To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.350
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.350
- Committer: Teddy Hogeborn
- Date: 2016-02-28 10:59:18 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 331.
- Revision ID: teddy@recompile.se-20160228105918-tb8pt2p5j0tkcls3
Handle GnuTLS errors and partial sends in gnutls "module".
* mandos (GnuTLS.E_INTERRUPTED, GnuTLS.E_AGAIN): New.
(GnuTLS.Error): Set error code as "code" attribute.
(GnuTLS.ClientSession.send): Handle partial sends with a loop.
(GnuTLS._retry_on_error): New function.
(GnuTLS.record_send, GnuTLS.handshake, GnuTLS.bye): Set "errcheck"
attribute to
"_retry_on_error".
(ClientHandler.handle): Remove loop for handling partial sends;
GnuTLS.ClientSession.send() will do that.
* mandos (GnuTLS.E_INTERRUPTED, GnuTLS.E_AGAIN): New.
(GnuTLS.Error): Set error code as "code" attribute.
(GnuTLS.ClientSession.send): Handle partial sends with a loop.
(GnuTLS._retry_on_error): New function.
(GnuTLS.record_send, GnuTLS.handshake, GnuTLS.bye): Set "errcheck"
attribute to
"_retry_on_error".
(ClientHandler.handle): Remove loop for handling partial sends;
GnuTLS.ClientSession.send() will do that.
- files added:
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
43
46
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
51
51
import sys
52
52
import re
53
53
import os
62
62
import struct
63
63
import fcntl
64
64
import functools
65
import cPickle as pickle
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
66
69
import multiprocessing
67
70
import types
68
71
import binascii
69
72
import tempfile
70
73
import itertools
71
74
import collections
75
import codecs
72
76
73
77
import dbus
74
78
import dbus.service
75
import gobject
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
76
83
import avahi
77
84
from dbus.mainloop.glib import DBusGMainLoop
78
85
import ctypes
88
95
except ImportError:
89
96
SO_BINDTODEVICE = None
90
97
91
version = "1.6.5"
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
92
102
stored_state_file = "clients.pickle"
93
103
94
104
logger = logging.getLogger()
95
105
syslogger = None
96
106
97
107
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
101
110
except (OSError, AttributeError):
111
102
112
def if_nametoindex(interface):
103
113
"Get an interface index the hard way, i.e. using fcntl()"
104
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
115
with contextlib.closing(socket.socket()) as s:
106
116
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
117
struct.pack(b"16s16x", interface))
118
interface_index = struct.unpack("I", ifreq[16:20])[0]
111
119
return interface_index
112
120
113
121
114
122
def initlogger(debug, level=logging.WARNING):
115
123
"""init logger and add loglevel"""
116
124
117
syslogger = (logging.handlers.SysLogHandler
118
(facility =
119
logging.handlers.SysLogHandler.LOG_DAEMON,
120
address = str("/dev/log")))
125
global syslogger
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
121
129
syslogger.setFormatter(logging.Formatter
122
130
('Mandos [%(process)d]: %(levelname)s:'
123
131
' %(message)s'))
140
148
141
149
class PGPEngine(object):
142
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
143
152
def __init__(self):
144
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
154
self.gnupgargs = ['--batch',
184
193
185
194
def encrypt(self, data, password):
186
195
passphrase = self.password_encode(password)
187
with tempfile.NamedTemporaryFile(dir=self.tempdir
188
) as passfile:
196
with tempfile.NamedTemporaryFile(
197
dir=self.tempdir) as passfile:
189
198
passfile.write(passphrase)
190
199
passfile.flush()
191
200
proc = subprocess.Popen(['gpg', '--symmetric',
202
211
203
212
def decrypt(self, data, password):
204
213
passphrase = self.password_encode(password)
205
with tempfile.NamedTemporaryFile(dir = self.tempdir
206
) as passfile:
214
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
207
216
passfile.write(passphrase)
208
217
passfile.flush()
209
218
proc = subprocess.Popen(['gpg', '--decrypt',
213
222
stdin = subprocess.PIPE,
214
223
stdout = subprocess.PIPE,
215
224
stderr = subprocess.PIPE)
216
decrypted_plaintext, err = proc.communicate(input
217
= data)
225
decrypted_plaintext, err = proc.communicate(input = data)
218
226
if proc.returncode != 0:
219
227
raise PGPError(err)
220
228
return decrypted_plaintext
223
231
class AvahiError(Exception):
224
232
def __init__(self, value, *args, **kwargs):
225
233
self.value = value
226
super(AvahiError, self).__init__(value, *args, **kwargs)
227
def __unicode__(self):
228
return unicode(repr(self.value))
234
return super(AvahiError, self).__init__(value, *args,
235
**kwargs)
236
229
237
230
238
class AvahiServiceError(AvahiError):
231
239
pass
232
240
241
233
242
class AvahiGroupError(AvahiError):
234
243
pass
235
244
255
264
bus: dbus.SystemBus()
256
265
"""
257
266
258
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
259
servicetype = None, port = None, TXT = None,
260
domain = "", host = "", max_renames = 32768,
261
protocol = avahi.PROTO_UNSPEC, bus = None):
267
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
262
278
self.interface = interface
263
279
self.name = name
264
280
self.type = servicetype
274
290
self.bus = bus
275
291
self.entry_group_state_changed_match = None
276
292
277
def rename(self):
293
def rename(self, remove=True):
278
294
"""Derived from the Avahi example code"""
279
295
if self.rename_count >= self.max_renames:
280
296
logger.critical("No suitable Zeroconf service name found"
281
297
" after %i retries, exiting.",
282
298
self.rename_count)
283
299
raise AvahiServiceError("Too many renames")
284
self.name = unicode(self.server
285
.GetAlternativeServiceName(self.name))
300
self.name = str(
301
self.server.GetAlternativeServiceName(self.name))
302
self.rename_count += 1
286
303
logger.info("Changing Zeroconf service name to %r ...",
287
304
self.name)
288
self.remove()
305
if remove:
306
self.remove()
289
307
try:
290
308
self.add()
291
309
except dbus.exceptions.DBusException as error:
292
logger.critical("D-Bus Exception", exc_info=error)
293
self.cleanup()
294
os._exit(1)
295
self.rename_count += 1
310
if (error.get_dbus_name()
311
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
313
return self.rename(remove=False)
314
else:
315
logger.critical("D-Bus Exception", exc_info=error)
316
self.cleanup()
317
os._exit(1)
296
318
297
319
def remove(self):
298
320
"""Derived from the Avahi example code"""
336
358
self.rename()
337
359
elif state == avahi.ENTRY_GROUP_FAILURE:
338
360
logger.critical("Avahi: Error in group state changed %s",
339
unicode(error))
340
raise AvahiGroupError("State changed: {0!s}"
341
.format(error))
361
str(error))
362
raise AvahiGroupError("State changed: {!s}".format(error))
342
363
343
364
def cleanup(self):
344
365
"""Derived from the Avahi example code"""
354
375
def server_state_changed(self, state, error=None):
355
376
"""Derived from the Avahi example code"""
356
377
logger.debug("Avahi server state change: %i", state)
357
bad_states = { avahi.SERVER_INVALID:
358
"Zeroconf server invalid",
359
avahi.SERVER_REGISTERING: None,
360
avahi.SERVER_COLLISION:
361
"Zeroconf server name collision",
362
avahi.SERVER_FAILURE:
363
"Zeroconf server failure" }
378
bad_states = {
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
383
}
364
384
if state in bad_states:
365
385
if bad_states[state] is not None:
366
386
if error is None:
369
389
logger.error(bad_states[state] + ": %r", error)
370
390
self.cleanup()
371
391
elif state == avahi.SERVER_RUNNING:
372
self.add()
392
try:
393
self.add()
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
398
" collision.")
399
return self.rename(remove=False)
400
else:
401
logger.critical("D-Bus Exception", exc_info=error)
402
self.cleanup()
403
os._exit(1)
373
404
else:
374
405
if error is None:
375
406
logger.debug("Unknown state: %r", state)
385
416
follow_name_owner_changes=True),
386
417
avahi.DBUS_INTERFACE_SERVER)
387
418
self.server.connect_to_signal("StateChanged",
388
self.server_state_changed)
419
self.server_state_changed)
389
420
self.server_state_changed(self.server.GetState())
390
421
391
422
392
423
class AvahiServiceToSyslog(AvahiService):
393
def rename(self):
424
def rename(self, *args, **kwargs):
394
425
"""Add the new name to the syslog messages"""
395
ret = AvahiService.rename(self)
396
syslogger.setFormatter(logging.Formatter
397
('Mandos ({0}) [%(process)d]:'
398
' %(levelname)s: %(message)s'
399
.format(self.name)))
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
.format(self.name)))
400
430
return ret
401
431
402
403
def timedelta_to_milliseconds(td):
404
"Convert a datetime.timedelta() to milliseconds"
405
return ((td.days * 24 * 60 * 60 * 1000)
406
+ (td.seconds * 1000)
407
+ (td.microseconds // 1000))
408
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
450
451
# Constants
452
E_SUCCESS = 0
453
E_INTERRUPTED = -52
454
E_AGAIN = -28
455
CRT_OPENPGP = 2
456
CLIENT = 2
457
SHUT_RDWR = 0
458
CRD_CERTIFICATE = 1
459
E_NO_CERTIFICATE_FOUND = -49
460
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
462
# Types
463
class session_int(ctypes.Structure):
464
_fields_ = []
465
session_t = ctypes.POINTER(session_int)
466
class certificate_credentials_st(ctypes.Structure):
467
_fields_ = []
468
certificate_credentials_t = ctypes.POINTER(
469
certificate_credentials_st)
470
certificate_type_t = ctypes.c_int
471
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
475
_fields_ = []
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
480
transport_ptr_t = ctypes.c_void_p
481
close_request_t = ctypes.c_int
482
483
# Exceptions
484
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
490
# Default usage is by a message string, but if a return
491
# code is passed, convert it to a string with
492
# gnutls.strerror()
493
self.code = code
494
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
497
message, *args)
498
499
class CertificateSecurityError(Error):
500
pass
501
502
# Classes
503
class Credentials(object):
504
def __init__(self):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
508
self.type = gnutls.CRD_CERTIFICATE
509
510
def __del__(self):
511
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
520
True)
521
self.socket = socket
522
if credentials is None:
523
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
526
ctypes.c_void_p))
527
self.credentials = credentials
528
529
def __del__(self):
530
gnutls.deinit(self._c_object)
531
532
def handshake(self):
533
return gnutls.handshake(self._c_object)
534
535
def send(self, data):
536
data = bytes(data)
537
data_len = len(data)
538
while data_len > 0:
539
data_len -= gnutls.record_send(self._c_object,
540
data[-data_len:],
541
data_len)
542
543
def bye(self):
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
546
# Error handling functions
547
def _error_code(result):
548
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
550
if result >= 0:
551
return result
552
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
556
def _retry_on_error(result, func, arguments):
557
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
559
while result < 0:
560
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
return _error_code(result)
562
result = func(*arguments)
563
return result
564
565
# Unless otherwise indicated, the function declarations below are
566
# all from the gnutls/gnutls.h C header file.
567
568
# Functions
569
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
ctypes.POINTER(ctypes.c_char_p)]
572
priority_set_direct.restype = _error_code
573
574
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
init.restype = _error_code
577
578
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
580
set_default_priority.restype = _error_code
581
582
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
584
ctypes.c_size_t]
585
record_send.restype = ctypes.c_ssize_t
586
record_send.errcheck = _retry_on_error
587
588
certificate_allocate_credentials = (
589
_library.gnutls_certificate_allocate_credentials)
590
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
592
certificate_allocate_credentials.restype = _error_code
593
594
certificate_free_credentials = (
595
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
597
certificate_free_credentials.restype = None
598
599
handshake_set_private_extensions = (
600
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
602
ctypes.c_int]
603
handshake_set_private_extensions.restype = None
604
605
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
607
ctypes.c_void_p]
608
credentials_set.restype = _error_code
609
610
strerror = _library.gnutls_strerror
611
strerror.argtypes = [ctypes.c_int]
612
strerror.restype = ctypes.c_char_p
613
614
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
616
certificate_type_get.restype = _error_code
617
618
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
620
ctypes.POINTER(ctypes.c_uint)]
621
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
623
global_set_log_level = _library.gnutls_global_set_log_level
624
global_set_log_level.argtypes = [ctypes.c_int]
625
global_set_log_level.restype = None
626
627
global_set_log_function = _library.gnutls_global_set_log_function
628
global_set_log_function.argtypes = [log_func]
629
global_set_log_function.restype = None
630
631
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
633
deinit.restype = None
634
635
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
638
handshake.errcheck = _retry_on_error
639
640
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
transport_set_ptr.restype = None
643
644
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
647
bye.errcheck = _retry_on_error
648
649
check_version = _library.gnutls_check_version
650
check_version.argtypes = [ctypes.c_char_p]
651
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
682
# Remove non-public functions
683
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
686
687
def call_pipe(connection, # : multiprocessing.Connection
688
func, *args, **kwargs):
689
"""This function is meant to be called by multiprocessing.Process
690
691
This function runs func(*args, **kwargs), and writes the resulting
692
return value on the provided multiprocessing.Connection.
693
"""
694
connection.send(func(*args, **kwargs))
695
connection.close()
409
696
410
697
class Client(object):
411
698
"""A representation of a client host served by this server.
438
725
last_checker_status: integer between 0 and 255 reflecting exit
439
726
status of last checker. -1 reflects crashed
440
727
checker, -2 means no checker completed yet.
728
last_checker_signal: The signal which killed the last checker, if
729
last_checker_status is -1
441
730
last_enabled: datetime.datetime(); (UTC) or None
442
731
name: string; from the config file, used in log messages and
443
732
D-Bus identifiers
456
745
"fingerprint", "host", "interval",
457
746
"last_approval_request", "last_checked_ok",
458
747
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
469
470
def timeout_milliseconds(self):
471
"Return the 'timeout' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.timeout)
473
474
def extended_timeout_milliseconds(self):
475
"Return the 'extended_timeout' attribute in milliseconds"
476
return timedelta_to_milliseconds(self.extended_timeout)
477
478
def interval_milliseconds(self):
479
"Return the 'interval' attribute in milliseconds"
480
return timedelta_to_milliseconds(self.interval)
481
482
def approval_delay_milliseconds(self):
483
return timedelta_to_milliseconds(self.approval_delay)
748
client_defaults = {
749
"timeout": "PT5M",
750
"extended_timeout": "PT15M",
751
"interval": "PT2M",
752
"checker": "fping -q -- %%(host)s",
753
"host": "",
754
"approval_delay": "PT0S",
755
"approval_duration": "PT1S",
756
"approved_by_default": "True",
757
"enabled": "True",
758
}
484
759
485
760
@staticmethod
486
761
def config_parser(config):
502
777
client["enabled"] = config.getboolean(client_name,
503
778
"enabled")
504
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
505
783
client["fingerprint"] = (section["fingerprint"].upper()
506
784
.replace(" ", ""))
507
785
if "secret" in section:
512
790
"rb") as secfile:
513
791
client["secret"] = secfile.read()
514
792
else:
515
raise TypeError("No secret or secfile for section {0}"
793
raise TypeError("No secret or secfile for section {}"
516
794
.format(section))
517
795
client["timeout"] = string_to_delta(section["timeout"])
518
796
client["extended_timeout"] = string_to_delta(
535
813
server_settings = {}
536
814
self.server_settings = server_settings
537
815
# adding all client settings
538
for setting, value in settings.iteritems():
816
for setting, value in settings.items():
539
817
setattr(self, setting, value)
540
818
541
819
if self.enabled:
549
827
self.expires = None
550
828
551
829
logger.debug("Creating client %r", self.name)
552
# Uppercase and remove spaces from fingerprint for later
553
# comparison purposes with return value from the fingerprint()
554
# function
555
830
logger.debug(" Fingerprint: %s", self.fingerprint)
556
831
self.created = settings.get("created",
557
832
datetime.datetime.utcnow())
564
839
self.current_checker_command = None
565
840
self.approved = None
566
841
self.approvals_pending = 0
567
self.changedstate = (multiprocessing_manager
568
.Condition(multiprocessing_manager
569
.Lock()))
570
self.client_structure = [attr for attr in
571
self.__dict__.iterkeys()
842
self.changedstate = multiprocessing_manager.Condition(
843
multiprocessing_manager.Lock())
844
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
572
846
if not attr.startswith("_")]
573
847
self.client_structure.append("client_structure")
574
848
575
for name, t in inspect.getmembers(type(self),
576
lambda obj:
577
isinstance(obj,
578
property)):
849
for name, t in inspect.getmembers(
850
type(self), lambda obj: isinstance(obj, property)):
579
851
if not name.startswith("_"):
580
852
self.client_structure.append(name)
581
853
623
895
# and every interval from then on.
624
896
if self.checker_initiator_tag is not None:
625
897
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = (gobject.timeout_add
627
(self.interval_milliseconds(),
628
self.start_checker))
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
900
self.start_checker)
629
901
# Schedule a disable() when 'timeout' has passed
630
902
if self.disable_initiator_tag is not None:
631
903
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = (gobject.timeout_add
633
(self.timeout_milliseconds(),
634
self.disable))
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
635
906
# Also start a new checker *right now*.
636
907
self.start_checker()
637
908
638
def checker_callback(self, pid, condition, command):
909
def checker_callback(self, source, condition, connection,
910
command):
639
911
"""The checker has completed, so take appropriate actions."""
640
912
self.checker_callback_tag = None
641
913
self.checker = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
914
# Read return code from connection (see call_pipe)
915
returncode = connection.recv()
916
connection.close()
917
918
if returncode >= 0:
919
self.last_checker_status = returncode
920
self.last_checker_signal = None
644
921
if self.last_checker_status == 0:
645
922
logger.info("Checker for %(name)s succeeded",
646
923
vars(self))
647
924
self.checked_ok()
648
925
else:
649
logger.info("Checker for %(name)s failed",
650
vars(self))
926
logger.info("Checker for %(name)s failed", vars(self))
651
927
else:
652
928
self.last_checker_status = -1
929
self.last_checker_signal = -returncode
653
930
logger.warning("Checker for %(name)s crashed?",
654
931
vars(self))
932
return False
655
933
656
934
def checked_ok(self):
657
935
"""Assert that the client has been seen, alive and well."""
658
936
self.last_checked_ok = datetime.datetime.utcnow()
659
937
self.last_checker_status = 0
938
self.last_checker_signal = None
660
939
self.bump_timeout()
661
940
662
941
def bump_timeout(self, timeout=None):
667
946
gobject.source_remove(self.disable_initiator_tag)
668
947
self.disable_initiator_tag = None
669
948
if getattr(self, "enabled", False):
670
self.disable_initiator_tag = (gobject.timeout_add
671
(timedelta_to_milliseconds
672
(timeout), self.disable))
949
self.disable_initiator_tag = gobject.timeout_add(
950
int(timeout.total_seconds() * 1000), self.disable)
673
951
self.expires = datetime.datetime.utcnow() + timeout
674
952
675
953
def need_approval(self):
689
967
# than 'timeout' for the client to be disabled, which is as it
690
968
# should be.
691
969
692
# If a checker exists, make sure it is not a zombie
693
try:
694
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
695
except AttributeError:
696
pass
697
except OSError as error:
698
if error.errno != errno.ECHILD:
699
raise
700
else:
701
if pid:
702
logger.warning("Checker was a zombie")
703
gobject.source_remove(self.checker_callback_tag)
704
self.checker_callback(pid, status,
705
self.current_checker_command)
970
if self.checker is not None and not self.checker.is_alive():
971
logger.warning("Checker was not alive; joining")
972
self.checker.join()
973
self.checker = None
706
974
# Start a new checker if needed
707
975
if self.checker is None:
708
976
# Escape attributes for the shell
709
escaped_attrs = dict(
710
(attr, re.escape(unicode(getattr(self, attr))))
711
for attr in
712
self.runtime_expansions)
977
escaped_attrs = {
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
713
980
try:
714
981
command = self.checker_command % escaped_attrs
715
982
except TypeError as error:
716
983
logger.error('Could not format string "%s"',
717
self.checker_command, exc_info=error)
718
return True # Try again later
984
self.checker_command,
985
exc_info=error)
986
return True # Try again later
719
987
self.current_checker_command = command
720
try:
721
logger.info("Starting checker %r for %s",
722
command, self.name)
723
# We don't need to redirect stdout and stderr, since
724
# in normal mode, that is already done by daemon(),
725
# and in debug mode we don't want to. (Stdin is
726
# always replaced by /dev/null.)
727
# The exception is when not debugging but nevertheless
728
# running in the foreground; use the previously
729
# created wnull.
730
popen_args = {}
731
if (not self.server_settings["debug"]
732
and self.server_settings["foreground"]):
733
popen_args.update({"stdout": wnull,
734
"stderr": wnull })
735
self.checker = subprocess.Popen(command,
736
close_fds=True,
737
shell=True, cwd="/",
738
**popen_args)
739
except OSError as error:
740
logger.error("Failed to start subprocess",
741
exc_info=error)
742
return True
743
self.checker_callback_tag = (gobject.child_watch_add
744
(self.checker.pid,
745
self.checker_callback,
746
data=command))
747
# The checker may have completed before the gobject
748
# watch was added. Check for this.
749
try:
750
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
751
except OSError as error:
752
if error.errno == errno.ECHILD:
753
# This should never happen
754
logger.error("Child process vanished",
755
exc_info=error)
756
return True
757
raise
758
if pid:
759
gobject.source_remove(self.checker_callback_tag)
760
self.checker_callback(pid, status, command)
988
logger.info("Starting checker %r for %s", command,
989
self.name)
990
# We don't need to redirect stdout and stderr, since
991
# in normal mode, that is already done by daemon(),
992
# and in debug mode we don't want to. (Stdin is
993
# always replaced by /dev/null.)
994
# The exception is when not debugging but nevertheless
995
# running in the foreground; use the previously
996
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1000
if (not self.server_settings["debug"]
1001
and self.server_settings["foreground"]):
1002
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1005
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1009
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1012
self.checker_callback, pipe[0], command)
761
1013
# Re-run this periodically if run by gobject.timeout_add
762
1014
return True
763
1015
769
1021
if getattr(self, "checker", None) is None:
770
1022
return
771
1023
logger.debug("Stopping checker for %(name)s", vars(self))
772
try:
773
self.checker.terminate()
774
#time.sleep(0.5)
775
#if self.checker.poll() is None:
776
# self.checker.kill()
777
except OSError as error:
778
if error.errno != errno.ESRCH: # No such process
779
raise
1024
self.checker.terminate()
780
1025
self.checker = None
781
1026
782
1027
783
def dbus_service_property(dbus_interface, signature="v",
784
access="readwrite", byte_arrays=False):
1028
def dbus_service_property(dbus_interface,
1029
signature="v",
1030
access="readwrite",
1031
byte_arrays=False):
785
1032
"""Decorators for marking methods of a DBusObjectWithProperties to
786
1033
become properties on the D-Bus.
787
1034
796
1043
# "Set" method, so we fail early here:
797
1044
if byte_arrays and signature != "ay":
798
1045
raise ValueError("Byte arrays not supported for non-'ay'"
799
" signature {0!r}".format(signature))
1046
" signature {!r}".format(signature))
1047
800
1048
def decorator(func):
801
1049
func._dbus_is_property = True
802
1050
func._dbus_interface = dbus_interface
807
1055
func._dbus_name = func._dbus_name[:-14]
808
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
809
1057
return func
1058
810
1059
return decorator
811
1060
812
1061
821
1070
"org.freedesktop.DBus.Property.EmitsChangedSignal":
822
1071
"false"}
823
1072
"""
1073
824
1074
def decorator(func):
825
1075
func._dbus_is_interface = True
826
1076
func._dbus_interface = dbus_interface
827
1077
func._dbus_name = dbus_interface
828
1078
return func
1079
829
1080
return decorator
830
1081
831
1082
833
1084
"""Decorator to annotate D-Bus methods, signals or properties
834
1085
Usage:
835
1086
1087
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
"org.freedesktop.DBus.Property."
1089
"EmitsChangedSignal": "false"})
836
1090
@dbus_service_property("org.example.Interface", signature="b",
837
1091
access="r")
838
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
1092
def Property_dbus_property(self):
842
1093
return dbus.Boolean(False)
1094
1095
See also the DBusObjectWithAnnotations class.
843
1096
"""
1097
844
1098
def decorator(func):
845
1099
func._dbus_annotations = annotations
846
1100
return func
1101
847
1102
return decorator
848
1103
849
1104
850
1105
class DBusPropertyException(dbus.exceptions.DBusException):
851
1106
"""A base class for D-Bus property-related exceptions
852
1107
"""
853
def __unicode__(self):
854
return unicode(str(self))
1108
pass
855
1109
856
1110
857
1111
class DBusPropertyAccessException(DBusPropertyException):
866
1120
pass
867
1121
868
1122
869
class DBusObjectWithProperties(dbus.service.Object):
870
"""A D-Bus object with properties.
1123
class DBusObjectWithAnnotations(dbus.service.Object):
1124
"""A D-Bus object with annotations.
871
1125
872
Classes inheriting from this can use the dbus_service_property
873
decorator to expose methods as D-Bus properties. It exposes the
874
standard Get(), Set(), and GetAll() methods on the D-Bus.
1126
Classes inheriting from this can use the dbus_annotations
1127
decorator to add annotations to methods or signals.
875
1128
"""
876
1129
877
1130
@staticmethod
881
1134
If called like _is_dbus_thing("method") it returns a function
882
1135
suitable for use as predicate to inspect.getmembers().
883
1136
"""
884
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1137
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
1138
False)
886
1139
887
1140
def _get_all_dbus_things(self, thing):
888
1141
"""Returns a generator of (name, attribute) pairs
889
1142
"""
890
return ((getattr(athing.__get__(self), "_dbus_name",
891
name),
1143
return ((getattr(athing.__get__(self), "_dbus_name", name),
892
1144
athing.__get__(self))
893
1145
for cls in self.__class__.__mro__
894
1146
for name, athing in
895
inspect.getmembers(cls,
896
self._is_dbus_thing(thing)))
1147
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1149
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1153
def Introspect(self, object_path, connection):
1154
"""Overloading of standard D-Bus method.
1155
1156
Inserts annotation tags on methods and signals.
1157
"""
1158
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
connection)
1160
try:
1161
document = xml.dom.minidom.parseString(xmlstring)
1162
1163
for if_tag in document.getElementsByTagName("interface"):
1164
# Add annotation tags
1165
for typ in ("method", "signal"):
1166
for tag in if_tag.getElementsByTagName(typ):
1167
annots = dict()
1168
for name, prop in (self.
1169
_get_all_dbus_things(typ)):
1170
if (name == tag.getAttribute("name")
1171
and prop._dbus_interface
1172
== if_tag.getAttribute("name")):
1173
annots.update(getattr(
1174
prop, "_dbus_annotations", {}))
1175
for name, value in annots.items():
1176
ann_tag = document.createElement(
1177
"annotation")
1178
ann_tag.setAttribute("name", name)
1179
ann_tag.setAttribute("value", value)
1180
tag.appendChild(ann_tag)
1181
# Add interface annotation tags
1182
for annotation, value in dict(
1183
itertools.chain.from_iterable(
1184
annotations().items()
1185
for name, annotations
1186
in self._get_all_dbus_things("interface")
1187
if name == if_tag.getAttribute("name")
1188
)).items():
1189
ann_tag = document.createElement("annotation")
1190
ann_tag.setAttribute("name", annotation)
1191
ann_tag.setAttribute("value", value)
1192
if_tag.appendChild(ann_tag)
1193
# Fix argument name for the Introspect method itself
1194
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1196
for cn in if_tag.getElementsByTagName("method"):
1197
if cn.getAttribute("name") == "Introspect":
1198
for arg in cn.getElementsByTagName("arg"):
1199
if (arg.getAttribute("direction")
1200
== "out"):
1201
arg.setAttribute("name",
1202
"xml_data")
1203
xmlstring = document.toxml("utf-8")
1204
document.unlink()
1205
except (AttributeError, xml.dom.DOMException,
1206
xml.parsers.expat.ExpatError) as error:
1207
logger.error("Failed to override Introspection method",
1208
exc_info=error)
1209
return xmlstring
1210
1211
1212
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
"""A D-Bus object with properties.
1214
1215
Classes inheriting from this can use the dbus_service_property
1216
decorator to expose methods as D-Bus properties. It exposes the
1217
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
"""
897
1219
898
1220
def _get_dbus_property(self, interface_name, property_name):
899
1221
"""Returns a bound method if one exists which is a D-Bus
900
1222
property with the specified name and interface.
901
1223
"""
902
for cls in self.__class__.__mro__:
903
for name, value in (inspect.getmembers
904
(cls,
905
self._is_dbus_thing("property"))):
1224
for cls in self.__class__.__mro__:
1225
for name, value in inspect.getmembers(
1226
cls, self._is_dbus_thing("property")):
906
1227
if (value._dbus_name == property_name
907
1228
and value._dbus_interface == interface_name):
908
1229
return value.__get__(self)
909
1230
910
1231
# No such property
911
raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
+ interface_name + "."
913
+ property_name)
914
915
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1232
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
self.dbus_object_path, interface_name, property_name))
1234
1235
@classmethod
1236
def _get_all_interface_names(cls):
1237
"""Get a sequence of all interfaces supported by an object"""
1238
return (name for name in set(getattr(getattr(x, attr),
1239
"_dbus_interface", None)
1240
for x in (inspect.getmro(cls))
1241
for attr in dir(x))
1242
if name is not None)
1243
1244
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
in_signature="ss",
916
1246
out_signature="v")
917
1247
def Get(self, interface_name, property_name):
918
1248
"""Standard D-Bus property Get() method, see D-Bus standard.
937
1267
# signatures other than "ay".
938
1268
if prop._dbus_signature != "ay":
939
1269
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {0!r}"
1270
"'ay' signature {!r}"
941
1271
.format(prop._dbus_signature))
942
1272
value = dbus.ByteArray(b''.join(chr(byte)
943
1273
for byte in value))
944
1274
prop(value)
945
1275
946
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1276
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
in_signature="s",
947
1278
out_signature="a{sv}")
948
1279
def GetAll(self, interface_name):
949
1280
"""Standard D-Bus property GetAll() method, see D-Bus
964
1295
if not hasattr(value, "variant_level"):
965
1296
properties[name] = value
966
1297
continue
967
properties[name] = type(value)(value, variant_level=
968
value.variant_level+1)
1298
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
969
1300
return dbus.Dictionary(properties, signature="sv")
970
1301
1302
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
def PropertiesChanged(self, interface_name, changed_properties,
1304
invalidated_properties):
1305
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1306
standard.
1307
"""
1308
pass
1309
971
1310
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
972
1311
out_signature="s",
973
1312
path_keyword='object_path',
977
1316
978
1317
Inserts property tags and interface annotation tags.
979
1318
"""
980
xmlstring = dbus.service.Object.Introspect(self, object_path,
981
connection)
1319
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1320
object_path,
1321
connection)
982
1322
try:
983
1323
document = xml.dom.minidom.parseString(xmlstring)
1324
984
1325
def make_tag(document, name, prop):
985
1326
e = document.createElement("property")
986
1327
e.setAttribute("name", name)
987
1328
e.setAttribute("type", prop._dbus_signature)
988
1329
e.setAttribute("access", prop._dbus_access)
989
1330
return e
1331
990
1332
for if_tag in document.getElementsByTagName("interface"):
991
1333
# Add property tags
992
1334
for tag in (make_tag(document, name, prop)
995
1337
if prop._dbus_interface
996
1338
== if_tag.getAttribute("name")):
997
1339
if_tag.appendChild(tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr
1008
(prop,
1009
"_dbus_annotations",
1010
{}))
1011
for name, value in annots.iteritems():
1012
ann_tag = document.createElement(
1013
"annotation")
1014
ann_tag.setAttribute("name", name)
1015
ann_tag.setAttribute("value", value)
1016
tag.appendChild(ann_tag)
1017
# Add interface annotation tags
1018
for annotation, value in dict(
1019
itertools.chain.from_iterable(
1020
annotations().iteritems()
1021
for name, annotations in
1022
self._get_all_dbus_things("interface")
1023
if name == if_tag.getAttribute("name")
1024
)).iteritems():
1025
ann_tag = document.createElement("annotation")
1026
ann_tag.setAttribute("name", annotation)
1027
ann_tag.setAttribute("value", value)
1028
if_tag.appendChild(ann_tag)
1340
# Add annotation tags for properties
1341
for tag in if_tag.getElementsByTagName("property"):
1342
annots = dict()
1343
for name, prop in self._get_all_dbus_things(
1344
"property"):
1345
if (name == tag.getAttribute("name")
1346
and prop._dbus_interface
1347
== if_tag.getAttribute("name")):
1348
annots.update(getattr(
1349
prop, "_dbus_annotations", {}))
1350
for name, value in annots.items():
1351
ann_tag = document.createElement(
1352
"annotation")
1353
ann_tag.setAttribute("name", name)
1354
ann_tag.setAttribute("value", value)
1355
tag.appendChild(ann_tag)
1029
1356
# Add the names to the return values for the
1030
1357
# "org.freedesktop.DBus.Properties" methods
1031
1358
if (if_tag.getAttribute("name")
1049
1376
exc_info=error)
1050
1377
return xmlstring
1051
1378
1379
try:
1380
dbus.OBJECT_MANAGER_IFACE
1381
except AttributeError:
1382
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1384
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
"""A D-Bus object with an ObjectManager.
1386
1387
Classes inheriting from this exposes the standard
1388
GetManagedObjects call and the InterfacesAdded and
1389
InterfacesRemoved signals on the standard
1390
"org.freedesktop.DBus.ObjectManager" interface.
1391
1392
Note: No signals are sent automatically; they must be sent
1393
manually.
1394
"""
1395
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1397
def GetManagedObjects(self):
1398
"""This function must be overridden"""
1399
raise NotImplementedError()
1400
1401
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1403
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1407
def InterfacesRemoved(self, object_path, interfaces):
1408
pass
1409
1410
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1414
def Introspect(self, object_path, connection):
1415
"""Overloading of standard D-Bus method.
1416
1417
Override return argument name of GetManagedObjects to be
1418
"objpath_interfaces_and_properties"
1419
"""
1420
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1421
object_path,
1422
connection)
1423
try:
1424
document = xml.dom.minidom.parseString(xmlstring)
1425
1426
for if_tag in document.getElementsByTagName("interface"):
1427
# Fix argument name for the GetManagedObjects method
1428
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1430
for cn in if_tag.getElementsByTagName("method"):
1431
if (cn.getAttribute("name")
1432
== "GetManagedObjects"):
1433
for arg in cn.getElementsByTagName("arg"):
1434
if (arg.getAttribute("direction")
1435
== "out"):
1436
arg.setAttribute(
1437
"name",
1438
"objpath_interfaces"
1439
"_and_properties")
1440
xmlstring = document.toxml("utf-8")
1441
document.unlink()
1442
except (AttributeError, xml.dom.DOMException,
1443
xml.parsers.expat.ExpatError) as error:
1444
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1446
return xmlstring
1052
1447
1053
1448
def datetime_to_dbus(dt, variant_level=0):
1054
1449
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1055
1450
if dt is None:
1056
1451
return dbus.String("", variant_level = variant_level)
1057
return dbus.String(dt.isoformat(),
1058
variant_level=variant_level)
1452
return dbus.String(dt.isoformat(), variant_level=variant_level)
1059
1453
1060
1454
1061
1455
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1081
1475
(from DBusObjectWithProperties) and interfaces (from the
1082
1476
dbus_interface_annotations decorator).
1083
1477
"""
1478
1084
1479
def wrapper(cls):
1085
1480
for orig_interface_name, alt_interface_name in (
1086
alt_interface_names.iteritems()):
1481
alt_interface_names.items()):
1087
1482
attr = {}
1088
1483
interface_names = set()
1089
1484
# Go though all attributes of the class
1091
1486
# Ignore non-D-Bus attributes, and D-Bus attributes
1092
1487
# with the wrong interface name
1093
1488
if (not hasattr(attribute, "_dbus_interface")
1094
or not attribute._dbus_interface
1095
.startswith(orig_interface_name)):
1489
or not attribute._dbus_interface.startswith(
1490
orig_interface_name)):
1096
1491
continue
1097
1492
# Create an alternate D-Bus interface name based on
1098
1493
# the current name
1099
alt_interface = (attribute._dbus_interface
1100
.replace(orig_interface_name,
1101
alt_interface_name))
1494
alt_interface = attribute._dbus_interface.replace(
1495
orig_interface_name, alt_interface_name)
1102
1496
interface_names.add(alt_interface)
1103
1497
# Is this a D-Bus signal?
1104
1498
if getattr(attribute, "_dbus_is_signal", False):
1105
# Extract the original non-method undecorated
1106
# function by black magic
1107
nonmethod_func = (dict(
1499
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
nonmethod_func = (dict(
1108
1503
zip(attribute.func_code.co_freevars,
1109
attribute.__closure__))["func"]
1110
.cell_contents)
1504
attribute.__closure__))
1505
["func"].cell_contents)
1506
else:
1507
nonmethod_func = attribute
1111
1508
# Create a new, but exactly alike, function
1112
1509
# object, and decorate it to be a new D-Bus signal
1113
1510
# with the alternate D-Bus interface name
1114
new_function = (dbus.service.signal
1115
(alt_interface,
1116
attribute._dbus_signature)
1117
(types.FunctionType(
1118
nonmethod_func.func_code,
1119
nonmethod_func.func_globals,
1120
nonmethod_func.func_name,
1121
nonmethod_func.func_defaults,
1122
nonmethod_func.func_closure)))
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1525
new_function = (dbus.service.signal(
1526
alt_interface,
1527
attribute._dbus_signature)(new_function))
1123
1528
# Copy annotations, if any
1124
1529
try:
1125
new_function._dbus_annotations = (
1126
dict(attribute._dbus_annotations))
1530
new_function._dbus_annotations = dict(
1531
attribute._dbus_annotations)
1127
1532
except AttributeError:
1128
1533
pass
1129
1534
# Define a creator of a function to call both the
1134
1539
"""This function is a scope container to pass
1135
1540
func1 and func2 to the "call_both" function
1136
1541
outside of its arguments"""
1542
1543
@functools.wraps(func2)
1137
1544
def call_both(*args, **kwargs):
1138
1545
"""This function will emit two D-Bus
1139
1546
signals by calling func1 and func2"""
1140
1547
func1(*args, **kwargs)
1141
1548
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1550
for name, attr in inspect.getmembers(func2):
1551
if name.startswith("_dbus_"):
1552
setattr(call_both, name, attr)
1553
1142
1554
return call_both
1143
1555
# Create the "call_both" function and add it to
1144
1556
# the class
1149
1561
# object. Decorate it to be a new D-Bus method
1150
1562
# with the alternate D-Bus interface name. Add it
1151
1563
# to the class.
1152
attr[attrname] = (dbus.service.method
1153
(alt_interface,
1154
attribute._dbus_in_signature,
1155
attribute._dbus_out_signature)
1156
(types.FunctionType
1157
(attribute.func_code,
1158
attribute.func_globals,
1159
attribute.func_name,
1160
attribute.func_defaults,
1161
attribute.func_closure)))
1564
attr[attrname] = (
1565
dbus.service.method(
1566
alt_interface,
1567
attribute._dbus_in_signature,
1568
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1162
1574
# Copy annotations, if any
1163
1575
try:
1164
attr[attrname]._dbus_annotations = (
1165
dict(attribute._dbus_annotations))
1576
attr[attrname]._dbus_annotations = dict(
1577
attribute._dbus_annotations)
1166
1578
except AttributeError:
1167
1579
pass
1168
1580
# Is this a D-Bus property?
1171
1583
# object, and decorate it to be a new D-Bus
1172
1584
# property with the alternate D-Bus interface
1173
1585
# name. Add it to the class.
1174
attr[attrname] = (dbus_service_property
1175
(alt_interface,
1176
attribute._dbus_signature,
1177
attribute._dbus_access,
1178
attribute
1179
._dbus_get_args_options
1180
["byte_arrays"])
1181
(types.FunctionType
1182
(attribute.func_code,
1183
attribute.func_globals,
1184
attribute.func_name,
1185
attribute.func_defaults,
1186
attribute.func_closure)))
1586
attr[attrname] = (dbus_service_property(
1587
alt_interface, attribute._dbus_signature,
1588
attribute._dbus_access,
1589
attribute._dbus_get_args_options
1590
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1187
1597
# Copy annotations, if any
1188
1598
try:
1189
attr[attrname]._dbus_annotations = (
1190
dict(attribute._dbus_annotations))
1599
attr[attrname]._dbus_annotations = dict(
1600
attribute._dbus_annotations)
1191
1601
except AttributeError:
1192
1602
pass
1193
1603
# Is this a D-Bus interface?
1196
1606
# object. Decorate it to be a new D-Bus interface
1197
1607
# with the alternate D-Bus interface name. Add it
1198
1608
# to the class.
1199
attr[attrname] = (dbus_interface_annotations
1200
(alt_interface)
1201
(types.FunctionType
1202
(attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1609
attr[attrname] = (
1610
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1207
1616
if deprecate:
1208
1617
# Deprecate all alternate interfaces
1209
iname="_AlternateDBusNames_interface_annotation{0}"
1618
iname="_AlternateDBusNames_interface_annotation{}"
1210
1619
for interface_name in interface_names:
1620
1211
1621
@dbus_interface_annotations(interface_name)
1212
1622
def func(self):
1213
1623
return { "org.freedesktop.DBus.Deprecated":
1214
"true" }
1624
"true" }
1215
1625
# Find an unused name
1216
1626
for aname in (iname.format(i)
1217
1627
for i in itertools.count()):
1221
1631
if interface_names:
1222
1632
# Replace the class with a new subclass of it with
1223
1633
# methods, signals, etc. as created above.
1224
cls = type(b"{0}Alternate".format(cls.__name__),
1225
(cls,), attr)
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1226
1636
return cls
1637
1227
1638
return wrapper
1228
1639
1229
1640
1230
1641
@alternate_dbus_interfaces({"se.recompile.Mandos":
1231
"se.bsnet.fukt.Mandos"})
1642
"se.bsnet.fukt.Mandos"})
1232
1643
class ClientDBus(Client, DBusObjectWithProperties):
1233
1644
"""A Client class using D-Bus
1234
1645
1238
1649
"""
1239
1650
1240
1651
runtime_expansions = (Client.runtime_expansions
1241
+ ("dbus_object_path",))
1652
+ ("dbus_object_path", ))
1653
1654
_interface = "se.recompile.Mandos.Client"
1242
1655
1243
1656
# dbus.service.Object doesn't use super(), so we can't either.
1244
1657
1247
1660
Client.__init__(self, *args, **kwargs)
1248
1661
# Only now, when this client is initialized, can it show up on
1249
1662
# the D-Bus
1250
client_object_name = unicode(self.name).translate(
1663
client_object_name = str(self.name).translate(
1251
1664
{ord("."): ord("_"),
1252
1665
ord("-"): ord("_")})
1253
self.dbus_object_path = (dbus.ObjectPath
1254
("/clients/" + client_object_name))
1666
self.dbus_object_path = dbus.ObjectPath(
1667
"/clients/" + client_object_name)
1255
1668
DBusObjectWithProperties.__init__(self, self.bus,
1256
1669
self.dbus_object_path)
1257
1670
1258
def notifychangeproperty(transform_func,
1259
dbus_name, type_func=lambda x: x,
1260
variant_level=1):
1671
def notifychangeproperty(transform_func, dbus_name,
1672
type_func=lambda x: x,
1673
variant_level=1,
1674
invalidate_only=False,
1675
_interface=_interface):
1261
1676
""" Modify a variable so that it's a property which announces
1262
1677
its changes to DBus.
1263
1678
1268
1683
to the D-Bus. Default: no transform
1269
1684
variant_level: D-Bus variant level. Default: 1
1270
1685
"""
1271
attrname = "_{0}".format(dbus_name)
1686
attrname = "_{}".format(dbus_name)
1687
1272
1688
def setter(self, value):
1273
1689
if hasattr(self, "dbus_object_path"):
1274
1690
if (not hasattr(self, attrname) or
1275
1691
type_func(getattr(self, attrname, None))
1276
1692
!= type_func(value)):
1277
dbus_value = transform_func(type_func(value),
1278
variant_level
1279
=variant_level)
1280
self.PropertyChanged(dbus.String(dbus_name),
1281
dbus_value)
1693
if invalidate_only:
1694
self.PropertiesChanged(
1695
_interface, dbus.Dictionary(),
1696
dbus.Array((dbus_name, )))
1697
else:
1698
dbus_value = transform_func(
1699
type_func(value),
1700
variant_level = variant_level)
1701
self.PropertyChanged(dbus.String(dbus_name),
1702
dbus_value)
1703
self.PropertiesChanged(
1704
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1707
dbus.Array())
1282
1708
setattr(self, attrname, value)
1283
1709
1284
1710
return property(lambda self: getattr(self, attrname), setter)
1290
1716
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1291
1717
last_enabled = notifychangeproperty(datetime_to_dbus,
1292
1718
"LastEnabled")
1293
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1294
type_func = lambda checker:
1295
checker is not None)
1719
checker = notifychangeproperty(
1720
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1296
1722
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1297
1723
"LastCheckedOK")
1298
1724
last_checker_status = notifychangeproperty(dbus.Int16,
1301
1727
datetime_to_dbus, "LastApprovalRequest")
1302
1728
approved_by_default = notifychangeproperty(dbus.Boolean,
1303
1729
"ApprovedByDefault")
1304
approval_delay = notifychangeproperty(dbus.UInt64,
1305
"ApprovalDelay",
1306
type_func =
1307
timedelta_to_milliseconds)
1730
approval_delay = notifychangeproperty(
1731
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1308
1733
approval_duration = notifychangeproperty(
1309
1734
dbus.UInt64, "ApprovalDuration",
1310
type_func = timedelta_to_milliseconds)
1735
type_func = lambda td: td.total_seconds() * 1000)
1311
1736
host = notifychangeproperty(dbus.String, "Host")
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func =
1314
timedelta_to_milliseconds)
1737
timeout = notifychangeproperty(
1738
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1315
1740
extended_timeout = notifychangeproperty(
1316
1741
dbus.UInt64, "ExtendedTimeout",
1317
type_func = timedelta_to_milliseconds)
1318
interval = notifychangeproperty(dbus.UInt64,
1319
"Interval",
1320
type_func =
1321
timedelta_to_milliseconds)
1742
type_func = lambda td: td.total_seconds() * 1000)
1743
interval = notifychangeproperty(
1744
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1322
1746
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
invalidate_only=True)
1323
1749
1324
1750
del notifychangeproperty
1325
1751
1332
1758
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1333
1759
Client.__del__(self, *args, **kwargs)
1334
1760
1335
def checker_callback(self, pid, condition, command,
1336
*args, **kwargs):
1337
self.checker_callback_tag = None
1338
self.checker = None
1339
if os.WIFEXITED(condition):
1340
exitstatus = os.WEXITSTATUS(condition)
1761
def checker_callback(self, source, condition,
1762
connection, command, *args, **kwargs):
1763
ret = Client.checker_callback(self, source, condition,
1764
connection, command, *args,
1765
**kwargs)
1766
exitstatus = self.last_checker_status
1767
if exitstatus >= 0:
1341
1768
# Emit D-Bus signal
1342
1769
self.CheckerCompleted(dbus.Int16(exitstatus),
1343
dbus.Int64(condition),
1770
# This is specific to GNU libC
1771
dbus.Int64(exitstatus << 8),
1344
1772
dbus.String(command))
1345
1773
else:
1346
1774
# Emit D-Bus signal
1347
1775
self.CheckerCompleted(dbus.Int16(-1),
1348
dbus.Int64(condition),
1776
dbus.Int64(
1777
# This is specific to GNU libC
1778
(exitstatus << 8)
1779
| self.last_checker_signal),
1349
1780
dbus.String(command))
1350
1351
return Client.checker_callback(self, pid, condition, command,
1352
*args, **kwargs)
1781
return ret
1353
1782
1354
1783
def start_checker(self, *args, **kwargs):
1355
1784
old_checker_pid = getattr(self.checker, "pid", None)
1367
1796
1368
1797
def approve(self, value=True):
1369
1798
self.approved = value
1370
gobject.timeout_add(timedelta_to_milliseconds
1371
(self.approval_duration),
1372
self._reset_approved)
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1373
1801
self.send_changedstate()
1374
1802
1375
1803
## D-Bus methods, signals & properties
1376
_interface = "se.recompile.Mandos.Client"
1377
1804
1378
1805
## Interfaces
1379
1806
1380
@dbus_interface_annotations(_interface)
1381
def _foo(self):
1382
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1383
"false"}
1384
1385
1807
## Signals
1386
1808
1387
1809
# CheckerCompleted - signal
1397
1819
pass
1398
1820
1399
1821
# PropertyChanged - signal
1822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1400
1823
@dbus.service.signal(_interface, signature="sv")
1401
1824
def PropertyChanged(self, property, value):
1402
1825
"D-Bus signal"
1436
1859
self.checked_ok()
1437
1860
1438
1861
# Enable - method
1862
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1439
1863
@dbus.service.method(_interface)
1440
1864
def Enable(self):
1441
1865
"D-Bus method"
1442
1866
self.enable()
1443
1867
1444
1868
# StartChecker - method
1869
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1445
1870
@dbus.service.method(_interface)
1446
1871
def StartChecker(self):
1447
1872
"D-Bus method"
1448
1873
self.start_checker()
1449
1874
1450
1875
# Disable - method
1876
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1451
1877
@dbus.service.method(_interface)
1452
1878
def Disable(self):
1453
1879
"D-Bus method"
1454
1880
self.disable()
1455
1881
1456
1882
# StopChecker - method
1883
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1457
1884
@dbus.service.method(_interface)
1458
1885
def StopChecker(self):
1459
1886
self.stop_checker()
1466
1893
return dbus.Boolean(bool(self.approvals_pending))
1467
1894
1468
1895
# ApprovedByDefault - property
1469
@dbus_service_property(_interface, signature="b",
1896
@dbus_service_property(_interface,
1897
signature="b",
1470
1898
access="readwrite")
1471
1899
def ApprovedByDefault_dbus_property(self, value=None):
1472
1900
if value is None: # get
1474
1902
self.approved_by_default = bool(value)
1475
1903
1476
1904
# ApprovalDelay - property
1477
@dbus_service_property(_interface, signature="t",
1905
@dbus_service_property(_interface,
1906
signature="t",
1478
1907
access="readwrite")
1479
1908
def ApprovalDelay_dbus_property(self, value=None):
1480
1909
if value is None: # get
1481
return dbus.UInt64(self.approval_delay_milliseconds())
1910
return dbus.UInt64(self.approval_delay.total_seconds()
1911
* 1000)
1482
1912
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1483
1913
1484
1914
# ApprovalDuration - property
1485
@dbus_service_property(_interface, signature="t",
1915
@dbus_service_property(_interface,
1916
signature="t",
1486
1917
access="readwrite")
1487
1918
def ApprovalDuration_dbus_property(self, value=None):
1488
1919
if value is None: # get
1489
return dbus.UInt64(timedelta_to_milliseconds(
1490
self.approval_duration))
1920
return dbus.UInt64(self.approval_duration.total_seconds()
1921
* 1000)
1491
1922
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1492
1923
1493
1924
# Name - property
1925
@dbus_annotations(
1926
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1494
1927
@dbus_service_property(_interface, signature="s", access="read")
1495
1928
def Name_dbus_property(self):
1496
1929
return dbus.String(self.name)
1497
1930
1498
1931
# Fingerprint - property
1932
@dbus_annotations(
1933
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1499
1934
@dbus_service_property(_interface, signature="s", access="read")
1500
1935
def Fingerprint_dbus_property(self):
1501
1936
return dbus.String(self.fingerprint)
1502
1937
1503
1938
# Host - property
1504
@dbus_service_property(_interface, signature="s",
1939
@dbus_service_property(_interface,
1940
signature="s",
1505
1941
access="readwrite")
1506
1942
def Host_dbus_property(self, value=None):
1507
1943
if value is None: # get
1508
1944
return dbus.String(self.host)
1509
self.host = unicode(value)
1945
self.host = str(value)
1510
1946
1511
1947
# Created - property
1948
@dbus_annotations(
1949
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1512
1950
@dbus_service_property(_interface, signature="s", access="read")
1513
1951
def Created_dbus_property(self):
1514
1952
return datetime_to_dbus(self.created)
1519
1957
return datetime_to_dbus(self.last_enabled)
1520
1958
1521
1959
# Enabled - property
1522
@dbus_service_property(_interface, signature="b",
1960
@dbus_service_property(_interface,
1961
signature="b",
1523
1962
access="readwrite")
1524
1963
def Enabled_dbus_property(self, value=None):
1525
1964
if value is None: # get
1530
1969
self.disable()
1531
1970
1532
1971
# LastCheckedOK - property
1533
@dbus_service_property(_interface, signature="s",
1972
@dbus_service_property(_interface,
1973
signature="s",
1534
1974
access="readwrite")
1535
1975
def LastCheckedOK_dbus_property(self, value=None):
1536
1976
if value is not None:
1539
1979
return datetime_to_dbus(self.last_checked_ok)
1540
1980
1541
1981
# LastCheckerStatus - property
1542
@dbus_service_property(_interface, signature="n",
1543
access="read")
1982
@dbus_service_property(_interface, signature="n", access="read")
1544
1983
def LastCheckerStatus_dbus_property(self):
1545
1984
return dbus.Int16(self.last_checker_status)
1546
1985
1555
1994
return datetime_to_dbus(self.last_approval_request)
1556
1995
1557
1996
# Timeout - property
1558
@dbus_service_property(_interface, signature="t",
1997
@dbus_service_property(_interface,
1998
signature="t",
1559
1999
access="readwrite")
1560
2000
def Timeout_dbus_property(self, value=None):
1561
2001
if value is None: # get
1562
return dbus.UInt64(self.timeout_milliseconds())
2002
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1563
2003
old_timeout = self.timeout
1564
2004
self.timeout = datetime.timedelta(0, 0, 0, value)
1565
2005
# Reschedule disabling
1574
2014
is None):
1575
2015
return
1576
2016
gobject.source_remove(self.disable_initiator_tag)
1577
self.disable_initiator_tag = (
1578
gobject.timeout_add(
1579
timedelta_to_milliseconds(self.expires - now),
1580
self.disable))
2017
self.disable_initiator_tag = gobject.timeout_add(
2018
int((self.expires - now).total_seconds() * 1000),
2019
self.disable)
1581
2020
1582
2021
# ExtendedTimeout - property
1583
@dbus_service_property(_interface, signature="t",
2022
@dbus_service_property(_interface,
2023
signature="t",
1584
2024
access="readwrite")
1585
2025
def ExtendedTimeout_dbus_property(self, value=None):
1586
2026
if value is None: # get
1587
return dbus.UInt64(self.extended_timeout_milliseconds())
2027
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
* 1000)
1588
2029
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1589
2030
1590
2031
# Interval - property
1591
@dbus_service_property(_interface, signature="t",
2032
@dbus_service_property(_interface,
2033
signature="t",
1592
2034
access="readwrite")
1593
2035
def Interval_dbus_property(self, value=None):
1594
2036
if value is None: # get
1595
return dbus.UInt64(self.interval_milliseconds())
2037
return dbus.UInt64(self.interval.total_seconds() * 1000)
1596
2038
self.interval = datetime.timedelta(0, 0, 0, value)
1597
2039
if getattr(self, "checker_initiator_tag", None) is None:
1598
2040
return
1599
2041
if self.enabled:
1600
2042
# Reschedule checker run
1601
2043
gobject.source_remove(self.checker_initiator_tag)
1602
self.checker_initiator_tag = (gobject.timeout_add
1603
(value, self.start_checker))
1604
self.start_checker() # Start one now, too
2044
self.checker_initiator_tag = gobject.timeout_add(
2045
value, self.start_checker)
2046
self.start_checker() # Start one now, too
1605
2047
1606
2048
# Checker - property
1607
@dbus_service_property(_interface, signature="s",
2049
@dbus_service_property(_interface,
2050
signature="s",
1608
2051
access="readwrite")
1609
2052
def Checker_dbus_property(self, value=None):
1610
2053
if value is None: # get
1611
2054
return dbus.String(self.checker_command)
1612
self.checker_command = unicode(value)
2055
self.checker_command = str(value)
1613
2056
1614
2057
# CheckerRunning - property
1615
@dbus_service_property(_interface, signature="b",
2058
@dbus_service_property(_interface,
2059
signature="b",
1616
2060
access="readwrite")
1617
2061
def CheckerRunning_dbus_property(self, value=None):
1618
2062
if value is None: # get
1623
2067
self.stop_checker()
1624
2068
1625
2069
# ObjectPath - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
"org.freedesktop.DBus.Deprecated": "true"})
1626
2073
@dbus_service_property(_interface, signature="o", access="read")
1627
2074
def ObjectPath_dbus_property(self):
1628
2075
return self.dbus_object_path # is already a dbus.ObjectPath
1629
2076
1630
2077
# Secret = property
1631
@dbus_service_property(_interface, signature="ay",
1632
access="write", byte_arrays=True)
2078
@dbus_annotations(
2079
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2080
"invalidates"})
2081
@dbus_service_property(_interface,
2082
signature="ay",
2083
access="write",
2084
byte_arrays=True)
1633
2085
def Secret_dbus_property(self, value):
1634
self.secret = str(value)
2086
self.secret = bytes(value)
1635
2087
1636
2088
del _interface
1637
2089
1641
2093
self._pipe = child_pipe
1642
2094
self._pipe.send(('init', fpr, address))
1643
2095
if not self._pipe.recv():
1644
raise KeyError()
2096
raise KeyError(fpr)
1645
2097
1646
2098
def __getattribute__(self, name):
1647
2099
if name == '_pipe':
1651
2103
if data[0] == 'data':
1652
2104
return data[1]
1653
2105
if data[0] == 'function':
2106
1654
2107
def func(*args, **kwargs):
1655
2108
self._pipe.send(('funcall', name, args, kwargs))
1656
2109
return self._pipe.recv()[1]
2110
1657
2111
return func
1658
2112
1659
2113
def __setattr__(self, name, value):
1671
2125
def handle(self):
1672
2126
with contextlib.closing(self.server.child_pipe) as child_pipe:
1673
2127
logger.info("TCP connection from: %s",
1674
unicode(self.client_address))
2128
str(self.client_address))
1675
2129
logger.debug("Pipe FD: %d",
1676
2130
self.server.child_pipe.fileno())
1677
2131
1678
session = (gnutls.connection
1679
.ClientSession(self.request,
1680
gnutls.connection
1681
.X509Credentials()))
1682
1683
# Note: gnutls.connection.X509Credentials is really a
1684
# generic GnuTLS certificate credentials object so long as
1685
# no X.509 keys are added to it. Therefore, we can use it
1686
# here despite using OpenPGP certificates.
2132
session = gnutls.ClientSession(self.request)
1687
2133
1688
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1689
2135
# "+AES-256-CBC", "+SHA1",
1693
2139
priority = self.server.gnutls_priority
1694
2140
if priority is None:
1695
2141
priority = "NORMAL"
1696
(gnutls.library.functions
1697
.gnutls_priority_set_direct(session._c_object,
1698
priority, None))
2142
gnutls.priority_set_direct(session._c_object, priority,
2143
None)
1699
2144
1700
2145
# Start communication using the Mandos protocol
1701
2146
# Get protocol number
1711
2156
# Start GnuTLS connection
1712
2157
try:
1713
2158
session.handshake()
1714
except gnutls.errors.GNUTLSError as error:
2159
except gnutls.Error as error:
1715
2160
logger.warning("Handshake failed: %s", error)
1716
2161
# Do not run session.bye() here: the session is not
1717
2162
# established. Just abandon the request.
1721
2166
approval_required = False
1722
2167
try:
1723
2168
try:
1724
fpr = self.fingerprint(self.peer_certificate
1725
(session))
1726
except (TypeError,
1727
gnutls.errors.GNUTLSError) as error:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
1728
2172
logger.warning("Bad certificate: %s", error)
1729
2173
return
1730
2174
logger.debug("Fingerprint: %s", fpr)
1743
2187
while True:
1744
2188
if not client.enabled:
1745
2189
logger.info("Client %s is disabled",
1746
client.name)
2190
client.name)
1747
2191
if self.server.use_dbus:
1748
2192
# Emit D-Bus signal
1749
2193
client.Rejected("Disabled")
1758
2202
if self.server.use_dbus:
1759
2203
# Emit D-Bus signal
1760
2204
client.NeedApproval(
1761
client.approval_delay_milliseconds(),
1762
client.approved_by_default)
2205
client.approval_delay.total_seconds()
2206
* 1000, client.approved_by_default)
1763
2207
else:
1764
2208
logger.warning("Client %s was not approved",
1765
2209
client.name)
1771
2215
#wait until timeout or approved
1772
2216
time = datetime.datetime.now()
1773
2217
client.changedstate.acquire()
1774
client.changedstate.wait(
1775
float(timedelta_to_milliseconds(delay)
1776
/ 1000))
2218
client.changedstate.wait(delay.total_seconds())
1777
2219
client.changedstate.release()
1778
2220
time2 = datetime.datetime.now()
1779
2221
if (time2 - time) >= delay:
1790
2232
else:
1791
2233
delay -= time2 - time
1792
2234
1793
sent_size = 0
1794
while sent_size < len(client.secret):
1795
try:
1796
sent = session.send(client.secret[sent_size:])
1797
except gnutls.errors.GNUTLSError as error:
1798
logger.warning("gnutls send failed",
1799
exc_info=error)
1800
return
1801
logger.debug("Sent: %d, remaining: %d",
1802
sent, len(client.secret)
1803
- (sent_size + sent))
1804
sent_size += sent
2235
try:
2236
session.send(client.secret)
2237
except gnutls.Error as error:
2238
logger.warning("gnutls send failed",
2239
exc_info = error)
2240
return
1805
2241
1806
2242
logger.info("Sending secret to %s", client.name)
1807
2243
# bump the timeout using extended_timeout
1815
2251
client.approvals_pending -= 1
1816
2252
try:
1817
2253
session.bye()
1818
except gnutls.errors.GNUTLSError as error:
2254
except gnutls.Error as error:
1819
2255
logger.warning("GnuTLS bye failed",
1820
2256
exc_info=error)
1821
2257
1823
2259
def peer_certificate(session):
1824
2260
"Return the peer's OpenPGP certificate as a bytestring"
1825
2261
# If not an OpenPGP certificate...
1826
if (gnutls.library.functions
1827
.gnutls_certificate_type_get(session._c_object)
1828
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1829
# ...do the normal thing
1830
return session.peer_certificate
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2264
# ...return invalid data
2265
return b""
1831
2266
list_size = ctypes.c_uint(1)
1832
cert_list = (gnutls.library.functions
1833
.gnutls_certificate_get_peers
2267
cert_list = (gnutls.certificate_get_peers
1834
2268
(session._c_object, ctypes.byref(list_size)))
1835
2269
if not bool(cert_list) and list_size.value != 0:
1836
raise gnutls.errors.GNUTLSError("error getting peer"
1837
" certificate")
2270
raise gnutls.Error("error getting peer certificate")
1838
2271
if list_size.value == 0:
1839
2272
return None
1840
2273
cert = cert_list[0]
1844
2277
def fingerprint(openpgp):
1845
2278
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1846
2279
# New GnuTLS "datum" with the OpenPGP public key
1847
datum = (gnutls.library.types
1848
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1849
ctypes.POINTER
1850
(ctypes.c_ubyte)),
1851
ctypes.c_uint(len(openpgp))))
2280
datum = gnutls.datum_t(
2281
ctypes.cast(ctypes.c_char_p(openpgp),
2282
ctypes.POINTER(ctypes.c_ubyte)),
2283
ctypes.c_uint(len(openpgp)))
1852
2284
# New empty GnuTLS certificate
1853
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1854
(gnutls.library.functions
1855
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2285
crt = gnutls.openpgp_crt_t()
2286
gnutls.openpgp_crt_init(ctypes.byref(crt))
1856
2287
# Import the OpenPGP public key into the certificate
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1859
gnutls.library.constants
1860
.GNUTLS_OPENPGP_FMT_RAW))
2288
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2289
gnutls.OPENPGP_FMT_RAW)
1861
2290
# Verify the self signature in the key
1862
2291
crtverify = ctypes.c_uint()
1863
(gnutls.library.functions
1864
.gnutls_openpgp_crt_verify_self(crt, 0,
1865
ctypes.byref(crtverify)))
2292
gnutls.openpgp_crt_verify_self(crt, 0,
2293
ctypes.byref(crtverify))
1866
2294
if crtverify.value != 0:
1867
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1868
raise (gnutls.errors.CertificateSecurityError
1869
("Verify failed"))
2295
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
1870
2297
# New buffer for the fingerprint
1871
2298
buf = ctypes.create_string_buffer(20)
1872
2299
buf_len = ctypes.c_size_t()
1873
2300
# Get the fingerprint from the certificate into the buffer
1874
(gnutls.library.functions
1875
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1876
ctypes.byref(buf_len)))
2301
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2302
ctypes.byref(buf_len))
1877
2303
# Deinit the certificate
1878
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2304
gnutls.openpgp_crt_deinit(crt)
1879
2305
# Convert the buffer to a Python bytestring
1880
2306
fpr = ctypes.string_at(buf, buf_len.value)
1881
2307
# Convert the bytestring to hexadecimal notation
1885
2311
1886
2312
class MultiprocessingMixIn(object):
1887
2313
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
1888
2315
def sub_process_main(self, request, address):
1889
2316
try:
1890
2317
self.finish_request(request, address)
1902
2329
1903
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1904
2331
""" adds a pipe to the MixIn """
2332
1905
2333
def process_request(self, request, client_address):
1906
2334
"""Overrides and wraps the original process_request().
1907
2335
1928
2356
interface: None or a network interface name (string)
1929
2357
use_ipv6: Boolean; to use IPv6 or not
1930
2358
"""
2359
1931
2360
def __init__(self, server_address, RequestHandlerClass,
1932
interface=None, use_ipv6=True, socketfd=None):
2361
interface=None,
2362
use_ipv6=True,
2363
socketfd=None):
1933
2364
"""If socketfd is set, use that file descriptor instead of
1934
2365
creating a new one with socket.socket().
1935
2366
"""
1976
2407
self.interface)
1977
2408
else:
1978
2409
try:
1979
self.socket.setsockopt(socket.SOL_SOCKET,
1980
SO_BINDTODEVICE,
1981
str(self.interface + '\0'))
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
1982
2413
except socket.error as error:
1983
2414
if error.errno == errno.EPERM:
1984
2415
logger.error("No permission to bind to"
2002
2433
self.server_address = (any_address,
2003
2434
self.server_address[1])
2004
2435
elif not self.server_address[1]:
2005
self.server_address = (self.server_address[0],
2006
0)
2436
self.server_address = (self.server_address[0], 0)
2007
2437
# if self.interface:
2008
2438
# self.server_address = (self.server_address[0],
2009
2439
# 0, # port
2023
2453
2024
2454
Assumes a gobject.MainLoop event loop.
2025
2455
"""
2456
2026
2457
def __init__(self, server_address, RequestHandlerClass,
2027
interface=None, use_ipv6=True, clients=None,
2028
gnutls_priority=None, use_dbus=True, socketfd=None):
2458
interface=None,
2459
use_ipv6=True,
2460
clients=None,
2461
gnutls_priority=None,
2462
use_dbus=True,
2463
socketfd=None):
2029
2464
self.enabled = False
2030
2465
self.clients = clients
2031
2466
if self.clients is None:
2037
2472
interface = interface,
2038
2473
use_ipv6 = use_ipv6,
2039
2474
socketfd = socketfd)
2475
2040
2476
def server_activate(self):
2041
2477
if self.enabled:
2042
2478
return socketserver.TCPServer.server_activate(self)
2046
2482
2047
2483
def add_pipe(self, parent_pipe, proc):
2048
2484
# Call "handle_ipc" for both data and EOF events
2049
gobject.io_add_watch(parent_pipe.fileno(),
2050
gobject.IO_IN | gobject.IO_HUP,
2051
functools.partial(self.handle_ipc,
2052
parent_pipe =
2053
parent_pipe,
2054
proc = proc))
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2488
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2055
2491
2056
def handle_ipc(self, source, condition, parent_pipe=None,
2057
proc = None, client_object=None):
2492
def handle_ipc(self, source, condition,
2493
parent_pipe=None,
2494
proc = None,
2495
client_object=None):
2058
2496
# error, or the other end of multiprocessing.Pipe has closed
2059
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2060
2498
# Wait for other process to exit
2083
2521
parent_pipe.send(False)
2084
2522
return False
2085
2523
2086
gobject.io_add_watch(parent_pipe.fileno(),
2087
gobject.IO_IN | gobject.IO_HUP,
2088
functools.partial(self.handle_ipc,
2089
parent_pipe =
2090
parent_pipe,
2091
proc = proc,
2092
client_object =
2093
client))
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2527
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2094
2531
parent_pipe.send(True)
2095
2532
# remove the old hook in favor of the new above hook on
2096
2533
# same fileno
2102
2539
2103
2540
parent_pipe.send(('data', getattr(client_object,
2104
2541
funcname)(*args,
2105
**kwargs)))
2542
**kwargs)))
2106
2543
2107
2544
if command == 'getattr':
2108
2545
attrname = request[1]
2109
if callable(client_object.__getattribute__(attrname)):
2110
parent_pipe.send(('function',))
2546
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
2111
2549
else:
2112
parent_pipe.send(('data', client_object
2113
.__getattribute__(attrname)))
2550
parent_pipe.send((
2551
'data', client_object.__getattribute__(attrname)))
2114
2552
2115
2553
if command == 'setattr':
2116
2554
attrname = request[1]
2147
2585
# avoid excessive use of external libraries.
2148
2586
2149
2587
# New type for defining tokens, syntax, and semantics all-in-one
2150
Token = collections.namedtuple("Token",
2151
("regexp", # To match token; if
2152
# "value" is not None,
2153
# must have a "group"
2154
# containing digits
2155
"value", # datetime.timedelta or
2156
# None
2157
"followers")) # Tokens valid after
2158
# this token
2588
Token = collections.namedtuple("Token", (
2589
"regexp", # To match token; if "value" is not None, must have
2590
# a "group" containing digits
2591
"value", # datetime.timedelta or None
2592
"followers")) # Tokens valid after this token
2159
2593
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2160
2594
# the "duration" ABNF definition in RFC 3339, Appendix A.
2161
2595
token_end = Token(re.compile(r"$"), None, frozenset())
2162
2596
token_second = Token(re.compile(r"(\d+)S"),
2163
2597
datetime.timedelta(seconds=1),
2164
frozenset((token_end,)))
2598
frozenset((token_end, )))
2165
2599
token_minute = Token(re.compile(r"(\d+)M"),
2166
2600
datetime.timedelta(minutes=1),
2167
2601
frozenset((token_second, token_end)))
2183
2617
frozenset((token_month, token_end)))
2184
2618
token_week = Token(re.compile(r"(\d+)W"),
2185
2619
datetime.timedelta(weeks=1),
2186
frozenset((token_end,)))
2620
frozenset((token_end, )))
2187
2621
token_duration = Token(re.compile(r"P"), None,
2188
2622
frozenset((token_year, token_month,
2189
2623
token_day, token_time,
2190
token_week))),
2624
token_week)))
2191
2625
# Define starting values
2192
2626
value = datetime.timedelta() # Value so far
2193
2627
found_token = None
2194
followers = frozenset(token_duration,) # Following valid tokens
2628
followers = frozenset((token_duration, )) # Following valid tokens
2195
2629
s = duration # String left to parse
2196
2630
# Loop until end token is found
2197
2631
while found_token is not token_end:
2214
2648
break
2215
2649
else:
2216
2650
# No currently valid tokens were found
2217
raise ValueError("Invalid RFC 3339 duration")
2651
raise ValueError("Invalid RFC 3339 duration: {!r}"
2652
.format(duration))
2218
2653
# End token found
2219
2654
return value
2220
2655
2244
2679
timevalue = datetime.timedelta(0)
2245
2680
for s in interval.split():
2246
2681
try:
2247
suffix = unicode(s[-1])
2682
suffix = s[-1]
2248
2683
value = int(s[:-1])
2249
2684
if suffix == "d":
2250
2685
delta = datetime.timedelta(value)
2257
2692
elif suffix == "w":
2258
2693
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2259
2694
else:
2260
raise ValueError("Unknown suffix {0!r}"
2261
.format(suffix))
2695
raise ValueError("Unknown suffix {!r}".format(suffix))
2262
2696
except IndexError as e:
2263
2697
raise ValueError(*(e.args))
2264
2698
timevalue += delta
2281
2715
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2282
2716
if not stat.S_ISCHR(os.fstat(null).st_mode):
2283
2717
raise OSError(errno.ENODEV,
2284
"{0} not a character device"
2718
"{} not a character device"
2285
2719
.format(os.devnull))
2286
2720
os.dup2(null, sys.stdin.fileno())
2287
2721
os.dup2(null, sys.stdout.fileno())
2297
2731
2298
2732
parser = argparse.ArgumentParser()
2299
2733
parser.add_argument("-v", "--version", action="version",
2300
version = "%(prog)s {0}".format(version),
2734
version = "%(prog)s {}".format(version),
2301
2735
help="show version number and exit")
2302
2736
parser.add_argument("-i", "--interface", metavar="IF",
2303
2737
help="Bind to interface IF")
2336
2770
help="Directory to save/restore state in")
2337
2771
parser.add_argument("--foreground", action="store_true",
2338
2772
help="Run in foreground", default=None)
2773
parser.add_argument("--no-zeroconf", action="store_false",
2774
dest="zeroconf", help="Do not use Zeroconf",
2775
default=None)
2339
2776
2340
2777
options = parser.parse_args()
2341
2778
2350
2787
"port": "",
2351
2788
"debug": "False",
2352
2789
"priority":
2353
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2354
2792
"servicename": "Mandos",
2355
2793
"use_dbus": "True",
2356
2794
"use_ipv6": "True",
2359
2797
"socket": "",
2360
2798
"statedir": "/var/lib/mandos",
2361
2799
"foreground": "False",
2362
}
2800
"zeroconf": "True",
2801
}
2363
2802
2364
2803
# Parse config file for server-global settings
2365
2804
server_config = configparser.SafeConfigParser(server_defaults)
2366
2805
del server_defaults
2367
server_config.read(os.path.join(options.configdir,
2368
"mandos.conf"))
2806
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2369
2807
# Convert the SafeConfigParser object to a dict
2370
2808
server_settings = server_config.defaults()
2371
2809
# Use the appropriate methods on the non-string config options
2389
2827
# Override the settings from the config file with command line
2390
2828
# options, if set.
2391
2829
for option in ("interface", "address", "port", "debug",
2392
"priority", "servicename", "configdir",
2393
"use_dbus", "use_ipv6", "debuglevel", "restore",
2394
"statedir", "socket", "foreground"):
2830
"priority", "servicename", "configdir", "use_dbus",
2831
"use_ipv6", "debuglevel", "restore", "statedir",
2832
"socket", "foreground", "zeroconf"):
2395
2833
value = getattr(options, option)
2396
2834
if value is not None:
2397
2835
server_settings[option] = value
2398
2836
del options
2399
2837
# Force all strings to be unicode
2400
2838
for option in server_settings.keys():
2401
if type(server_settings[option]) is str:
2402
server_settings[option] = unicode(server_settings[option])
2839
if isinstance(server_settings[option], bytes):
2840
server_settings[option] = (server_settings[option]
2841
.decode("utf-8"))
2403
2842
# Force all boolean options to be boolean
2404
2843
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2405
"foreground"):
2844
"foreground", "zeroconf"):
2406
2845
server_settings[option] = bool(server_settings[option])
2407
2846
# Debug implies foreground
2408
2847
if server_settings["debug"]:
2411
2850
2412
2851
##################################################################
2413
2852
2853
if (not server_settings["zeroconf"]
2854
and not (server_settings["port"]
2855
or server_settings["socket"] != "")):
2856
parser.error("Needs port or socket to work without Zeroconf")
2857
2414
2858
# For convenience
2415
2859
debug = server_settings["debug"]
2416
2860
debuglevel = server_settings["debuglevel"]
2419
2863
stored_state_path = os.path.join(server_settings["statedir"],
2420
2864
stored_state_file)
2421
2865
foreground = server_settings["foreground"]
2866
zeroconf = server_settings["zeroconf"]
2422
2867
2423
2868
if debug:
2424
2869
initlogger(debug, logging.DEBUG)
2430
2875
initlogger(debug, level)
2431
2876
2432
2877
if server_settings["servicename"] != "Mandos":
2433
syslogger.setFormatter(logging.Formatter
2434
('Mandos ({0}) [%(process)d]:'
2435
' %(levelname)s: %(message)s'
2436
.format(server_settings
2437
["servicename"])))
2878
syslogger.setFormatter(
2879
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
' %(levelname)s: %(message)s'.format(
2881
server_settings["servicename"])))
2438
2882
2439
2883
# Parse config file with clients
2440
2884
client_config = configparser.SafeConfigParser(Client
2445
2889
global mandos_dbus_service
2446
2890
mandos_dbus_service = None
2447
2891
2448
tcp_server = MandosServer((server_settings["address"],
2449
server_settings["port"]),
2450
ClientHandler,
2451
interface=(server_settings["interface"]
2452
or None),
2453
use_ipv6=use_ipv6,
2454
gnutls_priority=
2455
server_settings["priority"],
2456
use_dbus=use_dbus,
2457
socketfd=(server_settings["socket"]
2458
or None))
2892
socketfd = None
2893
if server_settings["socket"] != "":
2894
socketfd = server_settings["socket"]
2895
tcp_server = MandosServer(
2896
(server_settings["address"], server_settings["port"]),
2897
ClientHandler,
2898
interface=(server_settings["interface"] or None),
2899
use_ipv6=use_ipv6,
2900
gnutls_priority=server_settings["priority"],
2901
use_dbus=use_dbus,
2902
socketfd=socketfd)
2459
2903
if not foreground:
2460
2904
pidfilename = "/run/mandos.pid"
2461
2905
if not os.path.isdir("/run/."):
2462
2906
pidfilename = "/var/run/mandos.pid"
2463
2907
pidfile = None
2464
2908
try:
2465
pidfile = open(pidfilename, "w")
2909
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2466
2910
except IOError as e:
2467
2911
logger.error("Could not open file %r", pidfilename,
2468
2912
exc_info=e)
2489
2933
2490
2934
# "Use a log level over 10 to enable all debugging options."
2491
2935
# - GnuTLS manual
2492
gnutls.library.functions.gnutls_global_set_log_level(11)
2936
gnutls.global_set_log_level(11)
2493
2937
2494
@gnutls.library.types.gnutls_log_func
2938
@gnutls.log_func
2495
2939
def debug_gnutls(level, string):
2496
2940
logger.debug("GnuTLS: %s", string[:-1])
2497
2941
2498
(gnutls.library.functions
2499
.gnutls_global_set_log_function(debug_gnutls))
2942
gnutls.global_set_log_function(debug_gnutls)
2500
2943
2501
2944
# Redirect stdin so all checkers get /dev/null
2502
2945
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2522
2965
if use_dbus:
2523
2966
try:
2524
2967
bus_name = dbus.service.BusName("se.recompile.Mandos",
2525
bus, do_not_queue=True)
2526
old_bus_name = (dbus.service.BusName
2527
("se.bsnet.fukt.Mandos", bus,
2528
do_not_queue=True))
2529
except dbus.exceptions.NameExistsException as e:
2968
bus,
2969
do_not_queue=True)
2970
old_bus_name = dbus.service.BusName(
2971
"se.bsnet.fukt.Mandos", bus,
2972
do_not_queue=True)
2973
except dbus.exceptions.DBusException as e:
2530
2974
logger.error("Disabling D-Bus:", exc_info=e)
2531
2975
use_dbus = False
2532
2976
server_settings["use_dbus"] = False
2533
2977
tcp_server.use_dbus = False
2534
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2535
service = AvahiServiceToSyslog(name =
2536
server_settings["servicename"],
2537
servicetype = "_mandos._tcp",
2538
protocol = protocol, bus = bus)
2539
if server_settings["interface"]:
2540
service.interface = (if_nametoindex
2541
(str(server_settings["interface"])))
2978
if zeroconf:
2979
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
2985
if server_settings["interface"]:
2986
service.interface = if_nametoindex(
2987
server_settings["interface"].encode("utf-8"))
2542
2988
2543
2989
global multiprocessing_manager
2544
2990
multiprocessing_manager = multiprocessing.Manager()
2563
3009
if server_settings["restore"]:
2564
3010
try:
2565
3011
with open(stored_state_path, "rb") as stored_state:
2566
clients_data, old_client_settings = (pickle.load
2567
(stored_state))
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
2568
3014
os.remove(stored_state_path)
2569
3015
except IOError as e:
2570
3016
if e.errno == errno.ENOENT:
2571
logger.warning("Could not load persistent state: {0}"
2572
.format(os.strerror(e.errno)))
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
2573
3019
else:
2574
3020
logger.critical("Could not load persistent state:",
2575
3021
exc_info=e)
2576
3022
raise
2577
3023
except EOFError as e:
2578
3024
logger.warning("Could not load persistent state: "
2579
"EOFError:", exc_info=e)
3025
"EOFError:",
3026
exc_info=e)
2580
3027
2581
3028
with PGPEngine() as pgp:
2582
for client_name, client in clients_data.iteritems():
3029
for client_name, client in clients_data.items():
2583
3030
# Skip removed clients
2584
3031
if client_name not in client_settings:
2585
3032
continue
2594
3041
# For each value in new config, check if it
2595
3042
# differs from the old config value (Except for
2596
3043
# the "secret" attribute)
2597
if (name != "secret" and
2598
value != old_client_settings[client_name]
2599
[name]):
3044
if (name != "secret"
3045
and (value !=
3046
old_client_settings[client_name][name])):
2600
3047
client[name] = value
2601
3048
except KeyError:
2602
3049
pass
2603
3050
2604
3051
# Clients who has passed its expire date can still be
2605
# enabled if its last checker was successful. Clients
3052
# enabled if its last checker was successful. A Client
2606
3053
# whose checker succeeded before we stored its state is
2607
3054
# assumed to have successfully run all checkers during
2608
3055
# downtime.
2610
3057
if datetime.datetime.utcnow() >= client["expires"]:
2611
3058
if not client["last_checked_ok"]:
2612
3059
logger.warning(
2613
"disabling client {0} - Client never "
2614
"performed a successful checker"
2615
.format(client_name))
3060
"disabling client {} - Client never "
3061
"performed a successful checker".format(
3062
client_name))
2616
3063
client["enabled"] = False
2617
3064
elif client["last_checker_status"] != 0:
2618
3065
logger.warning(
2619
"disabling client {0} - Client "
2620
"last checker failed with error code {1}"
2621
.format(client_name,
2622
client["last_checker_status"]))
3066
"disabling client {} - Client last"
3067
" checker failed with error code"
3068
" {}".format(
3069
client_name,
3070
client["last_checker_status"]))
2623
3071
client["enabled"] = False
2624
3072
else:
2625
client["expires"] = (datetime.datetime
2626
.utcnow()
2627
+ client["timeout"])
3073
client["expires"] = (
3074
datetime.datetime.utcnow()
3075
+ client["timeout"])
2628
3076
logger.debug("Last checker succeeded,"
2629
" keeping {0} enabled"
2630
.format(client_name))
3077
" keeping {} enabled".format(
3078
client_name))
2631
3079
try:
2632
client["secret"] = (
2633
pgp.decrypt(client["encrypted_secret"],
2634
client_settings[client_name]
2635
["secret"]))
3080
client["secret"] = pgp.decrypt(
3081
client["encrypted_secret"],
3082
client_settings[client_name]["secret"])
2636
3083
except PGPError:
2637
3084
# If decryption fails, we use secret from new settings
2638
logger.debug("Failed to decrypt {0} old secret"
2639
.format(client_name))
2640
client["secret"] = (
2641
client_settings[client_name]["secret"])
3085
logger.debug("Failed to decrypt {} old secret".format(
3086
client_name))
3087
client["secret"] = (client_settings[client_name]
3088
["secret"])
2642
3089
2643
3090
# Add/remove clients based on new changes made to config
2644
3091
for client_name in (set(old_client_settings)
2649
3096
clients_data[client_name] = client_settings[client_name]
2650
3097
2651
3098
# Create all client objects
2652
for client_name, client in clients_data.iteritems():
3099
for client_name, client in clients_data.items():
2653
3100
tcp_server.clients[client_name] = client_class(
2654
name = client_name, settings = client,
3101
name = client_name,
3102
settings = client,
2655
3103
server_settings = server_settings)
2656
3104
2657
3105
if not tcp_server.clients:
2659
3107
2660
3108
if not foreground:
2661
3109
if pidfile is not None:
3110
pid = os.getpid()
2662
3111
try:
2663
3112
with pidfile:
2664
pid = os.getpid()
2665
pidfile.write(str(pid) + "\n".encode("utf-8"))
3113
print(pid, file=pidfile)
2666
3114
except IOError:
2667
3115
logger.error("Could not write to file %r with PID %d",
2668
3116
pidfilename, pid)
2673
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2674
3122
2675
3123
if use_dbus:
2676
@alternate_dbus_interfaces({"se.recompile.Mandos":
2677
"se.bsnet.fukt.Mandos"})
2678
class MandosDBusService(DBusObjectWithProperties):
3124
3125
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3127
class MandosDBusService(DBusObjectWithObjectManager):
2679
3128
"""A D-Bus proxy object"""
3129
2680
3130
def __init__(self):
2681
3131
dbus.service.Object.__init__(self, bus, "/")
3132
2682
3133
_interface = "se.recompile.Mandos"
2683
3134
2684
@dbus_interface_annotations(_interface)
2685
def _foo(self):
2686
return { "org.freedesktop.DBus.Property"
2687
".EmitsChangedSignal":
2688
"false"}
2689
2690
3135
@dbus.service.signal(_interface, signature="o")
2691
3136
def ClientAdded(self, objpath):
2692
3137
"D-Bus signal"
2697
3142
"D-Bus signal"
2698
3143
pass
2699
3144
3145
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
"true"})
2700
3147
@dbus.service.signal(_interface, signature="os")
2701
3148
def ClientRemoved(self, objpath, name):
2702
3149
"D-Bus signal"
2703
3150
pass
2704
3151
3152
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
"true"})
2705
3154
@dbus.service.method(_interface, out_signature="ao")
2706
3155
def GetAllClients(self):
2707
3156
"D-Bus method"
2708
return dbus.Array(c.dbus_object_path
2709
for c in
3157
return dbus.Array(c.dbus_object_path for c in
2710
3158
tcp_server.clients.itervalues())
2711
3159
3160
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
"true"})
2712
3162
@dbus.service.method(_interface,
2713
3163
out_signature="a{oa{sv}}")
2714
3164
def GetAllClientsWithProperties(self):
2715
3165
"D-Bus method"
2716
3166
return dbus.Dictionary(
2717
((c.dbus_object_path, c.GetAll(""))
2718
for c in tcp_server.clients.itervalues()),
3167
{ c.dbus_object_path: c.GetAll(
3168
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
2719
3170
signature="oa{sv}")
2720
3171
2721
3172
@dbus.service.method(_interface, in_signature="o")
2725
3176
if c.dbus_object_path == object_path:
2726
3177
del tcp_server.clients[c.name]
2727
3178
c.remove_from_connection()
2728
# Don't signal anything except ClientRemoved
3179
# Don't signal the disabling
2729
3180
c.disable(quiet=True)
2730
# Emit D-Bus signal
2731
self.ClientRemoved(object_path, c.name)
3181
# Emit D-Bus signal for removal
3182
self.client_removed_signal(c)
2732
3183
return
2733
3184
raise KeyError(object_path)
2734
3185
2735
3186
del _interface
3187
3188
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3190
def GetManagedObjects(self):
3191
"""D-Bus method"""
3192
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3200
def client_added_signal(self, client):
3201
"""Send the new standard signal and the old signal"""
3202
if use_dbus:
3203
# New standard signal
3204
self.InterfacesAdded(
3205
client.dbus_object_path,
3206
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3210
# Old signal
3211
self.ClientAdded(client.dbus_object_path)
3212
3213
def client_removed_signal(self, client):
3214
"""Send the new standard signal and the old signal"""
3215
if use_dbus:
3216
# New standard signal
3217
self.InterfacesRemoved(
3218
client.dbus_object_path,
3219
client._get_all_interface_names())
3220
# Old signal
3221
self.ClientRemoved(client.dbus_object_path,
3222
client.name)
2736
3223
2737
3224
mandos_dbus_service = MandosDBusService()
2738
3225
2739
3226
def cleanup():
2740
3227
"Cleanup function; run on exit"
2741
service.cleanup()
3228
if zeroconf:
3229
service.cleanup()
2742
3230
2743
3231
multiprocessing.active_children()
2744
3232
wnull.close()
2758
3246
2759
3247
# A list of attributes that can not be pickled
2760
3248
# + secret.
2761
exclude = set(("bus", "changedstate", "secret",
2762
"checker", "server_settings"))
2763
for name, typ in (inspect.getmembers
2764
(dbus.service.Object)):
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3251
for name, typ in inspect.getmembers(dbus.service
3252
.Object):
2765
3253
exclude.add(name)
2766
3254
2767
3255
client_dict["encrypted_secret"] = (client
2774
3262
del client_settings[client.name]["secret"]
2775
3263
2776
3264
try:
2777
with (tempfile.NamedTemporaryFile
2778
(mode='wb', suffix=".pickle", prefix='clients-',
2779
dir=os.path.dirname(stored_state_path),
2780
delete=False)) as stored_state:
3265
with tempfile.NamedTemporaryFile(
3266
mode='wb',
3267
suffix=".pickle",
3268
prefix='clients-',
3269
dir=os.path.dirname(stored_state_path),
3270
delete=False) as stored_state:
2781
3271
pickle.dump((clients, client_settings), stored_state)
2782
tempname=stored_state.name
3272
tempname = stored_state.name
2783
3273
os.rename(tempname, stored_state_path)
2784
3274
except (IOError, OSError) as e:
2785
3275
if not debug:
2788
3278
except NameError:
2789
3279
pass
2790
3280
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2791
logger.warning("Could not save persistent state: {0}"
3281
logger.warning("Could not save persistent state: {}"
2792
3282
.format(os.strerror(e.errno)))
2793
3283
else:
2794
3284
logger.warning("Could not save persistent state:",
2800
3290
name, client = tcp_server.clients.popitem()
2801
3291
if use_dbus:
2802
3292
client.remove_from_connection()
2803
# Don't signal anything except ClientRemoved
3293
# Don't signal the disabling
2804
3294
client.disable(quiet=True)
3295
# Emit D-Bus signal for removal
2805
3296
if use_dbus:
2806
# Emit D-Bus signal
2807
mandos_dbus_service.ClientRemoved(client
2808
.dbus_object_path,
2809
client.name)
3297
mandos_dbus_service.client_removed_signal(client)
2810
3298
client_settings.clear()
2811
3299
2812
3300
atexit.register(cleanup)
2813
3301
2814
3302
for client in tcp_server.clients.itervalues():
2815
3303
if use_dbus:
2816
# Emit D-Bus signal
2817
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3304
# Emit D-Bus signal for adding
3305
mandos_dbus_service.client_added_signal(client)
2818
3306
# Need to initiate checking of clients
2819
3307
if client.enabled:
2820
3308
client.init_checker()
2823
3311
tcp_server.server_activate()
2824
3312
2825
3313
# Find out what port we got
2826
service.port = tcp_server.socket.getsockname()[1]
3314
if zeroconf:
3315
service.port = tcp_server.socket.getsockname()[1]
2827
3316
if use_ipv6:
2828
3317
logger.info("Now listening on address %r, port %d,"
2829
3318
" flowinfo %d, scope_id %d",
2835
3324
#service.interface = tcp_server.socket.getsockname()[3]
2836
3325
2837
3326
try:
2838
# From the Avahi example code
2839
try:
2840
service.activate()
2841
except dbus.exceptions.DBusException as error:
2842
logger.critical("D-Bus Exception", exc_info=error)
2843
cleanup()
2844
sys.exit(1)
2845
# End of Avahi example code
3327
if zeroconf:
3328
# From the Avahi example code
3329
try:
3330
service.activate()
3331
except dbus.exceptions.DBusException as error:
3332
logger.critical("D-Bus Exception", exc_info=error)
3333
cleanup()
3334
sys.exit(1)
3335
# End of Avahi example code
2846
3336
2847
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2848
3338
lambda *args, **kwargs:
2863
3353
# Must run before the D-Bus bus name gets deregistered
2864
3354
cleanup()
2865
3355
3356
2866
3357
if __name__ == '__main__':
2867
3358
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0