interval from then on.

609

879

if self.checker_initiator_tag is not None:

610

880

gobject.source_remove(self.checker_initiator_tag)

611

self.checker_initiator_tag = (gobject.timeout_add

612

(int(self.interval

613

.total_seconds() * 1000),

614

self.start_checker))

881

self.checker_initiator_tag = gobject.timeout_add(

882

int(self.interval.total_seconds() * 1000),

883

self.start_checker)

615

884

# Schedule a disable() when 'timeout' has passed

616

885

if self.disable_initiator_tag is not None:

617

886

gobject.source_remove(self.disable_initiator_tag)

618

self.disable_initiator_tag = (gobject.timeout_add

619

(int(self.timeout

620

.total_seconds() * 1000),

621

self.disable))

887

self.disable_initiator_tag = gobject.timeout_add(

888

int(self.timeout.total_seconds() * 1000), self.disable)

622

889

# Also start a new checker *right now*.

623

890

self.start_checker()

624

891

625

def checker_callback(self, pid, condition, command):

892

def checker_callback(self, source, condition, connection,

893

command):

626

894

"""The checker has completed, so take appropriate actions."""

627

895

self.checker_callback_tag = None

628

896

self.checker = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

897

# Read return code from connection (see call_pipe)

898

returncode = connection.recv()

899

connection.close()

900

901

if returncode >= 0:

902

self.last_checker_status = returncode

903

self.last_checker_signal = None

631

904

if self.last_checker_status == 0:

632

905

logger.info("Checker for %(name)s succeeded",

633

906

vars(self))

634

907

self.checked_ok()

635

908

else:

636

logger.info("Checker for %(name)s failed",

637

vars(self))

909

logger.info("Checker for %(name)s failed", vars(self))

638

910

else:

639

911

self.last_checker_status = -1

912

self.last_checker_signal = -returncode

640

913

logger.warning("Checker for %(name)s crashed?",

641

914

vars(self))

915

return False

642

916

643

917

def checked_ok(self):

644

918

"""Assert that the client has been seen, alive and well."""

645

919

self.last_checked_ok = datetime.datetime.utcnow()

646

920

self.last_checker_status = 0

921

self.last_checker_signal = None

647

922

self.bump_timeout()

648

923

649

924

def bump_timeout(self, timeout=None):

654

929

gobject.source_remove(self.disable_initiator_tag)

655

930

self.disable_initiator_tag = None

656

931

if getattr(self, "enabled", False):

657

self.disable_initiator_tag = (gobject.timeout_add

658

(int(timeout.total_seconds()

659

* 1000), self.disable))

932

self.disable_initiator_tag = gobject.timeout_add(

933

int(timeout.total_seconds() * 1000), self.disable)

660

934

self.expires = datetime.datetime.utcnow() + timeout

661

935

662

936

def need_approval(self):

676

950

# than 'timeout' for the client to be disabled, which is as it

677

951

# should be.

678

952

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except AttributeError:

683

pass

684

except OSError as error:

685

if error.errno != errno.ECHILD:

686

raise

687

else:

688

if pid:

689

logger.warning("Checker was a zombie")

690

gobject.source_remove(self.checker_callback_tag)

691

self.checker_callback(pid, status,

692

self.current_checker_command)

953

if self.checker is not None and not self.checker.is_alive():

954

logger.warning("Checker was not alive; joining")

955

self.checker.join()

956

self.checker = None

693

957

# Start a new checker if needed

694

958

if self.checker is None:

695

959

# Escape attributes for the shell

696

escaped_attrs = { attr:

697

re.escape(str(getattr(self, attr)))

698

for attr in self.runtime_expansions }

960

escaped_attrs = {

961

attr: re.escape(str(getattr(self, attr)))

962

for attr in self.runtime_expansions }

699

963

try:

700

964

command = self.checker_command % escaped_attrs

701

965

except TypeError as error:

702

966

logger.error('Could not format string "%s"',

703

self.checker_command, exc_info=error)

704

return True # Try again later

967

self.checker_command,

968

exc_info=error)

969

return True # Try again later

705

970

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

# The exception is when not debugging but nevertheless

714

# running in the foreground; use the previously

715

# created wnull.

716

popen_args = {}

717

if (not self.server_settings["debug"]

718

and self.server_settings["foreground"]):

719

popen_args.update({"stdout": wnull,

720

"stderr": wnull })

721

self.checker = subprocess.Popen(command,

722

close_fds=True,

723

shell=True, cwd="/",

724

**popen_args)

725

except OSError as error:

726

logger.error("Failed to start subprocess",

727

exc_info=error)

728

return True

729

self.checker_callback_tag = (gobject.child_watch_add

730

(self.checker.pid,

731

self.checker_callback,

732

data=command))

733

# The checker may have completed before the gobject

734

# watch was added. Check for this.

735

try:

736

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

737

except OSError as error:

738

if error.errno == errno.ECHILD:

739

# This should never happen

740

logger.error("Child process vanished",

741

exc_info=error)

742

return True

743

raise

744

if pid:

745

gobject.source_remove(self.checker_callback_tag)

746

self.checker_callback(pid, status, command)

971

logger.info("Starting checker %r for %s", command,

972

self.name)

973

# We don't need to redirect stdout and stderr, since

974

# in normal mode, that is already done by daemon(),

975

# and in debug mode we don't want to. (Stdin is

976

# always replaced by /dev/null.)

977

# The exception is when not debugging but nevertheless

978

# running in the foreground; use the previously

979

# created wnull.

980

popen_args = { "close_fds": True,

981

"shell": True,

982

"cwd": "/" }

983

if (not self.server_settings["debug"]

984

and self.server_settings["foreground"]):

985

popen_args.update({"stdout": wnull,

986

"stderr": wnull })

987

pipe = multiprocessing.Pipe(duplex = False)

988

self.checker = multiprocessing.Process(

989

target = call_pipe,

990

args = (pipe[1], subprocess.call, command),

991

kwargs = popen_args)

992

self.checker.start()

993

self.checker_callback_tag = gobject.io_add_watch(

994

pipe[0].fileno(), gobject.IO_IN,

995

self.checker_callback, pipe[0], command)

747

996

# Re-run this periodically if run by gobject.timeout_add

748

997

return True

749

998

755

1004

if getattr(self, "checker", None) is None:

756

1005

return

757

1006

logger.debug("Stopping checker for %(name)s", vars(self))

758

try:

759

self.checker.terminate()

760

#time.sleep(0.5)

761

#if self.checker.poll() is None:

762

# self.checker.kill()

763

except OSError as error:

764

if error.errno != errno.ESRCH: # No such process

765

raise

1007

self.checker.terminate()

766

1008

self.checker = None

767

1009

768

1010

769

def dbus_service_property(dbus_interface, signature="v",

770

access="readwrite", byte_arrays=False):

1011

def dbus_service_property(dbus_interface,

1012

signature="v",

1013

access="readwrite",

1014

byte_arrays=False):

771

1015

"""Decorators for marking methods of a DBusObjectWithProperties to

772

1016

become properties on the D-Bus.

773

1017

783

1027

if byte_arrays and signature != "ay":

784

1028

raise ValueError("Byte arrays not supported for non-'ay'"

785

1029

" signature {!r}".format(signature))

1030

786

1031

def decorator(func):

787

1032

func._dbus_is_property = True

788

1033

func._dbus_interface = dbus_interface

793

1038

func._dbus_name = func._dbus_name[:-14]

794

1039

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

795

1040

return func

1041

796

1042

return decorator

797

1043

798

1044

807

1053

"org.freedesktop.DBus.Property.EmitsChangedSignal":

808

1054

"false"}

809

1055

"""

1056

810

1057

def decorator(func):

811

1058

func._dbus_is_interface = True

812

1059

func._dbus_interface = dbus_interface

813

1060

func._dbus_name = dbus_interface

814

1061

return func

1062

815

1063

return decorator

816

1064

817

1065

826

1074

access="r")

827

1075

def Property_dbus_property(self):

828

1076

return dbus.Boolean(False)

1077

1078

See also the DBusObjectWithAnnotations class.

829

1079

"""

1080

830

1081

def decorator(func):

831

1082

func._dbus_annotations = annotations

832

1083

return func

1084

833

1085

return decorator

834

1086

835

1087

838

1090

"""

839

1091

pass

840

1092

1093

841

1094

class DBusPropertyAccessException(DBusPropertyException):

842

1095

"""A property's access permissions disallows an operation.

843

1096

"""

850

1103

pass

851

1104

852

1105

853

class DBusObjectWithProperties(dbus.service.Object):

854

"""A D-Bus object with properties.

1106

class DBusObjectWithAnnotations(dbus.service.Object):

1107

"""A D-Bus object with annotations.

855

1108

856

Classes inheriting from this can use the dbus_service_property

857

decorator to expose methods as D-Bus properties. It exposes the

858

standard Get(), Set(), and GetAll() methods on the D-Bus.

1109

Classes inheriting from this can use the dbus_annotations

1110

decorator to add annotations to methods or signals.

859

1111

"""

860

1112

861

1113

@staticmethod

871

1123

def _get_all_dbus_things(self, thing):

872

1124

"""Returns a generator of (name, attribute) pairs

873

1125

"""

874

return ((getattr(athing.__get__(self), "_dbus_name",

875

name),

1126

return ((getattr(athing.__get__(self), "_dbus_name", name),

876

1127

athing.__get__(self))

877

1128

for cls in self.__class__.__mro__

878

1129

for name, athing in

879

inspect.getmembers(cls,

880

self._is_dbus_thing(thing)))

1130

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1131

1132

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1133

out_signature = "s",

1134

path_keyword = 'object_path',

1135

connection_keyword = 'connection')

1136

def Introspect(self, object_path, connection):

1137

"""Overloading of standard D-Bus method.

1138

1139

Inserts annotation tags on methods and signals.

1140

"""

1141

xmlstring = dbus.service.Object.Introspect(self, object_path,

1142

connection)

1143

try:

1144

document = xml.dom.minidom.parseString(xmlstring)

1145

1146

for if_tag in document.getElementsByTagName("interface"):

1147

# Add annotation tags

1148

for typ in ("method", "signal"):

1149

for tag in if_tag.getElementsByTagName(typ):

1150

annots = dict()

1151

for name, prop in (self.

1152

_get_all_dbus_things(typ)):

1153

if (name == tag.getAttribute("name")

1154

and prop._dbus_interface

1155

== if_tag.getAttribute("name")):

1156

annots.update(getattr(

1157

prop, "_dbus_annotations", {}))

1158

for name, value in annots.items():

1159

ann_tag = document.createElement(

1160

"annotation")

1161

ann_tag.setAttribute("name", name)

1162

ann_tag.setAttribute("value", value)

1163

tag.appendChild(ann_tag)

1164

# Add interface annotation tags

1165

for annotation, value in dict(

1166

itertools.chain.from_iterable(

1167

annotations().items()

1168

for name, annotations

1169

in self._get_all_dbus_things("interface")

1170

if name == if_tag.getAttribute("name")

1171

)).items():

1172

ann_tag = document.createElement("annotation")

1173

ann_tag.setAttribute("name", annotation)

1174

ann_tag.setAttribute("value", value)

1175

if_tag.appendChild(ann_tag)

1176

# Fix argument name for the Introspect method itself

1177

if (if_tag.getAttribute("name")

1178

== dbus.INTROSPECTABLE_IFACE):

1179

for cn in if_tag.getElementsByTagName("method"):

1180

if cn.getAttribute("name") == "Introspect":

1181

for arg in cn.getElementsByTagName("arg"):

1182

if (arg.getAttribute("direction")

1183

== "out"):

1184

arg.setAttribute("name",

1185

"xml_data")

1186

xmlstring = document.toxml("utf-8")

1187

document.unlink()

1188

except (AttributeError, xml.dom.DOMException,

1189

xml.parsers.expat.ExpatError) as error:

1190

logger.error("Failed to override Introspection method",

1191

exc_info=error)

1192

return xmlstring

1193

1194

1195

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1196

"""A D-Bus object with properties.

1197

1198

Classes inheriting from this can use the dbus_service_property

1199

decorator to expose methods as D-Bus properties. It exposes the

1200

standard Get(), Set(), and GetAll() methods on the D-Bus.

1201

"""

881

1202

882

1203

def _get_dbus_property(self, interface_name, property_name):

883

1204

"""Returns a bound method if one exists which is a D-Bus

884

1205

property with the specified name and interface.

885

1206

"""

886

for cls in self.__class__.__mro__:

887

for name, value in (inspect.getmembers

888

(cls,

889

self._is_dbus_thing("property"))):

1207

for cls in self.__class__.__mro__:

1208

for name, value in inspect.getmembers(

1209

cls, self._is_dbus_thing("property")):

890

1210

if (value._dbus_name == property_name

891

1211

and value._dbus_interface == interface_name):

892

1212

return value.__get__(self)

893

1213

894

1214

# No such property

895

raise DBusPropertyNotFound(self.dbus_object_path + ":"

896

+ interface_name + "."

897

+ property_name)

898

899

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1215

raise DBusPropertyNotFound("{}:{}.{}".format(

1216

self.dbus_object_path, interface_name, property_name))

1217

1218

@classmethod

1219

def _get_all_interface_names(cls):

1220

"""Get a sequence of all interfaces supported by an object"""

1221

return (name for name in set(getattr(getattr(x, attr),

1222

"_dbus_interface", None)

1223

for x in (inspect.getmro(cls))

1224

for attr in dir(x))

1225

if name is not None)

1226

1227

@dbus.service.method(dbus.PROPERTIES_IFACE,

1228

in_signature="ss",

900

1229

out_signature="v")

901

1230

def Get(self, interface_name, property_name):

902

1231

"""Standard D-Bus property Get() method, see D-Bus standard.

927

1256

for byte in value))

928

1257

prop(value)

929

1258

930

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1259

@dbus.service.method(dbus.PROPERTIES_IFACE,

1260

in_signature="s",

931

1261

out_signature="a{sv}")

932

1262

def GetAll(self, interface_name):

933

1263

"""Standard D-Bus property GetAll() method, see D-Bus

948

1278

if not hasattr(value, "variant_level"):

949

1279

properties[name] = value

950

1280

continue

951

properties[name] = type(value)(value, variant_level=

952

value.variant_level+1)

1281

properties[name] = type(value)(

1282

value, variant_level = value.variant_level + 1)

953

1283

return dbus.Dictionary(properties, signature="sv")

954

1284

955

1285

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

969

1299

970

1300

Inserts property tags and interface annotation tags.

971

1301

"""

972

xmlstring = dbus.service.Object.Introspect(self, object_path,

973

connection)

1302

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1303

object_path,

1304

connection)

974

1305

try:

975

1306

document = xml.dom.minidom.parseString(xmlstring)

1307

976

1308

def make_tag(document, name, prop):

977

1309

e = document.createElement("property")

978

1310

e.setAttribute("name", name)

979

1311

e.setAttribute("type", prop._dbus_signature)

980

1312

e.setAttribute("access", prop._dbus_access)

981

1313

return e

1314

982

1315

for if_tag in document.getElementsByTagName("interface"):

983

1316

# Add property tags

984

1317

for tag in (make_tag(document, name, prop)

987

1320

if prop._dbus_interface

988

1321

== if_tag.getAttribute("name")):

989

1322

if_tag.appendChild(tag)

990

# Add annotation tags

991

for typ in ("method", "signal", "property"):

992

for tag in if_tag.getElementsByTagName(typ):

993

annots = dict()

994

for name, prop in (self.

995

_get_all_dbus_things(typ)):

996

if (name == tag.getAttribute("name")

997

and prop._dbus_interface

998

== if_tag.getAttribute("name")):

999

annots.update(getattr

1000

(prop,

1001

"_dbus_annotations",

1002

{}))

1003

for name, value in annots.items():

1004

ann_tag = document.createElement(

1005

"annotation")

1006

ann_tag.setAttribute("name", name)

1007

ann_tag.setAttribute("value", value)

1008

tag.appendChild(ann_tag)

1009

# Add interface annotation tags

1010

for annotation, value in dict(

1011

itertools.chain.from_iterable(

1012

annotations().items()

1013

for name, annotations in

1014

self._get_all_dbus_things("interface")

1015

if name == if_tag.getAttribute("name")

1016

)).items():

1017

ann_tag = document.createElement("annotation")

1018

ann_tag.setAttribute("name", annotation)

1019

ann_tag.setAttribute("value", value)

1020

if_tag.appendChild(ann_tag)

1323

# Add annotation tags for properties

1324

for tag in if_tag.getElementsByTagName("property"):

1325

annots = dict()

1326

for name, prop in self._get_all_dbus_things(

1327

"property"):

1328

if (name == tag.getAttribute("name")

1329

and prop._dbus_interface

1330

== if_tag.getAttribute("name")):

1331

annots.update(getattr(

1332

prop, "_dbus_annotations", {}))

1333

for name, value in annots.items():

1334

ann_tag = document.createElement(

1335

"annotation")

1336

ann_tag.setAttribute("name", name)

1337

ann_tag.setAttribute("value", value)

1338

tag.appendChild(ann_tag)

1021

1339

# Add the names to the return values for the

1022

1340

# "org.freedesktop.DBus.Properties" methods

1023

1341

if (if_tag.getAttribute("name")

1041

1359

exc_info=error)

1042

1360

return xmlstring

1043

1361

1362

try:

1363

dbus.OBJECT_MANAGER_IFACE

1364

except AttributeError:

1365

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1366

1367

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1368

"""A D-Bus object with an ObjectManager.

1369

1370

Classes inheriting from this exposes the standard

1371

GetManagedObjects call and the InterfacesAdded and

1372

InterfacesRemoved signals on the standard

1373

"org.freedesktop.DBus.ObjectManager" interface.

1374

1375

Note: No signals are sent automatically; they must be sent

1376

manually.

1377

"""

1378

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1379

out_signature = "a{oa{sa{sv}}}")

1380

def GetManagedObjects(self):

1381

"""This function must be overridden"""

1382

raise NotImplementedError()

1383

1384

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1385

signature = "oa{sa{sv}}")

1386

def InterfacesAdded(self, object_path, interfaces_and_properties):

1387

pass

1388

1389

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1390

def InterfacesRemoved(self, object_path, interfaces):

1391

pass

1392

1393

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1394

out_signature = "s",

1395

path_keyword = 'object_path',

1396

connection_keyword = 'connection')

1397

def Introspect(self, object_path, connection):

1398

"""Overloading of standard D-Bus method.

1399

1400

Override return argument name of GetManagedObjects to be

1401

"objpath_interfaces_and_properties"

1402

"""

1403

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1404

object_path,

1405

connection)

1406

try:

1407

document = xml.dom.minidom.parseString(xmlstring)

1408

1409

for if_tag in document.getElementsByTagName("interface"):

1410

# Fix argument name for the GetManagedObjects method

1411

if (if_tag.getAttribute("name")

1412

== dbus.OBJECT_MANAGER_IFACE):

1413

for cn in if_tag.getElementsByTagName("method"):

1414

if (cn.getAttribute("name")

1415

== "GetManagedObjects"):

1416

for arg in cn.getElementsByTagName("arg"):

1417

if (arg.getAttribute("direction")

1418

== "out"):

1419

arg.setAttribute(

1420

"name",

1421

"objpath_interfaces"

1422

"_and_properties")

1423

xmlstring = document.toxml("utf-8")

1424

document.unlink()

1425

except (AttributeError, xml.dom.DOMException,

1426

xml.parsers.expat.ExpatError) as error:

1427

logger.error("Failed to override Introspection method",

1428

exc_info = error)

1429

return xmlstring

1044

1430

1045

1431

def datetime_to_dbus(dt, variant_level=0):

1046

1432

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1047

1433

if dt is None:

1048

1434

return dbus.String("", variant_level = variant_level)

1049

return dbus.String(dt.isoformat(),

1050

variant_level=variant_level)

1435

return dbus.String(dt.isoformat(), variant_level=variant_level)

1051

1436

1052

1437

1053

1438

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1073

1458

(from DBusObjectWithProperties) and interfaces (from the

1074

1459

dbus_interface_annotations decorator).

1075

1460

"""

1461

1076

1462

def wrapper(cls):

1077

1463

for orig_interface_name, alt_interface_name in (

1078

alt_interface_names.items()):

1464

alt_interface_names.items()):

1079

1465

attr = {}

1080

1466

interface_names = set()

1081

1467

# Go though all attributes of the class

1083

1469

# Ignore non-D-Bus attributes, and D-Bus attributes

1084

1470

# with the wrong interface name

1085

1471

if (not hasattr(attribute, "_dbus_interface")

1086

or not attribute._dbus_interface

1087

.startswith(orig_interface_name)):

1472

or not attribute._dbus_interface.startswith(

1473

orig_interface_name)):

1088

1474

continue

1089

1475

# Create an alternate D-Bus interface name based on

1090

1476

# the current name

1091

alt_interface = (attribute._dbus_interface

1092

.replace(orig_interface_name,

1093

alt_interface_name))

1477

alt_interface = attribute._dbus_interface.replace(

1478

orig_interface_name, alt_interface_name)

1094

1479

interface_names.add(alt_interface)

1095

1480

# Is this a D-Bus signal?

1096

1481

if getattr(attribute, "_dbus_is_signal", False):

1097

# Extract the original non-method undecorated

1098

# function by black magic

1099

nonmethod_func = (dict(

1482

if sys.version_info.major == 2:

1483

# Extract the original non-method undecorated

1484

# function by black magic

1485

nonmethod_func = (dict(

1100

1486

zip(attribute.func_code.co_freevars,

1101

attribute.__closure__))["func"]

1102

.cell_contents)

1487

attribute.__closure__))

1488

["func"].cell_contents)

1489

else:

1490

nonmethod_func = attribute

1103

1491

# Create a new, but exactly alike, function

1104

1492

# object, and decorate it to be a new D-Bus signal

1105

1493

# with the alternate D-Bus interface name

1106

new_function = (dbus.service.signal

1107

(alt_interface,

1108

attribute._dbus_signature)

1109

(types.FunctionType(

1110

nonmethod_func.func_code,

1111

nonmethod_func.func_globals,

1112

nonmethod_func.func_name,

1113

nonmethod_func.func_defaults,

1114

nonmethod_func.func_closure)))

1494

if sys.version_info.major == 2:

1495

new_function = types.FunctionType(

1496

nonmethod_func.func_code,

1497

nonmethod_func.func_globals,

1498

nonmethod_func.func_name,

1499

nonmethod_func.func_defaults,

1500

nonmethod_func.func_closure)

1501

else:

1502

new_function = types.FunctionType(

1503

nonmethod_func.__code__,

1504

nonmethod_func.__globals__,

1505

nonmethod_func.__name__,

1506

nonmethod_func.__defaults__,

1507

nonmethod_func.__closure__)

1508

new_function = (dbus.service.signal(

1509

alt_interface,

1510

attribute._dbus_signature)(new_function))

1115

1511

# Copy annotations, if any

1116

1512

try:

1117

new_function._dbus_annotations = (

1118

dict(attribute._dbus_annotations))

1513

new_function._dbus_annotations = dict(

1514

attribute._dbus_annotations)

1119

1515

except AttributeError:

1120

1516

pass

1121

1517

# Define a creator of a function to call both the

1126

1522

"""This function is a scope container to pass

1127

1523

func1 and func2 to the "call_both" function

1128

1524

outside of its arguments"""

1525

1526

@functools.wraps(func2)

1129

1527

def call_both(*args, **kwargs):

1130

1528

"""This function will emit two D-Bus

1131

1529

signals by calling func1 and func2"""

1132

1530

func1(*args, **kwargs)

1133

1531

func2(*args, **kwargs)

1532

# Make wrapper function look like a D-Bus signal

1533

for name, attr in inspect.getmembers(func2):

1534

if name.startswith("_dbus_"):

1535

setattr(call_both, name, attr)

1536

1134

1537

return call_both

1135

1538

# Create the "call_both" function and add it to

1136

1539

# the class

1141

1544

# object. Decorate it to be a new D-Bus method

1142

1545

# with the alternate D-Bus interface name. Add it

1143

1546

# to the class.

1144

attr[attrname] = (dbus.service.method

1145

(alt_interface,

1146

attribute._dbus_in_signature,

1147

attribute._dbus_out_signature)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1547

attr[attrname] = (

1548

dbus.service.method(

1549

alt_interface,

1550

attribute._dbus_in_signature,

1551

attribute._dbus_out_signature)

1552

(types.FunctionType(attribute.func_code,

1553

attribute.func_globals,

1554

attribute.func_name,

1555

attribute.func_defaults,

1556

attribute.func_closure)))

1154

1557

# Copy annotations, if any

1155

1558

try:

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1559

attr[attrname]._dbus_annotations = dict(

1560

attribute._dbus_annotations)

1158

1561

except AttributeError:

1159

1562

pass

1160

1563

# Is this a D-Bus property?

1163

1566

# object, and decorate it to be a new D-Bus

1164

1567

# property with the alternate D-Bus interface

1165

1568

# name. Add it to the class.

1166

attr[attrname] = (dbus_service_property

1167

(alt_interface,

1168

attribute._dbus_signature,

1169

attribute._dbus_access,

1170

attribute

1171

._dbus_get_args_options

1172

["byte_arrays"])

1173

(types.FunctionType

1174

(attribute.func_code,

1175

attribute.func_globals,

1176

attribute.func_name,

1177

attribute.func_defaults,

1178

attribute.func_closure)))

1569

attr[attrname] = (dbus_service_property(

1570

alt_interface, attribute._dbus_signature,

1571

attribute._dbus_access,

1572

attribute._dbus_get_args_options

1573

["byte_arrays"])

1574

(types.FunctionType(

1575

attribute.func_code,

1576

attribute.func_globals,

1577

attribute.func_name,

1578

attribute.func_defaults,

1579

attribute.func_closure)))

1179

1580

# Copy annotations, if any

1180

1581

try:

1181

attr[attrname]._dbus_annotations = (

1182

dict(attribute._dbus_annotations))

1582

attr[attrname]._dbus_annotations = dict(

1583

attribute._dbus_annotations)

1183

1584

except AttributeError:

1184

1585

pass

1185

1586

# Is this a D-Bus interface?

1188

1589

# object. Decorate it to be a new D-Bus interface

1189

1590

# with the alternate D-Bus interface name. Add it

1190

1591

# to the class.

1191

attr[attrname] = (dbus_interface_annotations

1192

(alt_interface)

1193

(types.FunctionType

1194

(attribute.func_code,

1195

attribute.func_globals,

1196

attribute.func_name,

1197

attribute.func_defaults,

1198

attribute.func_closure)))

1592

attr[attrname] = (

1593

dbus_interface_annotations(alt_interface)

1594

(types.FunctionType(attribute.func_code,

1595

attribute.func_globals,

1596

attribute.func_name,

1597

attribute.func_defaults,

1598

attribute.func_closure)))

1199

1599

if deprecate:

1200

1600

# Deprecate all alternate interfaces

1201

1601

iname="_AlternateDBusNames_interface_annotation{}"

1202

1602

for interface_name in interface_names:

1603

1203

1604

@dbus_interface_annotations(interface_name)

1204

1605

def func(self):

1205

1606

return { "org.freedesktop.DBus.Deprecated":

1206

"true" }

1607

"true" }

1207

1608

# Find an unused name

1208

1609

for aname in (iname.format(i)

1209

1610

for i in itertools.count()):

1214

1615

# Replace the class with a new subclass of it with

1215

1616

# methods, signals, etc. as created above.

1216

1617

cls = type(b"{}Alternate".format(cls.__name__),

1217

(cls,), attr)

1618

(cls, ), attr)

1218

1619

return cls

1620

1219

1621

return wrapper

1220

1622

1221

1623

1222

1624

@alternate_dbus_interfaces({"se.recompile.Mandos":

1223

"se.bsnet.fukt.Mandos"})

1625

"se.bsnet.fukt.Mandos"})

1224

1626

class ClientDBus(Client, DBusObjectWithProperties):

1225

1627

"""A Client class using D-Bus

1226

1628

1230

1632

"""

1231

1633

1232

1634

runtime_expansions = (Client.runtime_expansions

1233

+ ("dbus_object_path",))

1635

+ ("dbus_object_path", ))

1234

1636

1235

1637

_interface = "se.recompile.Mandos.Client"

1236

1638

1244

1646

client_object_name = str(self.name).translate(

1245

1647

{ord("."): ord("_"),

1246

1648

ord("-"): ord("_")})

1247

self.dbus_object_path = (dbus.ObjectPath

1248

("/clients/" + client_object_name))

1649

self.dbus_object_path = dbus.ObjectPath(

1650

"/clients/" + client_object_name)

1249

1651

DBusObjectWithProperties.__init__(self, self.bus,

1250

1652

self.dbus_object_path)

1251

1653

1252

def notifychangeproperty(transform_func,

1253

dbus_name, type_func=lambda x: x,

1254

variant_level=1, invalidate_only=False,

1654

def notifychangeproperty(transform_func, dbus_name,

1655

type_func=lambda x: x,

1656

variant_level=1,

1657

invalidate_only=False,

1255

1658

_interface=_interface):

1256

1659

""" Modify a variable so that it's a property which announces

1257

1660

its changes to DBus.

1264

1667

variant_level: D-Bus variant level. Default: 1

1265

1668

"""

1266

1669

attrname = "_{}".format(dbus_name)

1670

1267

1671

def setter(self, value):

1268

1672

if hasattr(self, "dbus_object_path"):

1269

1673

if (not hasattr(self, attrname) or

1270

1674

type_func(getattr(self, attrname, None))

1271

1675

!= type_func(value)):

1272

1676

if invalidate_only:

1273

self.PropertiesChanged(_interface,

1274

dbus.Dictionary(),

1275

dbus.Array

1276

((dbus_name,)))

1677

self.PropertiesChanged(

1678

_interface, dbus.Dictionary(),

1679

dbus.Array((dbus_name, )))

1277

1680

else:

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1681

dbus_value = transform_func(

1682

type_func(value),

1683

variant_level = variant_level)

1281

1684

self.PropertyChanged(dbus.String(dbus_name),

1282

1685

dbus_value)

1283

self.PropertiesChanged(_interface,

1284

dbus.Dictionary({

1285

dbus.String(dbus_name):

1286

dbus_value }), dbus.Array())

1686

self.PropertiesChanged(

1687

_interface,

1688

dbus.Dictionary({ dbus.String(dbus_name):

1689

dbus_value }),

1690

dbus.Array())

1287

1691

setattr(self, attrname, value)

1288

1692

1289

1693

return property(lambda self: getattr(self, attrname), setter)

1295

1699

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1296

1700

last_enabled = notifychangeproperty(datetime_to_dbus,

1297

1701

"LastEnabled")

1298

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1299

type_func = lambda checker:

1300

checker is not None)

1702

checker = notifychangeproperty(

1703

dbus.Boolean, "CheckerRunning",

1704

type_func = lambda checker: checker is not None)

1301

1705

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1302

1706

"LastCheckedOK")

1303

1707

last_checker_status = notifychangeproperty(dbus.Int16,

1306

1710

datetime_to_dbus, "LastApprovalRequest")

1307

1711

approved_by_default = notifychangeproperty(dbus.Boolean,

1308

1712

"ApprovedByDefault")

1309

approval_delay = notifychangeproperty(dbus.UInt64,

1310

"ApprovalDelay",

1311

type_func =

1312

lambda td: td.total_seconds()

1313

* 1000)

1713

approval_delay = notifychangeproperty(

1714

dbus.UInt64, "ApprovalDelay",

1715

type_func = lambda td: td.total_seconds() * 1000)

1314

1716

approval_duration = notifychangeproperty(

1315

1717

dbus.UInt64, "ApprovalDuration",

1316

1718

type_func = lambda td: td.total_seconds() * 1000)

1317

1719

host = notifychangeproperty(dbus.String, "Host")

1318

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1319

type_func = lambda td:

1320

td.total_seconds() * 1000)

1720

timeout = notifychangeproperty(

1721

dbus.UInt64, "Timeout",

1722

type_func = lambda td: td.total_seconds() * 1000)

1321

1723

extended_timeout = notifychangeproperty(

1322

1724

dbus.UInt64, "ExtendedTimeout",

1323

1725

type_func = lambda td: td.total_seconds() * 1000)

1324

interval = notifychangeproperty(dbus.UInt64,

1325

"Interval",

1326

type_func =

1327

lambda td: td.total_seconds()

1328

* 1000)

1726

interval = notifychangeproperty(

1727

dbus.UInt64, "Interval",

1728

type_func = lambda td: td.total_seconds() * 1000)

1329

1729

checker_command = notifychangeproperty(dbus.String, "Checker")

1330

1730

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1331

1731

invalidate_only=True)

1341

1741

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1342

1742

Client.__del__(self, *args, **kwargs)

1343

1743

1344

def checker_callback(self, pid, condition, command,

1345

*args, **kwargs):

1346

self.checker_callback_tag = None

1347

self.checker = None

1348

if os.WIFEXITED(condition):

1349

exitstatus = os.WEXITSTATUS(condition)

1744

def checker_callback(self, source, condition,

1745

connection, command, *args, **kwargs):

1746

ret = Client.checker_callback(self, source, condition,

1747

connection, command, *args,

1748

**kwargs)

1749

exitstatus = self.last_checker_status

1750

if exitstatus >= 0:

1350

1751

# Emit D-Bus signal

1351

1752

self.CheckerCompleted(dbus.Int16(exitstatus),

1352

dbus.Int64(condition),

1753

# This is specific to GNU libC

1754

dbus.Int64(exitstatus << 8),

1353

1755

dbus.String(command))

1354

1756

else:

1355

1757

# Emit D-Bus signal

1356

1758

self.CheckerCompleted(dbus.Int16(-1),

1357

dbus.Int64(condition),

1759

dbus.Int64(

1760

# This is specific to GNU libC

1761

(exitstatus << 8)

1762

| self.last_checker_signal),

1358

1763

dbus.String(command))

1359

1360

return Client.checker_callback(self, pid, condition, command,

1361

*args, **kwargs)

1764

return ret

1362

1765

1363

1766

def start_checker(self, *args, **kwargs):

1364

1767

old_checker_pid = getattr(self.checker, "pid", None)

1439

1842

self.checked_ok()

1440

1843

1441

1844

# Enable - method

1845

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1442

1846

@dbus.service.method(_interface)

1443

1847

def Enable(self):

1444

1848

"D-Bus method"

1445

1849

self.enable()

1446

1850

1447

1851

# StartChecker - method

1852

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1448

1853

@dbus.service.method(_interface)

1449

1854

def StartChecker(self):

1450

1855

"D-Bus method"

1451

1856

self.start_checker()

1452

1857

1453

1858

# Disable - method

1859

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1454

1860

@dbus.service.method(_interface)

1455

1861

def Disable(self):

1456

1862

"D-Bus method"

1457

1863

self.disable()

1458

1864

1459

1865

# StopChecker - method

1866

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1460

1867

@dbus.service.method(_interface)

1461

1868

def StopChecker(self):

1462

1869

self.stop_checker()

1469

1876

return dbus.Boolean(bool(self.approvals_pending))

1470

1877

1471

1878

# ApprovedByDefault - property

1472

@dbus_service_property(_interface, signature="b",

1879

@dbus_service_property(_interface,

1880

signature="b",

1473

1881

access="readwrite")

1474

1882

def ApprovedByDefault_dbus_property(self, value=None):

1475

1883

if value is None: # get

1477

1885

self.approved_by_default = bool(value)

1478

1886

1479

1887

# ApprovalDelay - property

1480

@dbus_service_property(_interface, signature="t",

1888

@dbus_service_property(_interface,

1889

signature="t",

1481

1890

access="readwrite")

1482

1891

def ApprovalDelay_dbus_property(self, value=None):

1483

1892

if value is None: # get

1486

1895

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1487

1896

1488

1897

# ApprovalDuration - property

1489

@dbus_service_property(_interface, signature="t",

1898

@dbus_service_property(_interface,

1899

signature="t",

1490

1900

access="readwrite")

1491

1901

def ApprovalDuration_dbus_property(self, value=None):

1492

1902

if value is None: # get

1495

1905

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1496

1906

1497

1907

# Name - property

1908

@dbus_annotations(

1909

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1498

1910

@dbus_service_property(_interface, signature="s", access="read")

1499

1911

def Name_dbus_property(self):

1500

1912

return dbus.String(self.name)

1501

1913

1502

1914

# Fingerprint - property

1915

@dbus_annotations(

1916

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1503

1917

@dbus_service_property(_interface, signature="s", access="read")

1504

1918

def Fingerprint_dbus_property(self):

1505

1919

return dbus.String(self.fingerprint)

1506

1920

1507

1921

# Host - property

1508

@dbus_service_property(_interface, signature="s",

1922

@dbus_service_property(_interface,

1923

signature="s",

1509

1924

access="readwrite")

1510

1925

def Host_dbus_property(self, value=None):

1511

1926

if value is None: # get

1513

1928

self.host = str(value)

1514

1929

1515

1930

# Created - property

1931

@dbus_annotations(

1932

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1516

1933

@dbus_service_property(_interface, signature="s", access="read")

1517

1934

def Created_dbus_property(self):

1518

1935

return datetime_to_dbus(self.created)

1523

1940

return datetime_to_dbus(self.last_enabled)

1524

1941

1525

1942

# Enabled - property

1526

@dbus_service_property(_interface, signature="b",

1943

@dbus_service_property(_interface,

1944

signature="b",

1527

1945

access="readwrite")

1528

1946

def Enabled_dbus_property(self, value=None):

1529

1947

if value is None: # get

1534

1952

self.disable()

1535

1953

1536

1954

# LastCheckedOK - property

1537

@dbus_service_property(_interface, signature="s",

1955

@dbus_service_property(_interface,

1956

signature="s",

1538

1957

access="readwrite")

1539

1958

def LastCheckedOK_dbus_property(self, value=None):

1540

1959

if value is not None:

1543

1962

return datetime_to_dbus(self.last_checked_ok)

1544

1963

1545

1964

# LastCheckerStatus - property

1546

@dbus_service_property(_interface, signature="n",

1547

access="read")

1965

@dbus_service_property(_interface, signature="n", access="read")

1548

1966

def LastCheckerStatus_dbus_property(self):

1549

1967

return dbus.Int16(self.last_checker_status)

1550

1968

1559

1977

return datetime_to_dbus(self.last_approval_request)

1560

1978

1561

1979

# Timeout - property

1562

@dbus_service_property(_interface, signature="t",

1980

@dbus_service_property(_interface,

1981

signature="t",

1563

1982

access="readwrite")

1564

1983

def Timeout_dbus_property(self, value=None):

1565

1984

if value is None: # get

1578

1997

is None):

1579

1998

return

1580

1999

gobject.source_remove(self.disable_initiator_tag)

1581

self.disable_initiator_tag = (

1582

gobject.timeout_add(

1583

int((self.expires - now).total_seconds()

1584

* 1000), self.disable))

2000

self.disable_initiator_tag = gobject.timeout_add(

2001

int((self.expires - now).total_seconds() * 1000),

2002

self.disable)

1585

2003

1586

2004

# ExtendedTimeout - property

1587

@dbus_service_property(_interface, signature="t",

2005

@dbus_service_property(_interface,

2006

signature="t",

1588

2007

access="readwrite")

1589

2008

def ExtendedTimeout_dbus_property(self, value=None):

1590

2009

if value is None: # get

1593

2012

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1594

2013

1595

2014

# Interval - property

1596

@dbus_service_property(_interface, signature="t",

2015

@dbus_service_property(_interface,

2016

signature="t",

1597

2017

access="readwrite")

1598

2018

def Interval_dbus_property(self, value=None):

1599

2019

if value is None: # get

1604

2024

if self.enabled:

1605

2025

# Reschedule checker run

1606

2026

gobject.source_remove(self.checker_initiator_tag)

1607

self.checker_initiator_tag = (gobject.timeout_add

1608

(value, self.start_checker))

1609

self.start_checker() # Start one now, too

2027

self.checker_initiator_tag = gobject.timeout_add(

2028

value, self.start_checker)

2029

self.start_checker() # Start one now, too

1610

2030

1611

2031

# Checker - property

1612

@dbus_service_property(_interface, signature="s",

2032

@dbus_service_property(_interface,

2033

signature="s",

1613

2034

access="readwrite")

1614

2035

def Checker_dbus_property(self, value=None):

1615

2036

if value is None: # get

1617

2038

self.checker_command = str(value)

1618

2039

1619

2040

# CheckerRunning - property

1620

@dbus_service_property(_interface, signature="b",

2041

@dbus_service_property(_interface,

2042

signature="b",

1621

2043

access="readwrite")

1622

2044

def CheckerRunning_dbus_property(self, value=None):

1623

2045

if value is None: # get

1628

2050

self.stop_checker()

1629

2051

1630

2052

# ObjectPath - property

2053

@dbus_annotations(

2054

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2055

"org.freedesktop.DBus.Deprecated": "true"})

1631

2056

@dbus_service_property(_interface, signature="o", access="read")

1632

2057

def ObjectPath_dbus_property(self):

1633

2058

return self.dbus_object_path # is already a dbus.ObjectPath

1634

2059

1635

2060

# Secret = property

1636

@dbus_service_property(_interface, signature="ay",

1637

access="write", byte_arrays=True)

2061

@dbus_annotations(

2062

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2063

"invalidates"})

2064

@dbus_service_property(_interface,

2065

signature="ay",

2066

access="write",

2067

byte_arrays=True)

1638

2068

def Secret_dbus_property(self, value):

1639

2069

self.secret = bytes(value)

1640

2070

1646

2076

self._pipe = child_pipe

1647

2077

self._pipe.send(('init', fpr, address))

1648

2078

if not self._pipe.recv():

1649

raise KeyError()

2079

raise KeyError(fpr)

1650

2080

1651

2081

def __getattribute__(self, name):

1652

2082

if name == '_pipe':

1656

2086

if data[0] == 'data':

1657

2087

return data[1]

1658

2088

if data[0] == 'function':

2089

1659

2090

def func(*args, **kwargs):

1660

2091

self._pipe.send(('funcall', name, args, kwargs))

1661

2092

return self._pipe.recv()[1]

2093

1662

2094

return func

1663

2095

1664

2096

def __setattr__(self, name, value):

1680

2112

logger.debug("Pipe FD: %d",

1681

2113

self.server.child_pipe.fileno())

1682

2114

1683

session = (gnutls.connection

1684

.ClientSession(self.request,

1685

gnutls.connection

1686

.X509Credentials()))

1687

1688

# Note: gnutls.connection.X509Credentials is really a

1689

# generic GnuTLS certificate credentials object so long as

1690

# no X.509 keys are added to it. Therefore, we can use it

1691

# here despite using OpenPGP certificates.

2115

session = gnutls.ClientSession(self.request)

1692

2116

1693

2117

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1694

2118

# "+AES-256-CBC", "+SHA1",

1698

2122

priority = self.server.gnutls_priority

1699

2123

if priority is None:

1700

2124

priority = "NORMAL"

1701

(gnutls.library.functions

1702

.gnutls_priority_set_direct(session._c_object,

1703

priority, None))

2125

gnutls.priority_set_direct(session._c_object, priority,

2126

None)

1704

2127

1705

2128

# Start communication using the Mandos protocol

1706

2129

# Get protocol number

1716

2139

# Start GnuTLS connection

1717

2140

try:

1718

2141

session.handshake()

1719

except gnutls.errors.GNUTLSError as error:

2142

except gnutls.Error as error:

1720

2143

logger.warning("Handshake failed: %s", error)

1721

2144

# Do not run session.bye() here: the session is not

1722

2145

# established. Just abandon the request.

1726

2149

approval_required = False

1727

2150

try:

1728

2151

try:

1729

fpr = self.fingerprint(self.peer_certificate

1730

(session))

1731

except (TypeError,

1732

gnutls.errors.GNUTLSError) as error:

2152

fpr = self.fingerprint(

2153

self.peer_certificate(session))

2154

except (TypeError, gnutls.Error) as error:

1733

2155

logger.warning("Bad certificate: %s", error)

1734

2156

return

1735

2157

logger.debug("Fingerprint: %s", fpr)

1748

2170

while True:

1749

2171

if not client.enabled:

1750

2172

logger.info("Client %s is disabled",

1751

client.name)

2173

client.name)

1752

2174

if self.server.use_dbus:

1753

2175

# Emit D-Bus signal

1754

2176

client.Rejected("Disabled")

1797

2219

while sent_size < len(client.secret):

1798

2220

try:

1799

2221

sent = session.send(client.secret[sent_size:])

1800

except gnutls.errors.GNUTLSError as error:

2222

except gnutls.Error as error:

1801

2223

logger.warning("gnutls send failed",

1802

2224

exc_info=error)

1803

2225

return

1804

logger.debug("Sent: %d, remaining: %d",

1805

sent, len(client.secret)

1806

- (sent_size + sent))

2226

logger.debug("Sent: %d, remaining: %d", sent,

2227

len(client.secret) - (sent_size

2228

+ sent))

1807

2229

sent_size += sent

1808

2230

1809

2231

logger.info("Sending secret to %s", client.name)

1818

2240

client.approvals_pending -= 1

1819

2241

try:

1820

2242

session.bye()

1821

except gnutls.errors.GNUTLSError as error:

2243

except gnutls.Error as error:

1822

2244

logger.warning("GnuTLS bye failed",

1823

2245

exc_info=error)

1824

2246

1826

2248

def peer_certificate(session):

1827

2249

"Return the peer's OpenPGP certificate as a bytestring"

1828

2250

# If not an OpenPGP certificate...

1829

if (gnutls.library.functions

1830

.gnutls_certificate_type_get(session._c_object)

1831

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1832

# ...do the normal thing

1833

return session.peer_certificate

2251

if (gnutls.certificate_type_get(session._c_object)

2252

!= gnutls.CRT_OPENPGP):

2253

# ...return invalid data

2254

return b""

1834

2255

list_size = ctypes.c_uint(1)

1835

cert_list = (gnutls.library.functions

1836

.gnutls_certificate_get_peers

2256

cert_list = (gnutls.certificate_get_peers

1837

2257

(session._c_object, ctypes.byref(list_size)))

1838

2258

if not bool(cert_list) and list_size.value != 0:

1839

raise gnutls.errors.GNUTLSError("error getting peer"

1840

" certificate")

2259

raise gnutls.Error("error getting peer certificate")

1841

2260

if list_size.value == 0:

1842

2261

return None

1843

2262

cert = cert_list[0]

1847

2266

def fingerprint(openpgp):

1848

2267

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1849

2268

# New GnuTLS "datum" with the OpenPGP public key

1850

datum = (gnutls.library.types

1851

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1852

ctypes.POINTER

1853

(ctypes.c_ubyte)),

1854

ctypes.c_uint(len(openpgp))))

2269

datum = gnutls.datum_t(

2270

ctypes.cast(ctypes.c_char_p(openpgp),

2271

ctypes.POINTER(ctypes.c_ubyte)),

2272

ctypes.c_uint(len(openpgp)))

1855

2273

# New empty GnuTLS certificate

1856

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2274

crt = gnutls.openpgp_crt_t()

2275

gnutls.openpgp_crt_init(ctypes.byref(crt))

1859

2276

# Import the OpenPGP public key into the certificate

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1862

gnutls.library.constants

1863

.GNUTLS_OPENPGP_FMT_RAW))

2277

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2278

gnutls.OPENPGP_FMT_RAW)

1864

2279

# Verify the self signature in the key

1865

2280

crtverify = ctypes.c_uint()

1866

(gnutls.library.functions

1867

.gnutls_openpgp_crt_verify_self(crt, 0,

1868

ctypes.byref(crtverify)))

2281

gnutls.openpgp_crt_verify_self(crt, 0,

2282

ctypes.byref(crtverify))

1869

2283

if crtverify.value != 0:

1870

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1871

raise (gnutls.errors.CertificateSecurityError

1872

("Verify failed"))

2284

gnutls.openpgp_crt_deinit(crt)

2285

raise gnutls.CertificateSecurityError("Verify failed")

1873

2286

# New buffer for the fingerprint

1874

2287

buf = ctypes.create_string_buffer(20)

1875

2288

buf_len = ctypes.c_size_t()

1876

2289

# Get the fingerprint from the certificate into the buffer

1877

(gnutls.library.functions

1878

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1879

ctypes.byref(buf_len)))

2290

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2291

ctypes.byref(buf_len))

1880

2292

# Deinit the certificate

1881

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2293

gnutls.openpgp_crt_deinit(crt)

1882

2294

# Convert the buffer to a Python bytestring

1883

2295

fpr = ctypes.string_at(buf, buf_len.value)

1884

2296

# Convert the bytestring to hexadecimal notation

1888

2300

1889

2301

class MultiprocessingMixIn(object):

1890

2302

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2303

1891

2304

def sub_process_main(self, request, address):

1892

2305

try:

1893

2306

self.finish_request(request, address)

1905

2318

1906

2319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1907

2320

""" adds a pipe to the MixIn """

2321

1908

2322

def process_request(self, request, client_address):

1909

2323

"""Overrides and wraps the original process_request().

1910

2324

1931

2345

interface: None or a network interface name (string)

1932

2346

use_ipv6: Boolean; to use IPv6 or not

1933

2347

"""

2348

1934

2349

def __init__(self, server_address, RequestHandlerClass,

1935

interface=None, use_ipv6=True, socketfd=None):

2350

interface=None,

2351

use_ipv6=True,

2352

socketfd=None):

1936

2353

"""If socketfd is set, use that file descriptor instead of

1937

2354

creating a new one with socket.socket().

1938

2355

"""

1979

2396

self.interface)

1980

2397

else:

1981

2398

try:

1982

self.socket.setsockopt(socket.SOL_SOCKET,

1983

SO_BINDTODEVICE,

1984

(self.interface + "\0")

1985

.encode("utf-8"))

2399

self.socket.setsockopt(

2400

socket.SOL_SOCKET, SO_BINDTODEVICE,

2401

(self.interface + "\0").encode("utf-8"))

1986

2402

except socket.error as error:

1987

2403

if error.errno == errno.EPERM:

1988

2404

logger.error("No permission to bind to"

2006

2422

self.server_address = (any_address,

2007

2423

self.server_address[1])

2008

2424

elif not self.server_address[1]:

2009

self.server_address = (self.server_address[0],

2010

0)

2425

self.server_address = (self.server_address[0], 0)

2011

2426

# if self.interface:

2012

2427

# self.server_address = (self.server_address[0],

2013

2428

# 0, # port

2027

2442

2028

2443

Assumes a gobject.MainLoop event loop.

2029

2444

"""

2445

2030

2446

def __init__(self, server_address, RequestHandlerClass,

2031

interface=None, use_ipv6=True, clients=None,

2032

gnutls_priority=None, use_dbus=True, socketfd=None):

2447

interface=None,

2448

use_ipv6=True,

2449

clients=None,

2450

gnutls_priority=None,

2451

use_dbus=True,

2452

socketfd=None):

2033

2453

self.enabled = False

2034

2454

self.clients = clients

2035

2455

if self.clients is None:

2041

2461

interface = interface,

2042

2462

use_ipv6 = use_ipv6,

2043

2463

socketfd = socketfd)

2464

2044

2465

def server_activate(self):

2045

2466

if self.enabled:

2046

2467

return socketserver.TCPServer.server_activate(self)

2050

2471

2051

2472

def add_pipe(self, parent_pipe, proc):

2052

2473

# Call "handle_ipc" for both data and EOF events

2053

gobject.io_add_watch(parent_pipe.fileno(),

2054

gobject.IO_IN | gobject.IO_HUP,

2055

functools.partial(self.handle_ipc,

2056

parent_pipe =

2057

parent_pipe,

2058

proc = proc))

2474

gobject.io_add_watch(

2475

parent_pipe.fileno(),

2476

gobject.IO_IN | gobject.IO_HUP,

2477

functools.partial(self.handle_ipc,

2478

parent_pipe = parent_pipe,

2479

proc = proc))

2059

2480

2060

def handle_ipc(self, source, condition, parent_pipe=None,

2061

proc = None, client_object=None):

2481

def handle_ipc(self, source, condition,

2482

parent_pipe=None,

2483

proc = None,

2484

client_object=None):

2062

2485

# error, or the other end of multiprocessing.Pipe has closed

2063

2486

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2064

2487

# Wait for other process to exit

2087

2510

parent_pipe.send(False)

2088

2511

return False

2089

2512

2090

gobject.io_add_watch(parent_pipe.fileno(),

2091

gobject.IO_IN | gobject.IO_HUP,

2092

functools.partial(self.handle_ipc,

2093

parent_pipe =

2094

parent_pipe,

2095

proc = proc,

2096

client_object =

2097

client))

2513

gobject.io_add_watch(

2514

parent_pipe.fileno(),

2515

gobject.IO_IN | gobject.IO_HUP,

2516

functools.partial(self.handle_ipc,

2517

parent_pipe = parent_pipe,

2518

proc = proc,

2519

client_object = client))

2098

2520

parent_pipe.send(True)

2099

2521

# remove the old hook in favor of the new above hook on

2100

2522

# same fileno

2106

2528

2107

2529

parent_pipe.send(('data', getattr(client_object,

2108

2530

funcname)(*args,

2109

**kwargs)))

2531

**kwargs)))

2110

2532

2111

2533

if command == 'getattr':

2112

2534

attrname = request[1]

2113

if callable(client_object.__getattribute__(attrname)):

2114

parent_pipe.send(('function',))

2535

if isinstance(client_object.__getattribute__(attrname),

2536

collections.Callable):

2537

parent_pipe.send(('function', ))

2115

2538

else:

2116

parent_pipe.send(('data', client_object

2117

.__getattribute__(attrname)))

2539

parent_pipe.send((

2540

'data', client_object.__getattribute__(attrname)))

2118

2541

2119

2542

if command == 'setattr':

2120

2543

attrname = request[1]

2151

2574

# avoid excessive use of external libraries.

2152

2575

2153

2576

# New type for defining tokens, syntax, and semantics all-in-one

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2577

Token = collections.namedtuple("Token", (

2578

"regexp", # To match token; if "value" is not None, must have

2579

# a "group" containing digits

2580

"value", # datetime.timedelta or None

2581

"followers")) # Tokens valid after this token

2163

2582

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2164

2583

# the "duration" ABNF definition in RFC 3339, Appendix A.

2165

2584

token_end = Token(re.compile(r"$"), None, frozenset())

2166

2585

token_second = Token(re.compile(r"(\d+)S"),

2167

2586

datetime.timedelta(seconds=1),

2168

frozenset((token_end,)))

2587

frozenset((token_end, )))

2169

2588

token_minute = Token(re.compile(r"(\d+)M"),

2170

2589

datetime.timedelta(minutes=1),

2171

2590

frozenset((token_second, token_end)))

2187

2606

frozenset((token_month, token_end)))

2188

2607

token_week = Token(re.compile(r"(\d+)W"),

2189

2608

datetime.timedelta(weeks=1),

2190

frozenset((token_end,)))

2609

frozenset((token_end, )))

2191

2610

token_duration = Token(re.compile(r"P"), None,

2192

2611

frozenset((token_year, token_month,

2193

2612

token_day, token_time,

2195

2614

# Define starting values

2196

2615

value = datetime.timedelta() # Value so far

2197

2616

found_token = None

2198

followers = frozenset((token_duration,)) # Following valid tokens

2617

followers = frozenset((token_duration, )) # Following valid tokens

2199

2618

s = duration # String left to parse

2200

2619

# Loop until end token is found

2201

2620

while found_token is not token_end:

2218

2637

break

2219

2638

else:

2220

2639

# No currently valid tokens were found

2221

raise ValueError("Invalid RFC 3339 duration")

2640

raise ValueError("Invalid RFC 3339 duration: {!r}"

2641

.format(duration))

2222

2642

# End token found

2223

2643

return value

2224

2644

2261

2681

elif suffix == "w":

2262

2682

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2263

2683

else:

2264

raise ValueError("Unknown suffix {!r}"

2265

.format(suffix))

2684

raise ValueError("Unknown suffix {!r}".format(suffix))

2266

2685

except IndexError as e:

2267

2686

raise ValueError(*(e.args))

2268

2687

timevalue += delta

2284

2703

# Close all standard open file descriptors

2285

2704

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2286

2705

if not stat.S_ISCHR(os.fstat(null).st_mode):

2287

raise OSError(errno.ENODEV, "{} not a character device"

2706

raise OSError(errno.ENODEV,

2707

"{} not a character device"

2288

2708

.format(os.devnull))

2289

2709

os.dup2(null, sys.stdin.fileno())

2290

2710

os.dup2(null, sys.stdout.fileno())

2356

2776

"port": "",

2357

2777

"debug": "False",

2358

2778

"priority":

2359

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2779

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2780

":+SIGN-DSA-SHA256",

2360

2781

"servicename": "Mandos",

2361

2782

"use_dbus": "True",

2362

2783

"use_ipv6": "True",

2366

2787

"statedir": "/var/lib/mandos",

2367

2788

"foreground": "False",

2368

2789

"zeroconf": "True",

2369

}

2790

}

2370

2791

2371

2792

# Parse config file for server-global settings

2372

2793

server_config = configparser.SafeConfigParser(server_defaults)

2373

2794

del server_defaults

2374

server_config.read(os.path.join(options.configdir,

2375

"mandos.conf"))

2795

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2376

2796

# Convert the SafeConfigParser object to a dict

2377

2797

server_settings = server_config.defaults()

2378

2798

# Use the appropriate methods on the non-string config options

2396

2816

# Override the settings from the config file with command line

2397

2817

# options, if set.

2398

2818

for option in ("interface", "address", "port", "debug",

2399

"priority", "servicename", "configdir",

2400

"use_dbus", "use_ipv6", "debuglevel", "restore",

2401

"statedir", "socket", "foreground", "zeroconf"):

2819

"priority", "servicename", "configdir", "use_dbus",

2820

"use_ipv6", "debuglevel", "restore", "statedir",

2821

"socket", "foreground", "zeroconf"):

2402

2822

value = getattr(options, option)

2403

2823

if value is not None:

2404

2824

server_settings[option] = value

2419

2839

2420

2840

##################################################################

2421

2841

2422

if (not server_settings["zeroconf"] and

2423

not (server_settings["port"]

2424

or server_settings["socket"] != "")):

2425

parser.error("Needs port or socket to work without"

2426

" Zeroconf")

2842

if (not server_settings["zeroconf"]

2843

and not (server_settings["port"]

2844

or server_settings["socket"] != "")):

2845

parser.error("Needs port or socket to work without Zeroconf")

2427

2846

2428

2847

# For convenience

2429

2848

debug = server_settings["debug"]

2445

2864

initlogger(debug, level)

2446

2865

2447

2866

if server_settings["servicename"] != "Mandos":

2448

syslogger.setFormatter(logging.Formatter

2449

('Mandos ({}) [%(process)d]:'

2450

' %(levelname)s: %(message)s'

2451

.format(server_settings

2452

["servicename"])))

2867

syslogger.setFormatter(

2868

logging.Formatter('Mandos ({}) [%(process)d]:'

2869

' %(levelname)s: %(message)s'.format(

2870

server_settings["servicename"])))

2453

2871

2454

2872

# Parse config file with clients

2455

2873

client_config = configparser.SafeConfigParser(Client

2463

2881

socketfd = None

2464

2882

if server_settings["socket"] != "":

2465

2883

socketfd = server_settings["socket"]

2466

tcp_server = MandosServer((server_settings["address"],

2467

server_settings["port"]),

2468

ClientHandler,

2469

interface=(server_settings["interface"]

2470

or None),

2471

use_ipv6=use_ipv6,

2472

gnutls_priority=

2473

server_settings["priority"],

2474

use_dbus=use_dbus,

2475

socketfd=socketfd)

2884

tcp_server = MandosServer(

2885

(server_settings["address"], server_settings["port"]),

2886

ClientHandler,

2887

interface=(server_settings["interface"] or None),

2888

use_ipv6=use_ipv6,

2889

gnutls_priority=server_settings["priority"],

2890

use_dbus=use_dbus,

2891

socketfd=socketfd)

2476

2892

if not foreground:

2477

2893

pidfilename = "/run/mandos.pid"

2478

2894

if not os.path.isdir("/run/."):

2479

2895

pidfilename = "/var/run/mandos.pid"

2480

2896

pidfile = None

2481

2897

try:

2482

pidfile = open(pidfilename, "w")

2898

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2483

2899

except IOError as e:

2484

2900

logger.error("Could not open file %r", pidfilename,

2485

2901

exc_info=e)

2506

2922

2507

2923

# "Use a log level over 10 to enable all debugging options."

2508

2924

# - GnuTLS manual

2509

gnutls.library.functions.gnutls_global_set_log_level(11)

2925

gnutls.global_set_log_level(11)

2510

2926

2511

@gnutls.library.types.gnutls_log_func

2927

@gnutls.log_func

2512

2928

def debug_gnutls(level, string):

2513

2929

logger.debug("GnuTLS: %s", string[:-1])

2514

2930

2515

(gnutls.library.functions

2516

.gnutls_global_set_log_function(debug_gnutls))

2931

gnutls.global_set_log_function(debug_gnutls)

2517

2932

2518

2933

# Redirect stdin so all checkers get /dev/null

2519

2934

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2539

2954

if use_dbus:

2540

2955

try:

2541

2956

bus_name = dbus.service.BusName("se.recompile.Mandos",

2542

bus, do_not_queue=True)

2543

old_bus_name = (dbus.service.BusName

2544

("se.bsnet.fukt.Mandos", bus,

2545

do_not_queue=True))

2546

except dbus.exceptions.NameExistsException as e:

2957

bus,

2958

do_not_queue=True)

2959

old_bus_name = dbus.service.BusName(

2960

"se.bsnet.fukt.Mandos", bus,

2961

do_not_queue=True)

2962

except dbus.exceptions.DBusException as e:

2547

2963

logger.error("Disabling D-Bus:", exc_info=e)

2548

2964

use_dbus = False

2549

2965

server_settings["use_dbus"] = False

2550

2966

tcp_server.use_dbus = False

2551

2967

if zeroconf:

2552

2968

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2553

service = AvahiServiceToSyslog(name =

2554

server_settings["servicename"],

2555

servicetype = "_mandos._tcp",

2556

protocol = protocol, bus = bus)

2969

service = AvahiServiceToSyslog(

2970

name = server_settings["servicename"],

2971

servicetype = "_mandos._tcp",

2972

protocol = protocol,

2973

bus = bus)

2557

2974

if server_settings["interface"]:

2558

service.interface = (if_nametoindex

2559

(server_settings["interface"]

2560

.encode("utf-8")))

2975

service.interface = if_nametoindex(

2976

server_settings["interface"].encode("utf-8"))

2561

2977

2562

2978

global multiprocessing_manager

2563

2979

multiprocessing_manager = multiprocessing.Manager()

2582

2998

if server_settings["restore"]:

2583

2999

try:

2584

3000

with open(stored_state_path, "rb") as stored_state:

2585

clients_data, old_client_settings = (pickle.load

2586

(stored_state))

3001

clients_data, old_client_settings = pickle.load(

3002

stored_state)

2587

3003

os.remove(stored_state_path)

2588

3004

except IOError as e:

2589

3005

if e.errno == errno.ENOENT:

2590

logger.warning("Could not load persistent state: {}"

2591

.format(os.strerror(e.errno)))

3006

logger.warning("Could not load persistent state:"

3007

" {}".format(os.strerror(e.errno)))

2592

3008

else:

2593

3009

logger.critical("Could not load persistent state:",

2594

3010

exc_info=e)

2595

3011

raise

2596

3012

except EOFError as e:

2597

3013

logger.warning("Could not load persistent state: "

2598

"EOFError:", exc_info=e)

3014

"EOFError:",

3015

exc_info=e)

2599

3016

2600

3017

with PGPEngine() as pgp:

2601

3018

for client_name, client in clients_data.items():

2613

3030

# For each value in new config, check if it

2614

3031

# differs from the old config value (Except for

2615

3032

# the "secret" attribute)

2616

if (name != "secret" and

2617

value != old_client_settings[client_name]

2618

[name]):

3033

if (name != "secret"

3034

and (value !=

3035

old_client_settings[client_name][name])):

2619

3036

client[name] = value

2620

3037

except KeyError:

2621

3038

pass

2622

3039

2623

3040

# Clients who has passed its expire date can still be

2624

# enabled if its last checker was successful. Clients

3041

# enabled if its last checker was successful. A Client

2625

3042

# whose checker succeeded before we stored its state is

2626

3043

# assumed to have successfully run all checkers during

2627

3044

# downtime.

2630

3047

if not client["last_checked_ok"]:

2631

3048

logger.warning(

2632

3049

"disabling client {} - Client never "

2633

"performed a successful checker"

2634

.format(client_name))

3050

"performed a successful checker".format(

3051

client_name))

2635

3052

client["enabled"] = False

2636

3053

elif client["last_checker_status"] != 0:

2637

3054

logger.warning(

2638

3055

"disabling client {} - Client last"

2639

" checker failed with error code {}"

2640

.format(client_name,

2641

client["last_checker_status"]))

3056

" checker failed with error code"

3057

" {}".format(

3058

client_name,

3059

client["last_checker_status"]))

2642

3060

client["enabled"] = False

2643

3061

else:

2644

client["expires"] = (datetime.datetime

2645

.utcnow()

2646

+ client["timeout"])

3062

client["expires"] = (

3063

datetime.datetime.utcnow()

3064

+ client["timeout"])

2647

3065

logger.debug("Last checker succeeded,"

2648

" keeping {} enabled"

2649

.format(client_name))

3066

" keeping {} enabled".format(

3067

client_name))

2650

3068

try:

2651

client["secret"] = (

2652

pgp.decrypt(client["encrypted_secret"],

2653

client_settings[client_name]

2654

["secret"]))

3069

client["secret"] = pgp.decrypt(

3070

client["encrypted_secret"],

3071

client_settings[client_name]["secret"])

2655

3072

except PGPError:

2656

3073

# If decryption fails, we use secret from new settings

2657

logger.debug("Failed to decrypt {} old secret"

2658

.format(client_name))

2659

client["secret"] = (

2660

client_settings[client_name]["secret"])

3074

logger.debug("Failed to decrypt {} old secret".format(

3075

client_name))

3076

client["secret"] = (client_settings[client_name]

3077

["secret"])

2661

3078

2662

3079

# Add/remove clients based on new changes made to config

2663

3080

for client_name in (set(old_client_settings)

2670

3087

# Create all client objects

2671

3088

for client_name, client in clients_data.items():

2672

3089

tcp_server.clients[client_name] = client_class(

2673

name = client_name, settings = client,

3090

name = client_name,

3091

settings = client,

2674

3092

server_settings = server_settings)

2675

3093

2676

3094

if not tcp_server.clients:

2678

3096

2679

3097

if not foreground:

2680

3098

if pidfile is not None:

3099

pid = os.getpid()

2681

3100

try:

2682

3101

with pidfile:

2683

pid = os.getpid()

2684

pidfile.write("{}\n".format(pid).encode("utf-8"))

3102

print(pid, file=pidfile)

2685

3103

except IOError:

2686

3104

logger.error("Could not write to file %r with PID %d",

2687

3105

pidfilename, pid)

2692

3110

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2693

3111

2694

3112

if use_dbus:

2695

@alternate_dbus_interfaces({"se.recompile.Mandos":

2696

"se.bsnet.fukt.Mandos"})

2697

class MandosDBusService(DBusObjectWithProperties):

3113

3114

@alternate_dbus_interfaces(

3115

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3116

class MandosDBusService(DBusObjectWithObjectManager):

2698

3117

"""A D-Bus proxy object"""

3118

2699

3119

def __init__(self):

2700

3120

dbus.service.Object.__init__(self, bus, "/")

3121

2701

3122

_interface = "se.recompile.Mandos"

2702

3123

2703

@dbus_interface_annotations(_interface)

2704

def _foo(self):

2705

return { "org.freedesktop.DBus.Property"

2706

".EmitsChangedSignal":

2707

"false"}

2708

2709

3124

@dbus.service.signal(_interface, signature="o")

2710

3125

def ClientAdded(self, objpath):

2711

3126

"D-Bus signal"

2716

3131

"D-Bus signal"

2717

3132

pass

2718

3133

3134

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3135

"true"})

2719

3136

@dbus.service.signal(_interface, signature="os")

2720

3137

def ClientRemoved(self, objpath, name):

2721

3138

"D-Bus signal"

2722

3139

pass

2723

3140

3141

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3142

"true"})

2724

3143

@dbus.service.method(_interface, out_signature="ao")

2725

3144

def GetAllClients(self):

2726

3145

"D-Bus method"

2727

return dbus.Array(c.dbus_object_path

2728

for c in

3146

return dbus.Array(c.dbus_object_path for c in

2729

3147

tcp_server.clients.itervalues())

2730

3148

3149

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3150

"true"})

2731

3151

@dbus.service.method(_interface,

2732

3152

out_signature="a{oa{sv}}")

2733

3153

def GetAllClientsWithProperties(self):

2734

3154

"D-Bus method"

2735

3155

return dbus.Dictionary(

2736

{ c.dbus_object_path: c.GetAll("")

3156

{ c.dbus_object_path: c.GetAll(

3157

"se.recompile.Mandos.Client")

2737

3158

for c in tcp_server.clients.itervalues() },

2738

3159

signature="oa{sv}")

2739

3160

2744

3165

if c.dbus_object_path == object_path:

2745

3166

del tcp_server.clients[c.name]

2746

3167

c.remove_from_connection()

2747

# Don't signal anything except ClientRemoved

3168

# Don't signal the disabling

2748

3169

c.disable(quiet=True)

2749

# Emit D-Bus signal

2750

self.ClientRemoved(object_path, c.name)

3170

# Emit D-Bus signal for removal

3171

self.client_removed_signal(c)

2751

3172

return

2752

3173

raise KeyError(object_path)

2753

3174

2754

3175

del _interface

3176

3177

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3178

out_signature = "a{oa{sa{sv}}}")

3179

def GetManagedObjects(self):

3180

"""D-Bus method"""

3181

return dbus.Dictionary(

3182

{ client.dbus_object_path:

3183

dbus.Dictionary(

3184

{ interface: client.GetAll(interface)

3185

for interface in

3186

client._get_all_interface_names()})

3187

for client in tcp_server.clients.values()})

3188

3189

def client_added_signal(self, client):

3190

"""Send the new standard signal and the old signal"""

3191

if use_dbus:

3192

# New standard signal

3193

self.InterfacesAdded(

3194

client.dbus_object_path,

3195

dbus.Dictionary(

3196

{ interface: client.GetAll(interface)

3197

for interface in

3198

client._get_all_interface_names()}))

3199

# Old signal

3200

self.ClientAdded(client.dbus_object_path)

3201

3202

def client_removed_signal(self, client):

3203

"""Send the new standard signal and the old signal"""

3204

if use_dbus:

3205

# New standard signal

3206

self.InterfacesRemoved(

3207

client.dbus_object_path,

3208

client._get_all_interface_names())

3209

# Old signal

3210

self.ClientRemoved(client.dbus_object_path,

3211

client.name)

2755

3212

2756

3213

mandos_dbus_service = MandosDBusService()

2757

3214

2780

3237

# + secret.

2781

3238

exclude = { "bus", "changedstate", "secret",

2782

3239

"checker", "server_settings" }

2783

for name, typ in (inspect.getmembers

2784

(dbus.service.Object)):

3240

for name, typ in inspect.getmembers(dbus.service

3241

.Object):

2785

3242

exclude.add(name)

2786

3243

2787

3244

client_dict["encrypted_secret"] = (client

2794

3251

del client_settings[client.name]["secret"]

2795

3252

2796

3253

try:

2797

with (tempfile.NamedTemporaryFile

2798

(mode='wb', suffix=".pickle", prefix='clients-',

2799

dir=os.path.dirname(stored_state_path),

2800

delete=False)) as stored_state:

3254

with tempfile.NamedTemporaryFile(

3255

mode='wb',

3256

suffix=".pickle",

3257

prefix='clients-',

3258

dir=os.path.dirname(stored_state_path),

3259

delete=False) as stored_state:

2801

3260

pickle.dump((clients, client_settings), stored_state)

2802

tempname=stored_state.name

3261

tempname = stored_state.name

2803

3262

os.rename(tempname, stored_state_path)

2804

3263

except (IOError, OSError) as e:

2805

3264

if not debug:

2820

3279

name, client = tcp_server.clients.popitem()

2821

3280

if use_dbus:

2822

3281

client.remove_from_connection()

2823

# Don't signal anything except ClientRemoved

3282

# Don't signal the disabling

2824

3283

client.disable(quiet=True)

3284

# Emit D-Bus signal for removal

2825

3285

if use_dbus:

2826

# Emit D-Bus signal

2827

mandos_dbus_service.ClientRemoved(client

2828

.dbus_object_path,

2829

client.name)

3286

mandos_dbus_service.client_removed_signal(client)

2830

3287

client_settings.clear()

2831

3288

2832

3289

atexit.register(cleanup)

2833

3290

2834

3291

for client in tcp_server.clients.itervalues():

2835

3292

if use_dbus:

2836

# Emit D-Bus signal

2837

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3293

# Emit D-Bus signal for adding

3294

mandos_dbus_service.client_added_signal(client)

2838

3295

# Need to initiate checking of clients

2839

3296

if client.enabled:

2840

3297

client.init_checker()

2885

3342

# Must run before the D-Bus bus name gets deregistered

2886

3343

cleanup()

2887

3344

3345

2888

3346

if __name__ == '__main__':

2889

3347

main()