To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.7.352
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.352
- Committer: Teddy Hogeborn
- Date: 2016-02-28 12:33:38 UTC
- mto: (237.7.594 trunk)
- mto: This revision was merged to the branch mainline in revision 331.
- Revision ID: teddy@recompile.se-20160228123338-l1v2745d89r4xofe
Also accept python-gi as alternative to python-gobject
* debian/control (Source: mandos/Build-Depends-Indep): Change
"python-gobject" to "python-gobject | python-gi".
(Package: mandos/Depends): - '' -
* debian/control (Source: mandos/Build-Depends-Indep): Change
"python-gobject" to "python-gobject | python-gi".
(Package: mandos/Depends): - '' -
- files added:
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
43
46
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
51
51
import sys
52
52
import re
53
53
import os
62
62
import struct
63
63
import fcntl
64
64
import functools
65
import cPickle as pickle
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
66
69
import multiprocessing
67
70
import types
68
71
import binascii
69
72
import tempfile
70
73
import itertools
71
74
import collections
75
import codecs
72
76
73
77
import dbus
74
78
import dbus.service
75
import gobject
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
76
83
import avahi
77
84
from dbus.mainloop.glib import DBusGMainLoop
78
85
import ctypes
88
95
except ImportError:
89
96
SO_BINDTODEVICE = None
90
97
91
version = "1.6.7"
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
92
102
stored_state_file = "clients.pickle"
93
103
94
104
logger = logging.getLogger()
95
105
syslogger = None
96
106
97
107
try:
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
101
110
except (OSError, AttributeError):
111
102
112
def if_nametoindex(interface):
103
113
"Get an interface index the hard way, i.e. using fcntl()"
104
114
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
115
with contextlib.closing(socket.socket()) as s:
106
116
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
117
struct.pack(b"16s16x", interface))
118
interface_index = struct.unpack("I", ifreq[16:20])[0]
111
119
return interface_index
112
120
113
121
115
123
"""init logger and add loglevel"""
116
124
117
125
global syslogger
118
syslogger = (logging.handlers.SysLogHandler
119
(facility =
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
122
129
syslogger.setFormatter(logging.Formatter
123
130
('Mandos [%(process)d]: %(levelname)s:'
124
131
' %(message)s'))
141
148
142
149
class PGPEngine(object):
143
150
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
144
152
def __init__(self):
145
153
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
146
154
self.gnupgargs = ['--batch',
185
193
186
194
def encrypt(self, data, password):
187
195
passphrase = self.password_encode(password)
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
189
) as passfile:
196
with tempfile.NamedTemporaryFile(
197
dir=self.tempdir) as passfile:
190
198
passfile.write(passphrase)
191
199
passfile.flush()
192
200
proc = subprocess.Popen(['gpg', '--symmetric',
203
211
204
212
def decrypt(self, data, password):
205
213
passphrase = self.password_encode(password)
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
207
) as passfile:
214
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
208
216
passfile.write(passphrase)
209
217
passfile.flush()
210
218
proc = subprocess.Popen(['gpg', '--decrypt',
214
222
stdin = subprocess.PIPE,
215
223
stdout = subprocess.PIPE,
216
224
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
218
= data)
225
decrypted_plaintext, err = proc.communicate(input = data)
219
226
if proc.returncode != 0:
220
227
raise PGPError(err)
221
228
return decrypted_plaintext
224
231
class AvahiError(Exception):
225
232
def __init__(self, value, *args, **kwargs):
226
233
self.value = value
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
234
return super(AvahiError, self).__init__(value, *args,
235
**kwargs)
236
230
237
231
238
class AvahiServiceError(AvahiError):
232
239
pass
233
240
241
234
242
class AvahiGroupError(AvahiError):
235
243
pass
236
244
256
264
bus: dbus.SystemBus()
257
265
"""
258
266
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
267
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
263
278
self.interface = interface
264
279
self.name = name
265
280
self.type = servicetype
275
290
self.bus = bus
276
291
self.entry_group_state_changed_match = None
277
292
278
def rename(self):
293
def rename(self, remove=True):
279
294
"""Derived from the Avahi example code"""
280
295
if self.rename_count >= self.max_renames:
281
296
logger.critical("No suitable Zeroconf service name found"
282
297
" after %i retries, exiting.",
283
298
self.rename_count)
284
299
raise AvahiServiceError("Too many renames")
285
self.name = unicode(self.server
286
.GetAlternativeServiceName(self.name))
300
self.name = str(
301
self.server.GetAlternativeServiceName(self.name))
302
self.rename_count += 1
287
303
logger.info("Changing Zeroconf service name to %r ...",
288
304
self.name)
289
self.remove()
305
if remove:
306
self.remove()
290
307
try:
291
308
self.add()
292
309
except dbus.exceptions.DBusException as error:
293
logger.critical("D-Bus Exception", exc_info=error)
294
self.cleanup()
295
os._exit(1)
296
self.rename_count += 1
310
if (error.get_dbus_name()
311
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
313
return self.rename(remove=False)
314
else:
315
logger.critical("D-Bus Exception", exc_info=error)
316
self.cleanup()
317
os._exit(1)
297
318
298
319
def remove(self):
299
320
"""Derived from the Avahi example code"""
337
358
self.rename()
338
359
elif state == avahi.ENTRY_GROUP_FAILURE:
339
360
logger.critical("Avahi: Error in group state changed %s",
340
unicode(error))
341
raise AvahiGroupError("State changed: {0!s}"
342
.format(error))
361
str(error))
362
raise AvahiGroupError("State changed: {!s}".format(error))
343
363
344
364
def cleanup(self):
345
365
"""Derived from the Avahi example code"""
355
375
def server_state_changed(self, state, error=None):
356
376
"""Derived from the Avahi example code"""
357
377
logger.debug("Avahi server state change: %i", state)
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
378
bad_states = {
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
383
}
365
384
if state in bad_states:
366
385
if bad_states[state] is not None:
367
386
if error is None:
370
389
logger.error(bad_states[state] + ": %r", error)
371
390
self.cleanup()
372
391
elif state == avahi.SERVER_RUNNING:
373
self.add()
392
try:
393
self.add()
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
398
" collision.")
399
return self.rename(remove=False)
400
else:
401
logger.critical("D-Bus Exception", exc_info=error)
402
self.cleanup()
403
os._exit(1)
374
404
else:
375
405
if error is None:
376
406
logger.debug("Unknown state: %r", state)
386
416
follow_name_owner_changes=True),
387
417
avahi.DBUS_INTERFACE_SERVER)
388
418
self.server.connect_to_signal("StateChanged",
389
self.server_state_changed)
419
self.server_state_changed)
390
420
self.server_state_changed(self.server.GetState())
391
421
392
422
393
423
class AvahiServiceToSyslog(AvahiService):
394
def rename(self):
424
def rename(self, *args, **kwargs):
395
425
"""Add the new name to the syslog messages"""
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({0}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
.format(self.name)))
401
430
return ret
402
431
403
404
def timedelta_to_milliseconds(td):
405
"Convert a datetime.timedelta() to milliseconds"
406
return ((td.days * 24 * 60 * 60 * 1000)
407
+ (td.seconds * 1000)
408
+ (td.microseconds // 1000))
409
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
450
451
# Constants
452
E_SUCCESS = 0
453
E_INTERRUPTED = -52
454
E_AGAIN = -28
455
CRT_OPENPGP = 2
456
CLIENT = 2
457
SHUT_RDWR = 0
458
CRD_CERTIFICATE = 1
459
E_NO_CERTIFICATE_FOUND = -49
460
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
462
# Types
463
class session_int(ctypes.Structure):
464
_fields_ = []
465
session_t = ctypes.POINTER(session_int)
466
class certificate_credentials_st(ctypes.Structure):
467
_fields_ = []
468
certificate_credentials_t = ctypes.POINTER(
469
certificate_credentials_st)
470
certificate_type_t = ctypes.c_int
471
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
475
_fields_ = []
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
480
transport_ptr_t = ctypes.c_void_p
481
close_request_t = ctypes.c_int
482
483
# Exceptions
484
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
490
# Default usage is by a message string, but if a return
491
# code is passed, convert it to a string with
492
# gnutls.strerror()
493
self.code = code
494
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
497
message, *args)
498
499
class CertificateSecurityError(Error):
500
pass
501
502
# Classes
503
class Credentials(object):
504
def __init__(self):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
508
self.type = gnutls.CRD_CERTIFICATE
509
510
def __del__(self):
511
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
520
True)
521
self.socket = socket
522
if credentials is None:
523
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
526
ctypes.c_void_p))
527
self.credentials = credentials
528
529
def __del__(self):
530
gnutls.deinit(self._c_object)
531
532
def handshake(self):
533
return gnutls.handshake(self._c_object)
534
535
def send(self, data):
536
data = bytes(data)
537
data_len = len(data)
538
while data_len > 0:
539
data_len -= gnutls.record_send(self._c_object,
540
data[-data_len:],
541
data_len)
542
543
def bye(self):
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
546
# Error handling functions
547
def _error_code(result):
548
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
550
if result >= 0:
551
return result
552
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
556
def _retry_on_error(result, func, arguments):
557
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
559
while result < 0:
560
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
return _error_code(result)
562
result = func(*arguments)
563
return result
564
565
# Unless otherwise indicated, the function declarations below are
566
# all from the gnutls/gnutls.h C header file.
567
568
# Functions
569
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
ctypes.POINTER(ctypes.c_char_p)]
572
priority_set_direct.restype = _error_code
573
574
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
init.restype = _error_code
577
578
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
580
set_default_priority.restype = _error_code
581
582
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
584
ctypes.c_size_t]
585
record_send.restype = ctypes.c_ssize_t
586
record_send.errcheck = _retry_on_error
587
588
certificate_allocate_credentials = (
589
_library.gnutls_certificate_allocate_credentials)
590
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
592
certificate_allocate_credentials.restype = _error_code
593
594
certificate_free_credentials = (
595
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
597
certificate_free_credentials.restype = None
598
599
handshake_set_private_extensions = (
600
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
602
ctypes.c_int]
603
handshake_set_private_extensions.restype = None
604
605
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
607
ctypes.c_void_p]
608
credentials_set.restype = _error_code
609
610
strerror = _library.gnutls_strerror
611
strerror.argtypes = [ctypes.c_int]
612
strerror.restype = ctypes.c_char_p
613
614
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
616
certificate_type_get.restype = _error_code
617
618
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
620
ctypes.POINTER(ctypes.c_uint)]
621
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
623
global_set_log_level = _library.gnutls_global_set_log_level
624
global_set_log_level.argtypes = [ctypes.c_int]
625
global_set_log_level.restype = None
626
627
global_set_log_function = _library.gnutls_global_set_log_function
628
global_set_log_function.argtypes = [log_func]
629
global_set_log_function.restype = None
630
631
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
633
deinit.restype = None
634
635
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
638
handshake.errcheck = _retry_on_error
639
640
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
transport_set_ptr.restype = None
643
644
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
647
bye.errcheck = _retry_on_error
648
649
check_version = _library.gnutls_check_version
650
check_version.argtypes = [ctypes.c_char_p]
651
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
682
# Remove non-public functions
683
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
686
687
def call_pipe(connection, # : multiprocessing.Connection
688
func, *args, **kwargs):
689
"""This function is meant to be called by multiprocessing.Process
690
691
This function runs func(*args, **kwargs), and writes the resulting
692
return value on the provided multiprocessing.Connection.
693
"""
694
connection.send(func(*args, **kwargs))
695
connection.close()
410
696
411
697
class Client(object):
412
698
"""A representation of a client host served by this server.
439
725
last_checker_status: integer between 0 and 255 reflecting exit
440
726
status of last checker. -1 reflects crashed
441
727
checker, -2 means no checker completed yet.
728
last_checker_signal: The signal which killed the last checker, if
729
last_checker_status is -1
442
730
last_enabled: datetime.datetime(); (UTC) or None
443
731
name: string; from the config file, used in log messages and
444
732
D-Bus identifiers
457
745
"fingerprint", "host", "interval",
458
746
"last_approval_request", "last_checked_ok",
459
747
"last_enabled", "name", "timeout")
460
client_defaults = { "timeout": "PT5M",
461
"extended_timeout": "PT15M",
462
"interval": "PT2M",
463
"checker": "fping -q -- %%(host)s",
464
"host": "",
465
"approval_delay": "PT0S",
466
"approval_duration": "PT1S",
467
"approved_by_default": "True",
468
"enabled": "True",
469
}
470
471
def timeout_milliseconds(self):
472
"Return the 'timeout' attribute in milliseconds"
473
return timedelta_to_milliseconds(self.timeout)
474
475
def extended_timeout_milliseconds(self):
476
"Return the 'extended_timeout' attribute in milliseconds"
477
return timedelta_to_milliseconds(self.extended_timeout)
478
479
def interval_milliseconds(self):
480
"Return the 'interval' attribute in milliseconds"
481
return timedelta_to_milliseconds(self.interval)
482
483
def approval_delay_milliseconds(self):
484
return timedelta_to_milliseconds(self.approval_delay)
748
client_defaults = {
749
"timeout": "PT5M",
750
"extended_timeout": "PT15M",
751
"interval": "PT2M",
752
"checker": "fping -q -- %%(host)s",
753
"host": "",
754
"approval_delay": "PT0S",
755
"approval_duration": "PT1S",
756
"approved_by_default": "True",
757
"enabled": "True",
758
}
485
759
486
760
@staticmethod
487
761
def config_parser(config):
503
777
client["enabled"] = config.getboolean(client_name,
504
778
"enabled")
505
779
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
506
783
client["fingerprint"] = (section["fingerprint"].upper()
507
784
.replace(" ", ""))
508
785
if "secret" in section:
513
790
"rb") as secfile:
514
791
client["secret"] = secfile.read()
515
792
else:
516
raise TypeError("No secret or secfile for section {0}"
793
raise TypeError("No secret or secfile for section {}"
517
794
.format(section))
518
795
client["timeout"] = string_to_delta(section["timeout"])
519
796
client["extended_timeout"] = string_to_delta(
536
813
server_settings = {}
537
814
self.server_settings = server_settings
538
815
# adding all client settings
539
for setting, value in settings.iteritems():
816
for setting, value in settings.items():
540
817
setattr(self, setting, value)
541
818
542
819
if self.enabled:
550
827
self.expires = None
551
828
552
829
logger.debug("Creating client %r", self.name)
553
# Uppercase and remove spaces from fingerprint for later
554
# comparison purposes with return value from the fingerprint()
555
# function
556
830
logger.debug(" Fingerprint: %s", self.fingerprint)
557
831
self.created = settings.get("created",
558
832
datetime.datetime.utcnow())
565
839
self.current_checker_command = None
566
840
self.approved = None
567
841
self.approvals_pending = 0
568
self.changedstate = (multiprocessing_manager
569
.Condition(multiprocessing_manager
570
.Lock()))
571
self.client_structure = [attr for attr in
572
self.__dict__.iterkeys()
842
self.changedstate = multiprocessing_manager.Condition(
843
multiprocessing_manager.Lock())
844
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
573
846
if not attr.startswith("_")]
574
847
self.client_structure.append("client_structure")
575
848
576
for name, t in inspect.getmembers(type(self),
577
lambda obj:
578
isinstance(obj,
579
property)):
849
for name, t in inspect.getmembers(
850
type(self), lambda obj: isinstance(obj, property)):
580
851
if not name.startswith("_"):
581
852
self.client_structure.append(name)
582
853
624
895
# and every interval from then on.
625
896
if self.checker_initiator_tag is not None:
626
897
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = (gobject.timeout_add
628
(self.interval_milliseconds(),
629
self.start_checker))
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
900
self.start_checker)
630
901
# Schedule a disable() when 'timeout' has passed
631
902
if self.disable_initiator_tag is not None:
632
903
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = (gobject.timeout_add
634
(self.timeout_milliseconds(),
635
self.disable))
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
636
906
# Also start a new checker *right now*.
637
907
self.start_checker()
638
908
639
def checker_callback(self, pid, condition, command):
909
def checker_callback(self, source, condition, connection,
910
command):
640
911
"""The checker has completed, so take appropriate actions."""
641
912
self.checker_callback_tag = None
642
913
self.checker = None
643
if os.WIFEXITED(condition):
644
self.last_checker_status = os.WEXITSTATUS(condition)
914
# Read return code from connection (see call_pipe)
915
returncode = connection.recv()
916
connection.close()
917
918
if returncode >= 0:
919
self.last_checker_status = returncode
920
self.last_checker_signal = None
645
921
if self.last_checker_status == 0:
646
922
logger.info("Checker for %(name)s succeeded",
647
923
vars(self))
648
924
self.checked_ok()
649
925
else:
650
logger.info("Checker for %(name)s failed",
651
vars(self))
926
logger.info("Checker for %(name)s failed", vars(self))
652
927
else:
653
928
self.last_checker_status = -1
929
self.last_checker_signal = -returncode
654
930
logger.warning("Checker for %(name)s crashed?",
655
931
vars(self))
932
return False
656
933
657
934
def checked_ok(self):
658
935
"""Assert that the client has been seen, alive and well."""
659
936
self.last_checked_ok = datetime.datetime.utcnow()
660
937
self.last_checker_status = 0
938
self.last_checker_signal = None
661
939
self.bump_timeout()
662
940
663
941
def bump_timeout(self, timeout=None):
668
946
gobject.source_remove(self.disable_initiator_tag)
669
947
self.disable_initiator_tag = None
670
948
if getattr(self, "enabled", False):
671
self.disable_initiator_tag = (gobject.timeout_add
672
(timedelta_to_milliseconds
673
(timeout), self.disable))
949
self.disable_initiator_tag = gobject.timeout_add(
950
int(timeout.total_seconds() * 1000), self.disable)
674
951
self.expires = datetime.datetime.utcnow() + timeout
675
952
676
953
def need_approval(self):
690
967
# than 'timeout' for the client to be disabled, which is as it
691
968
# should be.
692
969
693
# If a checker exists, make sure it is not a zombie
694
try:
695
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
696
except AttributeError:
697
pass
698
except OSError as error:
699
if error.errno != errno.ECHILD:
700
raise
701
else:
702
if pid:
703
logger.warning("Checker was a zombie")
704
gobject.source_remove(self.checker_callback_tag)
705
self.checker_callback(pid, status,
706
self.current_checker_command)
970
if self.checker is not None and not self.checker.is_alive():
971
logger.warning("Checker was not alive; joining")
972
self.checker.join()
973
self.checker = None
707
974
# Start a new checker if needed
708
975
if self.checker is None:
709
976
# Escape attributes for the shell
710
escaped_attrs = dict(
711
(attr, re.escape(unicode(getattr(self, attr))))
712
for attr in
713
self.runtime_expansions)
977
escaped_attrs = {
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
714
980
try:
715
981
command = self.checker_command % escaped_attrs
716
982
except TypeError as error:
717
983
logger.error('Could not format string "%s"',
718
self.checker_command, exc_info=error)
719
return True # Try again later
984
self.checker_command,
985
exc_info=error)
986
return True # Try again later
720
987
self.current_checker_command = command
721
try:
722
logger.info("Starting checker %r for %s",
723
command, self.name)
724
# We don't need to redirect stdout and stderr, since
725
# in normal mode, that is already done by daemon(),
726
# and in debug mode we don't want to. (Stdin is
727
# always replaced by /dev/null.)
728
# The exception is when not debugging but nevertheless
729
# running in the foreground; use the previously
730
# created wnull.
731
popen_args = {}
732
if (not self.server_settings["debug"]
733
and self.server_settings["foreground"]):
734
popen_args.update({"stdout": wnull,
735
"stderr": wnull })
736
self.checker = subprocess.Popen(command,
737
close_fds=True,
738
shell=True, cwd="/",
739
**popen_args)
740
except OSError as error:
741
logger.error("Failed to start subprocess",
742
exc_info=error)
743
return True
744
self.checker_callback_tag = (gobject.child_watch_add
745
(self.checker.pid,
746
self.checker_callback,
747
data=command))
748
# The checker may have completed before the gobject
749
# watch was added. Check for this.
750
try:
751
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
752
except OSError as error:
753
if error.errno == errno.ECHILD:
754
# This should never happen
755
logger.error("Child process vanished",
756
exc_info=error)
757
return True
758
raise
759
if pid:
760
gobject.source_remove(self.checker_callback_tag)
761
self.checker_callback(pid, status, command)
988
logger.info("Starting checker %r for %s", command,
989
self.name)
990
# We don't need to redirect stdout and stderr, since
991
# in normal mode, that is already done by daemon(),
992
# and in debug mode we don't want to. (Stdin is
993
# always replaced by /dev/null.)
994
# The exception is when not debugging but nevertheless
995
# running in the foreground; use the previously
996
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1000
if (not self.server_settings["debug"]
1001
and self.server_settings["foreground"]):
1002
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1005
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1009
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1012
self.checker_callback, pipe[0], command)
762
1013
# Re-run this periodically if run by gobject.timeout_add
763
1014
return True
764
1015
770
1021
if getattr(self, "checker", None) is None:
771
1022
return
772
1023
logger.debug("Stopping checker for %(name)s", vars(self))
773
try:
774
self.checker.terminate()
775
#time.sleep(0.5)
776
#if self.checker.poll() is None:
777
# self.checker.kill()
778
except OSError as error:
779
if error.errno != errno.ESRCH: # No such process
780
raise
1024
self.checker.terminate()
781
1025
self.checker = None
782
1026
783
1027
784
def dbus_service_property(dbus_interface, signature="v",
785
access="readwrite", byte_arrays=False):
1028
def dbus_service_property(dbus_interface,
1029
signature="v",
1030
access="readwrite",
1031
byte_arrays=False):
786
1032
"""Decorators for marking methods of a DBusObjectWithProperties to
787
1033
become properties on the D-Bus.
788
1034
797
1043
# "Set" method, so we fail early here:
798
1044
if byte_arrays and signature != "ay":
799
1045
raise ValueError("Byte arrays not supported for non-'ay'"
800
" signature {0!r}".format(signature))
1046
" signature {!r}".format(signature))
1047
801
1048
def decorator(func):
802
1049
func._dbus_is_property = True
803
1050
func._dbus_interface = dbus_interface
808
1055
func._dbus_name = func._dbus_name[:-14]
809
1056
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
810
1057
return func
1058
811
1059
return decorator
812
1060
813
1061
822
1070
"org.freedesktop.DBus.Property.EmitsChangedSignal":
823
1071
"false"}
824
1072
"""
1073
825
1074
def decorator(func):
826
1075
func._dbus_is_interface = True
827
1076
func._dbus_interface = dbus_interface
828
1077
func._dbus_name = dbus_interface
829
1078
return func
1079
830
1080
return decorator
831
1081
832
1082
834
1084
"""Decorator to annotate D-Bus methods, signals or properties
835
1085
Usage:
836
1086
1087
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
"org.freedesktop.DBus.Property."
1089
"EmitsChangedSignal": "false"})
837
1090
@dbus_service_property("org.example.Interface", signature="b",
838
1091
access="r")
839
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
842
1092
def Property_dbus_property(self):
843
1093
return dbus.Boolean(False)
1094
1095
See also the DBusObjectWithAnnotations class.
844
1096
"""
1097
845
1098
def decorator(func):
846
1099
func._dbus_annotations = annotations
847
1100
return func
1101
848
1102
return decorator
849
1103
850
1104
851
1105
class DBusPropertyException(dbus.exceptions.DBusException):
852
1106
"""A base class for D-Bus property-related exceptions
853
1107
"""
854
def __unicode__(self):
855
return unicode(str(self))
1108
pass
856
1109
857
1110
858
1111
class DBusPropertyAccessException(DBusPropertyException):
867
1120
pass
868
1121
869
1122
870
class DBusObjectWithProperties(dbus.service.Object):
871
"""A D-Bus object with properties.
1123
class DBusObjectWithAnnotations(dbus.service.Object):
1124
"""A D-Bus object with annotations.
872
1125
873
Classes inheriting from this can use the dbus_service_property
874
decorator to expose methods as D-Bus properties. It exposes the
875
standard Get(), Set(), and GetAll() methods on the D-Bus.
1126
Classes inheriting from this can use the dbus_annotations
1127
decorator to add annotations to methods or signals.
876
1128
"""
877
1129
878
1130
@staticmethod
882
1134
If called like _is_dbus_thing("method") it returns a function
883
1135
suitable for use as predicate to inspect.getmembers().
884
1136
"""
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1137
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
886
1138
False)
887
1139
888
1140
def _get_all_dbus_things(self, thing):
889
1141
"""Returns a generator of (name, attribute) pairs
890
1142
"""
891
return ((getattr(athing.__get__(self), "_dbus_name",
892
name),
1143
return ((getattr(athing.__get__(self), "_dbus_name", name),
893
1144
athing.__get__(self))
894
1145
for cls in self.__class__.__mro__
895
1146
for name, athing in
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
1147
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1149
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1153
def Introspect(self, object_path, connection):
1154
"""Overloading of standard D-Bus method.
1155
1156
Inserts annotation tags on methods and signals.
1157
"""
1158
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
connection)
1160
try:
1161
document = xml.dom.minidom.parseString(xmlstring)
1162
1163
for if_tag in document.getElementsByTagName("interface"):
1164
# Add annotation tags
1165
for typ in ("method", "signal"):
1166
for tag in if_tag.getElementsByTagName(typ):
1167
annots = dict()
1168
for name, prop in (self.
1169
_get_all_dbus_things(typ)):
1170
if (name == tag.getAttribute("name")
1171
and prop._dbus_interface
1172
== if_tag.getAttribute("name")):
1173
annots.update(getattr(
1174
prop, "_dbus_annotations", {}))
1175
for name, value in annots.items():
1176
ann_tag = document.createElement(
1177
"annotation")
1178
ann_tag.setAttribute("name", name)
1179
ann_tag.setAttribute("value", value)
1180
tag.appendChild(ann_tag)
1181
# Add interface annotation tags
1182
for annotation, value in dict(
1183
itertools.chain.from_iterable(
1184
annotations().items()
1185
for name, annotations
1186
in self._get_all_dbus_things("interface")
1187
if name == if_tag.getAttribute("name")
1188
)).items():
1189
ann_tag = document.createElement("annotation")
1190
ann_tag.setAttribute("name", annotation)
1191
ann_tag.setAttribute("value", value)
1192
if_tag.appendChild(ann_tag)
1193
# Fix argument name for the Introspect method itself
1194
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1196
for cn in if_tag.getElementsByTagName("method"):
1197
if cn.getAttribute("name") == "Introspect":
1198
for arg in cn.getElementsByTagName("arg"):
1199
if (arg.getAttribute("direction")
1200
== "out"):
1201
arg.setAttribute("name",
1202
"xml_data")
1203
xmlstring = document.toxml("utf-8")
1204
document.unlink()
1205
except (AttributeError, xml.dom.DOMException,
1206
xml.parsers.expat.ExpatError) as error:
1207
logger.error("Failed to override Introspection method",
1208
exc_info=error)
1209
return xmlstring
1210
1211
1212
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
"""A D-Bus object with properties.
1214
1215
Classes inheriting from this can use the dbus_service_property
1216
decorator to expose methods as D-Bus properties. It exposes the
1217
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
"""
898
1219
899
1220
def _get_dbus_property(self, interface_name, property_name):
900
1221
"""Returns a bound method if one exists which is a D-Bus
901
1222
property with the specified name and interface.
902
1223
"""
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
905
(cls,
906
self._is_dbus_thing("property"))):
1224
for cls in self.__class__.__mro__:
1225
for name, value in inspect.getmembers(
1226
cls, self._is_dbus_thing("property")):
907
1227
if (value._dbus_name == property_name
908
1228
and value._dbus_interface == interface_name):
909
1229
return value.__get__(self)
910
1230
911
1231
# No such property
912
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
+ interface_name + "."
914
+ property_name)
915
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1232
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
self.dbus_object_path, interface_name, property_name))
1234
1235
@classmethod
1236
def _get_all_interface_names(cls):
1237
"""Get a sequence of all interfaces supported by an object"""
1238
return (name for name in set(getattr(getattr(x, attr),
1239
"_dbus_interface", None)
1240
for x in (inspect.getmro(cls))
1241
for attr in dir(x))
1242
if name is not None)
1243
1244
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
in_signature="ss",
917
1246
out_signature="v")
918
1247
def Get(self, interface_name, property_name):
919
1248
"""Standard D-Bus property Get() method, see D-Bus standard.
938
1267
# signatures other than "ay".
939
1268
if prop._dbus_signature != "ay":
940
1269
raise ValueError("Byte arrays not supported for non-"
941
"'ay' signature {0!r}"
1270
"'ay' signature {!r}"
942
1271
.format(prop._dbus_signature))
943
1272
value = dbus.ByteArray(b''.join(chr(byte)
944
1273
for byte in value))
945
1274
prop(value)
946
1275
947
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1276
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
in_signature="s",
948
1278
out_signature="a{sv}")
949
1279
def GetAll(self, interface_name):
950
1280
"""Standard D-Bus property GetAll() method, see D-Bus
965
1295
if not hasattr(value, "variant_level"):
966
1296
properties[name] = value
967
1297
continue
968
properties[name] = type(value)(value, variant_level=
969
value.variant_level+1)
1298
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
970
1300
return dbus.Dictionary(properties, signature="sv")
971
1301
1302
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
def PropertiesChanged(self, interface_name, changed_properties,
1304
invalidated_properties):
1305
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1306
standard.
1307
"""
1308
pass
1309
972
1310
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
973
1311
out_signature="s",
974
1312
path_keyword='object_path',
978
1316
979
1317
Inserts property tags and interface annotation tags.
980
1318
"""
981
xmlstring = dbus.service.Object.Introspect(self, object_path,
982
connection)
1319
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1320
object_path,
1321
connection)
983
1322
try:
984
1323
document = xml.dom.minidom.parseString(xmlstring)
1324
985
1325
def make_tag(document, name, prop):
986
1326
e = document.createElement("property")
987
1327
e.setAttribute("name", name)
988
1328
e.setAttribute("type", prop._dbus_signature)
989
1329
e.setAttribute("access", prop._dbus_access)
990
1330
return e
1331
991
1332
for if_tag in document.getElementsByTagName("interface"):
992
1333
# Add property tags
993
1334
for tag in (make_tag(document, name, prop)
996
1337
if prop._dbus_interface
997
1338
== if_tag.getAttribute("name")):
998
1339
if_tag.appendChild(tag)
999
# Add annotation tags
1000
for typ in ("method", "signal", "property"):
1001
for tag in if_tag.getElementsByTagName(typ):
1002
annots = dict()
1003
for name, prop in (self.
1004
_get_all_dbus_things(typ)):
1005
if (name == tag.getAttribute("name")
1006
and prop._dbus_interface
1007
== if_tag.getAttribute("name")):
1008
annots.update(getattr
1009
(prop,
1010
"_dbus_annotations",
1011
{}))
1012
for name, value in annots.iteritems():
1013
ann_tag = document.createElement(
1014
"annotation")
1015
ann_tag.setAttribute("name", name)
1016
ann_tag.setAttribute("value", value)
1017
tag.appendChild(ann_tag)
1018
# Add interface annotation tags
1019
for annotation, value in dict(
1020
itertools.chain.from_iterable(
1021
annotations().iteritems()
1022
for name, annotations in
1023
self._get_all_dbus_things("interface")
1024
if name == if_tag.getAttribute("name")
1025
)).iteritems():
1026
ann_tag = document.createElement("annotation")
1027
ann_tag.setAttribute("name", annotation)
1028
ann_tag.setAttribute("value", value)
1029
if_tag.appendChild(ann_tag)
1340
# Add annotation tags for properties
1341
for tag in if_tag.getElementsByTagName("property"):
1342
annots = dict()
1343
for name, prop in self._get_all_dbus_things(
1344
"property"):
1345
if (name == tag.getAttribute("name")
1346
and prop._dbus_interface
1347
== if_tag.getAttribute("name")):
1348
annots.update(getattr(
1349
prop, "_dbus_annotations", {}))
1350
for name, value in annots.items():
1351
ann_tag = document.createElement(
1352
"annotation")
1353
ann_tag.setAttribute("name", name)
1354
ann_tag.setAttribute("value", value)
1355
tag.appendChild(ann_tag)
1030
1356
# Add the names to the return values for the
1031
1357
# "org.freedesktop.DBus.Properties" methods
1032
1358
if (if_tag.getAttribute("name")
1050
1376
exc_info=error)
1051
1377
return xmlstring
1052
1378
1379
try:
1380
dbus.OBJECT_MANAGER_IFACE
1381
except AttributeError:
1382
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1384
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
"""A D-Bus object with an ObjectManager.
1386
1387
Classes inheriting from this exposes the standard
1388
GetManagedObjects call and the InterfacesAdded and
1389
InterfacesRemoved signals on the standard
1390
"org.freedesktop.DBus.ObjectManager" interface.
1391
1392
Note: No signals are sent automatically; they must be sent
1393
manually.
1394
"""
1395
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1397
def GetManagedObjects(self):
1398
"""This function must be overridden"""
1399
raise NotImplementedError()
1400
1401
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1403
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1407
def InterfacesRemoved(self, object_path, interfaces):
1408
pass
1409
1410
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1414
def Introspect(self, object_path, connection):
1415
"""Overloading of standard D-Bus method.
1416
1417
Override return argument name of GetManagedObjects to be
1418
"objpath_interfaces_and_properties"
1419
"""
1420
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1421
object_path,
1422
connection)
1423
try:
1424
document = xml.dom.minidom.parseString(xmlstring)
1425
1426
for if_tag in document.getElementsByTagName("interface"):
1427
# Fix argument name for the GetManagedObjects method
1428
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1430
for cn in if_tag.getElementsByTagName("method"):
1431
if (cn.getAttribute("name")
1432
== "GetManagedObjects"):
1433
for arg in cn.getElementsByTagName("arg"):
1434
if (arg.getAttribute("direction")
1435
== "out"):
1436
arg.setAttribute(
1437
"name",
1438
"objpath_interfaces"
1439
"_and_properties")
1440
xmlstring = document.toxml("utf-8")
1441
document.unlink()
1442
except (AttributeError, xml.dom.DOMException,
1443
xml.parsers.expat.ExpatError) as error:
1444
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1446
return xmlstring
1053
1447
1054
1448
def datetime_to_dbus(dt, variant_level=0):
1055
1449
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1056
1450
if dt is None:
1057
1451
return dbus.String("", variant_level = variant_level)
1058
return dbus.String(dt.isoformat(),
1059
variant_level=variant_level)
1452
return dbus.String(dt.isoformat(), variant_level=variant_level)
1060
1453
1061
1454
1062
1455
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1082
1475
(from DBusObjectWithProperties) and interfaces (from the
1083
1476
dbus_interface_annotations decorator).
1084
1477
"""
1478
1085
1479
def wrapper(cls):
1086
1480
for orig_interface_name, alt_interface_name in (
1087
alt_interface_names.iteritems()):
1481
alt_interface_names.items()):
1088
1482
attr = {}
1089
1483
interface_names = set()
1090
1484
# Go though all attributes of the class
1092
1486
# Ignore non-D-Bus attributes, and D-Bus attributes
1093
1487
# with the wrong interface name
1094
1488
if (not hasattr(attribute, "_dbus_interface")
1095
or not attribute._dbus_interface
1096
.startswith(orig_interface_name)):
1489
or not attribute._dbus_interface.startswith(
1490
orig_interface_name)):
1097
1491
continue
1098
1492
# Create an alternate D-Bus interface name based on
1099
1493
# the current name
1100
alt_interface = (attribute._dbus_interface
1101
.replace(orig_interface_name,
1102
alt_interface_name))
1494
alt_interface = attribute._dbus_interface.replace(
1495
orig_interface_name, alt_interface_name)
1103
1496
interface_names.add(alt_interface)
1104
1497
# Is this a D-Bus signal?
1105
1498
if getattr(attribute, "_dbus_is_signal", False):
1106
# Extract the original non-method undecorated
1107
# function by black magic
1108
nonmethod_func = (dict(
1499
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
nonmethod_func = (dict(
1109
1503
zip(attribute.func_code.co_freevars,
1110
attribute.__closure__))["func"]
1111
.cell_contents)
1504
attribute.__closure__))
1505
["func"].cell_contents)
1506
else:
1507
nonmethod_func = attribute
1112
1508
# Create a new, but exactly alike, function
1113
1509
# object, and decorate it to be a new D-Bus signal
1114
1510
# with the alternate D-Bus interface name
1115
new_function = (dbus.service.signal
1116
(alt_interface,
1117
attribute._dbus_signature)
1118
(types.FunctionType(
1119
nonmethod_func.func_code,
1120
nonmethod_func.func_globals,
1121
nonmethod_func.func_name,
1122
nonmethod_func.func_defaults,
1123
nonmethod_func.func_closure)))
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1525
new_function = (dbus.service.signal(
1526
alt_interface,
1527
attribute._dbus_signature)(new_function))
1124
1528
# Copy annotations, if any
1125
1529
try:
1126
new_function._dbus_annotations = (
1127
dict(attribute._dbus_annotations))
1530
new_function._dbus_annotations = dict(
1531
attribute._dbus_annotations)
1128
1532
except AttributeError:
1129
1533
pass
1130
1534
# Define a creator of a function to call both the
1135
1539
"""This function is a scope container to pass
1136
1540
func1 and func2 to the "call_both" function
1137
1541
outside of its arguments"""
1542
1543
@functools.wraps(func2)
1138
1544
def call_both(*args, **kwargs):
1139
1545
"""This function will emit two D-Bus
1140
1546
signals by calling func1 and func2"""
1141
1547
func1(*args, **kwargs)
1142
1548
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1550
for name, attr in inspect.getmembers(func2):
1551
if name.startswith("_dbus_"):
1552
setattr(call_both, name, attr)
1553
1143
1554
return call_both
1144
1555
# Create the "call_both" function and add it to
1145
1556
# the class
1150
1561
# object. Decorate it to be a new D-Bus method
1151
1562
# with the alternate D-Bus interface name. Add it
1152
1563
# to the class.
1153
attr[attrname] = (dbus.service.method
1154
(alt_interface,
1155
attribute._dbus_in_signature,
1156
attribute._dbus_out_signature)
1157
(types.FunctionType
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1564
attr[attrname] = (
1565
dbus.service.method(
1566
alt_interface,
1567
attribute._dbus_in_signature,
1568
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1163
1574
# Copy annotations, if any
1164
1575
try:
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1576
attr[attrname]._dbus_annotations = dict(
1577
attribute._dbus_annotations)
1167
1578
except AttributeError:
1168
1579
pass
1169
1580
# Is this a D-Bus property?
1172
1583
# object, and decorate it to be a new D-Bus
1173
1584
# property with the alternate D-Bus interface
1174
1585
# name. Add it to the class.
1175
attr[attrname] = (dbus_service_property
1176
(alt_interface,
1177
attribute._dbus_signature,
1178
attribute._dbus_access,
1179
attribute
1180
._dbus_get_args_options
1181
["byte_arrays"])
1182
(types.FunctionType
1183
(attribute.func_code,
1184
attribute.func_globals,
1185
attribute.func_name,
1186
attribute.func_defaults,
1187
attribute.func_closure)))
1586
attr[attrname] = (dbus_service_property(
1587
alt_interface, attribute._dbus_signature,
1588
attribute._dbus_access,
1589
attribute._dbus_get_args_options
1590
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1188
1597
# Copy annotations, if any
1189
1598
try:
1190
attr[attrname]._dbus_annotations = (
1191
dict(attribute._dbus_annotations))
1599
attr[attrname]._dbus_annotations = dict(
1600
attribute._dbus_annotations)
1192
1601
except AttributeError:
1193
1602
pass
1194
1603
# Is this a D-Bus interface?
1197
1606
# object. Decorate it to be a new D-Bus interface
1198
1607
# with the alternate D-Bus interface name. Add it
1199
1608
# to the class.
1200
attr[attrname] = (dbus_interface_annotations
1201
(alt_interface)
1202
(types.FunctionType
1203
(attribute.func_code,
1204
attribute.func_globals,
1205
attribute.func_name,
1206
attribute.func_defaults,
1207
attribute.func_closure)))
1609
attr[attrname] = (
1610
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1208
1616
if deprecate:
1209
1617
# Deprecate all alternate interfaces
1210
iname="_AlternateDBusNames_interface_annotation{0}"
1618
iname="_AlternateDBusNames_interface_annotation{}"
1211
1619
for interface_name in interface_names:
1620
1212
1621
@dbus_interface_annotations(interface_name)
1213
1622
def func(self):
1214
1623
return { "org.freedesktop.DBus.Deprecated":
1215
"true" }
1624
"true" }
1216
1625
# Find an unused name
1217
1626
for aname in (iname.format(i)
1218
1627
for i in itertools.count()):
1222
1631
if interface_names:
1223
1632
# Replace the class with a new subclass of it with
1224
1633
# methods, signals, etc. as created above.
1225
cls = type(b"{0}Alternate".format(cls.__name__),
1226
(cls,), attr)
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1227
1636
return cls
1637
1228
1638
return wrapper
1229
1639
1230
1640
1231
1641
@alternate_dbus_interfaces({"se.recompile.Mandos":
1232
"se.bsnet.fukt.Mandos"})
1642
"se.bsnet.fukt.Mandos"})
1233
1643
class ClientDBus(Client, DBusObjectWithProperties):
1234
1644
"""A Client class using D-Bus
1235
1645
1239
1649
"""
1240
1650
1241
1651
runtime_expansions = (Client.runtime_expansions
1242
+ ("dbus_object_path",))
1652
+ ("dbus_object_path", ))
1653
1654
_interface = "se.recompile.Mandos.Client"
1243
1655
1244
1656
# dbus.service.Object doesn't use super(), so we can't either.
1245
1657
1248
1660
Client.__init__(self, *args, **kwargs)
1249
1661
# Only now, when this client is initialized, can it show up on
1250
1662
# the D-Bus
1251
client_object_name = unicode(self.name).translate(
1663
client_object_name = str(self.name).translate(
1252
1664
{ord("."): ord("_"),
1253
1665
ord("-"): ord("_")})
1254
self.dbus_object_path = (dbus.ObjectPath
1255
("/clients/" + client_object_name))
1666
self.dbus_object_path = dbus.ObjectPath(
1667
"/clients/" + client_object_name)
1256
1668
DBusObjectWithProperties.__init__(self, self.bus,
1257
1669
self.dbus_object_path)
1258
1670
1259
def notifychangeproperty(transform_func,
1260
dbus_name, type_func=lambda x: x,
1261
variant_level=1):
1671
def notifychangeproperty(transform_func, dbus_name,
1672
type_func=lambda x: x,
1673
variant_level=1,
1674
invalidate_only=False,
1675
_interface=_interface):
1262
1676
""" Modify a variable so that it's a property which announces
1263
1677
its changes to DBus.
1264
1678
1269
1683
to the D-Bus. Default: no transform
1270
1684
variant_level: D-Bus variant level. Default: 1
1271
1685
"""
1272
attrname = "_{0}".format(dbus_name)
1686
attrname = "_{}".format(dbus_name)
1687
1273
1688
def setter(self, value):
1274
1689
if hasattr(self, "dbus_object_path"):
1275
1690
if (not hasattr(self, attrname) or
1276
1691
type_func(getattr(self, attrname, None))
1277
1692
!= type_func(value)):
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1281
self.PropertyChanged(dbus.String(dbus_name),
1282
dbus_value)
1693
if invalidate_only:
1694
self.PropertiesChanged(
1695
_interface, dbus.Dictionary(),
1696
dbus.Array((dbus_name, )))
1697
else:
1698
dbus_value = transform_func(
1699
type_func(value),
1700
variant_level = variant_level)
1701
self.PropertyChanged(dbus.String(dbus_name),
1702
dbus_value)
1703
self.PropertiesChanged(
1704
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1707
dbus.Array())
1283
1708
setattr(self, attrname, value)
1284
1709
1285
1710
return property(lambda self: getattr(self, attrname), setter)
1291
1716
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1292
1717
last_enabled = notifychangeproperty(datetime_to_dbus,
1293
1718
"LastEnabled")
1294
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1295
type_func = lambda checker:
1296
checker is not None)
1719
checker = notifychangeproperty(
1720
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1297
1722
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1298
1723
"LastCheckedOK")
1299
1724
last_checker_status = notifychangeproperty(dbus.Int16,
1302
1727
datetime_to_dbus, "LastApprovalRequest")
1303
1728
approved_by_default = notifychangeproperty(dbus.Boolean,
1304
1729
"ApprovedByDefault")
1305
approval_delay = notifychangeproperty(dbus.UInt64,
1306
"ApprovalDelay",
1307
type_func =
1308
timedelta_to_milliseconds)
1730
approval_delay = notifychangeproperty(
1731
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1309
1733
approval_duration = notifychangeproperty(
1310
1734
dbus.UInt64, "ApprovalDuration",
1311
type_func = timedelta_to_milliseconds)
1735
type_func = lambda td: td.total_seconds() * 1000)
1312
1736
host = notifychangeproperty(dbus.String, "Host")
1313
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1314
type_func =
1315
timedelta_to_milliseconds)
1737
timeout = notifychangeproperty(
1738
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1316
1740
extended_timeout = notifychangeproperty(
1317
1741
dbus.UInt64, "ExtendedTimeout",
1318
type_func = timedelta_to_milliseconds)
1319
interval = notifychangeproperty(dbus.UInt64,
1320
"Interval",
1321
type_func =
1322
timedelta_to_milliseconds)
1742
type_func = lambda td: td.total_seconds() * 1000)
1743
interval = notifychangeproperty(
1744
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1323
1746
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
invalidate_only=True)
1324
1749
1325
1750
del notifychangeproperty
1326
1751
1333
1758
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1334
1759
Client.__del__(self, *args, **kwargs)
1335
1760
1336
def checker_callback(self, pid, condition, command,
1337
*args, **kwargs):
1338
self.checker_callback_tag = None
1339
self.checker = None
1340
if os.WIFEXITED(condition):
1341
exitstatus = os.WEXITSTATUS(condition)
1761
def checker_callback(self, source, condition,
1762
connection, command, *args, **kwargs):
1763
ret = Client.checker_callback(self, source, condition,
1764
connection, command, *args,
1765
**kwargs)
1766
exitstatus = self.last_checker_status
1767
if exitstatus >= 0:
1342
1768
# Emit D-Bus signal
1343
1769
self.CheckerCompleted(dbus.Int16(exitstatus),
1344
dbus.Int64(condition),
1770
# This is specific to GNU libC
1771
dbus.Int64(exitstatus << 8),
1345
1772
dbus.String(command))
1346
1773
else:
1347
1774
# Emit D-Bus signal
1348
1775
self.CheckerCompleted(dbus.Int16(-1),
1349
dbus.Int64(condition),
1776
dbus.Int64(
1777
# This is specific to GNU libC
1778
(exitstatus << 8)
1779
| self.last_checker_signal),
1350
1780
dbus.String(command))
1351
1352
return Client.checker_callback(self, pid, condition, command,
1353
*args, **kwargs)
1781
return ret
1354
1782
1355
1783
def start_checker(self, *args, **kwargs):
1356
1784
old_checker_pid = getattr(self.checker, "pid", None)
1368
1796
1369
1797
def approve(self, value=True):
1370
1798
self.approved = value
1371
gobject.timeout_add(timedelta_to_milliseconds
1372
(self.approval_duration),
1373
self._reset_approved)
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1374
1801
self.send_changedstate()
1375
1802
1376
1803
## D-Bus methods, signals & properties
1377
_interface = "se.recompile.Mandos.Client"
1378
1804
1379
1805
## Interfaces
1380
1806
1381
@dbus_interface_annotations(_interface)
1382
def _foo(self):
1383
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1384
"false"}
1385
1386
1807
## Signals
1387
1808
1388
1809
# CheckerCompleted - signal
1398
1819
pass
1399
1820
1400
1821
# PropertyChanged - signal
1822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1401
1823
@dbus.service.signal(_interface, signature="sv")
1402
1824
def PropertyChanged(self, property, value):
1403
1825
"D-Bus signal"
1437
1859
self.checked_ok()
1438
1860
1439
1861
# Enable - method
1862
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1440
1863
@dbus.service.method(_interface)
1441
1864
def Enable(self):
1442
1865
"D-Bus method"
1443
1866
self.enable()
1444
1867
1445
1868
# StartChecker - method
1869
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1446
1870
@dbus.service.method(_interface)
1447
1871
def StartChecker(self):
1448
1872
"D-Bus method"
1449
1873
self.start_checker()
1450
1874
1451
1875
# Disable - method
1876
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1452
1877
@dbus.service.method(_interface)
1453
1878
def Disable(self):
1454
1879
"D-Bus method"
1455
1880
self.disable()
1456
1881
1457
1882
# StopChecker - method
1883
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1458
1884
@dbus.service.method(_interface)
1459
1885
def StopChecker(self):
1460
1886
self.stop_checker()
1467
1893
return dbus.Boolean(bool(self.approvals_pending))
1468
1894
1469
1895
# ApprovedByDefault - property
1470
@dbus_service_property(_interface, signature="b",
1896
@dbus_service_property(_interface,
1897
signature="b",
1471
1898
access="readwrite")
1472
1899
def ApprovedByDefault_dbus_property(self, value=None):
1473
1900
if value is None: # get
1475
1902
self.approved_by_default = bool(value)
1476
1903
1477
1904
# ApprovalDelay - property
1478
@dbus_service_property(_interface, signature="t",
1905
@dbus_service_property(_interface,
1906
signature="t",
1479
1907
access="readwrite")
1480
1908
def ApprovalDelay_dbus_property(self, value=None):
1481
1909
if value is None: # get
1482
return dbus.UInt64(self.approval_delay_milliseconds())
1910
return dbus.UInt64(self.approval_delay.total_seconds()
1911
* 1000)
1483
1912
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1484
1913
1485
1914
# ApprovalDuration - property
1486
@dbus_service_property(_interface, signature="t",
1915
@dbus_service_property(_interface,
1916
signature="t",
1487
1917
access="readwrite")
1488
1918
def ApprovalDuration_dbus_property(self, value=None):
1489
1919
if value is None: # get
1490
return dbus.UInt64(timedelta_to_milliseconds(
1491
self.approval_duration))
1920
return dbus.UInt64(self.approval_duration.total_seconds()
1921
* 1000)
1492
1922
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1493
1923
1494
1924
# Name - property
1925
@dbus_annotations(
1926
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1495
1927
@dbus_service_property(_interface, signature="s", access="read")
1496
1928
def Name_dbus_property(self):
1497
1929
return dbus.String(self.name)
1498
1930
1499
1931
# Fingerprint - property
1932
@dbus_annotations(
1933
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1500
1934
@dbus_service_property(_interface, signature="s", access="read")
1501
1935
def Fingerprint_dbus_property(self):
1502
1936
return dbus.String(self.fingerprint)
1503
1937
1504
1938
# Host - property
1505
@dbus_service_property(_interface, signature="s",
1939
@dbus_service_property(_interface,
1940
signature="s",
1506
1941
access="readwrite")
1507
1942
def Host_dbus_property(self, value=None):
1508
1943
if value is None: # get
1509
1944
return dbus.String(self.host)
1510
self.host = unicode(value)
1945
self.host = str(value)
1511
1946
1512
1947
# Created - property
1948
@dbus_annotations(
1949
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1513
1950
@dbus_service_property(_interface, signature="s", access="read")
1514
1951
def Created_dbus_property(self):
1515
1952
return datetime_to_dbus(self.created)
1520
1957
return datetime_to_dbus(self.last_enabled)
1521
1958
1522
1959
# Enabled - property
1523
@dbus_service_property(_interface, signature="b",
1960
@dbus_service_property(_interface,
1961
signature="b",
1524
1962
access="readwrite")
1525
1963
def Enabled_dbus_property(self, value=None):
1526
1964
if value is None: # get
1531
1969
self.disable()
1532
1970
1533
1971
# LastCheckedOK - property
1534
@dbus_service_property(_interface, signature="s",
1972
@dbus_service_property(_interface,
1973
signature="s",
1535
1974
access="readwrite")
1536
1975
def LastCheckedOK_dbus_property(self, value=None):
1537
1976
if value is not None:
1540
1979
return datetime_to_dbus(self.last_checked_ok)
1541
1980
1542
1981
# LastCheckerStatus - property
1543
@dbus_service_property(_interface, signature="n",
1544
access="read")
1982
@dbus_service_property(_interface, signature="n", access="read")
1545
1983
def LastCheckerStatus_dbus_property(self):
1546
1984
return dbus.Int16(self.last_checker_status)
1547
1985
1556
1994
return datetime_to_dbus(self.last_approval_request)
1557
1995
1558
1996
# Timeout - property
1559
@dbus_service_property(_interface, signature="t",
1997
@dbus_service_property(_interface,
1998
signature="t",
1560
1999
access="readwrite")
1561
2000
def Timeout_dbus_property(self, value=None):
1562
2001
if value is None: # get
1563
return dbus.UInt64(self.timeout_milliseconds())
2002
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1564
2003
old_timeout = self.timeout
1565
2004
self.timeout = datetime.timedelta(0, 0, 0, value)
1566
2005
# Reschedule disabling
1575
2014
is None):
1576
2015
return
1577
2016
gobject.source_remove(self.disable_initiator_tag)
1578
self.disable_initiator_tag = (
1579
gobject.timeout_add(
1580
timedelta_to_milliseconds(self.expires - now),
1581
self.disable))
2017
self.disable_initiator_tag = gobject.timeout_add(
2018
int((self.expires - now).total_seconds() * 1000),
2019
self.disable)
1582
2020
1583
2021
# ExtendedTimeout - property
1584
@dbus_service_property(_interface, signature="t",
2022
@dbus_service_property(_interface,
2023
signature="t",
1585
2024
access="readwrite")
1586
2025
def ExtendedTimeout_dbus_property(self, value=None):
1587
2026
if value is None: # get
1588
return dbus.UInt64(self.extended_timeout_milliseconds())
2027
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
* 1000)
1589
2029
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1590
2030
1591
2031
# Interval - property
1592
@dbus_service_property(_interface, signature="t",
2032
@dbus_service_property(_interface,
2033
signature="t",
1593
2034
access="readwrite")
1594
2035
def Interval_dbus_property(self, value=None):
1595
2036
if value is None: # get
1596
return dbus.UInt64(self.interval_milliseconds())
2037
return dbus.UInt64(self.interval.total_seconds() * 1000)
1597
2038
self.interval = datetime.timedelta(0, 0, 0, value)
1598
2039
if getattr(self, "checker_initiator_tag", None) is None:
1599
2040
return
1600
2041
if self.enabled:
1601
2042
# Reschedule checker run
1602
2043
gobject.source_remove(self.checker_initiator_tag)
1603
self.checker_initiator_tag = (gobject.timeout_add
1604
(value, self.start_checker))
1605
self.start_checker() # Start one now, too
2044
self.checker_initiator_tag = gobject.timeout_add(
2045
value, self.start_checker)
2046
self.start_checker() # Start one now, too
1606
2047
1607
2048
# Checker - property
1608
@dbus_service_property(_interface, signature="s",
2049
@dbus_service_property(_interface,
2050
signature="s",
1609
2051
access="readwrite")
1610
2052
def Checker_dbus_property(self, value=None):
1611
2053
if value is None: # get
1612
2054
return dbus.String(self.checker_command)
1613
self.checker_command = unicode(value)
2055
self.checker_command = str(value)
1614
2056
1615
2057
# CheckerRunning - property
1616
@dbus_service_property(_interface, signature="b",
2058
@dbus_service_property(_interface,
2059
signature="b",
1617
2060
access="readwrite")
1618
2061
def CheckerRunning_dbus_property(self, value=None):
1619
2062
if value is None: # get
1624
2067
self.stop_checker()
1625
2068
1626
2069
# ObjectPath - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
"org.freedesktop.DBus.Deprecated": "true"})
1627
2073
@dbus_service_property(_interface, signature="o", access="read")
1628
2074
def ObjectPath_dbus_property(self):
1629
2075
return self.dbus_object_path # is already a dbus.ObjectPath
1630
2076
1631
2077
# Secret = property
1632
@dbus_service_property(_interface, signature="ay",
1633
access="write", byte_arrays=True)
2078
@dbus_annotations(
2079
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2080
"invalidates"})
2081
@dbus_service_property(_interface,
2082
signature="ay",
2083
access="write",
2084
byte_arrays=True)
1634
2085
def Secret_dbus_property(self, value):
1635
self.secret = str(value)
2086
self.secret = bytes(value)
1636
2087
1637
2088
del _interface
1638
2089
1642
2093
self._pipe = child_pipe
1643
2094
self._pipe.send(('init', fpr, address))
1644
2095
if not self._pipe.recv():
1645
raise KeyError()
2096
raise KeyError(fpr)
1646
2097
1647
2098
def __getattribute__(self, name):
1648
2099
if name == '_pipe':
1652
2103
if data[0] == 'data':
1653
2104
return data[1]
1654
2105
if data[0] == 'function':
2106
1655
2107
def func(*args, **kwargs):
1656
2108
self._pipe.send(('funcall', name, args, kwargs))
1657
2109
return self._pipe.recv()[1]
2110
1658
2111
return func
1659
2112
1660
2113
def __setattr__(self, name, value):
1672
2125
def handle(self):
1673
2126
with contextlib.closing(self.server.child_pipe) as child_pipe:
1674
2127
logger.info("TCP connection from: %s",
1675
unicode(self.client_address))
2128
str(self.client_address))
1676
2129
logger.debug("Pipe FD: %d",
1677
2130
self.server.child_pipe.fileno())
1678
2131
1679
session = (gnutls.connection
1680
.ClientSession(self.request,
1681
gnutls.connection
1682
.X509Credentials()))
1683
1684
# Note: gnutls.connection.X509Credentials is really a
1685
# generic GnuTLS certificate credentials object so long as
1686
# no X.509 keys are added to it. Therefore, we can use it
1687
# here despite using OpenPGP certificates.
2132
session = gnutls.ClientSession(self.request)
1688
2133
1689
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1690
2135
# "+AES-256-CBC", "+SHA1",
1694
2139
priority = self.server.gnutls_priority
1695
2140
if priority is None:
1696
2141
priority = "NORMAL"
1697
(gnutls.library.functions
1698
.gnutls_priority_set_direct(session._c_object,
1699
priority, None))
2142
gnutls.priority_set_direct(session._c_object, priority,
2143
None)
1700
2144
1701
2145
# Start communication using the Mandos protocol
1702
2146
# Get protocol number
1712
2156
# Start GnuTLS connection
1713
2157
try:
1714
2158
session.handshake()
1715
except gnutls.errors.GNUTLSError as error:
2159
except gnutls.Error as error:
1716
2160
logger.warning("Handshake failed: %s", error)
1717
2161
# Do not run session.bye() here: the session is not
1718
2162
# established. Just abandon the request.
1722
2166
approval_required = False
1723
2167
try:
1724
2168
try:
1725
fpr = self.fingerprint(self.peer_certificate
1726
(session))
1727
except (TypeError,
1728
gnutls.errors.GNUTLSError) as error:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
1729
2172
logger.warning("Bad certificate: %s", error)
1730
2173
return
1731
2174
logger.debug("Fingerprint: %s", fpr)
1744
2187
while True:
1745
2188
if not client.enabled:
1746
2189
logger.info("Client %s is disabled",
1747
client.name)
2190
client.name)
1748
2191
if self.server.use_dbus:
1749
2192
# Emit D-Bus signal
1750
2193
client.Rejected("Disabled")
1759
2202
if self.server.use_dbus:
1760
2203
# Emit D-Bus signal
1761
2204
client.NeedApproval(
1762
client.approval_delay_milliseconds(),
1763
client.approved_by_default)
2205
client.approval_delay.total_seconds()
2206
* 1000, client.approved_by_default)
1764
2207
else:
1765
2208
logger.warning("Client %s was not approved",
1766
2209
client.name)
1772
2215
#wait until timeout or approved
1773
2216
time = datetime.datetime.now()
1774
2217
client.changedstate.acquire()
1775
client.changedstate.wait(
1776
float(timedelta_to_milliseconds(delay)
1777
/ 1000))
2218
client.changedstate.wait(delay.total_seconds())
1778
2219
client.changedstate.release()
1779
2220
time2 = datetime.datetime.now()
1780
2221
if (time2 - time) >= delay:
1791
2232
else:
1792
2233
delay -= time2 - time
1793
2234
1794
sent_size = 0
1795
while sent_size < len(client.secret):
1796
try:
1797
sent = session.send(client.secret[sent_size:])
1798
except gnutls.errors.GNUTLSError as error:
1799
logger.warning("gnutls send failed",
1800
exc_info=error)
1801
return
1802
logger.debug("Sent: %d, remaining: %d",
1803
sent, len(client.secret)
1804
- (sent_size + sent))
1805
sent_size += sent
2235
try:
2236
session.send(client.secret)
2237
except gnutls.Error as error:
2238
logger.warning("gnutls send failed",
2239
exc_info = error)
2240
return
1806
2241
1807
2242
logger.info("Sending secret to %s", client.name)
1808
2243
# bump the timeout using extended_timeout
1816
2251
client.approvals_pending -= 1
1817
2252
try:
1818
2253
session.bye()
1819
except gnutls.errors.GNUTLSError as error:
2254
except gnutls.Error as error:
1820
2255
logger.warning("GnuTLS bye failed",
1821
2256
exc_info=error)
1822
2257
1824
2259
def peer_certificate(session):
1825
2260
"Return the peer's OpenPGP certificate as a bytestring"
1826
2261
# If not an OpenPGP certificate...
1827
if (gnutls.library.functions
1828
.gnutls_certificate_type_get(session._c_object)
1829
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1830
# ...do the normal thing
1831
return session.peer_certificate
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2264
# ...return invalid data
2265
return b""
1832
2266
list_size = ctypes.c_uint(1)
1833
cert_list = (gnutls.library.functions
1834
.gnutls_certificate_get_peers
2267
cert_list = (gnutls.certificate_get_peers
1835
2268
(session._c_object, ctypes.byref(list_size)))
1836
2269
if not bool(cert_list) and list_size.value != 0:
1837
raise gnutls.errors.GNUTLSError("error getting peer"
1838
" certificate")
2270
raise gnutls.Error("error getting peer certificate")
1839
2271
if list_size.value == 0:
1840
2272
return None
1841
2273
cert = cert_list[0]
1845
2277
def fingerprint(openpgp):
1846
2278
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1847
2279
# New GnuTLS "datum" with the OpenPGP public key
1848
datum = (gnutls.library.types
1849
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1850
ctypes.POINTER
1851
(ctypes.c_ubyte)),
1852
ctypes.c_uint(len(openpgp))))
2280
datum = gnutls.datum_t(
2281
ctypes.cast(ctypes.c_char_p(openpgp),
2282
ctypes.POINTER(ctypes.c_ubyte)),
2283
ctypes.c_uint(len(openpgp)))
1853
2284
# New empty GnuTLS certificate
1854
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1855
(gnutls.library.functions
1856
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2285
crt = gnutls.openpgp_crt_t()
2286
gnutls.openpgp_crt_init(ctypes.byref(crt))
1857
2287
# Import the OpenPGP public key into the certificate
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1860
gnutls.library.constants
1861
.GNUTLS_OPENPGP_FMT_RAW))
2288
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2289
gnutls.OPENPGP_FMT_RAW)
1862
2290
# Verify the self signature in the key
1863
2291
crtverify = ctypes.c_uint()
1864
(gnutls.library.functions
1865
.gnutls_openpgp_crt_verify_self(crt, 0,
1866
ctypes.byref(crtverify)))
2292
gnutls.openpgp_crt_verify_self(crt, 0,
2293
ctypes.byref(crtverify))
1867
2294
if crtverify.value != 0:
1868
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1869
raise (gnutls.errors.CertificateSecurityError
1870
("Verify failed"))
2295
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
1871
2297
# New buffer for the fingerprint
1872
2298
buf = ctypes.create_string_buffer(20)
1873
2299
buf_len = ctypes.c_size_t()
1874
2300
# Get the fingerprint from the certificate into the buffer
1875
(gnutls.library.functions
1876
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1877
ctypes.byref(buf_len)))
2301
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2302
ctypes.byref(buf_len))
1878
2303
# Deinit the certificate
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2304
gnutls.openpgp_crt_deinit(crt)
1880
2305
# Convert the buffer to a Python bytestring
1881
2306
fpr = ctypes.string_at(buf, buf_len.value)
1882
2307
# Convert the bytestring to hexadecimal notation
1886
2311
1887
2312
class MultiprocessingMixIn(object):
1888
2313
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
1889
2315
def sub_process_main(self, request, address):
1890
2316
try:
1891
2317
self.finish_request(request, address)
1903
2329
1904
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1905
2331
""" adds a pipe to the MixIn """
2332
1906
2333
def process_request(self, request, client_address):
1907
2334
"""Overrides and wraps the original process_request().
1908
2335
1929
2356
interface: None or a network interface name (string)
1930
2357
use_ipv6: Boolean; to use IPv6 or not
1931
2358
"""
2359
1932
2360
def __init__(self, server_address, RequestHandlerClass,
1933
interface=None, use_ipv6=True, socketfd=None):
2361
interface=None,
2362
use_ipv6=True,
2363
socketfd=None):
1934
2364
"""If socketfd is set, use that file descriptor instead of
1935
2365
creating a new one with socket.socket().
1936
2366
"""
1977
2407
self.interface)
1978
2408
else:
1979
2409
try:
1980
self.socket.setsockopt(socket.SOL_SOCKET,
1981
SO_BINDTODEVICE,
1982
str(self.interface + '\0'))
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
1983
2413
except socket.error as error:
1984
2414
if error.errno == errno.EPERM:
1985
2415
logger.error("No permission to bind to"
2003
2433
self.server_address = (any_address,
2004
2434
self.server_address[1])
2005
2435
elif not self.server_address[1]:
2006
self.server_address = (self.server_address[0],
2007
0)
2436
self.server_address = (self.server_address[0], 0)
2008
2437
# if self.interface:
2009
2438
# self.server_address = (self.server_address[0],
2010
2439
# 0, # port
2024
2453
2025
2454
Assumes a gobject.MainLoop event loop.
2026
2455
"""
2456
2027
2457
def __init__(self, server_address, RequestHandlerClass,
2028
interface=None, use_ipv6=True, clients=None,
2029
gnutls_priority=None, use_dbus=True, socketfd=None):
2458
interface=None,
2459
use_ipv6=True,
2460
clients=None,
2461
gnutls_priority=None,
2462
use_dbus=True,
2463
socketfd=None):
2030
2464
self.enabled = False
2031
2465
self.clients = clients
2032
2466
if self.clients is None:
2038
2472
interface = interface,
2039
2473
use_ipv6 = use_ipv6,
2040
2474
socketfd = socketfd)
2475
2041
2476
def server_activate(self):
2042
2477
if self.enabled:
2043
2478
return socketserver.TCPServer.server_activate(self)
2047
2482
2048
2483
def add_pipe(self, parent_pipe, proc):
2049
2484
# Call "handle_ipc" for both data and EOF events
2050
gobject.io_add_watch(parent_pipe.fileno(),
2051
gobject.IO_IN | gobject.IO_HUP,
2052
functools.partial(self.handle_ipc,
2053
parent_pipe =
2054
parent_pipe,
2055
proc = proc))
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2488
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2056
2491
2057
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2492
def handle_ipc(self, source, condition,
2493
parent_pipe=None,
2494
proc = None,
2495
client_object=None):
2059
2496
# error, or the other end of multiprocessing.Pipe has closed
2060
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2061
2498
# Wait for other process to exit
2084
2521
parent_pipe.send(False)
2085
2522
return False
2086
2523
2087
gobject.io_add_watch(parent_pipe.fileno(),
2088
gobject.IO_IN | gobject.IO_HUP,
2089
functools.partial(self.handle_ipc,
2090
parent_pipe =
2091
parent_pipe,
2092
proc = proc,
2093
client_object =
2094
client))
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2527
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2095
2531
parent_pipe.send(True)
2096
2532
# remove the old hook in favor of the new above hook on
2097
2533
# same fileno
2103
2539
2104
2540
parent_pipe.send(('data', getattr(client_object,
2105
2541
funcname)(*args,
2106
**kwargs)))
2542
**kwargs)))
2107
2543
2108
2544
if command == 'getattr':
2109
2545
attrname = request[1]
2110
if callable(client_object.__getattribute__(attrname)):
2111
parent_pipe.send(('function',))
2546
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
2112
2549
else:
2113
parent_pipe.send(('data', client_object
2114
.__getattribute__(attrname)))
2550
parent_pipe.send((
2551
'data', client_object.__getattribute__(attrname)))
2115
2552
2116
2553
if command == 'setattr':
2117
2554
attrname = request[1]
2148
2585
# avoid excessive use of external libraries.
2149
2586
2150
2587
# New type for defining tokens, syntax, and semantics all-in-one
2151
Token = collections.namedtuple("Token",
2152
("regexp", # To match token; if
2153
# "value" is not None,
2154
# must have a "group"
2155
# containing digits
2156
"value", # datetime.timedelta or
2157
# None
2158
"followers")) # Tokens valid after
2159
# this token
2588
Token = collections.namedtuple("Token", (
2589
"regexp", # To match token; if "value" is not None, must have
2590
# a "group" containing digits
2591
"value", # datetime.timedelta or None
2592
"followers")) # Tokens valid after this token
2160
2593
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2161
2594
# the "duration" ABNF definition in RFC 3339, Appendix A.
2162
2595
token_end = Token(re.compile(r"$"), None, frozenset())
2163
2596
token_second = Token(re.compile(r"(\d+)S"),
2164
2597
datetime.timedelta(seconds=1),
2165
frozenset((token_end,)))
2598
frozenset((token_end, )))
2166
2599
token_minute = Token(re.compile(r"(\d+)M"),
2167
2600
datetime.timedelta(minutes=1),
2168
2601
frozenset((token_second, token_end)))
2184
2617
frozenset((token_month, token_end)))
2185
2618
token_week = Token(re.compile(r"(\d+)W"),
2186
2619
datetime.timedelta(weeks=1),
2187
frozenset((token_end,)))
2620
frozenset((token_end, )))
2188
2621
token_duration = Token(re.compile(r"P"), None,
2189
2622
frozenset((token_year, token_month,
2190
2623
token_day, token_time,
2191
token_week))),
2624
token_week)))
2192
2625
# Define starting values
2193
2626
value = datetime.timedelta() # Value so far
2194
2627
found_token = None
2195
followers = frozenset(token_duration,) # Following valid tokens
2628
followers = frozenset((token_duration, )) # Following valid tokens
2196
2629
s = duration # String left to parse
2197
2630
# Loop until end token is found
2198
2631
while found_token is not token_end:
2215
2648
break
2216
2649
else:
2217
2650
# No currently valid tokens were found
2218
raise ValueError("Invalid RFC 3339 duration")
2651
raise ValueError("Invalid RFC 3339 duration: {!r}"
2652
.format(duration))
2219
2653
# End token found
2220
2654
return value
2221
2655
2245
2679
timevalue = datetime.timedelta(0)
2246
2680
for s in interval.split():
2247
2681
try:
2248
suffix = unicode(s[-1])
2682
suffix = s[-1]
2249
2683
value = int(s[:-1])
2250
2684
if suffix == "d":
2251
2685
delta = datetime.timedelta(value)
2258
2692
elif suffix == "w":
2259
2693
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2260
2694
else:
2261
raise ValueError("Unknown suffix {0!r}"
2262
.format(suffix))
2695
raise ValueError("Unknown suffix {!r}".format(suffix))
2263
2696
except IndexError as e:
2264
2697
raise ValueError(*(e.args))
2265
2698
timevalue += delta
2282
2715
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2283
2716
if not stat.S_ISCHR(os.fstat(null).st_mode):
2284
2717
raise OSError(errno.ENODEV,
2285
"{0} not a character device"
2718
"{} not a character device"
2286
2719
.format(os.devnull))
2287
2720
os.dup2(null, sys.stdin.fileno())
2288
2721
os.dup2(null, sys.stdout.fileno())
2298
2731
2299
2732
parser = argparse.ArgumentParser()
2300
2733
parser.add_argument("-v", "--version", action="version",
2301
version = "%(prog)s {0}".format(version),
2734
version = "%(prog)s {}".format(version),
2302
2735
help="show version number and exit")
2303
2736
parser.add_argument("-i", "--interface", metavar="IF",
2304
2737
help="Bind to interface IF")
2354
2787
"port": "",
2355
2788
"debug": "False",
2356
2789
"priority":
2357
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2358
2792
"servicename": "Mandos",
2359
2793
"use_dbus": "True",
2360
2794
"use_ipv6": "True",
2364
2798
"statedir": "/var/lib/mandos",
2365
2799
"foreground": "False",
2366
2800
"zeroconf": "True",
2367
}
2801
}
2368
2802
2369
2803
# Parse config file for server-global settings
2370
2804
server_config = configparser.SafeConfigParser(server_defaults)
2371
2805
del server_defaults
2372
server_config.read(os.path.join(options.configdir,
2373
"mandos.conf"))
2806
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2374
2807
# Convert the SafeConfigParser object to a dict
2375
2808
server_settings = server_config.defaults()
2376
2809
# Use the appropriate methods on the non-string config options
2394
2827
# Override the settings from the config file with command line
2395
2828
# options, if set.
2396
2829
for option in ("interface", "address", "port", "debug",
2397
"priority", "servicename", "configdir",
2398
"use_dbus", "use_ipv6", "debuglevel", "restore",
2399
"statedir", "socket", "foreground", "zeroconf"):
2830
"priority", "servicename", "configdir", "use_dbus",
2831
"use_ipv6", "debuglevel", "restore", "statedir",
2832
"socket", "foreground", "zeroconf"):
2400
2833
value = getattr(options, option)
2401
2834
if value is not None:
2402
2835
server_settings[option] = value
2403
2836
del options
2404
2837
# Force all strings to be unicode
2405
2838
for option in server_settings.keys():
2406
if type(server_settings[option]) is str:
2407
server_settings[option] = unicode(server_settings[option])
2839
if isinstance(server_settings[option], bytes):
2840
server_settings[option] = (server_settings[option]
2841
.decode("utf-8"))
2408
2842
# Force all boolean options to be boolean
2409
2843
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2410
2844
"foreground", "zeroconf"):
2416
2850
2417
2851
##################################################################
2418
2852
2419
if (not server_settings["zeroconf"] and
2420
not (server_settings["port"]
2421
or server_settings["socket"] != "")):
2422
parser.error("Needs port or socket to work without"
2423
" Zeroconf")
2853
if (not server_settings["zeroconf"]
2854
and not (server_settings["port"]
2855
or server_settings["socket"] != "")):
2856
parser.error("Needs port or socket to work without Zeroconf")
2424
2857
2425
2858
# For convenience
2426
2859
debug = server_settings["debug"]
2442
2875
initlogger(debug, level)
2443
2876
2444
2877
if server_settings["servicename"] != "Mandos":
2445
syslogger.setFormatter(logging.Formatter
2446
('Mandos ({0}) [%(process)d]:'
2447
' %(levelname)s: %(message)s'
2448
.format(server_settings
2449
["servicename"])))
2878
syslogger.setFormatter(
2879
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
' %(levelname)s: %(message)s'.format(
2881
server_settings["servicename"])))
2450
2882
2451
2883
# Parse config file with clients
2452
2884
client_config = configparser.SafeConfigParser(Client
2460
2892
socketfd = None
2461
2893
if server_settings["socket"] != "":
2462
2894
socketfd = server_settings["socket"]
2463
tcp_server = MandosServer((server_settings["address"],
2464
server_settings["port"]),
2465
ClientHandler,
2466
interface=(server_settings["interface"]
2467
or None),
2468
use_ipv6=use_ipv6,
2469
gnutls_priority=
2470
server_settings["priority"],
2471
use_dbus=use_dbus,
2472
socketfd=socketfd)
2895
tcp_server = MandosServer(
2896
(server_settings["address"], server_settings["port"]),
2897
ClientHandler,
2898
interface=(server_settings["interface"] or None),
2899
use_ipv6=use_ipv6,
2900
gnutls_priority=server_settings["priority"],
2901
use_dbus=use_dbus,
2902
socketfd=socketfd)
2473
2903
if not foreground:
2474
2904
pidfilename = "/run/mandos.pid"
2475
2905
if not os.path.isdir("/run/."):
2476
2906
pidfilename = "/var/run/mandos.pid"
2477
2907
pidfile = None
2478
2908
try:
2479
pidfile = open(pidfilename, "w")
2909
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2480
2910
except IOError as e:
2481
2911
logger.error("Could not open file %r", pidfilename,
2482
2912
exc_info=e)
2503
2933
2504
2934
# "Use a log level over 10 to enable all debugging options."
2505
2935
# - GnuTLS manual
2506
gnutls.library.functions.gnutls_global_set_log_level(11)
2936
gnutls.global_set_log_level(11)
2507
2937
2508
@gnutls.library.types.gnutls_log_func
2938
@gnutls.log_func
2509
2939
def debug_gnutls(level, string):
2510
2940
logger.debug("GnuTLS: %s", string[:-1])
2511
2941
2512
(gnutls.library.functions
2513
.gnutls_global_set_log_function(debug_gnutls))
2942
gnutls.global_set_log_function(debug_gnutls)
2514
2943
2515
2944
# Redirect stdin so all checkers get /dev/null
2516
2945
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2536
2965
if use_dbus:
2537
2966
try:
2538
2967
bus_name = dbus.service.BusName("se.recompile.Mandos",
2539
bus, do_not_queue=True)
2540
old_bus_name = (dbus.service.BusName
2541
("se.bsnet.fukt.Mandos", bus,
2542
do_not_queue=True))
2543
except dbus.exceptions.NameExistsException as e:
2968
bus,
2969
do_not_queue=True)
2970
old_bus_name = dbus.service.BusName(
2971
"se.bsnet.fukt.Mandos", bus,
2972
do_not_queue=True)
2973
except dbus.exceptions.DBusException as e:
2544
2974
logger.error("Disabling D-Bus:", exc_info=e)
2545
2975
use_dbus = False
2546
2976
server_settings["use_dbus"] = False
2547
2977
tcp_server.use_dbus = False
2548
2978
if zeroconf:
2549
2979
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
2980
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
2554
2985
if server_settings["interface"]:
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
2986
service.interface = if_nametoindex(
2987
server_settings["interface"].encode("utf-8"))
2557
2988
2558
2989
global multiprocessing_manager
2559
2990
multiprocessing_manager = multiprocessing.Manager()
2578
3009
if server_settings["restore"]:
2579
3010
try:
2580
3011
with open(stored_state_path, "rb") as stored_state:
2581
clients_data, old_client_settings = (pickle.load
2582
(stored_state))
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
2583
3014
os.remove(stored_state_path)
2584
3015
except IOError as e:
2585
3016
if e.errno == errno.ENOENT:
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
2588
3019
else:
2589
3020
logger.critical("Could not load persistent state:",
2590
3021
exc_info=e)
2591
3022
raise
2592
3023
except EOFError as e:
2593
3024
logger.warning("Could not load persistent state: "
2594
"EOFError:", exc_info=e)
3025
"EOFError:",
3026
exc_info=e)
2595
3027
2596
3028
with PGPEngine() as pgp:
2597
for client_name, client in clients_data.iteritems():
3029
for client_name, client in clients_data.items():
2598
3030
# Skip removed clients
2599
3031
if client_name not in client_settings:
2600
3032
continue
2609
3041
# For each value in new config, check if it
2610
3042
# differs from the old config value (Except for
2611
3043
# the "secret" attribute)
2612
if (name != "secret" and
2613
value != old_client_settings[client_name]
2614
[name]):
3044
if (name != "secret"
3045
and (value !=
3046
old_client_settings[client_name][name])):
2615
3047
client[name] = value
2616
3048
except KeyError:
2617
3049
pass
2618
3050
2619
3051
# Clients who has passed its expire date can still be
2620
# enabled if its last checker was successful. Clients
3052
# enabled if its last checker was successful. A Client
2621
3053
# whose checker succeeded before we stored its state is
2622
3054
# assumed to have successfully run all checkers during
2623
3055
# downtime.
2625
3057
if datetime.datetime.utcnow() >= client["expires"]:
2626
3058
if not client["last_checked_ok"]:
2627
3059
logger.warning(
2628
"disabling client {0} - Client never "
2629
"performed a successful checker"
2630
.format(client_name))
3060
"disabling client {} - Client never "
3061
"performed a successful checker".format(
3062
client_name))
2631
3063
client["enabled"] = False
2632
3064
elif client["last_checker_status"] != 0:
2633
3065
logger.warning(
2634
"disabling client {0} - Client "
2635
"last checker failed with error code {1}"
2636
.format(client_name,
2637
client["last_checker_status"]))
3066
"disabling client {} - Client last"
3067
" checker failed with error code"
3068
" {}".format(
3069
client_name,
3070
client["last_checker_status"]))
2638
3071
client["enabled"] = False
2639
3072
else:
2640
client["expires"] = (datetime.datetime
2641
.utcnow()
2642
+ client["timeout"])
3073
client["expires"] = (
3074
datetime.datetime.utcnow()
3075
+ client["timeout"])
2643
3076
logger.debug("Last checker succeeded,"
2644
" keeping {0} enabled"
2645
.format(client_name))
3077
" keeping {} enabled".format(
3078
client_name))
2646
3079
try:
2647
client["secret"] = (
2648
pgp.decrypt(client["encrypted_secret"],
2649
client_settings[client_name]
2650
["secret"]))
3080
client["secret"] = pgp.decrypt(
3081
client["encrypted_secret"],
3082
client_settings[client_name]["secret"])
2651
3083
except PGPError:
2652
3084
# If decryption fails, we use secret from new settings
2653
logger.debug("Failed to decrypt {0} old secret"
2654
.format(client_name))
2655
client["secret"] = (
2656
client_settings[client_name]["secret"])
3085
logger.debug("Failed to decrypt {} old secret".format(
3086
client_name))
3087
client["secret"] = (client_settings[client_name]
3088
["secret"])
2657
3089
2658
3090
# Add/remove clients based on new changes made to config
2659
3091
for client_name in (set(old_client_settings)
2664
3096
clients_data[client_name] = client_settings[client_name]
2665
3097
2666
3098
# Create all client objects
2667
for client_name, client in clients_data.iteritems():
3099
for client_name, client in clients_data.items():
2668
3100
tcp_server.clients[client_name] = client_class(
2669
name = client_name, settings = client,
3101
name = client_name,
3102
settings = client,
2670
3103
server_settings = server_settings)
2671
3104
2672
3105
if not tcp_server.clients:
2674
3107
2675
3108
if not foreground:
2676
3109
if pidfile is not None:
3110
pid = os.getpid()
2677
3111
try:
2678
3112
with pidfile:
2679
pid = os.getpid()
2680
pidfile.write(str(pid) + "\n".encode("utf-8"))
3113
print(pid, file=pidfile)
2681
3114
except IOError:
2682
3115
logger.error("Could not write to file %r with PID %d",
2683
3116
pidfilename, pid)
2688
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2689
3122
2690
3123
if use_dbus:
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2693
class MandosDBusService(DBusObjectWithProperties):
3124
3125
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3127
class MandosDBusService(DBusObjectWithObjectManager):
2694
3128
"""A D-Bus proxy object"""
3129
2695
3130
def __init__(self):
2696
3131
dbus.service.Object.__init__(self, bus, "/")
3132
2697
3133
_interface = "se.recompile.Mandos"
2698
3134
2699
@dbus_interface_annotations(_interface)
2700
def _foo(self):
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
2703
"false"}
2704
2705
3135
@dbus.service.signal(_interface, signature="o")
2706
3136
def ClientAdded(self, objpath):
2707
3137
"D-Bus signal"
2712
3142
"D-Bus signal"
2713
3143
pass
2714
3144
3145
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
"true"})
2715
3147
@dbus.service.signal(_interface, signature="os")
2716
3148
def ClientRemoved(self, objpath, name):
2717
3149
"D-Bus signal"
2718
3150
pass
2719
3151
3152
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
"true"})
2720
3154
@dbus.service.method(_interface, out_signature="ao")
2721
3155
def GetAllClients(self):
2722
3156
"D-Bus method"
2723
return dbus.Array(c.dbus_object_path
2724
for c in
3157
return dbus.Array(c.dbus_object_path for c in
2725
3158
tcp_server.clients.itervalues())
2726
3159
3160
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
"true"})
2727
3162
@dbus.service.method(_interface,
2728
3163
out_signature="a{oa{sv}}")
2729
3164
def GetAllClientsWithProperties(self):
2730
3165
"D-Bus method"
2731
3166
return dbus.Dictionary(
2732
((c.dbus_object_path, c.GetAll(""))
2733
for c in tcp_server.clients.itervalues()),
3167
{ c.dbus_object_path: c.GetAll(
3168
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
2734
3170
signature="oa{sv}")
2735
3171
2736
3172
@dbus.service.method(_interface, in_signature="o")
2740
3176
if c.dbus_object_path == object_path:
2741
3177
del tcp_server.clients[c.name]
2742
3178
c.remove_from_connection()
2743
# Don't signal anything except ClientRemoved
3179
# Don't signal the disabling
2744
3180
c.disable(quiet=True)
2745
# Emit D-Bus signal
2746
self.ClientRemoved(object_path, c.name)
3181
# Emit D-Bus signal for removal
3182
self.client_removed_signal(c)
2747
3183
return
2748
3184
raise KeyError(object_path)
2749
3185
2750
3186
del _interface
3187
3188
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3190
def GetManagedObjects(self):
3191
"""D-Bus method"""
3192
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3200
def client_added_signal(self, client):
3201
"""Send the new standard signal and the old signal"""
3202
if use_dbus:
3203
# New standard signal
3204
self.InterfacesAdded(
3205
client.dbus_object_path,
3206
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3210
# Old signal
3211
self.ClientAdded(client.dbus_object_path)
3212
3213
def client_removed_signal(self, client):
3214
"""Send the new standard signal and the old signal"""
3215
if use_dbus:
3216
# New standard signal
3217
self.InterfacesRemoved(
3218
client.dbus_object_path,
3219
client._get_all_interface_names())
3220
# Old signal
3221
self.ClientRemoved(client.dbus_object_path,
3222
client.name)
2751
3223
2752
3224
mandos_dbus_service = MandosDBusService()
2753
3225
2774
3246
2775
3247
# A list of attributes that can not be pickled
2776
3248
# + secret.
2777
exclude = set(("bus", "changedstate", "secret",
2778
"checker", "server_settings"))
2779
for name, typ in (inspect.getmembers
2780
(dbus.service.Object)):
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3251
for name, typ in inspect.getmembers(dbus.service
3252
.Object):
2781
3253
exclude.add(name)
2782
3254
2783
3255
client_dict["encrypted_secret"] = (client
2790
3262
del client_settings[client.name]["secret"]
2791
3263
2792
3264
try:
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
3265
with tempfile.NamedTemporaryFile(
3266
mode='wb',
3267
suffix=".pickle",
3268
prefix='clients-',
3269
dir=os.path.dirname(stored_state_path),
3270
delete=False) as stored_state:
2797
3271
pickle.dump((clients, client_settings), stored_state)
2798
tempname=stored_state.name
3272
tempname = stored_state.name
2799
3273
os.rename(tempname, stored_state_path)
2800
3274
except (IOError, OSError) as e:
2801
3275
if not debug:
2804
3278
except NameError:
2805
3279
pass
2806
3280
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2807
logger.warning("Could not save persistent state: {0}"
3281
logger.warning("Could not save persistent state: {}"
2808
3282
.format(os.strerror(e.errno)))
2809
3283
else:
2810
3284
logger.warning("Could not save persistent state:",
2816
3290
name, client = tcp_server.clients.popitem()
2817
3291
if use_dbus:
2818
3292
client.remove_from_connection()
2819
# Don't signal anything except ClientRemoved
3293
# Don't signal the disabling
2820
3294
client.disable(quiet=True)
3295
# Emit D-Bus signal for removal
2821
3296
if use_dbus:
2822
# Emit D-Bus signal
2823
mandos_dbus_service.ClientRemoved(client
2824
.dbus_object_path,
2825
client.name)
3297
mandos_dbus_service.client_removed_signal(client)
2826
3298
client_settings.clear()
2827
3299
2828
3300
atexit.register(cleanup)
2829
3301
2830
3302
for client in tcp_server.clients.itervalues():
2831
3303
if use_dbus:
2832
# Emit D-Bus signal
2833
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3304
# Emit D-Bus signal for adding
3305
mandos_dbus_service.client_added_signal(client)
2834
3306
# Need to initiate checking of clients
2835
3307
if client.enabled:
2836
3308
client.init_checker()
2881
3353
# Must run before the D-Bus bus name gets deregistered
2882
3354
cleanup()
2883
3355
3356
2884
3357
if __name__ == '__main__':
2885
3358
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0