/mandos/release : revision 237.7.47

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

37

import SocketServer as socketserver

43

38

import socket

44

39

import argparse

45

40

import datetime

50

45

import gnutls.library.functions

51

46

import gnutls.library.constants

52

47

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

48

import ConfigParser as configparser

57

49

import sys

58

50

import re

59

51

import os

68

60

import struct

69

61

import fcntl

70

62

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

63

import cPickle as pickle

75

64

import multiprocessing

76

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

81

import codecs

82

65

83

66

import dbus

84

67

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

68

import gobject

89

69

import avahi

90

70

from dbus.mainloop.glib import DBusGMainLoop

91

71

import ctypes

101

81

except ImportError:

102

82

SO_BINDTODEVICE = None

103

83

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

108

stored_state_file = "clients.pickle"

109

110

logger = logging.getLogger()

111

syslogger = None

112

113

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

116

except (OSError, AttributeError):

117

118

def if_nametoindex(interface):

119

"Get an interface index the hard way, i.e. using fcntl()"

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

with contextlib.closing(socket.socket()) as s:

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

125

return interface_index

126

127

128

def initlogger(debug, level=logging.WARNING):

129

"""init logger and add loglevel"""

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

syslogger.setFormatter(logging.Formatter

136

('Mandos [%(process)d]: %(levelname)s:'

137

' %(message)s'))

138

logger.addHandler(syslogger)

139

140

if debug:

141

console = logging.StreamHandler()

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

147

logger.setLevel(level)

148

149

150

class PGPError(Exception):

151

"""Exception if encryption/decryption fails"""

152

pass

153

154

155

class PGPEngine(object):

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

def __init__(self):

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

165

166

def __enter__(self):

167

return self

168

169

def __exit__(self, exc_type, exc_value, traceback):

170

self._cleanup()

171

return False

172

173

def __del__(self):

174

self._cleanup()

175

176

def _cleanup(self):

177

if self.tempdir is not None:

178

# Delete contents of tempdir

179

for root, dirs, files in os.walk(self.tempdir,

180

topdown = False):

181

for filename in files:

182

os.remove(os.path.join(root, filename))

183

for dirname in dirs:

184

os.rmdir(os.path.join(root, dirname))

185

# Remove tempdir

186

os.rmdir(self.tempdir)

187

self.tempdir = None

188

189

def password_encode(self, password):

190

# Passphrase can not be empty and can not contain newlines or

191

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

199

200

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

216

return ciphertext

217

218

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

234

return decrypted_plaintext

235

84

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

89

syslogger = (logging.handlers.SysLogHandler

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

236

102

237

103

class AvahiError(Exception):

238

104

def __init__(self, value, *args, **kwargs):

239

105

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

106

super(AvahiError, self).__init__(value, *args, **kwargs)

107

def __unicode__(self):

108

return unicode(repr(self.value))

243

109

244

110

class AvahiServiceError(AvahiError):

245

111

pass

246

112

247

248

113

class AvahiGroupError(AvahiError):

249

114

pass

250

115

257

122

Used to optionally bind to the specified interface.

258

123

name: string; Example: 'Mandos'

259

124

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

125

See <http://www.dns-sd.org/ServiceTypes.html>

261

126

port: integer; what port to announce

262

127

TXT: list of strings; TXT record for the service

263

128

domain: string; Domain to publish on, default to .local if empty.

269

134

server: D-Bus Server

270

135

bus: dbus.SystemBus()

271

136

"""

272

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

284

141

self.interface = interface

285

142

self.name = name

286

143

self.type = servicetype

295

152

self.server = None

296

153

self.bus = bus

297

154

self.entry_group_state_changed_match = None

298

299

def rename(self, remove=True):

155

def rename(self):

300

156

"""Derived from the Avahi example code"""

301

157

if self.rename_count >= self.max_renames:

302

158

logger.critical("No suitable Zeroconf service name found"

303

159

" after %i retries, exiting.",

304

160

self.rename_count)

305

161

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

309

163

logger.info("Changing Zeroconf service name to %r ...",

310

164

self.name)

311

if remove:

312

self.remove()

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

self.remove()

313

170

try:

314

171

self.add()

315

172

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

324

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

176

self.rename_count += 1

325

177

def remove(self):

326

178

"""Derived from the Avahi example code"""

327

179

if self.entry_group_state_changed_match is not None:

329

181

self.entry_group_state_changed_match = None

330

182

if self.group is not None:

331

183

self.group.Reset()

332

333

184

def add(self):

334

185

"""Derived from the Avahi example code"""

335

186

self.remove()

340

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

341

192

self.entry_group_state_changed_match = (

342

193

self.group.connect_to_signal(

343

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

344

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

345

196

self.name, self.type)

346

197

self.group.AddService(

352

203

dbus.UInt16(self.port),

353

204

avahi.string_array_to_txt_array(self.TXT))

354

205

self.group.Commit()

355

356

206

def entry_group_state_changed(self, state, error):

357

207

"""Derived from the Avahi example code"""

358

208

logger.debug("Avahi entry group state change: %i", state)

364

214

self.rename()

365

215

elif state == avahi.ENTRY_GROUP_FAILURE:

366

216

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

369

217

unicode(error))

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

370

220

def cleanup(self):

371

221

"""Derived from the Avahi example code"""

372

222

if self.group is not None:

373

223

try:

374

224

self.group.Free()

375

225

except (dbus.exceptions.UnknownMethodException,

376

dbus.exceptions.DBusException):

226

dbus.exceptions.DBusException) as e:

377

227

pass

378

228

self.group = None

379

229

self.remove()

380

381

230

def server_state_changed(self, state, error=None):

382

231

"""Derived from the Avahi example code"""

383

232

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

390

240

if state in bad_states:

391

241

if bad_states[state] is not None:

392

242

if error is None:

395

245

logger.error(bad_states[state] + ": %r", error)

396

246

self.cleanup()

397

247

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

248

self.add()

410

249

else:

411

250

if error is None:

412

251

logger.debug("Unknown state: %r", state)

413

252

else:

414

253

logger.debug("Unknown state: %r: %r", state, error)

415

416

254

def activate(self):

417

255

"""Derived from the Avahi example code"""

418

256

if self.server is None:

422

260

follow_name_owner_changes=True),

423

261

avahi.DBUS_INTERFACE_SERVER)

424

262

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

263

self.server_state_changed)

426

264

self.server_state_changed(self.server.GetState())

427

265

428

266

429

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

431

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

436

return ret

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

448

267

class Client(object):

449

268

"""A representation of a client host served by this server.

450

269

451

270

Attributes:

452

approved: bool(); 'None' if not yet approved/disapproved

271

_approved: bool(); 'None' if not yet approved/disapproved

453

272

approval_delay: datetime.timedelta(); Time to wait for approval

454

273

approval_duration: datetime.timedelta(); Duration of one approval

455

274

checker: subprocess.Popen(); a running checker process used

462

281

instance %(name)s can be used in the command.

463

282

checker_initiator_tag: a gobject event source tag, or None

464

283

created: datetime.datetime(); (UTC) object creation

465

client_structure: Object describing what attributes a client has

466

and is used for storing the client at exit

467

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

468

286

disable_initiator_tag: a gobject event source tag, or None

469

287

enabled: bool()

470

288

fingerprint: string (40 or 32 hexadecimal digits); used to

473

291

interval: datetime.timedelta(); How often to start a new checker

474

292

last_approval_request: datetime.datetime(); (UTC) or None

475

293

last_checked_ok: datetime.datetime(); (UTC) or None

476

last_checker_status: integer between 0 and 255 reflecting exit

477

status of last checker. -1 reflects crashed

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

last_enabled: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

482

295

name: string; from the config file, used in log messages and

483

296

D-Bus identifiers

484

297

secret: bytestring; sent verbatim (over TLS) to client

485

298

timeout: datetime.timedelta(); How long from last_checked_ok

486

299

until this client is disabled

487

extended_timeout: extra long timeout when secret has been sent

300

extended_timeout: extra long timeout when password has been sent

488

301

runtime_expansions: Allowed attributes for runtime expansion.

489

302

expires: datetime.datetime(); time (UTC) when a client will be

490

303

disabled, or None

491

server_settings: The server_settings dict from main()

492

304

"""

493

305

494

306

runtime_expansions = ("approval_delay", "approval_duration",

495

"created", "enabled", "expires",

496

"fingerprint", "host", "interval",

497

"last_approval_request", "last_checked_ok",

307

"created", "enabled", "fingerprint",

308

"host", "interval", "last_checked_ok",

498

309

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

510

310

511

311

@staticmethod

512

def config_parser(config):

513

"""Construct a new dict of client settings of this form:

514

{ client_name: {setting_name: value, ...}, ...}

515

with exceptions for any special settings as defined above.

516

NOTE: Must be a pure function. Must return the same result

517

value given the same arguments.

518

"""

519

settings = {}

520

for client_name in config.sections():

521

section = dict(config.items(client_name))

522

client = settings[client_name] = {}

523

524

client["host"] = section["host"]

525

# Reformat values from string types to Python types

526

client["approved_by_default"] = config.getboolean(

527

client_name, "approved_by_default")

528

client["enabled"] = config.getboolean(client_name,

529

"enabled")

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

535

.replace(" ", ""))

536

if "secret" in section:

537

client["secret"] = section["secret"].decode("base64")

538

elif "secfile" in section:

539

with open(os.path.expanduser(os.path.expandvars

540

(section["secfile"])),

541

"rb") as secfile:

542

client["secret"] = secfile.read()

543

else:

544

raise TypeError("No secret or secfile for section {}"

545

.format(section))

546

client["timeout"] = string_to_delta(section["timeout"])

547

client["extended_timeout"] = string_to_delta(

548

section["extended_timeout"])

549

client["interval"] = string_to_delta(section["interval"])

550

client["approval_delay"] = string_to_delta(

551

section["approval_delay"])

552

client["approval_duration"] = string_to_delta(

553

section["approval_duration"])

554

client["checker_command"] = section["checker"]

555

client["last_approval_request"] = None

556

client["last_checked_ok"] = None

557

client["last_checker_status"] = -2

558

559

return settings

560

561

def __init__(self, settings, name = None, server_settings=None):

312

def _timedelta_to_milliseconds(td):

313

"Convert a datetime.timedelta() to milliseconds"

314

return ((td.days * 24 * 60 * 60 * 1000)

315

+ (td.seconds * 1000)

316

+ (td.microseconds // 1000))

317

318

def timeout_milliseconds(self):

319

"Return the 'timeout' attribute in milliseconds"

320

return self._timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return self._timedelta_to_milliseconds(self.extended_timeout)

325

326

def interval_milliseconds(self):

327

"Return the 'interval' attribute in milliseconds"

328

return self._timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return self._timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

334

"""Note: the 'checker' key in 'config' sets the

335

'checker_command' attribute and *not* the 'checker'

336

attribute."""

562

337

self.name = name

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

566

# adding all client settings

567

for setting, value in settings.items():

568

setattr(self, setting, value)

569

570

if self.enabled:

571

if not hasattr(self, "last_enabled"):

572

self.last_enabled = datetime.datetime.utcnow()

573

if not hasattr(self, "expires"):

574

self.expires = (datetime.datetime.utcnow()

575

+ self.timeout)

576

else:

577

self.last_enabled = None

578

self.expires = None

579

338

if config is None:

339

config = {}

580

340

logger.debug("Creating client %r", self.name)

341

# Uppercase and remove spaces from fingerprint for later

342

# comparison purposes with return value from the fingerprint()

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

581

346

logger.debug(" Fingerprint: %s", self.fingerprint)

582

self.created = settings.get("created",

583

datetime.datetime.utcnow())

584

585

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

586

367

self.checker = None

587

368

self.checker_initiator_tag = None

588

369

self.disable_initiator_tag = None

370

self.expires = None

589

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

590

373

self.current_checker_command = None

591

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

592

378

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

597

if not attr.startswith("_")]

598

self.client_structure.append("client_structure")

599

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

602

if not name.startswith("_"):

603

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

604

384

605

# Send notice to process children that client state has changed

606

385

def send_changedstate(self):

607

with self.changedstate:

608

self.changedstate.notify_all()

609

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

610

390

def enable(self):

611

391

"""Start this client's checker and timeout hooks"""

612

392

if getattr(self, "enabled", False):

613

393

# Already enabled

614

394

return

395

self.send_changedstate()

396

self.last_enabled = datetime.datetime.utcnow()

397

# Schedule a new checker to be started an 'interval' from now,

398

# and every interval from then on.

399

self.checker_initiator_tag = (gobject.timeout_add

400

(self.interval_milliseconds(),

401

self.start_checker))

402

# Schedule a disable() when 'timeout' has passed

615

403

self.expires = datetime.datetime.utcnow() + self.timeout

404

self.disable_initiator_tag = (gobject.timeout_add

405

(self.timeout_milliseconds(),

406

self.disable))

616

407

self.enabled = True

617

self.last_enabled = datetime.datetime.utcnow()

618

self.init_checker()

619

self.send_changedstate()

408

# Also start a new checker *right now*.

409

self.start_checker()

620

410

621

411

def disable(self, quiet=True):

622

412

"""Disable this client."""

623

413

if not getattr(self, "enabled", False):

624

414

return False

625

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

626

418

logger.info("Disabling client %s", self.name)

627

if getattr(self, "disable_initiator_tag", None) is not None:

419

if getattr(self, "disable_initiator_tag", False):

628

420

gobject.source_remove(self.disable_initiator_tag)

629

421

self.disable_initiator_tag = None

630

422

self.expires = None

631

if getattr(self, "checker_initiator_tag", None) is not None:

423

if getattr(self, "checker_initiator_tag", False):

632

424

gobject.source_remove(self.checker_initiator_tag)

633

425

self.checker_initiator_tag = None

634

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

635

429

self.enabled = False

636

if not quiet:

637

self.send_changedstate()

638

430

# Do not run this again if called by a gobject.timeout_add

639

431

return False

640

432

641

433

def __del__(self):

434

self.disable_hook = None

642

435

self.disable()

643

436

644

def init_checker(self):

645

# Schedule a new checker to be started an 'interval' from now,

646

# and every interval from then on.

647

if self.checker_initiator_tag is not None:

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

652

# Schedule a disable() when 'timeout' has passed

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

657

# Also start a new checker *right now*.

658

self.start_checker()

659

660

def checker_callback(self, source, condition, connection,

661

command):

437

def checker_callback(self, pid, condition, command):

662

438

"""The checker has completed, so take appropriate actions."""

663

439

self.checker_callback_tag = None

664

440

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

672

if self.last_checker_status == 0:

441

if os.WIFEXITED(condition):

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

673

444

logger.info("Checker for %(name)s succeeded",

674

445

vars(self))

675

446

self.checked_ok()

676

447

else:

677

logger.info("Checker for %(name)s failed", vars(self))

448

logger.info("Checker for %(name)s failed",

449

vars(self))

678

450

else:

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

451

logger.warning("Checker for %(name)s crashed?",

682

452

vars(self))

683

return False

684

685

def checked_ok(self):

686

"""Assert that the client has been seen, alive and well."""

687

self.last_checked_ok = datetime.datetime.utcnow()

688

self.last_checker_status = 0

689

self.last_checker_signal = None

690

self.bump_timeout()

691

692

def bump_timeout(self, timeout=None):

693

"""Bump up the timeout for this client."""

453

454

def checked_ok(self, timeout=None):

455

"""Bump up the timeout for this client.

456

457

This should only be called when the client has been seen,

458

alive and well.

459

"""

694

460

if timeout is None:

695

461

timeout = self.timeout

696

if self.disable_initiator_tag is not None:

697

gobject.source_remove(self.disable_initiator_tag)

698

self.disable_initiator_tag = None

699

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

702

self.expires = datetime.datetime.utcnow() + timeout

462

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(self._timedelta_to_milliseconds(timeout),

467

self.disable))

703

468

704

469

def need_approval(self):

705

470

self.last_approval_request = datetime.datetime.utcnow()

710

475

If a checker already exists, leave it running and do

711

476

nothing."""

712

477

# The reason for not killing a running checker is that if we

713

# did that, and if a checker (for some reason) started running

714

# slowly and taking more than 'interval' time, then the client

715

# would inevitably timeout, since no checker would get a

716

# chance to run to completion. If we instead leave running

478

# did that, then if a checker (for some reason) started

479

# running slowly and taking more than 'interval' time, the

480

# client would inevitably timeout, since no checker would get

481

# a chance to run to completion. If we instead leave running

717

482

# checkers alone, the checker would have to take more time

718

483

# than 'timeout' for the client to be disabled, which is as it

719

484

# should be.

720

485

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

486

# If a checker exists, make sure it is not a zombie

487

try:

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

490

if (isinstance(error, OSError)

491

and error.errno != errno.ECHILD):

492

raise error

493

else:

494

if pid:

495

logger.warning("Checker was a zombie")

496

gobject.source_remove(self.checker_callback_tag)

497

self.checker_callback(pid, status,

498

self.current_checker_command)

725

499

# Start a new checker if needed

726

500

if self.checker is None:

727

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

731

501

try:

732

command = self.checker_command % escaped_attrs

733

except TypeError as error:

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

502

# In case checker_command has exactly one % operator

503

command = self.checker_command % self.host

504

except TypeError:

505

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

514

try:

515

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

519

return True # Try again later

738

520

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

521

try:

522

logger.info("Starting checker %r for %s",

523

command, self.name)

524

# We don't need to redirect stdout and stderr, since

525

# in normal mode, that is already done by daemon(),

526

# and in debug mode we don't want to. (Stdin is

527

# always replaced by /dev/null.)

528

self.checker = subprocess.Popen(command,

529

close_fds=True,

530

shell=True, cwd="/")

531

self.checker_callback_tag = (gobject.child_watch_add

532

(self.checker.pid,

533

self.checker_callback,

534

data=command))

535

# The checker may have completed before the gobject

536

# watch was added. Check for this.

537

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

538

if pid:

539

gobject.source_remove(self.checker_callback_tag)

540

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

543

error)

764

544

# Re-run this periodically if run by gobject.timeout_add

765

545

return True

766

546

772

552

if getattr(self, "checker", None) is None:

773

553

return

774

554

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

555

try:

556

os.kill(self.checker.pid, signal.SIGTERM)

557

#time.sleep(0.5)

558

#if self.checker.poll() is None:

559

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

561

if error.errno != errno.ESRCH: # No such process

562

raise

776

563

self.checker = None

777

564

778

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

783

567

"""Decorators for marking methods of a DBusObjectWithProperties to

784

568

become properties on the D-Bus.

785

569

794

578

# "Set" method, so we fail early here:

795

579

if byte_arrays and signature != "ay":

796

580

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {!r}".format(signature))

798

581

" signature %r" % signature)

799

582

def decorator(func):

800

583

func._dbus_is_property = True

801

584

func._dbus_interface = dbus_interface

806

589

func._dbus_name = func._dbus_name[:-14]

807

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

591

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

"""

846

847

def decorator(func):

848

func._dbus_annotations = annotations

849

return func

850

851

592

return decorator

852

593

853

594

854

595

class DBusPropertyException(dbus.exceptions.DBusException):

855

596

"""A base class for D-Bus property-related exceptions

856

597

"""

857

pass

598

def __unicode__(self):

599

return unicode(str(self))

858

600

859

601

860

602

class DBusPropertyAccessException(DBusPropertyException):

871

613

872

614

class DBusObjectWithProperties(dbus.service.Object):

873

615

"""A D-Bus object with properties.

874

616

875

617

Classes inheriting from this can use the dbus_service_property

876

618

decorator to expose methods as D-Bus properties. It exposes the

877

619

standard Get(), Set(), and GetAll() methods on the D-Bus.

878

620

"""

879

621

880

622

@staticmethod

881

def _is_dbus_thing(thing):

882

"""Returns a function testing if an attribute is a D-Bus thing

883

884

If called like _is_dbus_thing("method") it returns a function

885

suitable for use as predicate to inspect.getmembers().

886

"""

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

888

False)

623

def _is_dbus_property(obj):

624

return getattr(obj, "_dbus_is_property", False)

889

625

890

def _get_all_dbus_things(self, thing):

626

def _get_all_dbus_properties(self):

891

627

"""Returns a generator of (name, attribute) pairs

892

628

"""

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

894

athing.__get__(self))

895

for cls in self.__class__.__mro__

896

for name, athing in

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

629

return ((prop._dbus_name, prop)

630

for name, prop in

631

inspect.getmembers(self, self._is_dbus_property))

898

632

899

633

def _get_dbus_property(self, interface_name, property_name):

900

634

"""Returns a bound method if one exists which is a D-Bus

901

635

property with the specified name and interface.

902

636

"""

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

906

if (value._dbus_name == property_name

907

and value._dbus_interface == interface_name):

908

return value.__get__(self)

909

637

for name in (property_name,

638

property_name + "_dbus_property"):

639

prop = getattr(self, name, None)

640

if (prop is None

641

or not self._is_dbus_property(prop)

642

or prop._dbus_name != property_name

643

or (interface_name and prop._dbus_interface

644

and interface_name != prop._dbus_interface)):

645

continue

646

return prop

910

647

# No such property

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

650

+ property_name)

913

651

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

916

653

out_signature="v")

917

654

def Get(self, interface_name, property_name):

918

655

"""Standard D-Bus property Get() method, see D-Bus standard.

936

673

# The byte_arrays option is not supported yet on

937

674

# signatures other than "ay".

938

675

if prop._dbus_signature != "ay":

939

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {!r}"

941

.format(prop._dbus_signature))

942

value = dbus.ByteArray(b''.join(chr(byte)

943

for byte in value))

676

raise ValueError

677

value = dbus.ByteArray(''.join(unichr(byte)

678

for byte in value))

944

679

prop(value)

945

680

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

948

682

out_signature="a{sv}")

949

683

def GetAll(self, interface_name):

950

684

"""Standard D-Bus property GetAll() method, see D-Bus

951

685

standard.

952

686

953

687

Note: Will not include properties with access="write".

954

688

"""

955

properties = {}

956

for name, prop in self._get_all_dbus_things("property"):

689

all = {}

690

for name, prop in self._get_all_dbus_properties():

957

691

if (interface_name

958

692

and interface_name != prop._dbus_interface):

959

693

# Interface non-empty but did not match

963

697

continue

964

698

value = prop()

965

699

if not hasattr(value, "variant_level"):

966

properties[name] = value

700

all[name] = value

967

701

continue

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

970

return dbus.Dictionary(properties, signature="sv")

971

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

702

all[name] = type(value)(value, variant_level=

703

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

979

705

980

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

981

707

out_signature="s",

982

708

path_keyword='object_path',

983

709

connection_keyword='connection')

984

710

def Introspect(self, object_path, connection):

985

"""Overloading of standard D-Bus method.

986

987

Inserts property tags and interface annotation tags.

711

"""Standard D-Bus method, overloaded to insert property tags.

988

712

"""

989

713

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

714

connection)

991

715

try:

992

716

document = xml.dom.minidom.parseString(xmlstring)

993

994

717

def make_tag(document, name, prop):

995

718

e = document.createElement("property")

996

719

e.setAttribute("name", name)

997

720

e.setAttribute("type", prop._dbus_signature)

998

721

e.setAttribute("access", prop._dbus_access)

999

722

return e

1000

1001

723

for if_tag in document.getElementsByTagName("interface"):

1002

# Add property tags

1003

724

for tag in (make_tag(document, name, prop)

1004

725

for name, prop

1005

in self._get_all_dbus_things("property")

726

in self._get_all_dbus_properties()

1006

727

if prop._dbus_interface

1007

728

== if_tag.getAttribute("name")):

1008

729

if_tag.appendChild(tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1038

730

# Add the names to the return values for the

1039

731

# "org.freedesktop.DBus.Properties" methods

1040

732

if (if_tag.getAttribute("name")

1055

747

except (AttributeError, xml.dom.DOMException,

1056

748

xml.parsers.expat.ExpatError) as error:

1057

749

logger.error("Failed to override Introspection method",

1058

exc_info=error)

750

error)

1059

751

return xmlstring

1060

752

1061

753

1062

def datetime_to_dbus(dt, variant_level=0):

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1064

if dt is None:

1065

return dbus.String("", variant_level = variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1067

1068

1069

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1070

"""A class decorator; applied to a subclass of

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1072

interface names according to the "alt_interface_names" mapping.

1073

Usage:

1074

1075

@alternate_dbus_interfaces({"org.example.Interface":

1076

"net.example.AlternateInterface"})

1077

class SampleDBusObject(dbus.service.Object):

1078

@dbus.service.method("org.example.Interface")

1079

def SampleDBusMethod():

1080

pass

1081

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1083

reachable via two interfaces: "org.example.Interface" and

1084

"net.example.AlternateInterface", the latter of which will have

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1086

"true", unless "deprecate" is passed with a False value.

1087

1088

This works for methods and signals, and also for D-Bus properties

1089

(from DBusObjectWithProperties) and interfaces (from the

1090

dbus_interface_annotations decorator).

1091

"""

1092

1093

def wrapper(cls):

1094

for orig_interface_name, alt_interface_name in (

1095

alt_interface_names.items()):

1096

attr = {}

1097

interface_names = set()

1098

# Go though all attributes of the class

1099

for attrname, attribute in inspect.getmembers(cls):

1100

# Ignore non-D-Bus attributes, and D-Bus attributes

1101

# with the wrong interface name

1102

if (not hasattr(attribute, "_dbus_interface")

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1105

continue

1106

# Create an alternate D-Bus interface name based on

1107

# the current name

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1110

interface_names.add(alt_interface)

1111

# Is this a D-Bus signal?

1112

if getattr(attribute, "_dbus_is_signal", False):

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1120

else:

1121

nonmethod_func = attribute

1122

# Create a new, but exactly alike, function

1123

# object, and decorate it to be a new D-Bus signal

1124

# with the alternate D-Bus interface name

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1139

new_function = (dbus.service.signal(

1140

alt_interface,

1141

attribute._dbus_signature)(new_function))

1142

# Copy annotations, if any

1143

try:

1144

new_function._dbus_annotations = dict(

1145

attribute._dbus_annotations)

1146

except AttributeError:

1147

pass

1148

# Define a creator of a function to call both the

1149

# original and alternate functions, so both the

1150

# original and alternate signals gets sent when

1151

# the function is called

1152

def fixscope(func1, func2):

1153

"""This function is a scope container to pass

1154

func1 and func2 to the "call_both" function

1155

outside of its arguments"""

1156

1157

def call_both(*args, **kwargs):

1158

"""This function will emit two D-Bus

1159

signals by calling func1 and func2"""

1160

func1(*args, **kwargs)

1161

func2(*args, **kwargs)

1162

1163

return call_both

1164

# Create the "call_both" function and add it to

1165

# the class

1166

attr[attrname] = fixscope(attribute, new_function)

1167

# Is this a D-Bus method?

1168

elif getattr(attribute, "_dbus_is_method", False):

1169

# Create a new, but exactly alike, function

1170

# object. Decorate it to be a new D-Bus method

1171

# with the alternate D-Bus interface name. Add it

1172

# to the class.

1173

attr[attrname] = (

1174

dbus.service.method(

1175

alt_interface,

1176

attribute._dbus_in_signature,

1177

attribute._dbus_out_signature)

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1183

# Copy annotations, if any

1184

try:

1185

attr[attrname]._dbus_annotations = dict(

1186

attribute._dbus_annotations)

1187

except AttributeError:

1188

pass

1189

# Is this a D-Bus property?

1190

elif getattr(attribute, "_dbus_is_property", False):

1191

# Create a new, but exactly alike, function

1192

# object, and decorate it to be a new D-Bus

1193

# property with the alternate D-Bus interface

1194

# name. Add it to the class.

1195

attr[attrname] = (dbus_service_property(

1196

alt_interface, attribute._dbus_signature,

1197

attribute._dbus_access,

1198

attribute._dbus_get_args_options

1199

["byte_arrays"])

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1206

# Copy annotations, if any

1207

try:

1208

attr[attrname]._dbus_annotations = dict(

1209

attribute._dbus_annotations)

1210

except AttributeError:

1211

pass

1212

# Is this a D-Bus interface?

1213

elif getattr(attribute, "_dbus_is_interface", False):

1214

# Create a new, but exactly alike, function

1215

# object. Decorate it to be a new D-Bus interface

1216

# with the alternate D-Bus interface name. Add it

1217

# to the class.

1218

attr[attrname] = (

1219

dbus_interface_annotations(alt_interface)

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1225

if deprecate:

1226

# Deprecate all alternate interfaces

1227

iname="_AlternateDBusNames_interface_annotation{}"

1228

for interface_name in interface_names:

1229

1230

@dbus_interface_annotations(interface_name)

1231

def func(self):

1232

return { "org.freedesktop.DBus.Deprecated":

1233

"true" }

1234

# Find an unused name

1235

for aname in (iname.format(i)

1236

for i in itertools.count()):

1237

if aname not in attr:

1238

attr[aname] = func

1239

break

1240

if interface_names:

1241

# Replace the class with a new subclass of it with

1242

# methods, signals, etc. as created above.

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1245

return cls

1246

1247

return wrapper

1248

1249

1250

@alternate_dbus_interfaces({"se.recompile.Mandos":

1251

"se.bsnet.fukt.Mandos"})

1252

754

class ClientDBus(Client, DBusObjectWithProperties):

1253

755

"""A Client class using D-Bus

1254

756

1258

760

"""

1259

761

1260

762

runtime_expansions = (Client.runtime_expansions

1261

+ ("dbus_object_path", ))

1262

1263

_interface = "se.recompile.Mandos.Client"

763

+ ("dbus_object_path",))

1264

764

1265

765

# dbus.service.Object doesn't use super(), so we can't either.

1266

766

1267

767

def __init__(self, bus = None, *args, **kwargs):

768

self._approvals_pending = 0

1268

769

self.bus = bus

1269

770

Client.__init__(self, *args, **kwargs)

1270

771

# Only now, when this client is initialized, can it show up on

1271

772

# the D-Bus

1272

client_object_name = str(self.name).translate(

773

client_object_name = unicode(self.name).translate(

1273

774

{ord("."): ord("_"),

1274

775

ord("-"): ord("_")})

1275

self.dbus_object_path = dbus.ObjectPath(

1276

"/clients/" + client_object_name)

776

self.dbus_object_path = (dbus.ObjectPath

777

("/clients/" + client_object_name))

1277

778

DBusObjectWithProperties.__init__(self, self.bus,

1278

779

self.dbus_object_path)

1279

1280

def notifychangeproperty(transform_func, dbus_name,

1281

type_func=lambda x: x,

1282

variant_level=1,

1283

invalidate_only=False,

1284

_interface=_interface):

1285

""" Modify a variable so that it's a property which announces

1286

its changes to DBus.

1287

1288

transform_fun: Function that takes a value and a variant_level

1289

and transforms it to a D-Bus type.

1290

dbus_name: D-Bus name of the variable

1291

type_func: Function that transform the value before sending it

1292

to the D-Bus. Default: no transform

1293

variant_level: D-Bus variant level. Default: 1

1294

"""

1295

attrname = "_{}".format(dbus_name)

1296

1297

def setter(self, value):

1298

if hasattr(self, "dbus_object_path"):

1299

if (not hasattr(self, attrname) or

1300

type_func(getattr(self, attrname, None))

1301

!= type_func(value)):

1302

if invalidate_only:

1303

self.PropertiesChanged(

1304

_interface, dbus.Dictionary(),

1305

dbus.Array((dbus_name, )))

1306

else:

1307

dbus_value = transform_func(

1308

type_func(value),

1309

variant_level = variant_level)

1310

self.PropertyChanged(dbus.String(dbus_name),

1311

dbus_value)

1312

self.PropertiesChanged(

1313

_interface,

1314

dbus.Dictionary({ dbus.String(dbus_name):

1315

dbus_value }),

1316

dbus.Array())

1317

setattr(self, attrname, value)

1318

1319

return property(lambda self: getattr(self, attrname), setter)

1320

1321

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1322

approvals_pending = notifychangeproperty(dbus.Boolean,

1323

"ApprovalPending",

1324

type_func = bool)

1325

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1326

last_enabled = notifychangeproperty(datetime_to_dbus,

1327

"LastEnabled")

1328

checker = notifychangeproperty(

1329

dbus.Boolean, "CheckerRunning",

1330

type_func = lambda checker: checker is not None)

1331

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1332

"LastCheckedOK")

1333

last_checker_status = notifychangeproperty(dbus.Int16,

1334

"LastCheckerStatus")

1335

last_approval_request = notifychangeproperty(

1336

datetime_to_dbus, "LastApprovalRequest")

1337

approved_by_default = notifychangeproperty(dbus.Boolean,

1338

"ApprovedByDefault")

1339

approval_delay = notifychangeproperty(

1340

dbus.UInt64, "ApprovalDelay",

1341

type_func = lambda td: td.total_seconds() * 1000)

1342

approval_duration = notifychangeproperty(

1343

dbus.UInt64, "ApprovalDuration",

1344

type_func = lambda td: td.total_seconds() * 1000)

1345

host = notifychangeproperty(dbus.String, "Host")

1346

timeout = notifychangeproperty(

1347

dbus.UInt64, "Timeout",

1348

type_func = lambda td: td.total_seconds() * 1000)

1349

extended_timeout = notifychangeproperty(

1350

dbus.UInt64, "ExtendedTimeout",

1351

type_func = lambda td: td.total_seconds() * 1000)

1352

interval = notifychangeproperty(

1353

dbus.UInt64, "Interval",

1354

type_func = lambda td: td.total_seconds() * 1000)

1355

checker_command = notifychangeproperty(dbus.String, "Checker")

1356

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1357

invalidate_only=True)

1358

1359

del notifychangeproperty

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

802

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

806

807

@staticmethod

808

def _datetime_to_dbus(dt, variant_level=0):

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

812

return dbus.String(dt.isoformat(),

813

variant_level=variant_level)

814

815

def enable(self):

816

oldstate = getattr(self, "enabled", False)

817

r = Client.enable(self)

818

if oldstate != self.enabled:

819

# Emit D-Bus signals

820

self.PropertyChanged(dbus.String("Enabled"),

821

dbus.Boolean(True, variant_level=1))

822

self.PropertyChanged(

823

dbus.String("LastEnabled"),

824

self._datetime_to_dbus(self.last_enabled,

825

variant_level=1))

826

return r

827

828

def disable(self, quiet = False):

829

oldstate = getattr(self, "enabled", False)

830

r = Client.disable(self, quiet=quiet)

831

if not quiet and oldstate != self.enabled:

832

# Emit D-Bus signal

833

self.PropertyChanged(dbus.String("Enabled"),

834

dbus.Boolean(False, variant_level=1))

835

return r

1360

836

1361

837

def __del__(self, *args, **kwargs):

1362

838

try:

1367

843

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1368

844

Client.__del__(self, *args, **kwargs)

1369

845

1370

def checker_callback(self, source, condition,

1371

connection, command, *args, **kwargs):

1372

ret = Client.checker_callback(self, source, condition,

1373

connection, command, *args,

1374

**kwargs)

1375

exitstatus = self.last_checker_status

1376

if exitstatus >= 0:

846

def checker_callback(self, pid, condition, command,

847

*args, **kwargs):

848

self.checker_callback_tag = None

849

self.checker = None

850

# Emit D-Bus signal

851

self.PropertyChanged(dbus.String("CheckerRunning"),

852

dbus.Boolean(False, variant_level=1))

853

if os.WIFEXITED(condition):

854

exitstatus = os.WEXITSTATUS(condition)

1377

855

# Emit D-Bus signal

1378

856

self.CheckerCompleted(dbus.Int16(exitstatus),

1379

# This is specific to GNU libC

1380

dbus.Int64(exitstatus << 8),

857

dbus.Int64(condition),

1381

858

dbus.String(command))

1382

859

else:

1383

860

# Emit D-Bus signal

1384

861

self.CheckerCompleted(dbus.Int16(-1),

1385

dbus.Int64(

1386

# This is specific to GNU libC

1387

(exitstatus << 8)

1388

| self.last_checker_signal),

862

dbus.Int64(condition),

1389

863

dbus.String(command))

1390

return ret

864

865

return Client.checker_callback(self, pid, condition, command,

866

*args, **kwargs)

867

868

def checked_ok(self, *args, **kwargs):

869

Client.checked_ok(self, *args, **kwargs)

870

# Emit D-Bus signal

871

self.PropertyChanged(

872

dbus.String("LastCheckedOK"),

873

(self._datetime_to_dbus(self.last_checked_ok,

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

883

return r

1391

884

1392

885

def start_checker(self, *args, **kwargs):

1393

old_checker_pid = getattr(self.checker, "pid", None)

886

old_checker = self.checker

887

if self.checker is not None:

888

old_checker_pid = self.checker.pid

889

else:

890

old_checker_pid = None

1394

891

r = Client.start_checker(self, *args, **kwargs)

1395

892

# Only if new checker process was started

1396

893

if (self.checker is not None

1397

894

and old_checker_pid != self.checker.pid):

1398

895

# Emit D-Bus signal

1399

896

self.CheckerStarted(self.current_checker_command)

897

self.PropertyChanged(

898

dbus.String("CheckerRunning"),

899

dbus.Boolean(True, variant_level=1))

1400

900

return r

1401

901

902

def stop_checker(self, *args, **kwargs):

903

old_checker = getattr(self, "checker", None)

904

r = Client.stop_checker(self, *args, **kwargs)

905

if (old_checker is not None

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

908

dbus.Boolean(False, variant_level=1))

909

return r

910

1402

911

def _reset_approved(self):

1403

self.approved = None

912

self._approved = None

1404

913

return False

1405

914

1406

915

def approve(self, value=True):

1407

self.approved = value

1408

gobject.timeout_add(int(self.approval_duration.total_seconds()

1409

* 1000), self._reset_approved)

1410

916

self.send_changedstate()

917

self._approved = value

918

gobject.timeout_add(self._timedelta_to_milliseconds

919

(self.approval_duration),

920

self._reset_approved)

921

1411

922

1412

923

## D-Bus methods, signals & properties

1413

1414

## Interfaces

924

_interface = "se.bsnet.fukt.Mandos.Client"

1415

925

1416

926

## Signals

1417

927

1428

938

pass

1429

939

1430

940

# PropertyChanged - signal

1431

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1432

941

@dbus.service.signal(_interface, signature="sv")

1433

942

def PropertyChanged(self, property, value):

1434

943

"D-Bus signal"

1468

977

self.checked_ok()

1469

978

1470

979

# Enable - method

1471

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1472

980

@dbus.service.method(_interface)

1473

981

def Enable(self):

1474

982

"D-Bus method"

1475

983

self.enable()

1476

984

1477

985

# StartChecker - method

1478

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1479

986

@dbus.service.method(_interface)

1480

987

def StartChecker(self):

1481

988

"D-Bus method"

1482

989

self.start_checker()

1483

990

1484

991

# Disable - method

1485

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1486

992

@dbus.service.method(_interface)

1487

993

def Disable(self):

1488

994

"D-Bus method"

1489

995

self.disable()

1490

996

1491

997

# StopChecker - method

1492

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1493

998

@dbus.service.method(_interface)

1494

999

def StopChecker(self):

1495

1000

self.stop_checker()

1502

1007

return dbus.Boolean(bool(self.approvals_pending))

1503

1008

1504

1009

# ApprovedByDefault - property

1505

@dbus_service_property(_interface,

1506

signature="b",

1010

@dbus_service_property(_interface, signature="b",

1507

1011

access="readwrite")

1508

1012

def ApprovedByDefault_dbus_property(self, value=None):

1509

1013

if value is None: # get

1510

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1511

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1512

1021

1513

1022

# ApprovalDelay - property

1514

@dbus_service_property(_interface,

1515

signature="t",

1023

@dbus_service_property(_interface, signature="t",

1516

1024

access="readwrite")

1517

1025

def ApprovalDelay_dbus_property(self, value=None):

1518

1026

if value is None: # get

1519

return dbus.UInt64(self.approval_delay.total_seconds()

1520

* 1000)

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1521

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1522

1034

1523

1035

# ApprovalDuration - property

1524

@dbus_service_property(_interface,

1525

signature="t",

1036

@dbus_service_property(_interface, signature="t",

1526

1037

access="readwrite")

1527

1038

def ApprovalDuration_dbus_property(self, value=None):

1528

1039

if value is None: # get

1529

return dbus.UInt64(self.approval_duration.total_seconds()

1530

* 1000)

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1041

self.approval_duration))

1042

old_value = self.approval_duration

1531

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1532

1048

1533

1049

# Name - property

1534

@dbus_annotations(

1535

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1536

1050

@dbus_service_property(_interface, signature="s", access="read")

1537

1051

def Name_dbus_property(self):

1538

1052

return dbus.String(self.name)

1539

1053

1540

1054

# Fingerprint - property

1541

@dbus_annotations(

1542

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1543

1055

@dbus_service_property(_interface, signature="s", access="read")

1544

1056

def Fingerprint_dbus_property(self):

1545

1057

return dbus.String(self.fingerprint)

1546

1058

1547

1059

# Host - property

1548

@dbus_service_property(_interface,

1549

signature="s",

1060

@dbus_service_property(_interface, signature="s",

1550

1061

access="readwrite")

1551

1062

def Host_dbus_property(self, value=None):

1552

1063

if value is None: # get

1553

1064

return dbus.String(self.host)

1554

self.host = str(value)

1065

old_value = self.host

1066

self.host = value

1067

# Emit D-Bus signal

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

1555

1071

1556

1072

# Created - property

1557

@dbus_annotations(

1558

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1559

1073

@dbus_service_property(_interface, signature="s", access="read")

1560

1074

def Created_dbus_property(self):

1561

return datetime_to_dbus(self.created)

1075

return dbus.String(self._datetime_to_dbus(self.created))

1562

1076

1563

1077

# LastEnabled - property

1564

1078

@dbus_service_property(_interface, signature="s", access="read")

1565

1079

def LastEnabled_dbus_property(self):

1566

return datetime_to_dbus(self.last_enabled)

1080

return self._datetime_to_dbus(self.last_enabled)

1567

1081

1568

1082

# Enabled - property

1569

@dbus_service_property(_interface,

1570

signature="b",

1083

@dbus_service_property(_interface, signature="b",

1571

1084

access="readwrite")

1572

1085

def Enabled_dbus_property(self, value=None):

1573

1086

if value is None: # get

1578

1091

self.disable()

1579

1092

1580

1093

# LastCheckedOK - property

1581

@dbus_service_property(_interface,

1582

signature="s",

1094

@dbus_service_property(_interface, signature="s",

1583

1095

access="readwrite")

1584

1096

def LastCheckedOK_dbus_property(self, value=None):

1585

1097

if value is not None:

1586

1098

self.checked_ok()

1587

1099

return

1588

return datetime_to_dbus(self.last_checked_ok)

1589

1590

# LastCheckerStatus - property

1591

@dbus_service_property(_interface, signature="n", access="read")

1592

def LastCheckerStatus_dbus_property(self):

1593

return dbus.Int16(self.last_checker_status)

1100

return self._datetime_to_dbus(self.last_checked_ok)

1594

1101

1595

1102

# Expires - property

1596

1103

@dbus_service_property(_interface, signature="s", access="read")

1597

1104

def Expires_dbus_property(self):

1598

return datetime_to_dbus(self.expires)

1105

return self._datetime_to_dbus(self.expires)

1599

1106

1600

1107

# LastApprovalRequest - property

1601

1108

@dbus_service_property(_interface, signature="s", access="read")

1602

1109

def LastApprovalRequest_dbus_property(self):

1603

return datetime_to_dbus(self.last_approval_request)

1110

return self._datetime_to_dbus(self.last_approval_request)

1604

1111

1605

1112

# Timeout - property

1606

@dbus_service_property(_interface,

1607

signature="t",

1113

@dbus_service_property(_interface, signature="t",

1608

1114

access="readwrite")

1609

1115

def Timeout_dbus_property(self, value=None):

1610

1116

if value is None: # get

1611

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1612

old_timeout = self.timeout

1117

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

1613

1119

self.timeout = datetime.timedelta(0, 0, 0, value)

1614

# Reschedule disabling

1615

if self.enabled:

1616

now = datetime.datetime.utcnow()

1617

self.expires += self.timeout - old_timeout

1618

if self.expires <= now:

1619

# The timeout has passed

1620

self.disable()

1621

else:

1622

if (getattr(self, "disable_initiator_tag", None)

1623

is None):

1624

return

1625

gobject.source_remove(self.disable_initiator_tag)

1626

self.disable_initiator_tag = gobject.timeout_add(

1627

int((self.expires - now).total_seconds() * 1000),

1628

self.disable)

1629

1120

# Emit D-Bus signal

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1124

if getattr(self, "disable_initiator_tag", None) is None:

1125

return

1126

# Reschedule timeout

1127

gobject.source_remove(self.disable_initiator_tag)

1128

self.disable_initiator_tag = None

1129

self.expires = None

1130

time_to_die = (self.

1131

_timedelta_to_milliseconds((self

1132

.last_checked_ok

1133

+ self.timeout)

1134

- datetime.datetime

1135

.utcnow()))

1136

if time_to_die <= 0:

1137

# The timeout has passed

1138

self.disable()

1139

else:

1140

self.expires = (datetime.datetime.utcnow()

1141

+ datetime.timedelta(milliseconds = time_to_die))

1142

self.disable_initiator_tag = (gobject.timeout_add

1143

(time_to_die, self.disable))

1144

1630

1145

# ExtendedTimeout - property

1631

@dbus_service_property(_interface,

1632

signature="t",

1146

@dbus_service_property(_interface, signature="t",

1633

1147

access="readwrite")

1634

1148

def ExtendedTimeout_dbus_property(self, value=None):

1635

1149

if value is None: # get

1636

return dbus.UInt64(self.extended_timeout.total_seconds()

1637

* 1000)

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1638

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1639

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1640

1158

# Interval - property

1641

@dbus_service_property(_interface,

1642

signature="t",

1159

@dbus_service_property(_interface, signature="t",

1643

1160

access="readwrite")

1644

1161

def Interval_dbus_property(self, value=None):

1645

1162

if value is None: # get

1646

return dbus.UInt64(self.interval.total_seconds() * 1000)

1163

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

1647

1165

self.interval = datetime.timedelta(0, 0, 0, value)

1166

# Emit D-Bus signal

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1648

1170

if getattr(self, "checker_initiator_tag", None) is None:

1649

1171

return

1650

if self.enabled:

1651

# Reschedule checker run

1652

gobject.source_remove(self.checker_initiator_tag)

1653

self.checker_initiator_tag = gobject.timeout_add(

1654

value, self.start_checker)

1655

self.start_checker() # Start one now, too

1656

1172

# Reschedule checker run

1173

gobject.source_remove(self.checker_initiator_tag)

1174

self.checker_initiator_tag = (gobject.timeout_add

1175

(value, self.start_checker))

1176

self.start_checker() # Start one now, too

1177

1657

1178

# Checker - property

1658

@dbus_service_property(_interface,

1659

signature="s",

1179

@dbus_service_property(_interface, signature="s",

1660

1180

access="readwrite")

1661

1181

def Checker_dbus_property(self, value=None):

1662

1182

if value is None: # get

1663

1183

return dbus.String(self.checker_command)

1664

self.checker_command = str(value)

1184

old_value = self.checker_command

1185

self.checker_command = value

1186

# Emit D-Bus signal

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

1665

1191

1666

1192

# CheckerRunning - property

1667

@dbus_service_property(_interface,

1668

signature="b",

1193

@dbus_service_property(_interface, signature="b",

1669

1194

access="readwrite")

1670

1195

def CheckerRunning_dbus_property(self, value=None):

1671

1196

if value is None: # get

1676

1201

self.stop_checker()

1677

1202

1678

1203

# ObjectPath - property

1679

@dbus_annotations(

1680

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1681

"org.freedesktop.DBus.Deprecated": "true"})

1682

1204

@dbus_service_property(_interface, signature="o", access="read")

1683

1205

def ObjectPath_dbus_property(self):

1684

1206

return self.dbus_object_path # is already a dbus.ObjectPath

1685

1207

1686

1208

# Secret = property

1687

@dbus_annotations(

1688

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1689

"invalidates"})

1690

@dbus_service_property(_interface,

1691

signature="ay",

1692

access="write",

1693

byte_arrays=True)

1209

@dbus_service_property(_interface, signature="ay",

1210

access="write", byte_arrays=True)

1694

1211

def Secret_dbus_property(self, value):

1695

self.secret = bytes(value)

1212

self.secret = str(value)

1696

1213

1697

1214

del _interface

1698

1215

1702

1219

self._pipe = child_pipe

1703

1220

self._pipe.send(('init', fpr, address))

1704

1221

if not self._pipe.recv():

1705

raise KeyError(fpr)

1706

1222

raise KeyError()

1223

1707

1224

def __getattribute__(self, name):

1708

if name == '_pipe':

1225

if(name == '_pipe'):

1709

1226

return super(ProxyClient, self).__getattribute__(name)

1710

1227

self._pipe.send(('getattr', name))

1711

1228

data = self._pipe.recv()

1712

1229

if data[0] == 'data':

1713

1230

return data[1]

1714

1231

if data[0] == 'function':

1715

1716

1232

def func(*args, **kwargs):

1717

1233

self._pipe.send(('funcall', name, args, kwargs))

1718

1234

return self._pipe.recv()[1]

1719

1720

1235

return func

1721

1236

1722

1237

def __setattr__(self, name, value):

1723

if name == '_pipe':

1238

if(name == '_pipe'):

1724

1239

return super(ProxyClient, self).__setattr__(name, value)

1725

1240

self._pipe.send(('setattr', name, value))

1726

1241

1734

1249

def handle(self):

1735

1250

with contextlib.closing(self.server.child_pipe) as child_pipe:

1736

1251

logger.info("TCP connection from: %s",

1737

str(self.client_address))

1252

unicode(self.client_address))

1738

1253

logger.debug("Pipe FD: %d",

1739

1254

self.server.child_pipe.fileno())

1740

1741

session = gnutls.connection.ClientSession(

1742

self.request, gnutls.connection .X509Credentials())

1743

1255

1256

session = (gnutls.connection

1257

.ClientSession(self.request,

1258

gnutls.connection

1259

.X509Credentials()))

1260

1744

1261

# Note: gnutls.connection.X509Credentials is really a

1745

1262

# generic GnuTLS certificate credentials object so long as

1746

1263

# no X.509 keys are added to it. Therefore, we can use it

1747

1264

# here despite using OpenPGP certificates.

1748

1265

1749

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1750

1267

# "+AES-256-CBC", "+SHA1",

1751

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

1754

1271

priority = self.server.gnutls_priority

1755

1272

if priority is None:

1756

1273

priority = "NORMAL"

1757

gnutls.library.functions.gnutls_priority_set_direct(

1758

session._c_object, priority, None)

1759

1274

(gnutls.library.functions

1275

.gnutls_priority_set_direct(session._c_object,

1276

priority, None))

1277

1760

1278

# Start communication using the Mandos protocol

1761

1279

# Get protocol number

1762

1280

line = self.request.makefile().readline()

1763

1281

logger.debug("Protocol version: %r", line)

1764

1282

try:

1765

1283

if int(line.strip().split()[0]) > 1:

1766

raise RuntimeError(line)

1284

raise RuntimeError

1767

1285

except (ValueError, IndexError, RuntimeError) as error:

1768

1286

logger.error("Unknown protocol version: %s", error)

1769

1287

return

1770

1288

1771

1289

# Start GnuTLS connection

1772

1290

try:

1773

1291

session.handshake()

1777

1295

# established. Just abandon the request.

1778

1296

return

1779

1297

logger.debug("Handshake succeeded")

1780

1298

1781

1299

approval_required = False

1782

1300

try:

1783

1301

try:

1784

fpr = self.fingerprint(

1785

self.peer_certificate(session))

1302

fpr = self.fingerprint(self.peer_certificate

1303

(session))

1786

1304

except (TypeError,

1787

1305

gnutls.errors.GNUTLSError) as error:

1788

1306

logger.warning("Bad certificate: %s", error)

1789

1307

return

1790

1308

logger.debug("Fingerprint: %s", fpr)

1791

1309

1792

1310

try:

1793

1311

client = ProxyClient(child_pipe, fpr,

1794

1312

self.client_address)

1803

1321

while True:

1804

1322

if not client.enabled:

1805

1323

logger.info("Client %s is disabled",

1806

client.name)

1324

client.name)

1807

1325

if self.server.use_dbus:

1808

1326

# Emit D-Bus signal

1809

client.Rejected("Disabled")

1327

client.Rejected("Disabled")

1810

1328

return

1811

1329

1812

if client.approved or not client.approval_delay:

1330

if client._approved or not client.approval_delay:

1813

1331

#We are approved or approval is disabled

1814

1332

break

1815

elif client.approved is None:

1333

elif client._approved is None:

1816

1334

logger.info("Client %s needs approval",

1817

1335

client.name)

1818

1336

if self.server.use_dbus:

1819

1337

# Emit D-Bus signal

1820

1338

client.NeedApproval(

1821

client.approval_delay.total_seconds()

1822

* 1000, client.approved_by_default)

1339

client.approval_delay_milliseconds(),

1340

client.approved_by_default)

1823

1341

else:

1824

1342

logger.warning("Client %s was not approved",

1825

1343

client.name)

1829

1347

return

1830

1348

1831

1349

#wait until timeout or approved

1350

#x = float(client._timedelta_to_milliseconds(delay))

1832

1351

time = datetime.datetime.now()

1833

1352

client.changedstate.acquire()

1834

client.changedstate.wait(delay.total_seconds())

1353

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1835

1354

client.changedstate.release()

1836

1355

time2 = datetime.datetime.now()

1837

1356

if (time2 - time) >= delay:

1853

1372

try:

1854

1373

sent = session.send(client.secret[sent_size:])

1855

1374

except gnutls.errors.GNUTLSError as error:

1856

logger.warning("gnutls send failed",

1857

exc_info=error)

1375

logger.warning("gnutls send failed")

1858

1376

return

1859

logger.debug("Sent: %d, remaining: %d", sent,

1860

len(client.secret) - (sent_size

1861

+ sent))

1377

logger.debug("Sent: %d, remaining: %d",

1378

sent, len(client.secret)

1379

- (sent_size + sent))

1862

1380

sent_size += sent

1863

1381

1864

1382

logger.info("Sending secret to %s", client.name)

1865

# bump the timeout using extended_timeout

1866

client.bump_timeout(client.extended_timeout)

1383

# bump the timeout as if seen

1384

client.checked_ok(client.extended_timeout)

1867

1385

if self.server.use_dbus:

1868

1386

# Emit D-Bus signal

1869

1387

client.GotSecret()

1874

1392

try:

1875

1393

session.bye()

1876

1394

except gnutls.errors.GNUTLSError as error:

1877

logger.warning("GnuTLS bye failed",

1878

exc_info=error)

1395

logger.warning("GnuTLS bye failed")

1879

1396

1880

1397

@staticmethod

1881

1398

def peer_certificate(session):

1882

1399

"Return the peer's OpenPGP certificate as a bytestring"

1883

1400

# If not an OpenPGP certificate...

1884

if (gnutls.library.functions.gnutls_certificate_type_get(

1885

session._c_object)

1401

if (gnutls.library.functions

1402

.gnutls_certificate_type_get(session._c_object)

1886

1403

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1887

1404

# ...do the normal thing

1888

1405

return session.peer_certificate

1902

1419

def fingerprint(openpgp):

1903

1420

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1904

1421

# New GnuTLS "datum" with the OpenPGP public key

1905

datum = gnutls.library.types.gnutls_datum_t(

1906

ctypes.cast(ctypes.c_char_p(openpgp),

1907

ctypes.POINTER(ctypes.c_ubyte)),

1908

ctypes.c_uint(len(openpgp)))

1422

datum = (gnutls.library.types

1423

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1424

ctypes.POINTER

1425

(ctypes.c_ubyte)),

1426

ctypes.c_uint(len(openpgp))))

1909

1427

# New empty GnuTLS certificate

1910

1428

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1911

gnutls.library.functions.gnutls_openpgp_crt_init(

1912

ctypes.byref(crt))

1429

(gnutls.library.functions

1430

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1913

1431

# Import the OpenPGP public key into the certificate

1914

gnutls.library.functions.gnutls_openpgp_crt_import(

1915

crt, ctypes.byref(datum),

1916

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1432

(gnutls.library.functions

1433

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1434

gnutls.library.constants

1435

.GNUTLS_OPENPGP_FMT_RAW))

1917

1436

# Verify the self signature in the key

1918

1437

crtverify = ctypes.c_uint()

1919

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1920

crt, 0, ctypes.byref(crtverify))

1438

(gnutls.library.functions

1439

.gnutls_openpgp_crt_verify_self(crt, 0,

1440

ctypes.byref(crtverify)))

1921

1441

if crtverify.value != 0:

1922

1442

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1923

raise gnutls.errors.CertificateSecurityError(

1924

"Verify failed")

1443

raise (gnutls.errors.CertificateSecurityError

1444

("Verify failed"))

1925

1445

# New buffer for the fingerprint

1926

1446

buf = ctypes.create_string_buffer(20)

1927

1447

buf_len = ctypes.c_size_t()

1928

1448

# Get the fingerprint from the certificate into the buffer

1929

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1930

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1449

(gnutls.library.functions

1450

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1451

ctypes.byref(buf_len)))

1931

1452

# Deinit the certificate

1932

1453

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1933

1454

# Convert the buffer to a Python bytestring

1934

1455

fpr = ctypes.string_at(buf, buf_len.value)

1935

1456

# Convert the bytestring to hexadecimal notation

1936

hex_fpr = binascii.hexlify(fpr).upper()

1457

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1937

1458

return hex_fpr

1938

1459

1939

1460

1940

1461

class MultiprocessingMixIn(object):

1941

1462

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1942

1943

1463

def sub_process_main(self, request, address):

1944

1464

try:

1945

1465

self.finish_request(request, address)

1946

except Exception:

1466

except:

1947

1467

self.handle_error(request, address)

1948

1468

self.close_request(request)

1949

1469

1950

1470

def process_request(self, request, address):

1951

1471

"""Start a new process to process the request."""

1952

proc = multiprocessing.Process(target = self.sub_process_main,

1953

args = (request, address))

1954

proc.start()

1955

return proc

1956

1472

multiprocessing.Process(target = self.sub_process_main,

1473

args = (request, address)).start()

1957

1474

1958

1475

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1959

1476

""" adds a pipe to the MixIn """

1960

1961

1477

def process_request(self, request, client_address):

1962

1478

"""Overrides and wraps the original process_request().

1963

1479

1964

1480

This function creates a new pipe in self.pipe

1965

1481

"""

1966

1482

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1967

1968

proc = MultiprocessingMixIn.process_request(self, request,

1969

client_address)

1483

1484

super(MultiprocessingMixInWithPipe,

1485

self).process_request(request, client_address)

1970

1486

self.child_pipe.close()

1971

self.add_pipe(parent_pipe, proc)

1972

1973

def add_pipe(self, parent_pipe, proc):

1487

self.add_pipe(parent_pipe)

1488

1489

def add_pipe(self, parent_pipe):

1974

1490

"""Dummy function; override as necessary"""

1975

raise NotImplementedError()

1976

1491

raise NotImplementedError

1977

1492

1978

1493

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1979

1494

socketserver.TCPServer, object):

1984

1499

interface: None or a network interface name (string)

1985

1500

use_ipv6: Boolean; to use IPv6 or not

1986

1501

"""

1987

1988

1502

def __init__(self, server_address, RequestHandlerClass,

1989

interface=None,

1990

use_ipv6=True,

1991

socketfd=None):

1992

"""If socketfd is set, use that file descriptor instead of

1993

creating a new one with socket.socket().

1994

"""

1503

interface=None, use_ipv6=True):

1995

1504

self.interface = interface

1996

1505

if use_ipv6:

1997

1506

self.address_family = socket.AF_INET6

1998

if socketfd is not None:

1999

# Save the file descriptor

2000

self.socketfd = socketfd

2001

# Save the original socket.socket() function

2002

self.socket_socket = socket.socket

2003

# To implement --socket, we monkey patch socket.socket.

2004

#

2005

# (When socketserver.TCPServer is a new-style class, we

2006

# could make self.socket into a property instead of monkey

2007

# patching socket.socket.)

2008

#

2009

# Create a one-time-only replacement for socket.socket()

2010

@functools.wraps(socket.socket)

2011

def socket_wrapper(*args, **kwargs):

2012

# Restore original function so subsequent calls are

2013

# not affected.

2014

socket.socket = self.socket_socket

2015

del self.socket_socket

2016

# This time only, return a new socket object from the

2017

# saved file descriptor.

2018

return socket.fromfd(self.socketfd, *args, **kwargs)

2019

# Replace socket.socket() function with wrapper

2020

socket.socket = socket_wrapper

2021

# The socketserver.TCPServer.__init__ will call

2022

# socket.socket(), which might be our replacement,

2023

# socket_wrapper(), if socketfd was set.

2024

1507

socketserver.TCPServer.__init__(self, server_address,

2025

1508

RequestHandlerClass)

2026

2027

1509

def server_bind(self):

2028

1510

"""This overrides the normal server_bind() function

2029

1511

to bind to an interface if one was specified, and also NOT to

2035

1517

self.interface)

2036

1518

else:

2037

1519

try:

2038

self.socket.setsockopt(

2039

socket.SOL_SOCKET, SO_BINDTODEVICE,

2040

(self.interface + "\0").encode("utf-8"))

1520

self.socket.setsockopt(socket.SOL_SOCKET,

1521

SO_BINDTODEVICE,

1522

str(self.interface

1523

+ '\0'))

2041

1524

except socket.error as error:

2042

if error.errno == errno.EPERM:

2043

logger.error("No permission to bind to"

2044

" interface %s", self.interface)

2045

elif error.errno == errno.ENOPROTOOPT:

1525

if error[0] == errno.EPERM:

1526

logger.error("No permission to"

1527

" bind to interface %s",

1528

self.interface)

1529

elif error[0] == errno.ENOPROTOOPT:

2046

1530

logger.error("SO_BINDTODEVICE not available;"

2047

1531

" cannot bind to interface %s",

2048

1532

self.interface)

2049

elif error.errno == errno.ENODEV:

2050

logger.error("Interface %s does not exist,"

2051

" cannot bind", self.interface)

2052

1533

else:

2053

1534

raise

2054

1535

# Only bind(2) the socket if we really need to.

2057

1538

if self.address_family == socket.AF_INET6:

2058

1539

any_address = "::" # in6addr_any

2059

1540

else:

2060

any_address = "0.0.0.0" # INADDR_ANY

1541

any_address = socket.INADDR_ANY

2061

1542

self.server_address = (any_address,

2062

1543

self.server_address[1])

2063

1544

elif not self.server_address[1]:

2064

self.server_address = (self.server_address[0], 0)

1545

self.server_address = (self.server_address[0],

1546

0)

2065

1547

# if self.interface:

2066

1548

# self.server_address = (self.server_address[0],

2067

1549

# 0, # port

2081

1563

2082

1564

Assumes a gobject.MainLoop event loop.

2083

1565

"""

2084

2085

1566

def __init__(self, server_address, RequestHandlerClass,

2086

interface=None,

2087

use_ipv6=True,

2088

clients=None,

2089

gnutls_priority=None,

2090

use_dbus=True,

2091

socketfd=None):

1567

interface=None, use_ipv6=True, clients=None,

1568

gnutls_priority=None, use_dbus=True):

2092

1569

self.enabled = False

2093

1570

self.clients = clients

2094

1571

if self.clients is None:

2095

self.clients = {}

1572

self.clients = set()

2096

1573

self.use_dbus = use_dbus

2097

1574

self.gnutls_priority = gnutls_priority

2098

1575

IPv6_TCPServer.__init__(self, server_address,

2099

1576

RequestHandlerClass,

2100

1577

interface = interface,

2101

use_ipv6 = use_ipv6,

2102

socketfd = socketfd)

2103

1578

use_ipv6 = use_ipv6)

2104

1579

def server_activate(self):

2105

1580

if self.enabled:

2106

1581

return socketserver.TCPServer.server_activate(self)

2107

2108

1582

def enable(self):

2109

1583

self.enabled = True

2110

2111

def add_pipe(self, parent_pipe, proc):

1584

def add_pipe(self, parent_pipe):

2112

1585

# Call "handle_ipc" for both data and EOF events

2113

gobject.io_add_watch(

2114

parent_pipe.fileno(),

2115

gobject.IO_IN | gobject.IO_HUP,

2116

functools.partial(self.handle_ipc,

2117

parent_pipe = parent_pipe,

2118

proc = proc))

2119

2120

def handle_ipc(self, source, condition,

2121

parent_pipe=None,

2122

proc = None,

1586

gobject.io_add_watch(parent_pipe.fileno(),

1587

gobject.IO_IN | gobject.IO_HUP,

1588

functools.partial(self.handle_ipc,

1589

parent_pipe = parent_pipe))

1590

1591

def handle_ipc(self, source, condition, parent_pipe=None,

2123

1592

client_object=None):

2124

# error, or the other end of multiprocessing.Pipe has closed

2125

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2126

# Wait for other process to exit

2127

proc.join()

1593

condition_names = {

1594

gobject.IO_IN: "IN", # There is data to read.

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1596

# blocking).

1597

gobject.IO_PRI: "PRI", # There is urgent data to read.

1598

gobject.IO_ERR: "ERR", # Error condition.

1599

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1600

# broken, usually for pipes and

1601

# sockets).

1602

}

1603

conditions_string = ' | '.join(name

1604

for cond, name in

1605

condition_names.iteritems()

1606

if cond & condition)

1607

# error or the other end of multiprocessing.Pipe has closed

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2128

1609

return False

2129

1610

2130

1611

# Read a request from the child

2135

1616

fpr = request[1]

2136

1617

address = request[2]

2137

1618

2138

for c in self.clients.itervalues():

1619

for c in self.clients:

2139

1620

if c.fingerprint == fpr:

2140

1621

client = c

2141

1622

break

2144

1625

"dress: %s", fpr, address)

2145

1626

if self.use_dbus:

2146

1627

# Emit D-Bus signal

2147

mandos_dbus_service.ClientNotFound(fpr,

2148

address[0])

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

2149

1629

parent_pipe.send(False)

2150

1630

return False

2151

1631

2152

gobject.io_add_watch(

2153

parent_pipe.fileno(),

2154

gobject.IO_IN | gobject.IO_HUP,

2155

functools.partial(self.handle_ipc,

2156

parent_pipe = parent_pipe,

2157

proc = proc,

2158

client_object = client))

1632

gobject.io_add_watch(parent_pipe.fileno(),

1633

gobject.IO_IN | gobject.IO_HUP,

1634

functools.partial(self.handle_ipc,

1635

parent_pipe = parent_pipe,

1636

client_object = client))

2159

1637

parent_pipe.send(True)

2160

# remove the old hook in favor of the new above hook on

2161

# same fileno

1638

# remove the old hook in favor of the new above hook on same fileno

2162

1639

return False

2163

1640

if command == 'funcall':

2164

1641

funcname = request[1]

2165

1642

args = request[2]

2166

1643

kwargs = request[3]

2167

1644

2168

parent_pipe.send(('data', getattr(client_object,

2169

funcname)(*args,

2170

**kwargs)))

2171

1645

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1646

2172

1647

if command == 'getattr':

2173

1648

attrname = request[1]

2174

if isinstance(client_object.__getattribute__(attrname),

2175

collections.Callable):

2176

parent_pipe.send(('function', ))

1649

if callable(client_object.__getattribute__(attrname)):

1650

parent_pipe.send(('function',))

2177

1651

else:

2178

parent_pipe.send((

2179

'data', client_object.__getattribute__(attrname)))

1652

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2180

1653

2181

1654

if command == 'setattr':

2182

1655

attrname = request[1]

2183

1656

value = request[2]

2184

1657

setattr(client_object, attrname, value)

2185

1658

2186

1659

return True

2187

1660

2188

1661

2189

def rfc3339_duration_to_delta(duration):

2190

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2191

2192

>>> rfc3339_duration_to_delta("P7D")

2193

datetime.timedelta(7)

2194

>>> rfc3339_duration_to_delta("PT60S")

2195

datetime.timedelta(0, 60)

2196

>>> rfc3339_duration_to_delta("PT60M")

2197

datetime.timedelta(0, 3600)

2198

>>> rfc3339_duration_to_delta("PT24H")

2199

datetime.timedelta(1)

2200

>>> rfc3339_duration_to_delta("P1W")

2201

datetime.timedelta(7)

2202

>>> rfc3339_duration_to_delta("PT5M30S")

2203

datetime.timedelta(0, 330)

2204

>>> rfc3339_duration_to_delta("P1DT3M20S")

2205

datetime.timedelta(1, 200)

2206

"""

2207

2208

# Parsing an RFC 3339 duration with regular expressions is not

2209

# possible - there would have to be multiple places for the same

2210

# values, like seconds. The current code, while more esoteric, is

2211

# cleaner without depending on a parsing library. If Python had a

2212

# built-in library for parsing we would use it, but we'd like to

2213

# avoid excessive use of external libraries.

2214

2215

# New type for defining tokens, syntax, and semantics all-in-one

2216

Token = collections.namedtuple("Token", (

2217

"regexp", # To match token; if "value" is not None, must have

2218

# a "group" containing digits

2219

"value", # datetime.timedelta or None

2220

"followers")) # Tokens valid after this token

2221

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2222

# the "duration" ABNF definition in RFC 3339, Appendix A.

2223

token_end = Token(re.compile(r"$"), None, frozenset())

2224

token_second = Token(re.compile(r"(\d+)S"),

2225

datetime.timedelta(seconds=1),

2226

frozenset((token_end, )))

2227

token_minute = Token(re.compile(r"(\d+)M"),

2228

datetime.timedelta(minutes=1),

2229

frozenset((token_second, token_end)))

2230

token_hour = Token(re.compile(r"(\d+)H"),

2231

datetime.timedelta(hours=1),

2232

frozenset((token_minute, token_end)))

2233

token_time = Token(re.compile(r"T"),

2234

None,

2235

frozenset((token_hour, token_minute,

2236

token_second)))

2237

token_day = Token(re.compile(r"(\d+)D"),

2238

datetime.timedelta(days=1),

2239

frozenset((token_time, token_end)))

2240

token_month = Token(re.compile(r"(\d+)M"),

2241

datetime.timedelta(weeks=4),

2242

frozenset((token_day, token_end)))

2243

token_year = Token(re.compile(r"(\d+)Y"),

2244

datetime.timedelta(weeks=52),

2245

frozenset((token_month, token_end)))

2246

token_week = Token(re.compile(r"(\d+)W"),

2247

datetime.timedelta(weeks=1),

2248

frozenset((token_end, )))

2249

token_duration = Token(re.compile(r"P"), None,

2250

frozenset((token_year, token_month,

2251

token_day, token_time,

2252

token_week)))

2253

# Define starting values

2254

value = datetime.timedelta() # Value so far

2255

found_token = None

2256

followers = frozenset((token_duration, )) # Following valid tokens

2257

s = duration # String left to parse

2258

# Loop until end token is found

2259

while found_token is not token_end:

2260

# Search for any currently valid tokens

2261

for token in followers:

2262

match = token.regexp.match(s)

2263

if match is not None:

2264

# Token found

2265

if token.value is not None:

2266

# Value found, parse digits

2267

factor = int(match.group(1), 10)

2268

# Add to value so far

2269

value += factor * token.value

2270

# Strip token from string

2271

s = token.regexp.sub("", s, 1)

2272

# Go to found token

2273

found_token = token

2274

# Set valid next tokens

2275

followers = found_token.followers

2276

break

2277

else:

2278

# No currently valid tokens were found

2279

raise ValueError("Invalid RFC 3339 duration: {!r}"

2280

.format(duration))

2281

# End token found

2282

return value

2283

2284

2285

1662

def string_to_delta(interval):

2286

1663

"""Parse a string and return a datetime.timedelta

2287

1664

2298

1675

>>> string_to_delta('5m 30s')

2299

1676

datetime.timedelta(0, 330)

2300

1677

"""

2301

2302

try:

2303

return rfc3339_duration_to_delta(interval)

2304

except ValueError:

2305

pass

2306

2307

1678

timevalue = datetime.timedelta(0)

2308

1679

for s in interval.split():

2309

1680

try:

2310

suffix = s[-1]

1681

suffix = unicode(s[-1])

2311

1682

value = int(s[:-1])

2312

1683

if suffix == "d":

2313

1684

delta = datetime.timedelta(value)

2320

1691

elif suffix == "w":

2321

1692

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2322

1693

else:

2323

raise ValueError("Unknown suffix {!r}".format(suffix))

2324

except IndexError as e:

1694

raise ValueError("Unknown suffix %r" % suffix)

1695

except (ValueError, IndexError) as e:

2325

1696

raise ValueError(*(e.args))

2326

1697

timevalue += delta

2327

1698

return timevalue

2328

1699

2329

1700

1701

def if_nametoindex(interface):

1702

"""Call the C function if_nametoindex(), or equivalent

1703

1704

Note: This function cannot accept a unicode string."""

1705

global if_nametoindex

1706

try:

1707

if_nametoindex = (ctypes.cdll.LoadLibrary

1708

(ctypes.util.find_library("c"))

1709

.if_nametoindex)

1710

except (OSError, AttributeError):

1711

logger.warning("Doing if_nametoindex the hard way")

1712

def if_nametoindex(interface):

1713

"Get an interface index the hard way, i.e. using fcntl()"

1714

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1715

with contextlib.closing(socket.socket()) as s:

1716

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1717

struct.pack(str("16s16x"),

1718

interface))

1719

interface_index = struct.unpack(str("I"),

1720

ifreq[16:20])[0]

1721

return interface_index

1722

return if_nametoindex(interface)

1723

1724

2330

1725

def daemon(nochdir = False, noclose = False):

2331

1726

"""See daemon(3). Standard BSD Unix function.

2332

1727

2340

1735

sys.exit()

2341

1736

if not noclose:

2342

1737

# Close all standard open file descriptors

2343

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1738

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2344

1739

if not stat.S_ISCHR(os.fstat(null).st_mode):

2345

1740

raise OSError(errno.ENODEV,

2346

"{} not a character device"

2347

.format(os.devnull))

1741

"%s not a character device"

1742

% os.path.devnull)

2348

1743

os.dup2(null, sys.stdin.fileno())

2349

1744

os.dup2(null, sys.stdout.fileno())

2350

1745

os.dup2(null, sys.stderr.fileno())

2359

1754

2360

1755

parser = argparse.ArgumentParser()

2361

1756

parser.add_argument("-v", "--version", action="version",

2362

version = "%(prog)s {}".format(version),

1757

version = "%%(prog)s %s" % version,

2363

1758

help="show version number and exit")

2364

1759

parser.add_argument("-i", "--interface", metavar="IF",

2365

1760

help="Bind to interface IF")

2371

1766

help="Run self-test")

2372

1767

parser.add_argument("--debug", action="store_true",

2373

1768

help="Debug mode; run in foreground and log"

2374

" to terminal", default=None)

1769

" to terminal")

2375

1770

parser.add_argument("--debuglevel", metavar="LEVEL",

2376

1771

help="Debug level for stdout output")

2377

1772

parser.add_argument("--priority", help="GnuTLS"

2384

1779

" files")

2385

1780

parser.add_argument("--no-dbus", action="store_false",

2386

1781

dest="use_dbus", help="Do not provide D-Bus"

2387

" system bus interface", default=None)

1782

" system bus interface")

2388

1783

parser.add_argument("--no-ipv6", action="store_false",

2389

dest="use_ipv6", help="Do not use IPv6",

2390

default=None)

2391

parser.add_argument("--no-restore", action="store_false",

2392

dest="restore", help="Do not restore stored"

2393

" state", default=None)

2394

parser.add_argument("--socket", type=int,

2395

help="Specify a file descriptor to a network"

2396

" socket to use instead of creating one")

2397

parser.add_argument("--statedir", metavar="DIR",

2398

help="Directory to save/restore state in")

2399

parser.add_argument("--foreground", action="store_true",

2400

help="Run in foreground", default=None)

2401

parser.add_argument("--no-zeroconf", action="store_false",

2402

dest="zeroconf", help="Do not use Zeroconf",

2403

default=None)

2404

1784

dest="use_ipv6", help="Do not use IPv6")

2405

1785

options = parser.parse_args()

2406

1786

2407

1787

if options.check:

2408

1788

import doctest

2409

fail_count, test_count = doctest.testmod()

2410

sys.exit(os.EX_OK if fail_count == 0 else 1)

1789

doctest.testmod()

1790

sys.exit()

2411

1791

2412

1792

# Default values for config file for server-global settings

2413

1793

server_defaults = { "interface": "",

2415

1795

"port": "",

2416

1796

"debug": "False",

2417

1797

"priority":

2418

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2419

":+SIGN-DSA-SHA256",

1798

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2420

1799

"servicename": "Mandos",

2421

1800

"use_dbus": "True",

2422

1801

"use_ipv6": "True",

2423

1802

"debuglevel": "",

2424

"restore": "True",

2425

"socket": "",

2426

"statedir": "/var/lib/mandos",

2427

"foreground": "False",

2428

"zeroconf": "True",

2429

}

1803

}

2430

1804

2431

1805

# Parse config file for server-global settings

2432

1806

server_config = configparser.SafeConfigParser(server_defaults)

2433

1807

del server_defaults

2434

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1808

server_config.read(os.path.join(options.configdir,

1809

"mandos.conf"))

2435

1810

# Convert the SafeConfigParser object to a dict

2436

1811

server_settings = server_config.defaults()

2437

1812

# Use the appropriate methods on the non-string config options

2438

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1813

for option in ("debug", "use_dbus", "use_ipv6"):

2439

1814

server_settings[option] = server_config.getboolean("DEFAULT",

2440

1815

option)

2441

1816

if server_settings["port"]:

2442

1817

server_settings["port"] = server_config.getint("DEFAULT",

2443

1818

"port")

2444

if server_settings["socket"]:

2445

server_settings["socket"] = server_config.getint("DEFAULT",

2446

"socket")

2447

# Later, stdin will, and stdout and stderr might, be dup'ed

2448

# over with an opened os.devnull. But we don't want this to

2449

# happen with a supplied network socket.

2450

if 0 <= server_settings["socket"] <= 2:

2451

server_settings["socket"] = os.dup(server_settings

2452

["socket"])

2453

1819

del server_config

2454

1820

2455

1821

# Override the settings from the config file with command line

2456

1822

# options, if set.

2457

1823

for option in ("interface", "address", "port", "debug",

2458

"priority", "servicename", "configdir", "use_dbus",

2459

"use_ipv6", "debuglevel", "restore", "statedir",

2460

"socket", "foreground", "zeroconf"):

1824

"priority", "servicename", "configdir",

1825

"use_dbus", "use_ipv6", "debuglevel"):

2461

1826

value = getattr(options, option)

2462

1827

if value is not None:

2463

1828

server_settings[option] = value

2464

1829

del options

2465

1830

# Force all strings to be unicode

2466

1831

for option in server_settings.keys():

2467

if isinstance(server_settings[option], bytes):

2468

server_settings[option] = (server_settings[option]

2469

.decode("utf-8"))

2470

# Force all boolean options to be boolean

2471

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2472

"foreground", "zeroconf"):

2473

server_settings[option] = bool(server_settings[option])

2474

# Debug implies foreground

2475

if server_settings["debug"]:

2476

server_settings["foreground"] = True

1832

if type(server_settings[option]) is str:

1833

server_settings[option] = unicode(server_settings[option])

2477

1834

# Now we have our good server settings in "server_settings"

2478

1835

2479

1836

##################################################################

2480

1837

2481

if (not server_settings["zeroconf"]

2482

and not (server_settings["port"]

2483

or server_settings["socket"] != "")):

2484

parser.error("Needs port or socket to work without Zeroconf")

2485

2486

1838

# For convenience

2487

1839

debug = server_settings["debug"]

2488

1840

debuglevel = server_settings["debuglevel"]

2489

1841

use_dbus = server_settings["use_dbus"]

2490

1842

use_ipv6 = server_settings["use_ipv6"]

2491

stored_state_path = os.path.join(server_settings["statedir"],

2492

stored_state_file)

2493

foreground = server_settings["foreground"]

2494

zeroconf = server_settings["zeroconf"]

2495

2496

if debug:

2497

initlogger(debug, logging.DEBUG)

2498

else:

2499

if not debuglevel:

2500

initlogger(debug)

2501

else:

2502

level = getattr(logging, debuglevel.upper())

2503

initlogger(debug, level)

2504

1843

2505

1844

if server_settings["servicename"] != "Mandos":

2506

syslogger.setFormatter(

2507

logging.Formatter('Mandos ({}) [%(process)d]:'

2508

' %(levelname)s: %(message)s'.format(

2509

server_settings["servicename"])))

1845

syslogger.setFormatter(logging.Formatter

1846

('Mandos (%s) [%%(process)d]:'

1847

' %%(levelname)s: %%(message)s'

1848

% server_settings["servicename"]))

2510

1849

2511

1850

# Parse config file with clients

2512

client_config = configparser.SafeConfigParser(Client

2513

.client_defaults)

1851

client_defaults = { "timeout": "5m",

1852

"extended_timeout": "15m",

1853

"interval": "2m",

1854

"checker": "fping -q -- %%(host)s",

1855

"host": "",

1856

"approval_delay": "0s",

1857

"approval_duration": "1s",

1858

}

1859

client_config = configparser.SafeConfigParser(client_defaults)

2514

1860

client_config.read(os.path.join(server_settings["configdir"],

2515

1861

"clients.conf"))

2516

1862

2517

1863

global mandos_dbus_service

2518

1864

mandos_dbus_service = None

2519

1865

2520

socketfd = None

2521

if server_settings["socket"] != "":

2522

socketfd = server_settings["socket"]

2523

tcp_server = MandosServer(

2524

(server_settings["address"], server_settings["port"]),

2525

ClientHandler,

2526

interface=(server_settings["interface"] or None),

2527

use_ipv6=use_ipv6,

2528

gnutls_priority=server_settings["priority"],

2529

use_dbus=use_dbus,

2530

socketfd=socketfd)

2531

if not foreground:

2532

pidfilename = "/run/mandos.pid"

2533

if not os.path.isdir("/run/."):

2534

pidfilename = "/var/run/mandos.pid"

2535

pidfile = None

1866

tcp_server = MandosServer((server_settings["address"],

1867

server_settings["port"]),

1868

ClientHandler,

1869

interface=(server_settings["interface"]

1870

or None),

1871

use_ipv6=use_ipv6,

1872

gnutls_priority=

1873

server_settings["priority"],

1874

use_dbus=use_dbus)

1875

if not debug:

1876

pidfilename = "/var/run/mandos.pid"

2536

1877

try:

2537

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2538

except IOError as e:

2539

logger.error("Could not open file %r", pidfilename,

2540

exc_info=e)

1878

pidfile = open(pidfilename, "w")

1879

except IOError:

1880

logger.error("Could not open file %r", pidfilename)

2541

1881

2542

for name in ("_mandos", "mandos", "nobody"):

1882

try:

1883

uid = pwd.getpwnam("_mandos").pw_uid

1884

gid = pwd.getpwnam("_mandos").pw_gid

1885

except KeyError:

2543

1886

try:

2544

uid = pwd.getpwnam(name).pw_uid

2545

gid = pwd.getpwnam(name).pw_gid

2546

break

1887

uid = pwd.getpwnam("mandos").pw_uid

1888

gid = pwd.getpwnam("mandos").pw_gid

2547

1889

except KeyError:

2548

continue

2549

else:

2550

uid = 65534

2551

gid = 65534

1890

try:

1891

uid = pwd.getpwnam("nobody").pw_uid

1892

gid = pwd.getpwnam("nobody").pw_gid

1893

except KeyError:

1894

uid = 65534

1895

gid = 65534

2552

1896

try:

2553

1897

os.setgid(gid)

2554

1898

os.setuid(uid)

2555

1899

except OSError as error:

2556

if error.errno != errno.EPERM:

2557

raise

1900

if error[0] != errno.EPERM:

1901

raise error

2558

1902

1903

if not debug and not debuglevel:

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

1906

if debuglevel:

1907

level = getattr(logging, debuglevel.upper())

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

2559

1911

if debug:

2560

1912

# Enable all possible GnuTLS debugging

2561

1913

2567

1919

def debug_gnutls(level, string):

2568

1920

logger.debug("GnuTLS: %s", string[:-1])

2569

1921

2570

gnutls.library.functions.gnutls_global_set_log_function(

2571

debug_gnutls)

1922

(gnutls.library.functions

1923

.gnutls_global_set_log_function(debug_gnutls))

2572

1924

2573

1925

# Redirect stdin so all checkers get /dev/null

2574

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1926

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2575

1927

os.dup2(null, sys.stdin.fileno())

2576

1928

if null > 2:

2577

1929

os.close(null)

1930

else:

1931

# No console logging

1932

logger.removeHandler(console)

2578

1933

2579

1934

# Need to fork before connecting to D-Bus

2580

if not foreground:

1935

if not debug:

2581

1936

# Close all input and output, do double fork, etc.

2582

1937

daemon()

2583

1938

2584

# multiprocessing will use threads, so before we use gobject we

2585

# need to inform gobject that threads will be used.

2586

gobject.threads_init()

2587

2588

1939

global main_loop

2589

1940

# From the Avahi example code

2590

DBusGMainLoop(set_as_default=True)

1941

DBusGMainLoop(set_as_default=True )

2591

1942

main_loop = gobject.MainLoop()

2592

1943

bus = dbus.SystemBus()

2593

1944

# End of Avahi example code

2594

1945

if use_dbus:

2595

1946

try:

2596

bus_name = dbus.service.BusName("se.recompile.Mandos",

2597

bus,

2598

do_not_queue=True)

2599

old_bus_name = dbus.service.BusName(

2600

"se.bsnet.fukt.Mandos", bus,

2601

do_not_queue=True)

2602

except dbus.exceptions.DBusException as e:

2603

logger.error("Disabling D-Bus:", exc_info=e)

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1948

bus, do_not_queue=True)

1949

except dbus.exceptions.NameExistsException as e:

1950

logger.error(unicode(e) + ", disabling D-Bus")

2604

1951

use_dbus = False

2605

1952

server_settings["use_dbus"] = False

2606

1953

tcp_server.use_dbus = False

2607

if zeroconf:

2608

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2609

service = AvahiServiceToSyslog(

2610

name = server_settings["servicename"],

2611

servicetype = "_mandos._tcp",

2612

protocol = protocol,

2613

bus = bus)

2614

if server_settings["interface"]:

2615

service.interface = if_nametoindex(

2616

server_settings["interface"].encode("utf-8"))

1954

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1957

protocol = protocol, bus = bus)

1958

if server_settings["interface"]:

1959

service.interface = (if_nametoindex

1960

(str(server_settings["interface"])))

2617

1961

2618

1962

global multiprocessing_manager

2619

1963

multiprocessing_manager = multiprocessing.Manager()

2621

1965

client_class = Client

2622

1966

if use_dbus:

2623

1967

client_class = functools.partial(ClientDBus, bus = bus)

2624

2625

client_settings = Client.config_parser(client_config)

2626

old_client_settings = {}

2627

clients_data = {}

2628

2629

# This is used to redirect stdout and stderr for checker processes

2630

global wnull

2631

wnull = open(os.devnull, "w") # A writable /dev/null

2632

# Only used if server is running in foreground but not in debug

2633

# mode

2634

if debug or not foreground:

2635

wnull.close()

2636

2637

# Get client data and settings from last running state.

2638

if server_settings["restore"]:

2639

try:

2640

with open(stored_state_path, "rb") as stored_state:

2641

clients_data, old_client_settings = pickle.load(

2642

stored_state)

2643

os.remove(stored_state_path)

2644

except IOError as e:

2645

if e.errno == errno.ENOENT:

2646

logger.warning("Could not load persistent state:"

2647

" {}".format(os.strerror(e.errno)))

2648

else:

2649

logger.critical("Could not load persistent state:",

2650

exc_info=e)

2651

raise

2652

except EOFError as e:

2653

logger.warning("Could not load persistent state: "

2654

"EOFError:",

2655

exc_info=e)

2656

2657

with PGPEngine() as pgp:

2658

for client_name, client in clients_data.items():

2659

# Skip removed clients

2660

if client_name not in client_settings:

2661

continue

2662

2663

# Decide which value to use after restoring saved state.

2664

# We have three different values: Old config file,

2665

# new config file, and saved state.

2666

# New config value takes precedence if it differs from old

2667

# config value, otherwise use saved state.

2668

for name, value in client_settings[client_name].items():

2669

try:

2670

# For each value in new config, check if it

2671

# differs from the old config value (Except for

2672

# the "secret" attribute)

2673

if (name != "secret"

2674

and (value !=

2675

old_client_settings[client_name][name])):

2676

client[name] = value

2677

except KeyError:

2678

pass

2679

2680

# Clients who has passed its expire date can still be

2681

# enabled if its last checker was successful. A Client

2682

# whose checker succeeded before we stored its state is

2683

# assumed to have successfully run all checkers during

2684

# downtime.

2685

if client["enabled"]:

2686

if datetime.datetime.utcnow() >= client["expires"]:

2687

if not client["last_checked_ok"]:

2688

logger.warning(

2689

"disabling client {} - Client never "

2690

"performed a successful checker".format(

2691

client_name))

2692

client["enabled"] = False

2693

elif client["last_checker_status"] != 0:

2694

logger.warning(

2695

"disabling client {} - Client last"

2696

" checker failed with error code"

2697

" {}".format(

2698

client_name,

2699

client["last_checker_status"]))

2700

client["enabled"] = False

2701

else:

2702

client["expires"] = (

2703

datetime.datetime.utcnow()

2704

+ client["timeout"])

2705

logger.debug("Last checker succeeded,"

2706

" keeping {} enabled".format(

2707

client_name))

1968

def client_config_items(config, section):

1969

special_settings = {

1970

"approved_by_default":

1971

lambda: config.getboolean(section,

1972

"approved_by_default"),

1973

}

1974

for name, value in config.items(section):

2708

1975

try:

2709

client["secret"] = pgp.decrypt(

2710

client["encrypted_secret"],

2711

client_settings[client_name]["secret"])

2712

except PGPError:

2713

# If decryption fails, we use secret from new settings

2714

logger.debug("Failed to decrypt {} old secret".format(

2715

client_name))

2716

client["secret"] = (client_settings[client_name]

2717

["secret"])

2718

2719

# Add/remove clients based on new changes made to config

2720

for client_name in (set(old_client_settings)

2721

- set(client_settings)):

2722

del clients_data[client_name]

2723

for client_name in (set(client_settings)

2724

- set(old_client_settings)):

2725

clients_data[client_name] = client_settings[client_name]

2726

2727

# Create all client objects

2728

for client_name, client in clients_data.items():

2729

tcp_server.clients[client_name] = client_class(

2730

name = client_name,

2731

settings = client,

2732

server_settings = server_settings)

2733

1976

yield (name, special_settings[name]())

1977

except KeyError:

1978

yield (name, value)

1979

1980

tcp_server.clients.update(set(

1981

client_class(name = section,

1982

config= dict(client_config_items(

1983

client_config, section)))

1984

for section in client_config.sections()))

2734

1985

if not tcp_server.clients:

2735

1986

logger.warning("No clients defined")

2736

2737

if not foreground:

2738

if pidfile is not None:

2739

pid = os.getpid()

2740

try:

2741

with pidfile:

2742

print(pid, file=pidfile)

2743

except IOError:

2744

logger.error("Could not write to file %r with PID %d",

2745

pidfilename, pid)

2746

del pidfile

1987

1988

if not debug:

1989

try:

1990

with pidfile:

1991

pid = os.getpid()

1992

pidfile.write(str(pid) + "\n".encode("utf-8"))

1993

del pidfile

1994

except IOError:

1995

logger.error("Could not write to file %r with PID %d",

1996

pidfilename, pid)

1997

except NameError:

1998

# "pidfile" was never created

1999

pass

2747

2000

del pidfilename

2748

2001

2002

signal.signal(signal.SIGINT, signal.SIG_IGN)

2003

2749

2004

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2750

2005

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2751

2006

2752

2007

if use_dbus:

2753

2754

@alternate_dbus_interfaces(

2755

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2756

class MandosDBusService(DBusObjectWithProperties):

2008

class MandosDBusService(dbus.service.Object):

2757

2009

"""A D-Bus proxy object"""

2758

2759

2010

def __init__(self):

2760

2011

dbus.service.Object.__init__(self, bus, "/")

2761

2762

_interface = "se.recompile.Mandos"

2763

2764

@dbus_interface_annotations(_interface)

2765

def _foo(self):

2766

return {

2767

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2768

"false" }

2012

_interface = "se.bsnet.fukt.Mandos"

2769

2013

2770

2014

@dbus.service.signal(_interface, signature="o")

2771

2015

def ClientAdded(self, objpath):

2785

2029

@dbus.service.method(_interface, out_signature="ao")

2786

2030

def GetAllClients(self):

2787

2031

"D-Bus method"

2788

return dbus.Array(c.dbus_object_path for c in

2789

tcp_server.clients.itervalues())

2032

return dbus.Array(c.dbus_object_path

2033

for c in tcp_server.clients)

2790

2034

2791

2035

@dbus.service.method(_interface,

2792

2036

out_signature="a{oa{sv}}")

2793

2037

def GetAllClientsWithProperties(self):

2794

2038

"D-Bus method"

2795

2039

return dbus.Dictionary(

2796

{ c.dbus_object_path: c.GetAll("")

2797

for c in tcp_server.clients.itervalues() },

2040

((c.dbus_object_path, c.GetAll(""))

2041

for c in tcp_server.clients),

2798

2042

signature="oa{sv}")

2799

2043

2800

2044

@dbus.service.method(_interface, in_signature="o")

2801

2045

def RemoveClient(self, object_path):

2802

2046

"D-Bus method"

2803

for c in tcp_server.clients.itervalues():

2047

for c in tcp_server.clients:

2804

2048

if c.dbus_object_path == object_path:

2805

del tcp_server.clients[c.name]

2049

tcp_server.clients.remove(c)

2806

2050

c.remove_from_connection()

2807

2051

# Don't signal anything except ClientRemoved

2808

2052

c.disable(quiet=True)

2817

2061

2818

2062

def cleanup():

2819

2063

"Cleanup function; run on exit"

2820

if zeroconf:

2821

service.cleanup()

2822

2823

multiprocessing.active_children()

2824

wnull.close()

2825

if not (tcp_server.clients or client_settings):

2826

return

2827

2828

# Store client before exiting. Secrets are encrypted with key

2829

# based on what config file has. If config file is

2830

# removed/edited, old secret will thus be unrecovable.

2831

clients = {}

2832

with PGPEngine() as pgp:

2833

for client in tcp_server.clients.itervalues():

2834

key = client_settings[client.name]["secret"]

2835

client.encrypted_secret = pgp.encrypt(client.secret,

2836

key)

2837

client_dict = {}

2838

2839

# A list of attributes that can not be pickled

2840

# + secret.

2841

exclude = { "bus", "changedstate", "secret",

2842

"checker", "server_settings" }

2843

for name, typ in inspect.getmembers(dbus.service

2844

.Object):

2845

exclude.add(name)

2846

2847

client_dict["encrypted_secret"] = (client

2848

.encrypted_secret)

2849

for attr in client.client_structure:

2850

if attr not in exclude:

2851

client_dict[attr] = getattr(client, attr)

2852

2853

clients[client.name] = client_dict

2854

del client_settings[client.name]["secret"]

2855

2856

try:

2857

with tempfile.NamedTemporaryFile(

2858

mode='wb',

2859

suffix=".pickle",

2860

prefix='clients-',

2861

dir=os.path.dirname(stored_state_path),

2862

delete=False) as stored_state:

2863

pickle.dump((clients, client_settings), stored_state)

2864

tempname = stored_state.name

2865

os.rename(tempname, stored_state_path)

2866

except (IOError, OSError) as e:

2867

if not debug:

2868

try:

2869

os.remove(tempname)

2870

except NameError:

2871

pass

2872

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2873

logger.warning("Could not save persistent state: {}"

2874

.format(os.strerror(e.errno)))

2875

else:

2876

logger.warning("Could not save persistent state:",

2877

exc_info=e)

2878

raise

2879

2880

# Delete all clients, and settings from config

2064

service.cleanup()

2065

2881

2066

while tcp_server.clients:

2882

name, client = tcp_server.clients.popitem()

2067

client = tcp_server.clients.pop()

2883

2068

if use_dbus:

2884

2069

client.remove_from_connection()

2070

client.disable_hook = None

2885

2071

# Don't signal anything except ClientRemoved

2886

2072

client.disable(quiet=True)

2887

2073

if use_dbus:

2888

2074

# Emit D-Bus signal

2889

mandos_dbus_service.ClientRemoved(

2890

client.dbus_object_path, client.name)

2891

client_settings.clear()

2075

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2076

client.name)

2892

2077

2893

2078

atexit.register(cleanup)

2894

2079

2895

for client in tcp_server.clients.itervalues():

2080

for client in tcp_server.clients:

2896

2081

if use_dbus:

2897

2082

# Emit D-Bus signal

2898

2083

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2899

# Need to initiate checking of clients

2900

if client.enabled:

2901

client.init_checker()

2084

client.enable()

2902

2085

2903

2086

tcp_server.enable()

2904

2087

tcp_server.server_activate()

2905

2088

2906

2089

# Find out what port we got

2907

if zeroconf:

2908

service.port = tcp_server.socket.getsockname()[1]

2090

service.port = tcp_server.socket.getsockname()[1]

2909

2091

if use_ipv6:

2910

2092

logger.info("Now listening on address %r, port %d,"

2911

" flowinfo %d, scope_id %d",

2912

*tcp_server.socket.getsockname())

2093

" flowinfo %d, scope_id %d"

2094

% tcp_server.socket.getsockname())

2913

2095

else: # IPv4

2914

logger.info("Now listening on address %r, port %d",

2915

*tcp_server.socket.getsockname())

2096

logger.info("Now listening on address %r, port %d"

2097

% tcp_server.socket.getsockname())

2916

2098

2917

2099

#service.interface = tcp_server.socket.getsockname()[3]

2918

2100

2919

2101

try:

2920

if zeroconf:

2921

# From the Avahi example code

2922

try:

2923

service.activate()

2924

except dbus.exceptions.DBusException as error:

2925

logger.critical("D-Bus Exception", exc_info=error)

2926

cleanup()

2927

sys.exit(1)

2928

# End of Avahi example code

2102

# From the Avahi example code

2103

try:

2104

service.activate()

2105

except dbus.exceptions.DBusException as error:

2106

logger.critical("DBusException: %s", error)

2107

cleanup()

2108

sys.exit(1)

2109

# End of Avahi example code

2929

2110

2930

2111

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2931

2112

lambda *args, **kwargs:

2935

2116

logger.debug("Starting main loop")

2936

2117

main_loop.run()

2937

2118

except AvahiError as error:

2938

logger.critical("Avahi Error", exc_info=error)

2119

logger.critical("AvahiError: %s", error)

2939

2120

cleanup()

2940

2121

sys.exit(1)

2941

2122

except KeyboardInterrupt:

2946

2127

# Must run before the D-Bus bus name gets deregistered

2947

2128

cleanup()

2948

2129

2949

2950

2130

if __name__ == '__main__':

2951

2131

main()