126
386
self.rename_count = 0
127
387
self.max_renames = max_renames
128
388
self.protocol = protocol
389
self.group = None # our entry group
392
self.entry_group_state_changed_match = None
394
def rename(self, remove=True):
130
395
"""Derived from the Avahi example code"""
131
396
if self.rename_count >= self.max_renames:
132
logger.critical(u"No suitable Zeroconf service name found"
133
u" after %i retries, exiting.",
135
raise AvahiServiceError(u"Too many renames")
136
self.name = server.GetAlternativeServiceName(self.name)
137
logger.info(u"Changing Zeroconf service name to %r ...",
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
400
raise AvahiServiceError("Too many renames")
402
self.server.GetAlternativeServiceName(self.name))
144
403
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
410
except dbus.exceptions.DBusException as error:
411
if (error.get_dbus_name()
412
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
414
return self.rename(remove=False)
416
log.critical("D-Bus Exception", exc_info=error)
145
420
def remove(self):
146
421
"""Derived from the Avahi example code"""
147
if group is not None:
422
if self.entry_group_state_changed_match is not None:
423
self.entry_group_state_changed_match.remove()
424
self.entry_group_state_changed_match = None
425
if self.group is not None:
150
429
"""Derived from the Avahi example code"""
153
group = dbus.Interface(bus.get_object
155
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
group.connect_to_signal('StateChanged',
158
entry_group_state_changed)
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
service.name, service.type)
162
self.interface, # interface
163
self.protocol, # protocol
164
dbus.UInt32(0), # flags
165
self.name, self.type,
166
self.domain, self.host,
167
dbus.UInt16(self.port),
168
avahi.string_array_to_txt_array(self.TXT))
171
# From the Avahi example code:
172
group = None # our entry group
173
# End of Avahi example code
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
181
class Client(dbus.service.Object):
431
if self.group is None:
432
self.group = dbus.Interface(
433
self.bus.get_object(avahi.DBUS_NAME,
434
self.server.EntryGroupNew()),
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
self.entry_group_state_changed_match = (
437
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
441
self.group.AddService(
444
dbus.UInt32(0), # flags
445
self.name, self.type,
446
self.domain, self.host,
447
dbus.UInt16(self.port),
448
avahi.string_array_to_txt_array(self.TXT))
451
def entry_group_state_changed(self, state, error):
452
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
457
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
460
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
463
raise AvahiGroupError("State changed: {!s}".format(error))
466
"""Derived from the Avahi example code"""
467
if self.group is not None:
470
except (dbus.exceptions.UnknownMethodException,
471
dbus.exceptions.DBusException):
476
def server_state_changed(self, state, error=None):
477
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
avahi.SERVER_REGISTERING: None,
482
avahi.SERVER_COLLISION: "Zeroconf server name collision",
483
avahi.SERVER_FAILURE: "Zeroconf server failure",
485
if state in bad_states:
486
if bad_states[state] is not None:
488
log.error(bad_states[state])
490
log.error(bad_states[state] + ": %r", error)
492
elif state == avahi.SERVER_RUNNING:
495
except dbus.exceptions.DBusException as error:
496
if (error.get_dbus_name()
497
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
499
return self.rename(remove=False)
501
log.critical("D-Bus Exception", exc_info=error)
506
log.debug("Unknown state: %r", state)
508
log.debug("Unknown state: %r: %r", state, error)
511
"""Derived from the Avahi example code"""
512
if self.server is None:
513
self.server = dbus.Interface(
514
self.bus.get_object(avahi.DBUS_NAME,
515
avahi.DBUS_PATH_SERVER,
516
follow_name_owner_changes=True),
517
avahi.DBUS_INTERFACE_SERVER)
518
self.server.connect_to_signal("StateChanged",
519
self.server_state_changed)
520
self.server_state_changed(self.server.GetState())
523
class AvahiServiceToSyslog(AvahiService):
524
def rename(self, *args, **kwargs):
525
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
534
# Pretend that we have a GnuTLS module
536
"""This isn't so much a class as it is a module-like namespace."""
538
library = ctypes.util.find_library("gnutls")
540
library = ctypes.util.find_library("gnutls-deb0")
541
_library = ctypes.cdll.LoadLibrary(library)
544
# Unless otherwise indicated, the constants and types below are
545
# all from the gnutls/gnutls.h C header file.
556
E_NO_CERTIFICATE_FOUND = -49
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
565
class _session_int(ctypes.Structure):
567
session_t = ctypes.POINTER(_session_int)
569
class certificate_credentials_st(ctypes.Structure):
571
certificate_credentials_t = ctypes.POINTER(
572
certificate_credentials_st)
573
certificate_type_t = ctypes.c_int
575
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
579
class _openpgp_crt_int(ctypes.Structure):
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
credentials_type_t = ctypes.c_int
585
transport_ptr_t = ctypes.c_void_p
586
close_request_t = ctypes.c_int
589
class Error(Exception):
590
def __init__(self, message=None, code=None, args=()):
591
# Default usage is by a message string, but if a return
592
# code is passed, convert it to a string with
595
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
601
class CertificateSecurityError(Error):
605
def __init__(self, cls):
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
614
class CastToVoidPointer:
615
def __init__(self, cls):
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
624
class With_from_param:
626
def from_param(cls, obj):
627
return obj._as_parameter_
630
class Credentials(With_from_param):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
634
self.type = gnutls.CRD_CERTIFICATE
637
gnutls.certificate_free_credentials(self)
639
class ClientSession(With_from_param):
640
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
653
if credentials is None:
654
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
657
self.credentials = credentials
663
return gnutls.handshake(self)
665
def send(self, data):
669
data_len -= gnutls.record_send(self, data[-data_len:],
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
675
# Error handling functions
676
def _error_code(result):
677
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
raise gnutls.CertificateSecurityError(code=result)
683
raise gnutls.Error(code=result)
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
687
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
return _error_code(result)
692
result = func(*arguments)
695
# Unless otherwise indicated, the function declarations below are
696
# all from the gnutls/gnutls.h C header file.
699
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
701
ctypes.POINTER(ctypes.c_char_p)]
702
priority_set_direct.restype = _error_code
704
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
706
init.restype = _error_code
708
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
710
set_default_priority.restype = _error_code
712
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
715
record_send.restype = ctypes.c_ssize_t
716
record_send.errcheck = _retry_on_error
718
certificate_allocate_credentials = (
719
_library.gnutls_certificate_allocate_credentials)
720
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
722
certificate_allocate_credentials.restype = _error_code
724
certificate_free_credentials = (
725
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
727
certificate_free_credentials.restype = None
729
handshake_set_private_extensions = (
730
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
733
handshake_set_private_extensions.restype = None
735
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
738
credentials_set.restype = _error_code
740
strerror = _library.gnutls_strerror
741
strerror.argtypes = [ctypes.c_int]
742
strerror.restype = ctypes.c_char_p
744
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
746
certificate_type_get.restype = _error_code
748
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
750
ctypes.POINTER(ctypes.c_uint)]
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
753
global_set_log_level = _library.gnutls_global_set_log_level
754
global_set_log_level.argtypes = [ctypes.c_int]
755
global_set_log_level.restype = None
757
global_set_log_function = _library.gnutls_global_set_log_function
758
global_set_log_function.argtypes = [log_func]
759
global_set_log_function.restype = None
761
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
763
deinit.restype = None
765
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
768
handshake.errcheck = _retry_on_error
770
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
772
transport_set_ptr.restype = None
774
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
777
bye.errcheck = _retry_on_error
779
check_version = _library.gnutls_check_version
780
check_version.argtypes = [ctypes.c_char_p]
781
check_version.restype = ctypes.c_char_p
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
793
class pubkey_st(ctypes.Structure):
795
pubkey_t = ctypes.POINTER(pubkey_st)
797
x509_crt_fmt_t = ctypes.c_int
799
# All the function declarations below are from
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
808
pubkey_import.restype = _error_code
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
820
# All the function declarations below are from
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
831
openpgp_crt_import.restype = _error_code
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
838
ctypes.POINTER(ctypes.c_uint),
840
openpgp_crt_verify_self.restype = _error_code
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
852
openpgp_crt_get_fingerprint.restype = _error_code
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
859
# Remove non-public functions
860
del _error_code, _retry_on_error
863
def call_pipe(connection, # : multiprocessing.Connection
864
func, *args, **kwargs):
865
"""This function is meant to be called by multiprocessing.Process
867
This function runs func(*args, **kwargs), and writes the resulting
868
return value on the provided multiprocessing.Connection.
870
connection.send(func(*args, **kwargs))
182
875
"""A representation of a client host served by this server.
878
approved: bool(); None if not yet approved/disapproved
879
approval_delay: datetime.timedelta(); Time to wait for approval
880
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
884
checker_callback_tag: a GLib event source tag, or None
885
checker_command: string; External command which is run to check
886
if client lives. %() expansions are done at
887
runtime with vars(self) as dict, so that for
888
instance %(name)s can be used in the command.
889
checker_initiator_tag: a GLib event source tag, or None
890
created: datetime.datetime(); (UTC) object creation
891
client_structure: Object describing what attributes a client has
892
and is used for storing the client at exit
893
current_checker_command: string; current running checker_command
894
disable_initiator_tag: a GLib event source tag, or None
896
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
900
host: string; available for use by the checker command
901
interval: datetime.timedelta(); How often to start a new checker
902
last_approval_request: datetime.datetime(); (UTC) or None
903
last_checked_ok: datetime.datetime(); (UTC) or None
904
last_checker_status: integer between 0 and 255 reflecting exit
905
status of last checker. -1 reflects crashed
906
checker, -2 means no checker completed yet.
907
last_checker_signal: The signal which killed the last checker, if
908
last_checker_status is -1
909
last_enabled: datetime.datetime(); (UTC) or None
184
910
name: string; from the config file, used in log messages and
185
911
D-Bus identifiers
186
fingerprint: string (40 or 32 hexadecimal digits); used to
187
uniquely identify the client
188
912
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
913
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
201
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
203
checker_callback_tag: - '' -
204
checker_command: string; External command which is run to check if
205
client lives. %() expansions are done at
206
runtime with vars(self) as dict, so that for
207
instance %(name)s can be used in the command.
208
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
914
until this client is disabled
915
extended_timeout: extra long timeout when secret has been sent
916
runtime_expansions: Allowed attributes for runtime expansion.
917
expires: datetime.datetime(); time (UTC) when a client will be
919
server_settings: The server_settings dict from main()
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
224
def __init__(self, name = None, disable_hook=None, config=None,
226
"""Note: the 'checker' key in 'config' sets the
227
'checker_command' attribute and *not* the 'checker'
922
runtime_expansions = ("approval_delay", "approval_duration",
923
"created", "enabled", "expires", "key_id",
924
"fingerprint", "host", "interval",
925
"last_approval_request", "last_checked_ok",
926
"last_enabled", "name", "timeout")
929
"extended_timeout": "PT15M",
931
"checker": "fping -q -- %%(host)s",
933
"approval_delay": "PT0S",
934
"approval_duration": "PT1S",
935
"approved_by_default": "True",
940
def config_parser(config):
941
"""Construct a new dict of client settings of this form:
942
{ client_name: {setting_name: value, ...}, ...}
943
with exceptions for any special settings as defined above.
944
NOTE: Must be a pure function. Must return the same result
945
value given the same arguments.
948
for client_name in config.sections():
949
section = dict(config.items(client_name))
950
client = settings[client_name] = {}
952
client["host"] = section["host"]
953
# Reformat values from string types to Python types
954
client["approved_by_default"] = config.getboolean(
955
client_name, "approved_by_default")
956
client["enabled"] = config.getboolean(client_name,
959
# Uppercase and remove spaces from key_id and fingerprint
960
# for later comparison purposes with return value from the
961
# key_id() and fingerprint() functions
962
client["key_id"] = (section.get("key_id", "").upper()
964
client["fingerprint"] = (section.get("fingerprint",
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
972
if "secret" in section:
973
client["secret"] = codecs.decode(section["secret"]
976
elif "secfile" in section:
977
with open(os.path.expanduser(os.path.expandvars
978
(section["secfile"])),
980
client["secret"] = secfile.read()
982
raise TypeError("No secret or secfile for section {}"
984
client["timeout"] = string_to_delta(section["timeout"])
985
client["extended_timeout"] = string_to_delta(
986
section["extended_timeout"])
987
client["interval"] = string_to_delta(section["interval"])
988
client["approval_delay"] = string_to_delta(
989
section["approval_delay"])
990
client["approval_duration"] = string_to_delta(
991
section["approval_duration"])
992
client["checker_command"] = section["checker"]
993
client["last_approval_request"] = None
994
client["last_checked_ok"] = None
995
client["last_checker_status"] = -2
999
def __init__(self, settings, name=None, server_settings=None):
229
1000
self.name = name
232
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
234
# Uppercase and remove spaces from fingerprint for later
235
# comparison purposes with return value from the fingerprint()
237
self.fingerprint = (config["fingerprint"].upper()
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
if "secret" in config:
241
self.secret = config["secret"].decode(u"base64")
242
elif "secfile" in config:
243
with closing(open(os.path.expanduser
245
(config["secfile"])))) as secfile:
246
self.secret = secfile.read()
1001
if server_settings is None:
1002
server_settings = {}
1003
self.server_settings = server_settings
1004
# adding all client settings
1005
for setting, value in settings.items():
1006
setattr(self, setting, value)
1009
if not hasattr(self, "last_enabled"):
1010
self.last_enabled = datetime.datetime.utcnow()
1011
if not hasattr(self, "expires"):
1012
self.expires = (datetime.datetime.utcnow()
248
raise TypeError(u"No secret or secfile for client %s"
250
self.host = config.get("host", "")
251
self.created = datetime.datetime.utcnow()
253
self.last_enabled = None
254
self.last_checked_ok = None
255
self.timeout = string_to_delta(config["timeout"])
256
self.interval = string_to_delta(config["interval"])
257
self.disable_hook = disable_hook
1015
self.last_enabled = None
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
1021
self.created = settings.get("created",
1022
datetime.datetime.utcnow())
1024
# attributes specific for this server instance
258
1025
self.checker = None
259
1026
self.checker_initiator_tag = None
260
1027
self.disable_initiator_tag = None
261
1028
self.checker_callback_tag = None
262
self.checker_command = config["checker"]
263
1029
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
267
self.use_dbus = use_dbus
269
self.dbus_object_path = (dbus.ObjectPath
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
1030
self.approved = None
1031
self.approvals_pending = 0
1032
self.changedstate = multiprocessing_manager.Condition(
1033
multiprocessing_manager.Lock())
1034
self.client_structure = [attr
1035
for attr in self.__dict__.keys()
1036
if not attr.startswith("_")]
1037
self.client_structure.append("client_structure")
1039
for name, t in inspect.getmembers(
1040
type(self), lambda obj: isinstance(obj, property)):
1041
if not name.startswith("_"):
1042
self.client_structure.append(name)
1044
# Send notice to process children that client state has changed
1045
def send_changedstate(self):
1046
with self.changedstate:
1047
self.changedstate.notify_all()
275
1049
def enable(self):
276
1050
"""Start this client's checker and timeout hooks"""
1051
if getattr(self, "enabled", False):
277
1055
self.last_enabled = datetime.datetime.utcnow()
278
# Schedule a new checker to be started an 'interval' from now,
279
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
283
# Also start a new checker *right now*.
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
1057
self.send_changedstate()
1059
def disable(self, quiet=True):
299
1060
"""Disable this client."""
300
1061
if not getattr(self, "enabled", False):
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
1064
log.info("Disabling client %s", self.name)
1065
if getattr(self, "disable_initiator_tag", None) is not None:
1066
GLib.source_remove(self.disable_initiator_tag)
305
1067
self.disable_initiator_tag = None
306
if getattr(self, "checker_initiator_tag", False):
307
gobject.source_remove(self.checker_initiator_tag)
1069
if getattr(self, "checker_initiator_tag", None) is not None:
1070
GLib.source_remove(self.checker_initiator_tag)
308
1071
self.checker_initiator_tag = None
309
1072
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
312
1073
self.enabled = False
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
317
# Do not run this again if called by a gobject.timeout_add
1075
self.send_changedstate()
1076
# Do not run this again if called by a GLib.timeout_add
320
1079
def __del__(self):
321
self.disable_hook = None
324
def checker_callback(self, pid, condition, command):
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1087
if self.checker_initiator_tag is not None:
1088
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1095
delay_milliseconds = interval_milliseconds
1096
self.checker_initiator_tag = GLib.timeout_add(
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
1106
if self.disable_initiator_tag is not None:
1107
GLib.source_remove(self.disable_initiator_tag)
1108
self.disable_initiator_tag = GLib.timeout_add(
1109
int((self.expires - now).total_seconds() * 1000),
1112
def checker_callback(self, source, condition, connection,
325
1114
"""The checker has completed, so take appropriate actions."""
1115
# Read return code from connection (see call_pipe)
1116
returncode = connection.recv()
1118
if self.checker is not None:
326
1120
self.checker_callback_tag = None
327
1121
self.checker = None
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
335
logger.info(u"Checker for %(name)s succeeded",
1124
self.last_checker_status = returncode
1125
self.last_checker_signal = None
1126
if self.last_checker_status == 0:
1127
log.info("Checker for %(name)s succeeded", vars(self))
337
1128
self.checked_ok()
339
logger.info(u"Checker for %(name)s failed",
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
1130
log.info("Checker for %(name)s failed", vars(self))
347
logger.warning(u"Checker for %(name)s crashed?",
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
1132
self.last_checker_status = -1
1133
self.last_checker_signal = -returncode
1134
log.warning("Checker for %(name)s crashed?", vars(self))
355
1137
def checked_ok(self):
356
"""Bump up the timeout for this client.
357
This should only be called when the client has been seen,
1138
"""Assert that the client has been seen, alive and well."""
360
1139
self.last_checked_ok = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
372
def start_checker(self):
1140
self.last_checker_status = 0
1141
self.last_checker_signal = None
1144
def bump_timeout(self, timeout=None):
1145
"""Bump up the timeout for this client."""
1147
timeout = self.timeout
1148
if self.disable_initiator_tag is not None:
1149
GLib.source_remove(self.disable_initiator_tag)
1150
self.disable_initiator_tag = None
1151
if getattr(self, "enabled", False):
1152
self.disable_initiator_tag = GLib.timeout_add(
1153
int(timeout.total_seconds() * 1000), self.disable)
1154
self.expires = datetime.datetime.utcnow() + timeout
1156
def need_approval(self):
1157
self.last_approval_request = datetime.datetime.utcnow()
1159
def start_checker(self, start_was_randomized=False):
373
1160
"""Start a new checker subprocess if one is not running.
374
1162
If a checker already exists, leave it running and do
376
1164
# The reason for not killing a running checker is that if we
377
# did that, then if a checker (for some reason) started
378
# running slowly and taking more than 'interval' time, the
379
# client would inevitably timeout, since no checker would get
380
# a chance to run to completion. If we instead leave running
1165
# did that, and if a checker (for some reason) started running
1166
# slowly and taking more than 'interval' time, then the client
1167
# would inevitably timeout, since no checker would get a
1168
# chance to run to completion. If we instead leave running
381
1169
# checkers alone, the checker would have to take more time
382
# than 'timeout' for the client to be declared invalid, which
383
# is as it should be.
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
1170
# than 'timeout' for the client to be disabled, which is as it
1173
if self.checker is not None and not self.checker.is_alive():
1174
log.warning("Checker was not alive; joining")
393
1177
# Start a new checker if needed
394
1178
if self.checker is None:
396
# In case checker_command has exactly one % operator
397
command = self.checker_command % self.host
399
# Escape attributes for the shell
400
escaped_attrs = dict((key, re.escape(str(val)))
402
vars(self).iteritems())
404
command = self.checker_command % escaped_attrs
405
except TypeError, error:
406
logger.error(u'Could not format string "%s":'
407
u' %s', self.checker_command, error)
408
return True # Try again later
409
self.current_checker_command = command
411
logger.info(u"Starting checker %r for %s",
413
# We don't need to redirect stdout and stderr, since
414
# in normal mode, that is already done by daemon(),
415
# and in debug mode we don't want to. (Stdin is
416
# always replaced by /dev/null.)
417
self.checker = subprocess.Popen(command,
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
426
self.checker_callback_tag = (gobject.child_watch_add
428
self.checker_callback,
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
436
except OSError, error:
437
logger.error(u"Failed to start subprocess: %s",
439
# Re-run this periodically if run by gobject.timeout_add
1179
# Escape attributes for the shell
1181
attr: shlex.quote(str(getattr(self, attr)))
1182
for attr in self.runtime_expansions}
1184
command = self.checker_command % escaped_attrs
1185
except TypeError as error:
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1188
return True # Try again later
1189
self.current_checker_command = command
1190
log.info("Starting checker %r for %s", command, self.name)
1191
# We don't need to redirect stdout and stderr, since
1192
# in normal mode, that is already done by daemon(),
1193
# and in debug mode we don't want to. (Stdin is
1194
# always replaced by /dev/null.)
1195
# The exception is when not debugging but nevertheless
1196
# running in the foreground; use the previously
1198
popen_args = {"close_fds": True,
1201
if (not self.server_settings["debug"]
1202
and self.server_settings["foreground"]):
1203
popen_args.update({"stdout": wnull,
1205
pipe = multiprocessing.Pipe(duplex=False)
1206
self.checker = multiprocessing.Process(
1208
args=(pipe[1], subprocess.call, command),
1210
self.checker.start()
1211
self.checker_callback_tag = GLib.io_add_watch(
1212
GLib.IOChannel.unix_new(pipe[0].fileno()),
1213
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1214
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1226
# Re-run this periodically if run by GLib.timeout_add
442
1229
def stop_checker(self):
443
1230
"""Force the checker process, if any, to stop."""
444
1231
if self.checker_callback_tag:
445
gobject.source_remove(self.checker_callback_tag)
1232
GLib.source_remove(self.checker_callback_tag)
446
1233
self.checker_callback_tag = None
447
1234
if getattr(self, "checker", None) is None:
449
logger.debug(u"Stopping checker for %(name)s", vars(self))
451
os.kill(self.checker.pid, signal.SIGTERM)
453
#if self.checker.poll() is None:
454
# os.kill(self.checker.pid, signal.SIGKILL)
455
except OSError, error:
456
if error.errno != errno.ESRCH: # No such process
1236
log.debug("Stopping checker for %(name)s", vars(self))
1237
self.checker.terminate()
458
1238
self.checker = None
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
463
def still_valid(self):
464
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
467
now = datetime.datetime.utcnow()
468
if self.last_checked_ok is None:
469
return now < (self.created + self.timeout)
1241
def dbus_service_property(dbus_interface,
1245
"""Decorators for marking methods of a DBusObjectWithProperties to
1246
become properties on the D-Bus.
1248
The decorated method will be called with no arguments by "Get"
1249
and with one argument by "Set".
1251
The parameters, where they are supported, are the same as
1252
dbus.service.method, except there is only "signature", since the
1253
type from Get() and the type sent to Set() is the same.
1255
# Encoding deeply encoded byte arrays is not supported yet by the
1256
# "Set" method, so we fail early here:
1257
if byte_arrays and signature != "ay":
1258
raise ValueError("Byte arrays not supported for non-'ay'"
1259
" signature {!r}".format(signature))
1261
def decorator(func):
1262
func._dbus_is_property = True
1263
func._dbus_interface = dbus_interface
1264
func._dbus_signature = signature
1265
func._dbus_access = access
1266
func._dbus_name = func.__name__
1267
if func._dbus_name.endswith("_dbus_property"):
1268
func._dbus_name = func._dbus_name[:-14]
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1275
def dbus_interface_annotations(dbus_interface):
1276
"""Decorator for marking functions returning interface annotations
1280
@dbus_interface_annotations("org.example.Interface")
1281
def _foo(self): # Function name does not matter
1282
return {"org.freedesktop.DBus.Deprecated": "true",
1283
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1287
def decorator(func):
1288
func._dbus_is_interface = True
1289
func._dbus_interface = dbus_interface
1290
func._dbus_name = dbus_interface
1296
def dbus_annotations(annotations):
1297
"""Decorator to annotate D-Bus methods, signals or properties
1300
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1301
"org.freedesktop.DBus.Property."
1302
"EmitsChangedSignal": "false"})
1303
@dbus_service_property("org.example.Interface", signature="b",
1305
def Property_dbus_property(self):
1306
return dbus.Boolean(False)
1308
See also the DBusObjectWithAnnotations class.
1311
def decorator(func):
1312
func._dbus_annotations = annotations
1318
class DBusPropertyException(dbus.exceptions.DBusException):
1319
"""A base class for D-Bus property-related exceptions
1324
class DBusPropertyAccessException(DBusPropertyException):
1325
"""A property's access permissions disallows an operation.
1330
class DBusPropertyNotFound(DBusPropertyException):
1331
"""An attempt was made to access a non-existing property.
1336
class DBusObjectWithAnnotations(dbus.service.Object):
1337
"""A D-Bus object with annotations.
1339
Classes inheriting from this can use the dbus_annotations
1340
decorator to add annotations to methods or signals.
1344
def _is_dbus_thing(thing):
1345
"""Returns a function testing if an attribute is a D-Bus thing
1347
If called like _is_dbus_thing("method") it returns a function
1348
suitable for use as predicate to inspect.getmembers().
1350
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1353
def _get_all_dbus_things(self, thing):
1354
"""Returns a generator of (name, attribute) pairs
1356
return ((getattr(athing.__get__(self), "_dbus_name", name),
1357
athing.__get__(self))
1358
for cls in self.__class__.__mro__
1360
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1362
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1366
def Introspect(self, object_path, connection):
1367
"""Overloading of standard D-Bus method.
1369
Inserts annotation tags on methods and signals.
1371
xmlstring = dbus.service.Object.Introspect(self, object_path,
1374
document = xml.dom.minidom.parseString(xmlstring)
1376
for if_tag in document.getElementsByTagName("interface"):
1377
# Add annotation tags
1378
for typ in ("method", "signal"):
1379
for tag in if_tag.getElementsByTagName(typ):
1381
for name, prop in (self.
1382
_get_all_dbus_things(typ)):
1383
if (name == tag.getAttribute("name")
1384
and prop._dbus_interface
1385
== if_tag.getAttribute("name")):
1386
annots.update(getattr(
1387
prop, "_dbus_annotations", {}))
1388
for name, value in annots.items():
1389
ann_tag = document.createElement(
1391
ann_tag.setAttribute("name", name)
1392
ann_tag.setAttribute("value", value)
1393
tag.appendChild(ann_tag)
1394
# Add interface annotation tags
1395
for annotation, value in dict(
1396
itertools.chain.from_iterable(
1397
annotations().items()
1398
for name, annotations
1399
in self._get_all_dbus_things("interface")
1400
if name == if_tag.getAttribute("name")
1402
ann_tag = document.createElement("annotation")
1403
ann_tag.setAttribute("name", annotation)
1404
ann_tag.setAttribute("value", value)
1405
if_tag.appendChild(ann_tag)
1406
# Fix argument name for the Introspect method itself
1407
if (if_tag.getAttribute("name")
1408
== dbus.INTROSPECTABLE_IFACE):
1409
for cn in if_tag.getElementsByTagName("method"):
1410
if cn.getAttribute("name") == "Introspect":
1411
for arg in cn.getElementsByTagName("arg"):
1412
if (arg.getAttribute("direction")
1414
arg.setAttribute("name",
1416
xmlstring = document.toxml("utf-8")
1418
except (AttributeError, xml.dom.DOMException,
1419
xml.parsers.expat.ExpatError) as error:
1420
log.error("Failed to override Introspection method",
1425
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1426
"""A D-Bus object with properties.
1428
Classes inheriting from this can use the dbus_service_property
1429
decorator to expose methods as D-Bus properties. It exposes the
1430
standard Get(), Set(), and GetAll() methods on the D-Bus.
1433
def _get_dbus_property(self, interface_name, property_name):
1434
"""Returns a bound method if one exists which is a D-Bus
1435
property with the specified name and interface.
1437
for cls in self.__class__.__mro__:
1438
for name, value in inspect.getmembers(
1439
cls, self._is_dbus_thing("property")):
1440
if (value._dbus_name == property_name
1441
and value._dbus_interface == interface_name):
1442
return value.__get__(self)
1445
raise DBusPropertyNotFound("{}:{}.{}".format(
1446
self.dbus_object_path, interface_name, property_name))
1449
def _get_all_interface_names(cls):
1450
"""Get a sequence of all interfaces supported by an object"""
1451
return (name for name in set(getattr(getattr(x, attr),
1452
"_dbus_interface", None)
1453
for x in (inspect.getmro(cls))
1455
if name is not None)
1457
@dbus.service.method(dbus.PROPERTIES_IFACE,
1460
def Get(self, interface_name, property_name):
1461
"""Standard D-Bus property Get() method, see D-Bus standard.
1463
prop = self._get_dbus_property(interface_name, property_name)
1464
if prop._dbus_access == "write":
1465
raise DBusPropertyAccessException(property_name)
1467
if not hasattr(value, "variant_level"):
1469
return type(value)(value, variant_level=value.variant_level+1)
1471
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1472
def Set(self, interface_name, property_name, value):
1473
"""Standard D-Bus property Set() method, see D-Bus standard.
1475
prop = self._get_dbus_property(interface_name, property_name)
1476
if prop._dbus_access == "read":
1477
raise DBusPropertyAccessException(property_name)
1478
if prop._dbus_get_args_options["byte_arrays"]:
1479
# The byte_arrays option is not supported yet on
1480
# signatures other than "ay".
1481
if prop._dbus_signature != "ay":
1482
raise ValueError("Byte arrays not supported for non-"
1483
"'ay' signature {!r}"
1484
.format(prop._dbus_signature))
1485
value = dbus.ByteArray(bytes(value))
1488
@dbus.service.method(dbus.PROPERTIES_IFACE,
1490
out_signature="a{sv}")
1491
def GetAll(self, interface_name):
1492
"""Standard D-Bus property GetAll() method, see D-Bus
1495
Note: Will not include properties with access="write".
1498
for name, prop in self._get_all_dbus_things("property"):
1500
and interface_name != prop._dbus_interface):
1501
# Interface non-empty but did not match
1503
# Ignore write-only properties
1504
if prop._dbus_access == "write":
1507
if not hasattr(value, "variant_level"):
1508
properties[name] = value
1510
properties[name] = type(value)(
1511
value, variant_level=value.variant_level + 1)
1512
return dbus.Dictionary(properties, signature="sv")
1514
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1515
def PropertiesChanged(self, interface_name, changed_properties,
1516
invalidated_properties):
1517
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1522
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1526
def Introspect(self, object_path, connection):
1527
"""Overloading of standard D-Bus method.
1529
Inserts property tags and interface annotation tags.
1531
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1535
document = xml.dom.minidom.parseString(xmlstring)
1537
def make_tag(document, name, prop):
1538
e = document.createElement("property")
1539
e.setAttribute("name", name)
1540
e.setAttribute("type", prop._dbus_signature)
1541
e.setAttribute("access", prop._dbus_access)
1544
for if_tag in document.getElementsByTagName("interface"):
1546
for tag in (make_tag(document, name, prop)
1548
in self._get_all_dbus_things("property")
1549
if prop._dbus_interface
1550
== if_tag.getAttribute("name")):
1551
if_tag.appendChild(tag)
1552
# Add annotation tags for properties
1553
for tag in if_tag.getElementsByTagName("property"):
1555
for name, prop in self._get_all_dbus_things(
1557
if (name == tag.getAttribute("name")
1558
and prop._dbus_interface
1559
== if_tag.getAttribute("name")):
1560
annots.update(getattr(
1561
prop, "_dbus_annotations", {}))
1562
for name, value in annots.items():
1563
ann_tag = document.createElement(
1565
ann_tag.setAttribute("name", name)
1566
ann_tag.setAttribute("value", value)
1567
tag.appendChild(ann_tag)
1568
# Add the names to the return values for the
1569
# "org.freedesktop.DBus.Properties" methods
1570
if (if_tag.getAttribute("name")
1571
== "org.freedesktop.DBus.Properties"):
1572
for cn in if_tag.getElementsByTagName("method"):
1573
if cn.getAttribute("name") == "Get":
1574
for arg in cn.getElementsByTagName("arg"):
1575
if (arg.getAttribute("direction")
1577
arg.setAttribute("name", "value")
1578
elif cn.getAttribute("name") == "GetAll":
1579
for arg in cn.getElementsByTagName("arg"):
1580
if (arg.getAttribute("direction")
1582
arg.setAttribute("name", "props")
1583
xmlstring = document.toxml("utf-8")
1585
except (AttributeError, xml.dom.DOMException,
1586
xml.parsers.expat.ExpatError) as error:
1587
log.error("Failed to override Introspection method",
1593
dbus.OBJECT_MANAGER_IFACE
1594
except AttributeError:
1595
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1598
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1599
"""A D-Bus object with an ObjectManager.
1601
Classes inheriting from this exposes the standard
1602
GetManagedObjects call and the InterfacesAdded and
1603
InterfacesRemoved signals on the standard
1604
"org.freedesktop.DBus.ObjectManager" interface.
1606
Note: No signals are sent automatically; they must be sent
1609
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1610
out_signature="a{oa{sa{sv}}}")
1611
def GetManagedObjects(self):
1612
"""This function must be overridden"""
1613
raise NotImplementedError()
1615
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1616
signature="oa{sa{sv}}")
1617
def InterfacesAdded(self, object_path, interfaces_and_properties):
1620
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1621
def InterfacesRemoved(self, object_path, interfaces):
1624
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1628
def Introspect(self, object_path, connection):
1629
"""Overloading of standard D-Bus method.
1631
Override return argument name of GetManagedObjects to be
1632
"objpath_interfaces_and_properties"
1634
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1638
document = xml.dom.minidom.parseString(xmlstring)
1640
for if_tag in document.getElementsByTagName("interface"):
1641
# Fix argument name for the GetManagedObjects method
1642
if (if_tag.getAttribute("name")
1643
== dbus.OBJECT_MANAGER_IFACE):
1644
for cn in if_tag.getElementsByTagName("method"):
1645
if (cn.getAttribute("name")
1646
== "GetManagedObjects"):
1647
for arg in cn.getElementsByTagName("arg"):
1648
if (arg.getAttribute("direction")
1652
"objpath_interfaces"
1654
xmlstring = document.toxml("utf-8")
1656
except (AttributeError, xml.dom.DOMException,
1657
xml.parsers.expat.ExpatError) as error:
1658
log.error("Failed to override Introspection method",
1663
def datetime_to_dbus(dt, variant_level=0):
1664
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1666
return dbus.String("", variant_level=variant_level)
1667
return dbus.String(dt.isoformat(), variant_level=variant_level)
1670
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1671
"""A class decorator; applied to a subclass of
1672
dbus.service.Object, it will add alternate D-Bus attributes with
1673
interface names according to the "alt_interface_names" mapping.
1676
@alternate_dbus_interfaces({"org.example.Interface":
1677
"net.example.AlternateInterface"})
1678
class SampleDBusObject(dbus.service.Object):
1679
@dbus.service.method("org.example.Interface")
1680
def SampleDBusMethod():
1683
The above "SampleDBusMethod" on "SampleDBusObject" will be
1684
reachable via two interfaces: "org.example.Interface" and
1685
"net.example.AlternateInterface", the latter of which will have
1686
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1687
"true", unless "deprecate" is passed with a False value.
1689
This works for methods and signals, and also for D-Bus properties
1690
(from DBusObjectWithProperties) and interfaces (from the
1691
dbus_interface_annotations decorator).
1695
for orig_interface_name, alt_interface_name in (
1696
alt_interface_names.items()):
1698
interface_names = set()
1699
# Go though all attributes of the class
1700
for attrname, attribute in inspect.getmembers(cls):
1701
# Ignore non-D-Bus attributes, and D-Bus attributes
1702
# with the wrong interface name
1703
if (not hasattr(attribute, "_dbus_interface")
1704
or not attribute._dbus_interface.startswith(
1705
orig_interface_name)):
1707
# Create an alternate D-Bus interface name based on
1709
alt_interface = attribute._dbus_interface.replace(
1710
orig_interface_name, alt_interface_name)
1711
interface_names.add(alt_interface)
1712
# Is this a D-Bus signal?
1713
if getattr(attribute, "_dbus_is_signal", False):
1714
# Extract the original non-method undecorated
1715
# function by black magic
1716
if sys.version_info.major == 2:
1717
nonmethod_func = (dict(
1718
zip(attribute.func_code.co_freevars,
1719
attribute.__closure__))
1720
["func"].cell_contents)
1722
nonmethod_func = (dict(
1723
zip(attribute.__code__.co_freevars,
1724
attribute.__closure__))
1725
["func"].cell_contents)
1726
# Create a new, but exactly alike, function
1727
# object, and decorate it to be a new D-Bus signal
1728
# with the alternate D-Bus interface name
1729
new_function = copy_function(nonmethod_func)
1730
new_function = (dbus.service.signal(
1732
attribute._dbus_signature)(new_function))
1733
# Copy annotations, if any
1735
new_function._dbus_annotations = dict(
1736
attribute._dbus_annotations)
1737
except AttributeError:
1740
# Define a creator of a function to call both the
1741
# original and alternate functions, so both the
1742
# original and alternate signals gets sent when
1743
# the function is called
1744
def fixscope(func1, func2):
1745
"""This function is a scope container to pass
1746
func1 and func2 to the "call_both" function
1747
outside of its arguments"""
1749
@functools.wraps(func2)
1750
def call_both(*args, **kwargs):
1751
"""This function will emit two D-Bus
1752
signals by calling func1 and func2"""
1753
func1(*args, **kwargs)
1754
func2(*args, **kwargs)
1755
# Make wrapper function look like a D-Bus
1757
for name, attr in inspect.getmembers(func2):
1758
if name.startswith("_dbus_"):
1759
setattr(call_both, name, attr)
1762
# Create the "call_both" function and add it to
1764
attr[attrname] = fixscope(attribute, new_function)
1765
# Is this a D-Bus method?
1766
elif getattr(attribute, "_dbus_is_method", False):
1767
# Create a new, but exactly alike, function
1768
# object. Decorate it to be a new D-Bus method
1769
# with the alternate D-Bus interface name. Add it
1772
dbus.service.method(
1774
attribute._dbus_in_signature,
1775
attribute._dbus_out_signature)
1776
(copy_function(attribute)))
1777
# Copy annotations, if any
1779
attr[attrname]._dbus_annotations = dict(
1780
attribute._dbus_annotations)
1781
except AttributeError:
1783
# Is this a D-Bus property?
1784
elif getattr(attribute, "_dbus_is_property", False):
1785
# Create a new, but exactly alike, function
1786
# object, and decorate it to be a new D-Bus
1787
# property with the alternate D-Bus interface
1788
# name. Add it to the class.
1789
attr[attrname] = (dbus_service_property(
1790
alt_interface, attribute._dbus_signature,
1791
attribute._dbus_access,
1792
attribute._dbus_get_args_options
1794
(copy_function(attribute)))
1795
# Copy annotations, if any
1797
attr[attrname]._dbus_annotations = dict(
1798
attribute._dbus_annotations)
1799
except AttributeError:
1801
# Is this a D-Bus interface?
1802
elif getattr(attribute, "_dbus_is_interface", False):
1803
# Create a new, but exactly alike, function
1804
# object. Decorate it to be a new D-Bus interface
1805
# with the alternate D-Bus interface name. Add it
1808
dbus_interface_annotations(alt_interface)
1809
(copy_function(attribute)))
1811
# Deprecate all alternate interfaces
1812
iname = "_AlternateDBusNames_interface_annotation{}"
1813
for interface_name in interface_names:
1815
@dbus_interface_annotations(interface_name)
1817
return {"org.freedesktop.DBus.Deprecated":
1819
# Find an unused name
1820
for aname in (iname.format(i)
1821
for i in itertools.count()):
1822
if aname not in attr:
1826
# Replace the class with a new subclass of it with
1827
# methods, signals, etc. as created above.
1828
if sys.version_info.major == 2:
1829
cls = type(b"{}Alternate".format(cls.__name__),
1832
cls = type("{}Alternate".format(cls.__name__),
1839
@alternate_dbus_interfaces({"se.recompile.Mandos":
1840
"se.bsnet.fukt.Mandos"})
1841
class ClientDBus(Client, DBusObjectWithProperties):
1842
"""A Client class using D-Bus
1845
dbus_object_path: dbus.ObjectPath
1846
bus: dbus.SystemBus()
1849
runtime_expansions = (Client.runtime_expansions
1850
+ ("dbus_object_path", ))
1852
_interface = "se.recompile.Mandos.Client"
1854
# dbus.service.Object doesn't use super(), so we can't either.
1856
def __init__(self, bus=None, *args, **kwargs):
1858
Client.__init__(self, *args, **kwargs)
1859
# Only now, when this client is initialized, can it show up on
1861
client_object_name = str(self.name).translate(
1862
{ord("."): ord("_"),
1863
ord("-"): ord("_")})
1864
self.dbus_object_path = dbus.ObjectPath(
1865
"/clients/" + client_object_name)
1866
DBusObjectWithProperties.__init__(self, self.bus,
1867
self.dbus_object_path)
1869
def notifychangeproperty(transform_func, dbus_name,
1870
type_func=lambda x: x,
1872
invalidate_only=False,
1873
_interface=_interface):
1874
""" Modify a variable so that it's a property which announces
1875
its changes to DBus.
1877
transform_fun: Function that takes a value and a variant_level
1878
and transforms it to a D-Bus type.
1879
dbus_name: D-Bus name of the variable
1880
type_func: Function that transform the value before sending it
1881
to the D-Bus. Default: no transform
1882
variant_level: D-Bus variant level. Default: 1
1884
attrname = "_{}".format(dbus_name)
1886
def setter(self, value):
1887
if hasattr(self, "dbus_object_path"):
1888
if (not hasattr(self, attrname) or
1889
type_func(getattr(self, attrname, None))
1890
!= type_func(value)):
1892
self.PropertiesChanged(
1893
_interface, dbus.Dictionary(),
1894
dbus.Array((dbus_name, )))
1896
dbus_value = transform_func(
1898
variant_level=variant_level)
1899
self.PropertyChanged(dbus.String(dbus_name),
1901
self.PropertiesChanged(
1903
dbus.Dictionary({dbus.String(dbus_name):
1906
setattr(self, attrname, value)
1908
return property(lambda self: getattr(self, attrname), setter)
1910
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1911
approvals_pending = notifychangeproperty(dbus.Boolean,
1914
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1915
last_enabled = notifychangeproperty(datetime_to_dbus,
1917
checker = notifychangeproperty(
1918
dbus.Boolean, "CheckerRunning",
1919
type_func=lambda checker: checker is not None)
1920
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1922
last_checker_status = notifychangeproperty(dbus.Int16,
1923
"LastCheckerStatus")
1924
last_approval_request = notifychangeproperty(
1925
datetime_to_dbus, "LastApprovalRequest")
1926
approved_by_default = notifychangeproperty(dbus.Boolean,
1927
"ApprovedByDefault")
1928
approval_delay = notifychangeproperty(
1929
dbus.UInt64, "ApprovalDelay",
1930
type_func=lambda td: td.total_seconds() * 1000)
1931
approval_duration = notifychangeproperty(
1932
dbus.UInt64, "ApprovalDuration",
1933
type_func=lambda td: td.total_seconds() * 1000)
1934
host = notifychangeproperty(dbus.String, "Host")
1935
timeout = notifychangeproperty(
1936
dbus.UInt64, "Timeout",
1937
type_func=lambda td: td.total_seconds() * 1000)
1938
extended_timeout = notifychangeproperty(
1939
dbus.UInt64, "ExtendedTimeout",
1940
type_func=lambda td: td.total_seconds() * 1000)
1941
interval = notifychangeproperty(
1942
dbus.UInt64, "Interval",
1943
type_func=lambda td: td.total_seconds() * 1000)
1944
checker_command = notifychangeproperty(dbus.String, "Checker")
1945
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1946
invalidate_only=True)
1948
del notifychangeproperty
1950
def __del__(self, *args, **kwargs):
1952
self.remove_from_connection()
1955
if hasattr(DBusObjectWithProperties, "__del__"):
1956
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1957
Client.__del__(self, *args, **kwargs)
1959
def checker_callback(self, source, condition,
1960
connection, command, *args, **kwargs):
1961
ret = Client.checker_callback(self, source, condition,
1962
connection, command, *args,
1964
exitstatus = self.last_checker_status
1967
self.CheckerCompleted(dbus.Int16(exitstatus),
1968
# This is specific to GNU libC
1969
dbus.Int64(exitstatus << 8),
1970
dbus.String(command))
471
return now < (self.last_checked_ok + self.timeout)
473
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
1973
self.CheckerCompleted(dbus.Int16(-1),
1975
# This is specific to GNU libC
1977
| self.last_checker_signal),
1978
dbus.String(command))
1981
def start_checker(self, *args, **kwargs):
1982
old_checker_pid = getattr(self.checker, "pid", None)
1983
r = Client.start_checker(self, *args, **kwargs)
1984
# Only if new checker process was started
1985
if (self.checker is not None
1986
and old_checker_pid != self.checker.pid):
1988
self.CheckerStarted(self.current_checker_command)
1991
def _reset_approved(self):
1992
self.approved = None
1995
def approve(self, value=True):
1996
self.approved = value
1997
GLib.timeout_add(int(self.approval_duration.total_seconds()
1998
* 1000), self._reset_approved)
1999
self.send_changedstate()
2001
# D-Bus methods, signals & properties
480
2007
# CheckerCompleted - signal
481
2008
@dbus.service.signal(_interface, signature="nxs")
482
2009
def CheckerCompleted(self, exitcode, waitstatus, command):
486
2013
# CheckerStarted - signal
487
2014
@dbus.service.signal(_interface, signature="s")
488
2015
def CheckerStarted(self, command):
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
496
return dbus.Dictionary({
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
537
IsStillValid.__name__ = "IsStillValid"
539
2019
# PropertyChanged - signal
2020
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
540
2021
@dbus.service.signal(_interface, signature="sv")
541
2022
def PropertyChanged(self, property, value):
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
574
@dbus.service.method(_interface, in_signature="ay",
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
2026
# GotSecret - signal
2027
@dbus.service.signal(_interface)
2028
def GotSecret(self):
2030
Is sent after a successful transfer of secret from the Mandos
2031
server to mandos-client
2036
@dbus.service.signal(_interface, signature="s")
2037
def Rejected(self, reason):
2041
# NeedApproval - signal
2042
@dbus.service.signal(_interface, signature="tb")
2043
def NeedApproval(self, timeout, default):
2045
return self.need_approval()
2050
@dbus.service.method(_interface, in_signature="b")
2051
def Approve(self, value):
2054
# CheckedOK - method
2055
@dbus.service.method(_interface)
2056
def CheckedOK(self):
589
2059
# Enable - method
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
2060
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2061
@dbus.service.method(_interface)
593
2066
# StartChecker - method
2067
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
594
2068
@dbus.service.method(_interface)
595
2069
def StartChecker(self):
597
2071
self.start_checker()
599
2073
# Disable - method
2074
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
600
2075
@dbus.service.method(_interface)
601
2076
def Disable(self):
605
2080
# StopChecker - method
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
2081
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2082
@dbus.service.method(_interface)
2083
def StopChecker(self):
2088
# ApprovalPending - property
2089
@dbus_service_property(_interface, signature="b", access="read")
2090
def ApprovalPending_dbus_property(self):
2091
return dbus.Boolean(bool(self.approvals_pending))
2093
# ApprovedByDefault - property
2094
@dbus_service_property(_interface,
2097
def ApprovedByDefault_dbus_property(self, value=None):
2098
if value is None: # get
2099
return dbus.Boolean(self.approved_by_default)
2100
self.approved_by_default = bool(value)
2102
# ApprovalDelay - property
2103
@dbus_service_property(_interface,
2106
def ApprovalDelay_dbus_property(self, value=None):
2107
if value is None: # get
2108
return dbus.UInt64(self.approval_delay.total_seconds()
2110
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2112
# ApprovalDuration - property
2113
@dbus_service_property(_interface,
2116
def ApprovalDuration_dbus_property(self, value=None):
2117
if value is None: # get
2118
return dbus.UInt64(self.approval_duration.total_seconds()
2120
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2124
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2125
@dbus_service_property(_interface, signature="s", access="read")
2126
def Name_dbus_property(self):
2127
return dbus.String(self.name)
2131
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2132
@dbus_service_property(_interface, signature="s", access="read")
2133
def KeyID_dbus_property(self):
2134
return dbus.String(self.key_id)
2136
# Fingerprint - property
2138
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2139
@dbus_service_property(_interface, signature="s", access="read")
2140
def Fingerprint_dbus_property(self):
2141
return dbus.String(self.fingerprint)
2144
@dbus_service_property(_interface,
2147
def Host_dbus_property(self, value=None):
2148
if value is None: # get
2149
return dbus.String(self.host)
2150
self.host = str(value)
2152
# Created - property
2154
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2155
@dbus_service_property(_interface, signature="s", access="read")
2156
def Created_dbus_property(self):
2157
return datetime_to_dbus(self.created)
2159
# LastEnabled - property
2160
@dbus_service_property(_interface, signature="s", access="read")
2161
def LastEnabled_dbus_property(self):
2162
return datetime_to_dbus(self.last_enabled)
2164
# Enabled - property
2165
@dbus_service_property(_interface,
2168
def Enabled_dbus_property(self, value=None):
2169
if value is None: # get
2170
return dbus.Boolean(self.enabled)
2176
# LastCheckedOK - property
2177
@dbus_service_property(_interface,
2180
def LastCheckedOK_dbus_property(self, value=None):
2181
if value is not None:
2184
return datetime_to_dbus(self.last_checked_ok)
2186
# LastCheckerStatus - property
2187
@dbus_service_property(_interface, signature="n", access="read")
2188
def LastCheckerStatus_dbus_property(self):
2189
return dbus.Int16(self.last_checker_status)
2191
# Expires - property
2192
@dbus_service_property(_interface, signature="s", access="read")
2193
def Expires_dbus_property(self):
2194
return datetime_to_dbus(self.expires)
2196
# LastApprovalRequest - property
2197
@dbus_service_property(_interface, signature="s", access="read")
2198
def LastApprovalRequest_dbus_property(self):
2199
return datetime_to_dbus(self.last_approval_request)
2201
# Timeout - property
2202
@dbus_service_property(_interface,
2205
def Timeout_dbus_property(self, value=None):
2206
if value is None: # get
2207
return dbus.UInt64(self.timeout.total_seconds() * 1000)
2208
old_timeout = self.timeout
2209
self.timeout = datetime.timedelta(0, 0, 0, value)
2210
# Reschedule disabling
2212
now = datetime.datetime.utcnow()
2213
self.expires += self.timeout - old_timeout
2214
if self.expires <= now:
2215
# The timeout has passed
2218
if (getattr(self, "disable_initiator_tag", None)
2221
GLib.source_remove(self.disable_initiator_tag)
2222
self.disable_initiator_tag = GLib.timeout_add(
2223
int((self.expires - now).total_seconds() * 1000),
2226
# ExtendedTimeout - property
2227
@dbus_service_property(_interface,
2230
def ExtendedTimeout_dbus_property(self, value=None):
2231
if value is None: # get
2232
return dbus.UInt64(self.extended_timeout.total_seconds()
2234
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2236
# Interval - property
2237
@dbus_service_property(_interface,
2240
def Interval_dbus_property(self, value=None):
2241
if value is None: # get
2242
return dbus.UInt64(self.interval.total_seconds() * 1000)
2243
self.interval = datetime.timedelta(0, 0, 0, value)
2244
if getattr(self, "checker_initiator_tag", None) is None:
2247
# Reschedule checker run
2248
GLib.source_remove(self.checker_initiator_tag)
2249
self.checker_initiator_tag = GLib.timeout_add(
2250
value, self.start_checker)
2251
self.start_checker() # Start one now, too
2253
# Checker - property
2254
@dbus_service_property(_interface,
2257
def Checker_dbus_property(self, value=None):
2258
if value is None: # get
2259
return dbus.String(self.checker_command)
2260
self.checker_command = str(value)
2262
# CheckerRunning - property
2263
@dbus_service_property(_interface,
2266
def CheckerRunning_dbus_property(self, value=None):
2267
if value is None: # get
2268
return dbus.Boolean(self.checker is not None)
2270
self.start_checker()
2274
# ObjectPath - property
2276
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2277
"org.freedesktop.DBus.Deprecated": "true"})
2278
@dbus_service_property(_interface, signature="o", access="read")
2279
def ObjectPath_dbus_property(self):
2280
return self.dbus_object_path # is already a dbus.ObjectPath
2284
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2286
@dbus_service_property(_interface,
2290
def Secret_dbus_property(self, value):
2291
self.secret = bytes(value)
612
def peer_certificate(session):
613
"Return the peer's OpenPGP certificate as a bytestring"
614
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
# ...do the normal thing
619
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
627
if list_size.value == 0:
630
return ctypes.string_at(cert.data, cert.size)
633
def fingerprint(openpgp):
634
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
640
ctypes.c_uint(len(openpgp))))
641
# New empty GnuTLS certificate
642
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
650
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
if crtverify.value != 0:
655
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
raise gnutls.errors.CertificateSecurityError("Verify failed")
657
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
660
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
664
# Deinit the certificate
665
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
668
# Convert the bytestring to hexadecimal notation
669
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
"""A TCP request handler class.
675
Instantiated by IPv6_TCPServer for each request to handle it.
2297
def __init__(self, child_pipe, key_id, fpr, address):
2298
self._pipe = child_pipe
2299
self._pipe.send(("init", key_id, fpr, address))
2300
if not self._pipe.recv():
2301
raise KeyError(key_id or fpr)
2303
def __getattribute__(self, name):
2305
return super(ProxyClient, self).__getattribute__(name)
2306
self._pipe.send(("getattr", name))
2307
data = self._pipe.recv()
2308
if data[0] == "data":
2310
if data[0] == "function":
2312
def func(*args, **kwargs):
2313
self._pipe.send(("funcall", name, args, kwargs))
2314
return self._pipe.recv()[1]
2318
def __setattr__(self, name, value):
2320
return super(ProxyClient, self).__setattr__(name, value)
2321
self._pipe.send(("setattr", name, value))
2324
class ClientHandler(socketserver.BaseRequestHandler, object):
2325
"""A class to handle client connections.
2327
Instantiated once for each connection to handle it.
676
2328
Note: This will run in its own forked process."""
678
2330
def handle(self):
679
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
686
line = self.request.makefile().readline()
687
logger.debug(u"Protocol version: %r", line)
689
if int(line.strip().split()[0]) > 1:
691
except (ValueError, IndexError, RuntimeError), error:
692
logger.error(u"Unknown protocol version: %s", error)
695
# Note: gnutls.connection.X509Credentials is really a generic
696
# GnuTLS certificate credentials object so long as no X.509
697
# keys are added to it. Therefore, we can use it here despite
698
# using OpenPGP certificates.
700
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
711
except gnutls.errors.GNUTLSError, error:
712
logger.warning(u"Handshake failed: %s", error)
713
# Do not run session.bye() here: the session is not
714
# established. Just abandon the request.
716
logger.debug(u"Handshake succeeded")
718
fpr = fingerprint(peer_certificate(session))
719
except (TypeError, gnutls.errors.GNUTLSError), error:
720
logger.warning(u"Bad certificate: %s", error)
723
logger.debug(u"Fingerprint: %s", fpr)
725
for c in self.server.clients:
726
if c.fingerprint == fpr:
2331
with contextlib.closing(self.server.child_pipe) as child_pipe:
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2336
session = gnutls.ClientSession(self.request)
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2339
# "+AES-256-CBC", "+SHA1",
2340
# "+COMP-NULL", "+CTYPE-OPENPGP",
2342
# Use a fallback default, since this MUST be set.
2343
priority = self.server.gnutls_priority
2344
if priority is None:
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2349
# Start communication using the Mandos protocol
2350
# Get protocol number
2351
line = self.request.makefile().readline()
2352
log.debug("Protocol version: %r", line)
2354
if int(line.strip().split()[0]) > 1:
2355
raise RuntimeError(line)
2356
except (ValueError, IndexError, RuntimeError) as error:
2357
log.error("Unknown protocol version: %s", error)
2360
# Start GnuTLS connection
2363
except gnutls.Error as error:
2364
log.warning("Handshake failed: %s", error)
2365
# Do not run session.bye() here: the session is not
2366
# established. Just abandon the request.
2368
log.debug("Handshake succeeded")
2370
approval_required = False
2372
if gnutls.has_rawpk:
2375
key_id = self.key_id(
2376
self.peer_certificate(session))
2377
except (TypeError, gnutls.Error) as error:
2378
log.warning("Bad certificate: %s", error)
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2387
fpr = self.fingerprint(
2388
self.peer_certificate(session))
2389
except (TypeError, gnutls.Error) as error:
2390
log.warning("Bad certificate: %s", error)
2392
log.debug("Fingerprint: %s", fpr)
2395
client = ProxyClient(child_pipe, key_id, fpr,
2396
self.client_address)
2400
if client.approval_delay:
2401
delay = client.approval_delay
2402
client.approvals_pending += 1
2403
approval_required = True
2406
if not client.enabled:
2407
log.info("Client %s is disabled", client.name)
2408
if self.server.use_dbus:
2410
client.Rejected("Disabled")
2413
if client.approved or not client.approval_delay:
2414
# We are approved or approval is disabled
2416
elif client.approved is None:
2417
log.info("Client %s needs approval",
2419
if self.server.use_dbus:
2421
client.NeedApproval(
2422
client.approval_delay.total_seconds()
2423
* 1000, client.approved_by_default)
2425
log.warning("Client %s was not approved",
2427
if self.server.use_dbus:
2429
client.Rejected("Denied")
2432
# wait until timeout or approved
2433
time = datetime.datetime.now()
2434
client.changedstate.acquire()
2435
client.changedstate.wait(delay.total_seconds())
2436
client.changedstate.release()
2437
time2 = datetime.datetime.now()
2438
if (time2 - time) >= delay:
2439
if not client.approved_by_default:
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2443
if self.server.use_dbus:
2445
client.Rejected("Approval timed out")
2450
delay -= time2 - time
2453
session.send(client.secret)
2454
except gnutls.Error as error:
2455
log.warning("gnutls send failed", exc_info=error)
2458
log.info("Sending secret to %s", client.name)
2459
# bump the timeout using extended_timeout
2460
client.bump_timeout(client.extended_timeout)
2461
if self.server.use_dbus:
2466
if approval_required:
2467
client.approvals_pending -= 1
2470
except gnutls.Error as error:
2471
log.warning("GnuTLS bye failed", exc_info=error)
2474
def peer_certificate(session):
2475
"Return the peer's certificate as a bytestring"
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2479
except AttributeError:
2480
cert_type = gnutls.certificate_type_get(session)
2481
if gnutls.has_rawpk:
2482
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
730
logger.warning(u"Client not found for fingerprint: %s",
734
# Have to check if client.still_valid(), since it is possible
735
# that the client timed out while establishing the GnuTLS
737
if not client.still_valid():
738
logger.warning(u"Client %(name)s is invalid",
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
745
while sent_size < len(client.secret):
746
sent = session.send(client.secret[sent_size:])
747
logger.debug(u"Sent: %d, remaining: %d",
748
sent, len(client.secret)
749
- (sent_size + sent))
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2484
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2485
# If not a valid certificate type...
2486
if cert_type not in valid_cert_types:
2487
log.info("Cert type %r not in %r", cert_type,
2489
# ...return invalid data
2491
list_size = ctypes.c_uint(1)
2492
cert_list = (gnutls.certificate_get_peers
2493
(session, ctypes.byref(list_size)))
2494
if not bool(cert_list) and list_size.value != 0:
2495
raise gnutls.Error("error getting peer certificate")
2496
if list_size.value == 0:
2499
return ctypes.string_at(cert.data, cert.size)
2502
def key_id(certificate):
2503
"Convert a certificate bytestring to a hexdigit key ID"
2504
# New GnuTLS "datum" with the public key
2505
datum = gnutls.datum_t(
2506
ctypes.cast(ctypes.c_char_p(certificate),
2507
ctypes.POINTER(ctypes.c_ubyte)),
2508
ctypes.c_uint(len(certificate)))
2509
# XXX all these need to be created in the gnutls "module"
2510
# New empty GnuTLS certificate
2511
pubkey = gnutls.pubkey_t()
2512
gnutls.pubkey_init(ctypes.byref(pubkey))
2513
# Import the raw public key into the certificate
2514
gnutls.pubkey_import(pubkey,
2515
ctypes.byref(datum),
2516
gnutls.X509_FMT_DER)
2517
# New buffer for the key ID
2518
buf = ctypes.create_string_buffer(32)
2519
buf_len = ctypes.c_size_t(len(buf))
2520
# Get the key ID from the raw public key into the buffer
2521
gnutls.pubkey_get_key_id(
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2527
# Deinit the certificate
2528
gnutls.pubkey_deinit(pubkey)
2530
# Convert the buffer to a Python bytestring
2531
key_id = ctypes.string_at(buf, buf_len.value)
2532
# Convert the bytestring to hexadecimal notation
2533
hex_key_id = binascii.hexlify(key_id).upper()
2537
def fingerprint(openpgp):
2538
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2539
# New GnuTLS "datum" with the OpenPGP public key
2540
datum = gnutls.datum_t(
2541
ctypes.cast(ctypes.c_char_p(openpgp),
2542
ctypes.POINTER(ctypes.c_ubyte)),
2543
ctypes.c_uint(len(openpgp)))
2544
# New empty GnuTLS certificate
2545
crt = gnutls.openpgp_crt_t()
2546
gnutls.openpgp_crt_init(ctypes.byref(crt))
2547
# Import the OpenPGP public key into the certificate
2548
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2549
gnutls.OPENPGP_FMT_RAW)
2550
# Verify the self signature in the key
2551
crtverify = ctypes.c_uint()
2552
gnutls.openpgp_crt_verify_self(crt, 0,
2553
ctypes.byref(crtverify))
2554
if crtverify.value != 0:
2555
gnutls.openpgp_crt_deinit(crt)
2556
raise gnutls.CertificateSecurityError(code
2558
# New buffer for the fingerprint
2559
buf = ctypes.create_string_buffer(20)
2560
buf_len = ctypes.c_size_t()
2561
# Get the fingerprint from the certificate into the buffer
2562
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2563
ctypes.byref(buf_len))
2564
# Deinit the certificate
2565
gnutls.openpgp_crt_deinit(crt)
2566
# Convert the buffer to a Python bytestring
2567
fpr = ctypes.string_at(buf, buf_len.value)
2568
# Convert the bytestring to hexadecimal notation
2569
hex_fpr = binascii.hexlify(fpr).upper()
2573
class MultiprocessingMixIn:
2574
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2576
def sub_process_main(self, request, address):
2578
self.finish_request(request, address)
2580
self.handle_error(request, address)
2581
self.close_request(request)
2583
def process_request(self, request, address):
2584
"""Start a new process to process the request."""
2585
proc = multiprocessing.Process(target=self.sub_process_main,
2586
args=(request, address))
2591
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2592
""" adds a pipe to the MixIn """
2594
def process_request(self, request, client_address):
2595
"""Overrides and wraps the original process_request().
2597
This function creates a new pipe in self.pipe
2599
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2601
proc = MultiprocessingMixIn.process_request(self, request,
2603
self.child_pipe.close()
2604
self.add_pipe(parent_pipe, proc)
2606
def add_pipe(self, parent_pipe, proc):
2607
"""Dummy function; override as necessary"""
2608
raise NotImplementedError()
2611
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2612
socketserver.TCPServer):
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
758
settings: Server settings
759
clients: Set() of Client objects
760
2616
enabled: Boolean; whether this server is activated yet
2617
interface: None or a network interface name (string)
2618
use_ipv6: Boolean; to use IPv6 or not
762
address_family = socket.AF_INET6
763
def __init__(self, *args, **kwargs):
764
if "settings" in kwargs:
765
self.settings = kwargs["settings"]
766
del kwargs["settings"]
767
if "clients" in kwargs:
768
self.clients = kwargs["clients"]
769
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
2621
def __init__(self, server_address, RequestHandlerClass,
2625
"""If socketfd is set, use that file descriptor instead of
2626
creating a new one with socket.socket().
2628
self.interface = interface
2630
self.address_family = socket.AF_INET6
2631
if socketfd is not None:
2632
# Save the file descriptor
2633
self.socketfd = socketfd
2634
# Save the original socket.socket() function
2635
self.socket_socket = socket.socket
2637
# To implement --socket, we monkey patch socket.socket.
2639
# (When socketserver.TCPServer is a new-style class, we
2640
# could make self.socket into a property instead of monkey
2641
# patching socket.socket.)
2643
# Create a one-time-only replacement for socket.socket()
2644
@functools.wraps(socket.socket)
2645
def socket_wrapper(*args, **kwargs):
2646
# Restore original function so subsequent calls are
2648
socket.socket = self.socket_socket
2649
del self.socket_socket
2650
# This time only, return a new socket object from the
2651
# saved file descriptor.
2652
return socket.fromfd(self.socketfd, *args, **kwargs)
2653
# Replace socket.socket() function with wrapper
2654
socket.socket = socket_wrapper
2655
# The socketserver.TCPServer.__init__ will call
2656
# socket.socket(), which might be our replacement,
2657
# socket_wrapper(), if socketfd was set.
2658
socketserver.TCPServer.__init__(self, server_address,
2659
RequestHandlerClass)
776
2661
def server_bind(self):
777
2662
"""This overrides the normal server_bind() function
778
2663
to bind to an interface if one was specified, and also NOT to
779
2664
bind to an address or port if they were not specified."""
780
if self.settings["interface"]:
781
# 25 is from /usr/include/asm-i486/socket.h
782
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
2665
global SO_BINDTODEVICE
2666
if self.interface is not None:
2667
if SO_BINDTODEVICE is None:
2668
# Fall back to a hard-coded value which seems to be
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2671
SO_BINDTODEVICE = 25
784
self.socket.setsockopt(socket.SOL_SOCKET,
786
self.settings["interface"])
787
except socket.error, error:
788
if error[0] == errno.EPERM:
789
logger.error(u"No permission to"
790
u" bind to interface %s",
791
self.settings["interface"])
2673
self.socket.setsockopt(
2674
socket.SOL_SOCKET, SO_BINDTODEVICE,
2675
(self.interface + "\0").encode("utf-8"))
2676
except socket.error as error:
2677
if error.errno == errno.EPERM:
2678
log.error("No permission to bind to interface %s",
2680
elif error.errno == errno.ENOPROTOOPT:
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2683
elif error.errno == errno.ENODEV:
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
794
2688
# Only bind(2) the socket if we really need to.
795
2689
if self.server_address[0] or self.server_address[1]:
2690
if self.server_address[1]:
2691
self.allow_reuse_address = True
796
2692
if not self.server_address[0]:
797
2693
if self.address_family == socket.AF_INET6:
798
any_address = "::" # in6addr_any
2694
any_address = "::" # in6addr_any
800
any_address = socket.INADDR_ANY
2696
any_address = "0.0.0.0" # INADDR_ANY
801
2697
self.server_address = (any_address,
802
2698
self.server_address[1])
803
2699
elif not self.server_address[1]:
804
self.server_address = (self.server_address[0],
806
# if self.settings["interface"]:
2700
self.server_address = (self.server_address[0], 0)
2701
# if self.interface:
807
2702
# self.server_address = (self.server_address[0],
810
2705
# if_nametoindex
813
return super(IPv6_TCPServer, self).server_bind()
2707
return socketserver.TCPServer.server_bind(self)
2710
class MandosServer(IPv6_TCPServer):
2714
clients: set of Client objects
2715
gnutls_priority GnuTLS priority string
2716
use_dbus: Boolean; to emit D-Bus signals or not
2718
Assumes a GLib.MainLoop event loop.
2721
def __init__(self, server_address, RequestHandlerClass,
2725
gnutls_priority=None,
2728
self.enabled = False
2729
self.clients = clients
2730
if self.clients is None:
2732
self.use_dbus = use_dbus
2733
self.gnutls_priority = gnutls_priority
2734
IPv6_TCPServer.__init__(self, server_address,
2735
RequestHandlerClass,
2736
interface=interface,
814
2740
def server_activate(self):
815
2741
if self.enabled:
816
return super(IPv6_TCPServer, self).server_activate()
2742
return socketserver.TCPServer.server_activate(self)
817
2744
def enable(self):
818
2745
self.enabled = True
2747
def add_pipe(self, parent_pipe, proc):
2748
# Call "handle_ipc" for both data and EOF events
2750
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2751
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2752
functools.partial(self.handle_ipc,
2753
parent_pipe=parent_pipe,
2756
def handle_ipc(self, source, condition,
2759
client_object=None):
2760
# error, or the other end of multiprocessing.Pipe has closed
2761
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2762
# Wait for other process to exit
2766
# Read a request from the child
2767
request = parent_pipe.recv()
2768
command = request[0]
2770
if command == "init":
2771
key_id = request[1].decode("ascii")
2772
fpr = request[2].decode("ascii")
2773
address = request[3]
2775
for c in self.clients.values():
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2779
if key_id and c.key_id == key_id:
2782
if fpr and c.fingerprint == fpr:
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2792
parent_pipe.send(False)
2796
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2797
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2798
functools.partial(self.handle_ipc,
2799
parent_pipe=parent_pipe,
2801
client_object=client))
2802
parent_pipe.send(True)
2803
# remove the old hook in favor of the new above hook on
2806
if command == "funcall":
2807
funcname = request[1]
2811
parent_pipe.send(("data", getattr(client_object,
2815
if command == "getattr":
2816
attrname = request[1]
2817
if isinstance(client_object.__getattribute__(attrname),
2818
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2822
"data", client_object.__getattribute__(attrname)))
2824
if command == "setattr":
2825
attrname = request[1]
2827
setattr(client_object, attrname, value)
2832
def rfc3339_duration_to_delta(duration):
2833
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2853
# Parsing an RFC 3339 duration with regular expressions is not
2854
# possible - there would have to be multiple places for the same
2855
# values, like seconds. The current code, while more esoteric, is
2856
# cleaner without depending on a parsing library. If Python had a
2857
# built-in library for parsing we would use it, but we'd like to
2858
# avoid excessive use of external libraries.
2860
# New type for defining tokens, syntax, and semantics all-in-one
2861
Token = collections.namedtuple("Token", (
2862
"regexp", # To match token; if "value" is not None, must have
2863
# a "group" containing digits
2864
"value", # datetime.timedelta or None
2865
"followers")) # Tokens valid after this token
2866
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2867
# the "duration" ABNF definition in RFC 3339, Appendix A.
2868
token_end = Token(re.compile(r"$"), None, frozenset())
2869
token_second = Token(re.compile(r"(\d+)S"),
2870
datetime.timedelta(seconds=1),
2871
frozenset((token_end, )))
2872
token_minute = Token(re.compile(r"(\d+)M"),
2873
datetime.timedelta(minutes=1),
2874
frozenset((token_second, token_end)))
2875
token_hour = Token(re.compile(r"(\d+)H"),
2876
datetime.timedelta(hours=1),
2877
frozenset((token_minute, token_end)))
2878
token_time = Token(re.compile(r"T"),
2880
frozenset((token_hour, token_minute,
2882
token_day = Token(re.compile(r"(\d+)D"),
2883
datetime.timedelta(days=1),
2884
frozenset((token_time, token_end)))
2885
token_month = Token(re.compile(r"(\d+)M"),
2886
datetime.timedelta(weeks=4),
2887
frozenset((token_day, token_end)))
2888
token_year = Token(re.compile(r"(\d+)Y"),
2889
datetime.timedelta(weeks=52),
2890
frozenset((token_month, token_end)))
2891
token_week = Token(re.compile(r"(\d+)W"),
2892
datetime.timedelta(weeks=1),
2893
frozenset((token_end, )))
2894
token_duration = Token(re.compile(r"P"), None,
2895
frozenset((token_year, token_month,
2896
token_day, token_time,
2898
# Define starting values:
2900
value = datetime.timedelta()
2902
# Following valid tokens
2903
followers = frozenset((token_duration, ))
2904
# String left to parse
2906
# Loop until end token is found
2907
while found_token is not token_end:
2908
# Search for any currently valid tokens
2909
for token in followers:
2910
match = token.regexp.match(s)
2911
if match is not None:
2913
if token.value is not None:
2914
# Value found, parse digits
2915
factor = int(match.group(1), 10)
2916
# Add to value so far
2917
value += factor * token.value
2918
# Strip token from string
2919
s = token.regexp.sub("", s, 1)
2922
# Set valid next tokens
2923
followers = found_token.followers
2926
# No currently valid tokens were found
2927
raise ValueError("Invalid RFC 3339 duration: {!r}"
821
2933
def string_to_delta(interval):
822
2934
"""Parse a string and return a datetime.timedelta
824
>>> string_to_delta('7d')
825
datetime.timedelta(7)
826
>>> string_to_delta('60s')
827
datetime.timedelta(0, 60)
828
>>> string_to_delta('60m')
829
datetime.timedelta(0, 3600)
830
>>> string_to_delta('24h')
831
datetime.timedelta(1)
832
>>> string_to_delta(u'1w')
833
datetime.timedelta(7)
834
>>> string_to_delta('5m 30s')
835
datetime.timedelta(0, 330)
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2951
return rfc3339_duration_to_delta(interval)
837
2955
timevalue = datetime.timedelta(0)
838
2956
for s in interval.split():
840
suffix = unicode(s[-1])
841
2959
value = int(s[:-1])
843
2961
delta = datetime.timedelta(value)
845
2963
delta = datetime.timedelta(0, value)
847
2965
delta = datetime.timedelta(0, 0, 0, 0, value)
849
2967
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
851
2969
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
854
except (ValueError, IndexError):
2971
raise ValueError("Unknown suffix {!r}".format(suffix))
2972
except IndexError as e:
2973
raise ValueError(*(e.args))
856
2974
timevalue += delta
857
2975
return timevalue
860
def server_state_changed(state):
861
"""Derived from the Avahi example code"""
862
if state == avahi.SERVER_COLLISION:
863
logger.error(u"Zeroconf server name collision")
865
elif state == avahi.SERVER_RUNNING:
869
def entry_group_state_changed(state, error):
870
"""Derived from the Avahi example code"""
871
logger.debug(u"Avahi state change: %i", state)
873
if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
logger.debug(u"Zeroconf service established.")
875
elif state == avahi.ENTRY_GROUP_COLLISION:
876
logger.warning(u"Zeroconf service name collision.")
878
elif state == avahi.ENTRY_GROUP_FAILURE:
879
logger.critical(u"Avahi: Error in group state changed %s",
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
883
def if_nametoindex(interface):
884
"""Call the C function if_nametoindex(), or equivalent"""
885
global if_nametoindex
887
if_nametoindex = (ctypes.cdll.LoadLibrary
888
(ctypes.util.find_library("c"))
890
except (OSError, AttributeError):
891
if "struct" not in sys.modules:
893
if "fcntl" not in sys.modules:
895
def if_nametoindex(interface):
896
"Get an interface index the hard way, i.e. using fcntl()"
897
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
898
with closing(socket.socket()) as s:
899
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
struct.pack("16s16x", interface))
901
interface_index = struct.unpack("I", ifreq[16:20])[0]
902
return interface_index
903
return if_nametoindex(interface)
906
def daemon(nochdir = False, noclose = False):
2978
def daemon(nochdir=False, noclose=False):
907
2979
"""See daemon(3). Standard BSD Unix function.
908
2981
This should really exist as os.daemon, but it doesn't (yet)."""
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
931
parser.add_option("-i", "--interface", type="string",
932
metavar="IF", help="Bind to interface IF")
933
parser.add_option("-a", "--address", type="string",
934
help="Address to listen for requests on")
935
parser.add_option("-p", "--port", type="int",
936
help="Port number to receive requests on")
937
parser.add_option("--check", action="store_true",
938
help="Run self-test")
939
parser.add_option("--debug", action="store_true",
940
help="Debug mode; run in foreground and log to"
942
parser.add_option("--priority", type="string", help="GnuTLS"
943
" priority string (see GnuTLS documentation)")
944
parser.add_option("--servicename", type="string", metavar="NAME",
945
help="Zeroconf service name")
946
parser.add_option("--configdir", type="string",
947
default="/etc/mandos", metavar="DIR",
948
help="Directory to search for configuration"
950
parser.add_option("--no-dbus", action="store_false",
952
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
953
parser.add_option("--no-ipv6", action="store_false",
954
dest="use_ipv6", help="Do not use IPv6")
955
options = parser.parse_args()[0]
3005
##################################################################
3006
# Parsing of options, both command line and config file
3008
parser = argparse.ArgumentParser()
3009
parser.add_argument("-v", "--version", action="version",
3010
version="%(prog)s {}".format(version),
3011
help="show version number and exit")
3012
parser.add_argument("-i", "--interface", metavar="IF",
3013
help="Bind to interface IF")
3014
parser.add_argument("-a", "--address",
3015
help="Address to listen for requests on")
3016
parser.add_argument("-p", "--port", type=int,
3017
help="Port number to receive requests on")
3018
parser.add_argument("--check", action="store_true",
3019
help="Run self-test")
3020
parser.add_argument("--debug", action="store_true",
3021
help="Debug mode; run in foreground and log"
3022
" to terminal", default=None)
3023
parser.add_argument("--debuglevel", metavar="LEVEL",
3024
help="Debug level for stdout output")
3025
parser.add_argument("--priority", help="GnuTLS"
3026
" priority string (see GnuTLS documentation)")
3027
parser.add_argument("--servicename",
3028
metavar="NAME", help="Zeroconf service name")
3029
parser.add_argument("--configdir",
3030
default="/etc/mandos", metavar="DIR",
3031
help="Directory to search for configuration"
3033
parser.add_argument("--no-dbus", action="store_false",
3034
dest="use_dbus", help="Do not provide D-Bus"
3035
" system bus interface", default=None)
3036
parser.add_argument("--no-ipv6", action="store_false",
3037
dest="use_ipv6", help="Do not use IPv6",
3039
parser.add_argument("--no-restore", action="store_false",
3040
dest="restore", help="Do not restore stored"
3041
" state", default=None)
3042
parser.add_argument("--socket", type=int,
3043
help="Specify a file descriptor to a network"
3044
" socket to use instead of creating one")
3045
parser.add_argument("--statedir", metavar="DIR",
3046
help="Directory to save/restore state in")
3047
parser.add_argument("--foreground", action="store_true",
3048
help="Run in foreground", default=None)
3049
parser.add_argument("--no-zeroconf", action="store_false",
3050
dest="zeroconf", help="Do not use Zeroconf",
3053
options = parser.parse_args()
962
3055
# Default values for config file for server-global settings
963
server_defaults = { "interface": "",
968
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
969
"servicename": "Mandos",
3056
if gnutls.has_rawpk:
3057
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3058
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3060
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3061
":+SIGN-DSA-SHA256")
3062
server_defaults = {"interface": "",
3066
"priority": priority,
3067
"servicename": "Mandos",
3073
"statedir": "/var/lib/mandos",
3074
"foreground": "False",
974
3079
# Parse config file for server-global settings
975
server_config = ConfigParser.SafeConfigParser(server_defaults)
3080
server_config = configparser.ConfigParser(server_defaults)
976
3081
del server_defaults
977
3082
server_config.read(os.path.join(options.configdir, "mandos.conf"))
978
# Convert the SafeConfigParser object to a dict
3083
# Convert the ConfigParser object to a dict
979
3084
server_settings = server_config.defaults()
980
3085
# Use the appropriate methods on the non-string config options
981
server_settings["debug"] = server_config.getboolean("DEFAULT",
983
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
985
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
3086
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3087
"foreground", "zeroconf"):
3088
server_settings[option] = server_config.getboolean("DEFAULT",
987
3090
if server_settings["port"]:
988
3091
server_settings["port"] = server_config.getint("DEFAULT",
3093
if server_settings["socket"]:
3094
server_settings["socket"] = server_config.getint("DEFAULT",
3096
# Later, stdin will, and stdout and stderr might, be dup'ed
3097
# over with an opened os.devnull. But we don't want this to
3098
# happen with a supplied network socket.
3099
if 0 <= server_settings["socket"] <= 2:
3100
server_settings["socket"] = os.dup(server_settings
990
3102
del server_config
992
3104
# Override the settings from the config file with command line
993
3105
# options, if set.
994
3106
for option in ("interface", "address", "port", "debug",
995
"priority", "servicename", "configdir",
996
"use_dbus", "use_ipv6"):
3107
"priority", "servicename", "configdir", "use_dbus",
3108
"use_ipv6", "debuglevel", "restore", "statedir",
3109
"socket", "foreground", "zeroconf"):
997
3110
value = getattr(options, option)
998
3111
if value is not None:
999
3112
server_settings[option] = value
3114
# Force all strings to be unicode
3115
for option in server_settings.keys():
3116
if isinstance(server_settings[option], bytes):
3117
server_settings[option] = (server_settings[option]
3119
# Force all boolean options to be boolean
3120
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3121
"foreground", "zeroconf"):
3122
server_settings[option] = bool(server_settings[option])
3123
# Debug implies foreground
3124
if server_settings["debug"]:
3125
server_settings["foreground"] = True
1001
3126
# Now we have our good server settings in "server_settings"
3128
##################################################################
3130
if (not server_settings["zeroconf"]
3131
and not (server_settings["port"]
3132
or server_settings["socket"] != "")):
3133
parser.error("Needs port or socket to work without Zeroconf")
1003
3135
# For convenience
1004
3136
debug = server_settings["debug"]
3137
debuglevel = server_settings["debuglevel"]
1005
3138
use_dbus = server_settings["use_dbus"]
1006
use_dbus = False # XXX: Not done yet
1007
3139
use_ipv6 = server_settings["use_ipv6"]
1010
syslogger.setLevel(logging.WARNING)
1011
console.setLevel(logging.WARNING)
3140
stored_state_path = os.path.join(server_settings["statedir"],
3142
foreground = server_settings["foreground"]
3143
zeroconf = server_settings["zeroconf"]
3146
initlogger(debug, logging.DEBUG)
3151
level = getattr(logging, debuglevel.upper())
3152
initlogger(debug, level)
1013
3154
if server_settings["servicename"] != "Mandos":
1014
syslogger.setFormatter(logging.Formatter
1015
('Mandos (%s): %%(levelname)s:'
1017
% server_settings["servicename"]))
3155
syslogger.setFormatter(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
3158
server_settings["servicename"])))
1019
3160
# Parse config file with clients
1020
client_defaults = { "timeout": "1h",
1022
"checker": "fping -q -- %%(host)s",
1025
client_config = ConfigParser.SafeConfigParser(client_defaults)
3161
client_config = configparser.ConfigParser(Client.client_defaults)
1026
3162
client_config.read(os.path.join(server_settings["configdir"],
1027
3163
"clients.conf"))
1030
tcp_server = IPv6_TCPServer((server_settings["address"],
1031
server_settings["port"]),
1033
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
1035
pidfilename = "/var/run/mandos.pid"
1037
pidfile = open(pidfilename, "w")
1039
logger.error("Could not open file %r", pidfilename)
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
3165
global mandos_dbus_service
3166
mandos_dbus_service = None
3169
if server_settings["socket"] != "":
3170
socketfd = server_settings["socket"]
3171
tcp_server = MandosServer(
3172
(server_settings["address"], server_settings["port"]),
3174
interface=(server_settings["interface"] or None),
3176
gnutls_priority=server_settings["priority"],
3180
pidfilename = "/run/mandos.pid"
3181
if not os.path.isdir("/run/."):
3182
pidfilename = "/var/run/mandos.pid"
3185
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3186
except IOError as e:
3187
log.error("Could not open file %r", pidfilename,
3190
for name, group in (("_mandos", "_mandos"),
3191
("mandos", "mandos"),
3192
("nobody", "nogroup")):
3194
uid = pwd.getpwnam(name).pw_uid
3195
gid = pwd.getpwnam(group).pw_gid
1048
3197
except KeyError:
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1058
except OSError, error:
1059
if error[0] != errno.EPERM:
1062
# Enable all possible GnuTLS debugging
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3206
except OSError as error:
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3209
if error.errno != errno.EPERM:
3213
# Enable all possible GnuTLS debugging
1064
3215
# "Use a log level over 10 to enable all debugging options."
1065
3216
# - GnuTLS manual
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
1068
@gnutls.library.types.gnutls_log_func
3217
gnutls.global_set_log_level(11)
1069
3220
def debug_gnutls(level, string):
1070
logger.debug("GnuTLS: %s", string[:-1])
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
1080
if server_settings["interface"]:
1081
service.interface = (if_nametoindex
1082
(server_settings["interface"]))
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3224
gnutls.global_set_log_function(debug_gnutls)
3226
# Redirect stdin so all checkers get /dev/null
3227
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3228
os.dup2(null, sys.stdin.fileno())
3232
# Need to fork before connecting to D-Bus
3234
# Close all input and output, do double fork, etc.
3237
if gi.version_info < (3, 10, 2):
3238
# multiprocessing will use threads, so before we use GLib we
3239
# need to inform GLib that threads will be used.
1084
3242
global main_loop
1087
3243
# From the Avahi example code
1088
DBusGMainLoop(set_as_default=True )
1089
main_loop = gobject.MainLoop()
1090
bus = dbus.SystemBus()
1091
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
avahi.DBUS_PATH_SERVER),
1093
avahi.DBUS_INTERFACE_SERVER)
3244
DBusGMainLoop(set_as_default=True)
3245
main_loop = GLib.MainLoop()
3246
if use_dbus or zeroconf:
3247
bus = dbus.SystemBus()
1094
3248
# End of Avahi example code
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1098
clients.update(Set(Client(name = section,
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
1102
for section in client_config.sections()))
1104
logger.warning(u"No clients defined")
1107
# Redirect stdin so all checkers get /dev/null
1108
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1109
os.dup2(null, sys.stdin.fileno())
1113
# No console logging
1114
logger.removeHandler(console)
1115
# Close all input and output, do double fork, etc.
1120
pidfile.write(str(pid) + "\n")
3251
bus_name = dbus.service.BusName("se.recompile.Mandos",
3254
old_bus_name = dbus.service.BusName(
3255
"se.bsnet.fukt.Mandos", bus,
3257
except dbus.exceptions.DBusException as e:
3258
log.error("Disabling D-Bus:", exc_info=e)
3260
server_settings["use_dbus"] = False
3261
tcp_server.use_dbus = False
3263
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3264
service = AvahiServiceToSyslog(
3265
name=server_settings["servicename"],
3266
servicetype="_mandos._tcp",
3269
if server_settings["interface"]:
3270
service.interface = if_nametoindex(
3271
server_settings["interface"].encode("utf-8"))
3273
global multiprocessing_manager
3274
multiprocessing_manager = multiprocessing.Manager()
3276
client_class = Client
3278
client_class = functools.partial(ClientDBus, bus=bus)
3280
client_settings = Client.config_parser(client_config)
3281
old_client_settings = {}
3284
# This is used to redirect stdout and stderr for checker processes
3286
wnull = open(os.devnull, "w") # A writable /dev/null
3287
# Only used if server is running in foreground but not in debug
3289
if debug or not foreground:
3292
# Get client data and settings from last running state.
3293
if server_settings["restore"]:
3295
with open(stored_state_path, "rb") as stored_state:
3296
if sys.version_info.major == 2:
3297
clients_data, old_client_settings = pickle.load(
3300
bytes_clients_data, bytes_old_client_settings = (
3301
pickle.load(stored_state, encoding="bytes"))
3302
# Fix bytes to strings
3305
clients_data = {(key.decode("utf-8")
3306
if isinstance(key, bytes)
3309
bytes_clients_data.items()}
3310
del bytes_clients_data
3311
for key in clients_data:
3312
value = {(k.decode("utf-8")
3313
if isinstance(k, bytes) else k): v
3315
clients_data[key].items()}
3316
clients_data[key] = value
3318
value["client_structure"] = [
3320
if isinstance(s, bytes)
3322
value["client_structure"]]
3323
# .name, .host, and .checker_command
3324
for k in ("name", "host", "checker_command"):
3325
if isinstance(value[k], bytes):
3326
value[k] = value[k].decode("utf-8")
3327
if "key_id" not in value:
3328
value["key_id"] = ""
3329
elif "fingerprint" not in value:
3330
value["fingerprint"] = ""
3331
# old_client_settings
3333
old_client_settings = {
3334
(key.decode("utf-8")
3335
if isinstance(key, bytes)
3338
bytes_old_client_settings.items()}
3339
del bytes_old_client_settings
3340
# .host and .checker_command
3341
for value in old_client_settings.values():
3342
for attribute in ("host", "checker_command"):
3343
if isinstance(value[attribute], bytes):
3344
value[attribute] = (value[attribute]
3346
os.remove(stored_state_path)
3347
except IOError as e:
3348
if e.errno == errno.ENOENT:
3349
log.warning("Could not load persistent state:"
3350
" %s", os.strerror(e.errno))
3352
log.critical("Could not load persistent state:",
3355
except EOFError as e:
3356
log.warning("Could not load persistent state: EOFError:",
3359
with PGPEngine() as pgp:
3360
for client_name, client in clients_data.items():
3361
# Skip removed clients
3362
if client_name not in client_settings:
3365
# Decide which value to use after restoring saved state.
3366
# We have three different values: Old config file,
3367
# new config file, and saved state.
3368
# New config value takes precedence if it differs from old
3369
# config value, otherwise use saved state.
3370
for name, value in client_settings[client_name].items():
3372
# For each value in new config, check if it
3373
# differs from the old config value (Except for
3374
# the "secret" attribute)
3375
if (name != "secret"
3377
old_client_settings[client_name][name])):
3378
client[name] = value
3382
# Clients who has passed its expire date can still be
3383
# enabled if its last checker was successful. A Client
3384
# whose checker succeeded before we stored its state is
3385
# assumed to have successfully run all checkers during
3387
if client["enabled"]:
3388
if datetime.datetime.utcnow() >= client["expires"]:
3389
if not client["last_checked_ok"]:
3390
log.warning("disabling client %s - Client"
3391
" never performed a successful"
3392
" checker", client_name)
3393
client["enabled"] = False
3394
elif client["last_checker_status"] != 0:
3395
log.warning("disabling client %s - Client"
3396
" last checker failed with error"
3397
" code %s", client_name,
3398
client["last_checker_status"])
3399
client["enabled"] = False
3401
client["expires"] = (
3402
datetime.datetime.utcnow()
3403
+ client["timeout"])
3404
log.debug("Last checker succeeded, keeping %s"
3405
" enabled", client_name)
3407
client["secret"] = pgp.decrypt(
3408
client["encrypted_secret"],
3409
client_settings[client_name]["secret"])
3411
# If decryption fails, we use secret from new settings
3412
log.debug("Failed to decrypt %s old secret",
3414
client["secret"] = (client_settings[client_name]
3417
# Add/remove clients based on new changes made to config
3418
for client_name in (set(old_client_settings)
3419
- set(client_settings)):
3420
del clients_data[client_name]
3421
for client_name in (set(client_settings)
3422
- set(old_client_settings)):
3423
clients_data[client_name] = client_settings[client_name]
3425
# Create all client objects
3426
for client_name, client in clients_data.items():
3427
tcp_server.clients[client_name] = client_class(
3430
server_settings=server_settings)
3432
if not tcp_server.clients:
3433
log.warning("No clients defined")
3436
if pidfile is not None:
3440
print(pid, file=pidfile)
3442
log.error("Could not write to file %r with PID %d",
1124
logger.error(u"Could not write to file %r with PID %d",
1127
# "pidfile" was never created
1132
"Cleanup function; run on exit"
1134
# From the Avahi example code
1135
if not group is None:
1138
# End of Avahi example code
1141
client = clients.pop()
1142
client.disable_hook = None
1145
atexit.register(cleanup)
1148
signal.signal(signal.SIGINT, signal.SIG_IGN)
1149
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3447
for termsig in (signal.SIGHUP, signal.SIGTERM):
3448
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3449
lambda: main_loop.quit() and False)
1153
class MandosServer(dbus.service.Object):
3453
@alternate_dbus_interfaces(
3454
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3455
class MandosDBusService(DBusObjectWithObjectManager):
1154
3456
"""A D-Bus proxy object"""
1155
3458
def __init__(self):
1156
3459
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
3461
_interface = "se.recompile.Mandos"
3463
@dbus.service.signal(_interface, signature="o")
3464
def ClientAdded(self, objpath):
3468
@dbus.service.signal(_interface, signature="ss")
3469
def ClientNotFound(self, key_id, address):
3473
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
1164
3475
@dbus.service.signal(_interface, signature="os")
1165
3476
def ClientRemoved(self, objpath, name):
3480
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
1169
3482
@dbus.service.method(_interface, out_signature="ao")
1170
3483
def GetAllClients(self):
1172
return dbus.Array(c.dbus_object_path for c in clients)
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
3485
return dbus.Array(c.dbus_object_path for c in
3486
tcp_server.clients.values())
3488
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3490
@dbus.service.method(_interface,
3491
out_signature="a{oa{sv}}")
1175
3492
def GetAllClientsWithProperties(self):
1177
3494
return dbus.Dictionary(
1178
((c.dbus_object_path, c.GetAllProperties())
3495
{c.dbus_object_path: c.GetAll(
3496
"se.recompile.Mandos.Client")
3497
for c in tcp_server.clients.values()},
1180
3498
signature="oa{sv}")
1182
3500
@dbus.service.method(_interface, in_signature="o")
1183
3501
def RemoveClient(self, object_path):
3503
for c in tcp_server.clients.values():
1186
3504
if c.dbus_object_path == object_path:
1188
# Don't signal anything except ClientRemoved
1192
self.ClientRemoved(object_path, c.name)
3505
del tcp_server.clients[c.name]
3506
c.remove_from_connection()
3507
# Don't signal the disabling
3508
c.disable(quiet=True)
3509
# Emit D-Bus signal for removal
3510
self.client_removed_signal(c)
3512
raise KeyError(object_path)
1198
mandos_server = MandosServer()
1200
for client in clients:
3516
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3517
out_signature="a{oa{sa{sv}}}")
3518
def GetManagedObjects(self):
3520
return dbus.Dictionary(
3521
{client.dbus_object_path:
3523
{interface: client.GetAll(interface)
3525
client._get_all_interface_names()})
3526
for client in tcp_server.clients.values()})
3528
def client_added_signal(self, client):
3529
"""Send the new standard signal and the old signal"""
3531
# New standard signal
3532
self.InterfacesAdded(
3533
client.dbus_object_path,
3535
{interface: client.GetAll(interface)
3537
client._get_all_interface_names()}))
3539
self.ClientAdded(client.dbus_object_path)
3541
def client_removed_signal(self, client):
3542
"""Send the new standard signal and the old signal"""
3544
# New standard signal
3545
self.InterfacesRemoved(
3546
client.dbus_object_path,
3547
client._get_all_interface_names())
3549
self.ClientRemoved(client.dbus_object_path,
3552
mandos_dbus_service = MandosDBusService()
3554
# Save modules to variables to exempt the modules from being
3555
# unloaded before the function registered with atexit() is run.
3556
mp = multiprocessing
3560
"Cleanup function; run on exit"
3564
mp.active_children()
3566
if not (tcp_server.clients or client_settings):
3569
# Store client before exiting. Secrets are encrypted with key
3570
# based on what config file has. If config file is
3571
# removed/edited, old secret will thus be unrecovable.
3573
with PGPEngine() as pgp:
3574
for client in tcp_server.clients.values():
3575
key = client_settings[client.name]["secret"]
3576
client.encrypted_secret = pgp.encrypt(client.secret,
3580
# A list of attributes that can not be pickled
3582
exclude = {"bus", "changedstate", "secret",
3583
"checker", "server_settings"}
3584
for name, typ in inspect.getmembers(dbus.service
3588
client_dict["encrypted_secret"] = (client
3590
for attr in client.client_structure:
3591
if attr not in exclude:
3592
client_dict[attr] = getattr(client, attr)
3594
clients[client.name] = client_dict
3595
del client_settings[client.name]["secret"]
3598
with tempfile.NamedTemporaryFile(
3602
dir=os.path.dirname(stored_state_path),
3603
delete=False) as stored_state:
3604
pickle.dump((clients, client_settings), stored_state,
3606
tempname = stored_state.name
3607
os.rename(tempname, stored_state_path)
3608
except (IOError, OSError) as e:
3614
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3615
log.warning("Could not save persistent state: %s",
3616
os.strerror(e.errno))
3618
log.warning("Could not save persistent state:",
3622
# Delete all clients, and settings from config
3623
while tcp_server.clients:
3624
name, client = tcp_server.clients.popitem()
3626
client.remove_from_connection()
3627
# Don't signal the disabling
3628
client.disable(quiet=True)
3629
# Emit D-Bus signal for removal
3631
mandos_dbus_service.client_removed_signal(client)
3632
client_settings.clear()
3634
atexit.register(cleanup)
3636
for client in tcp_server.clients.values():
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
3638
# Emit D-Bus signal for adding
3639
mandos_dbus_service.client_added_signal(client)
3640
# Need to initiate checking of clients
3642
client.init_checker(randomize_start=True)
1207
3644
tcp_server.enable()
1208
3645
tcp_server.server_activate()
1210
3647
# Find out what port we got
1211
service.port = tcp_server.socket.getsockname()[1]
3649
service.port = tcp_server.socket.getsockname()[1]
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
3651
log.info("Now listening on address %r, port %d, flowinfo %d,"
3652
" scope_id %d", *tcp_server.socket.getsockname())
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
1220
#service.interface = tcp_server.socket.getsockname()[3]
3654
log.info("Now listening on address %r, port %d",
3655
*tcp_server.socket.getsockname())
3657
# service.interface = tcp_server.socket.getsockname()[3]
1223
# From the Avahi example code
1224
server.connect_to_signal("StateChanged", server_state_changed)
1226
server_state_changed(server.GetState())
1227
except dbus.exceptions.DBusException, error:
1228
logger.critical(u"DBusException: %s", error)
1230
# End of Avahi example code
1232
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1233
lambda *args, **kwargs:
1234
(tcp_server.handle_request
1235
(*args[2:], **kwargs) or True))
1237
logger.debug(u"Starting main loop")
3661
# From the Avahi example code
3664
except dbus.exceptions.DBusException as error:
3665
log.critical("D-Bus Exception", exc_info=error)
3668
# End of Avahi example code
3671
GLib.IOChannel.unix_new(tcp_server.fileno()),
3672
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3673
lambda *args, **kwargs: (tcp_server.handle_request
3674
(*args[2:], **kwargs) or True))
3676
log.debug("Starting main loop")
1238
3677
main_loop.run()
1239
except AvahiError, error:
1240
logger.critical(u"AvahiError: %s", error)
3678
except AvahiError as error:
3679
log.critical("Avahi Error", exc_info=error)
1242
3682
except KeyboardInterrupt:
1245
logger.debug("Server received KeyboardInterrupt")
1246
logger.debug("Server exiting")
1248
if __name__ == '__main__':
3684
print("", file=sys.stderr)
3685
log.debug("Server received KeyboardInterrupt")
3686
log.debug("Server exiting")
3687
# Must run before the D-Bus bus name gets deregistered
3691
def parse_test_args():
3692
# type: () -> argparse.Namespace
3693
parser = argparse.ArgumentParser(add_help=False)
3694
parser.add_argument("--check", action="store_true")
3695
parser.add_argument("--prefix", )
3696
args, unknown_args = parser.parse_known_args()
3698
# Remove test options from sys.argv
3699
sys.argv[1:] = unknown_args
3702
# Add all tests from doctest strings
3703
def load_tests(loader, tests, none):
3705
tests.addTests(doctest.DocTestSuite())
3708
if __name__ == "__main__":
3709
options = parse_test_args()
3712
extra_test_prefix = options.prefix
3713
if extra_test_prefix is not None:
3714
if not (unittest.main(argv=[""], exit=False)
3715
.result.wasSuccessful()):
3717
class ExtraTestLoader(unittest.TestLoader):
3718
testMethodPrefix = extra_test_prefix
3719
# Call using ./scriptname --test [--verbose]
3720
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3722
unittest.main(argv=[""])
3730
# (lambda (&optional extra)
3731
# (if (not (funcall run-tests-in-test-buffer default-directory
3733
# (funcall show-test-buffer-in-test-window)
3734
# (funcall remove-test-window)
3735
# (if extra (message "Extra tests run successfully!"))))
3736
# run-tests-in-test-buffer:
3737
# (lambda (dir &optional extra)
3738
# (with-current-buffer (get-buffer-create "*Test*")
3739
# (setq buffer-read-only nil
3740
# default-directory dir)
3742
# (compilation-mode))
3743
# (let ((process-result
3744
# (let ((inhibit-read-only t))
3745
# (process-file-shell-command
3746
# (funcall get-command-line extra) nil "*Test*"))))
3747
# (and (numberp process-result)
3748
# (= process-result 0))))
3750
# (lambda (&optional extra)
3751
# (let ((quoted-script
3752
# (shell-quote-argument (funcall get-script-name))))
3754
# (concat "%s --check" (if extra " --prefix=atest" ""))
3758
# (if (fboundp 'file-local-name)
3759
# (file-local-name (buffer-file-name))
3760
# (or (file-remote-p (buffer-file-name) 'localname)
3761
# (buffer-file-name))))
3762
# remove-test-window:
3764
# (let ((test-window (get-buffer-window "*Test*")))
3765
# (if test-window (delete-window test-window))))
3766
# show-test-buffer-in-test-window:
3768
# (when (not (get-buffer-window-list "*Test*"))
3769
# (setq next-error-last-buffer (get-buffer "*Test*"))
3770
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3771
# (display-buffer-overriding-action
3772
# `((display-buffer-in-side-window) (side . ,side)
3773
# (window-height . fit-window-to-buffer)
3774
# (window-width . fit-window-to-buffer))))
3775
# (display-buffer "*Test*"))))
3778
# (let* ((run-extra-tests (lambda () (interactive)
3779
# (funcall run-tests t)))
3780
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3781
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3782
# (setq minor-mode-overriding-map-alist
3783
# (cons `(run-tests . ,outer-keymap)
3784
# minor-mode-overriding-map-alist)))
3785
# (add-hook 'after-save-hook run-tests 90 t))