101
88
except ImportError:
102
89
SO_BINDTODEVICE = None
104
if sys.version_info.major == 2:
108
92
stored_state_file = "clients.pickle"
110
94
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
116
103
except (OSError, AttributeError):
118
104
def if_nametoindex(interface):
119
105
"Get an interface index the hard way, i.e. using fcntl()"
120
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
107
with contextlib.closing(socket.socket()) as s:
122
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
125
113
return interface_index
128
116
def initlogger(debug, level=logging.WARNING):
129
117
"""init logger and add loglevel"""
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
119
syslogger.setFormatter(logging.Formatter
136
120
('Mandos [%(process)d]: %(levelname)s:'
189
174
def password_encode(self, password):
190
175
# Passphrase can not be empty and can not contain newlines or
191
176
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
177
return b"mandos" + binascii.hexlify(password)
200
179
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
216
194
return ciphertext
218
196
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
234
211
return decrypted_plaintext
237
214
class AvahiError(Exception):
238
215
def __init__(self, value, *args, **kwargs):
239
216
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
244
221
class AvahiServiceError(AvahiError):
248
224
class AvahiGroupError(AvahiError):
297
266
self.entry_group_state_changed_match = None
299
def rename(self, remove=True):
300
269
"""Derived from the Avahi example code"""
301
270
if self.rename_count >= self.max_renames:
302
271
logger.critical("No suitable Zeroconf service name found"
303
272
" after %i retries, exiting.",
304
273
self.rename_count)
305
274
raise AvahiServiceError("Too many renames")
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
309
277
logger.info("Changing Zeroconf service name to %r ...",
315
282
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
321
logger.critical("D-Bus Exception", exc_info=error)
283
logger.critical("D-Bus Exception", exc_info=error)
286
self.rename_count += 1
325
288
def remove(self):
326
289
"""Derived from the Avahi example code"""
381
345
def server_state_changed(self, state, error=None):
382
346
"""Derived from the Avahi example code"""
383
347
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
390
355
if state in bad_states:
391
356
if bad_states[state] is not None:
392
357
if error is None:
422
376
follow_name_owner_changes=True),
423
377
avahi.DBUS_INTERFACE_SERVER)
424
378
self.server.connect_to_signal("StateChanged",
425
self.server_state_changed)
379
self.server_state_changed)
426
380
self.server_state_changed(self.server.GetState())
429
383
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
385
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
445
connection.send(func(*args, **kwargs))
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
448
401
class Client(object):
449
402
"""A representation of a client host served by this server.
496
446
"fingerprint", "host", "interval",
497
447
"last_approval_request", "last_checked_ok",
498
448
"last_enabled", "name", "timeout")
501
"extended_timeout": "PT15M",
503
"checker": "fping -q -- %%(host)s",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
460
def timeout_milliseconds(self):
461
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
468
def interval_milliseconds(self):
469
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
512
476
def config_parser(config):
590
551
self.current_checker_command = None
591
552
self.approved = None
592
553
self.approvals_pending = 0
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
597
559
if not attr.startswith("_")]
598
560
self.client_structure.append("client_structure")
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
562
for name, t in inspect.getmembers(type(self),
602
566
if not name.startswith("_"):
603
567
self.client_structure.append(name)
646
610
# and every interval from then on.
647
611
if self.checker_initiator_tag is not None:
648
612
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
613
self.checker_initiator_tag = (gobject.timeout_add
614
(self.interval_milliseconds(),
652
616
# Schedule a disable() when 'timeout' has passed
653
617
if self.disable_initiator_tag is not None:
654
618
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
619
self.disable_initiator_tag = (gobject.timeout_add
620
(self.timeout_milliseconds(),
657
622
# Also start a new checker *right now*.
658
623
self.start_checker()
660
def checker_callback(self, source, condition, connection,
625
def checker_callback(self, pid, condition, command):
662
626
"""The checker has completed, so take appropriate actions."""
663
627
self.checker_callback_tag = None
664
628
self.checker = None
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
672
631
if self.last_checker_status == 0:
673
632
logger.info("Checker for %(name)s succeeded",
675
634
self.checked_ok()
677
logger.info("Checker for %(name)s failed", vars(self))
636
logger.info("Checker for %(name)s failed",
679
639
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
681
640
logger.warning("Checker for %(name)s crashed?",
685
643
def checked_ok(self):
686
644
"""Assert that the client has been seen, alive and well."""
687
645
self.last_checked_ok = datetime.datetime.utcnow()
688
646
self.last_checker_status = 0
689
self.last_checker_signal = None
690
647
self.bump_timeout()
692
649
def bump_timeout(self, timeout=None):
718
676
# than 'timeout' for the client to be disabled, which is as it
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
679
# If a checker exists, make sure it is not a zombie
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except (AttributeError, OSError) as error:
683
if (isinstance(error, OSError)
684
and error.errno != errno.ECHILD):
688
logger.warning("Checker was a zombie")
689
gobject.source_remove(self.checker_callback_tag)
690
self.checker_callback(pid, status,
691
self.current_checker_command)
725
692
# Start a new checker if needed
726
693
if self.checker is None:
727
694
# Escape attributes for the shell
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
695
escaped_attrs = dict(
696
(attr, re.escape(unicode(getattr(self, attr))))
698
self.runtime_expansions)
732
700
command = self.checker_command % escaped_attrs
733
701
except TypeError as error:
734
702
logger.error('Could not format string "%s"',
735
self.checker_command,
703
self.checker_command, exc_info=error)
704
return True # Try again later
705
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
self.checker = subprocess.Popen(command,
716
except OSError as error:
717
logger.error("Failed to start subprocess",
737
return True # Try again later
738
self.current_checker_command = command
739
logger.info("Starting checker %r for %s", command,
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
748
popen_args = { "close_fds": True,
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
758
args = (pipe[1], subprocess.call, command),
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
719
self.checker_callback_tag = (gobject.child_watch_add
721
self.checker_callback,
723
# The checker may have completed before the gobject
724
# watch was added. Check for this.
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
727
gobject.source_remove(self.checker_callback_tag)
728
self.checker_callback(pid, status, command)
764
729
# Re-run this periodically if run by gobject.timeout_add
835
801
"""Decorator to annotate D-Bus methods, signals or properties
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
804
@dbus_service_property("org.example.Interface", signature="b",
806
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
"org.freedesktop.DBus.Property."
808
"EmitsChangedSignal": "false"})
843
809
def Property_dbus_property(self):
844
810
return dbus.Boolean(False)
846
See also the DBusObjectWithAnnotations class.
849
812
def decorator(func):
850
813
func._dbus_annotations = annotations
856
818
class DBusPropertyException(dbus.exceptions.DBusException):
857
819
"""A base class for D-Bus property-related exceptions
821
def __unicode__(self):
822
return unicode(str(self))
862
825
class DBusPropertyAccessException(DBusPropertyException):
885
849
If called like _is_dbus_thing("method") it returns a function
886
850
suitable for use as predicate to inspect.getmembers().
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
891
855
def _get_all_dbus_things(self, thing):
892
856
"""Returns a generator of (name, attribute) pairs
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
858
return ((getattr(athing.__get__(self), "_dbus_name",
895
860
athing.__get__(self))
896
861
for cls in self.__class__.__mro__
897
862
for name, athing in
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
900
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
902
path_keyword = 'object_path',
903
connection_keyword = 'connection')
904
def Introspect(self, object_path, connection):
905
"""Overloading of standard D-Bus method.
907
Inserts annotation tags on methods and signals.
909
xmlstring = dbus.service.Object.Introspect(self, object_path,
912
document = xml.dom.minidom.parseString(xmlstring)
914
for if_tag in document.getElementsByTagName("interface"):
915
# Add annotation tags
916
for typ in ("method", "signal"):
917
for tag in if_tag.getElementsByTagName(typ):
919
for name, prop in (self.
920
_get_all_dbus_things(typ)):
921
if (name == tag.getAttribute("name")
922
and prop._dbus_interface
923
== if_tag.getAttribute("name")):
924
annots.update(getattr(
925
prop, "_dbus_annotations", {}))
926
for name, value in annots.items():
927
ann_tag = document.createElement(
929
ann_tag.setAttribute("name", name)
930
ann_tag.setAttribute("value", value)
931
tag.appendChild(ann_tag)
932
# Add interface annotation tags
933
for annotation, value in dict(
934
itertools.chain.from_iterable(
935
annotations().items()
936
for name, annotations
937
in self._get_all_dbus_things("interface")
938
if name == if_tag.getAttribute("name")
940
ann_tag = document.createElement("annotation")
941
ann_tag.setAttribute("name", annotation)
942
ann_tag.setAttribute("value", value)
943
if_tag.appendChild(ann_tag)
944
# Fix argument name for the Introspect method itself
945
if (if_tag.getAttribute("name")
946
== dbus.INTROSPECTABLE_IFACE):
947
for cn in if_tag.getElementsByTagName("method"):
948
if cn.getAttribute("name") == "Introspect":
949
for arg in cn.getElementsByTagName("arg"):
950
if (arg.getAttribute("direction")
952
arg.setAttribute("name",
954
xmlstring = document.toxml("utf-8")
956
except (AttributeError, xml.dom.DOMException,
957
xml.parsers.expat.ExpatError) as error:
958
logger.error("Failed to override Introspection method",
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
964
"""A D-Bus object with properties.
966
Classes inheriting from this can use the dbus_service_property
967
decorator to expose methods as D-Bus properties. It exposes the
968
standard Get(), Set(), and GetAll() methods on the D-Bus.
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
971
866
def _get_dbus_property(self, interface_name, property_name):
972
867
"""Returns a bound method if one exists which is a D-Bus
973
868
property with the specified name and interface.
975
for cls in self.__class__.__mro__:
976
for name, value in inspect.getmembers(
977
cls, self._is_dbus_thing("property")):
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
978
874
if (value._dbus_name == property_name
979
875
and value._dbus_interface == interface_name):
980
876
return value.__get__(self)
982
878
# No such property
983
raise DBusPropertyNotFound("{}:{}.{}".format(
984
self.dbus_object_path, interface_name, property_name))
987
def _get_all_interface_names(cls):
988
"""Get a sequence of all interfaces supported by an object"""
989
return (name for name in set(getattr(getattr(x, attr),
990
"_dbus_interface", None)
991
for x in (inspect.getmro(cls))
995
@dbus.service.method(dbus.PROPERTIES_IFACE,
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
997
884
out_signature="v")
998
885
def Get(self, interface_name, property_name):
999
886
"""Standard D-Bus property Get() method, see D-Bus standard.
1088
961
if prop._dbus_interface
1089
962
== if_tag.getAttribute("name")):
1090
963
if_tag.appendChild(tag)
1091
# Add annotation tags for properties
1092
for tag in if_tag.getElementsByTagName("property"):
1094
for name, prop in self._get_all_dbus_things(
1096
if (name == tag.getAttribute("name")
1097
and prop._dbus_interface
1098
== if_tag.getAttribute("name")):
1099
annots.update(getattr(
1100
prop, "_dbus_annotations", {}))
1101
for name, value in annots.items():
1102
ann_tag = document.createElement(
1104
ann_tag.setAttribute("name", name)
1105
ann_tag.setAttribute("value", value)
1106
tag.appendChild(ann_tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
1107
995
# Add the names to the return values for the
1108
996
# "org.freedesktop.DBus.Properties" methods
1109
997
if (if_tag.getAttribute("name")
1127
1015
exc_info=error)
1128
1016
return xmlstring
1131
dbus.OBJECT_MANAGER_IFACE
1132
except AttributeError:
1133
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1135
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1136
"""A D-Bus object with an ObjectManager.
1138
Classes inheriting from this exposes the standard
1139
GetManagedObjects call and the InterfacesAdded and
1140
InterfacesRemoved signals on the standard
1141
"org.freedesktop.DBus.ObjectManager" interface.
1143
Note: No signals are sent automatically; they must be sent
1146
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1147
out_signature = "a{oa{sa{sv}}}")
1148
def GetManagedObjects(self):
1149
"""This function must be overridden"""
1150
raise NotImplementedError()
1152
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1153
signature = "oa{sa{sv}}")
1154
def InterfacesAdded(self, object_path, interfaces_and_properties):
1157
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1158
def InterfacesRemoved(self, object_path, interfaces):
1161
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1162
out_signature = "s",
1163
path_keyword = 'object_path',
1164
connection_keyword = 'connection')
1165
def Introspect(self, object_path, connection):
1166
"""Overloading of standard D-Bus method.
1168
Override return argument name of GetManagedObjects to be
1169
"objpath_interfaces_and_properties"
1171
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1175
document = xml.dom.minidom.parseString(xmlstring)
1177
for if_tag in document.getElementsByTagName("interface"):
1178
# Fix argument name for the GetManagedObjects method
1179
if (if_tag.getAttribute("name")
1180
== dbus.OBJECT_MANAGER_IFACE):
1181
for cn in if_tag.getElementsByTagName("method"):
1182
if (cn.getAttribute("name")
1183
== "GetManagedObjects"):
1184
for arg in cn.getElementsByTagName("arg"):
1185
if (arg.getAttribute("direction")
1189
"objpath_interfaces"
1191
xmlstring = document.toxml("utf-8")
1193
except (AttributeError, xml.dom.DOMException,
1194
xml.parsers.expat.ExpatError) as error:
1195
logger.error("Failed to override Introspection method",
1199
1019
def datetime_to_dbus(dt, variant_level=0):
1200
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1202
1022
return dbus.String("", variant_level = variant_level)
1203
return dbus.String(dt.isoformat(), variant_level=variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1206
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1237
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1238
1058
# with the wrong interface name
1239
1059
if (not hasattr(attribute, "_dbus_interface")
1240
or not attribute._dbus_interface.startswith(
1241
orig_interface_name)):
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1243
1063
# Create an alternate D-Bus interface name based on
1244
1064
# the current name
1245
alt_interface = attribute._dbus_interface.replace(
1246
orig_interface_name, alt_interface_name)
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1247
1068
interface_names.add(alt_interface)
1248
1069
# Is this a D-Bus signal?
1249
1070
if getattr(attribute, "_dbus_is_signal", False):
1250
if sys.version_info.major == 2:
1251
# Extract the original non-method undecorated
1252
# function by black magic
1253
nonmethod_func = (dict(
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1254
1074
zip(attribute.func_code.co_freevars,
1255
attribute.__closure__))
1256
["func"].cell_contents)
1258
nonmethod_func = attribute
1075
attribute.__closure__))["func"]
1259
1077
# Create a new, but exactly alike, function
1260
1078
# object, and decorate it to be a new D-Bus signal
1261
1079
# with the alternate D-Bus interface name
1262
if sys.version_info.major == 2:
1263
new_function = types.FunctionType(
1264
nonmethod_func.func_code,
1265
nonmethod_func.func_globals,
1266
nonmethod_func.func_name,
1267
nonmethod_func.func_defaults,
1268
nonmethod_func.func_closure)
1270
new_function = types.FunctionType(
1271
nonmethod_func.__code__,
1272
nonmethod_func.__globals__,
1273
nonmethod_func.__name__,
1274
nonmethod_func.__defaults__,
1275
nonmethod_func.__closure__)
1276
new_function = (dbus.service.signal(
1278
attribute._dbus_signature)(new_function))
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1279
1089
# Copy annotations, if any
1281
new_function._dbus_annotations = dict(
1282
attribute._dbus_annotations)
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1283
1093
except AttributeError:
1285
1095
# Define a creator of a function to call both the
1312
1115
# object. Decorate it to be a new D-Bus method
1313
1116
# with the alternate D-Bus interface name. Add it
1314
1117
# to the class.
1316
dbus.service.method(
1318
attribute._dbus_in_signature,
1319
attribute._dbus_out_signature)
1320
(types.FunctionType(attribute.func_code,
1321
attribute.func_globals,
1322
attribute.func_name,
1323
attribute.func_defaults,
1324
attribute.func_closure)))
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1325
1128
# Copy annotations, if any
1327
attr[attrname]._dbus_annotations = dict(
1328
attribute._dbus_annotations)
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1329
1132
except AttributeError:
1331
1134
# Is this a D-Bus property?
1334
1137
# object, and decorate it to be a new D-Bus
1335
1138
# property with the alternate D-Bus interface
1336
1139
# name. Add it to the class.
1337
attr[attrname] = (dbus_service_property(
1338
alt_interface, attribute._dbus_signature,
1339
attribute._dbus_access,
1340
attribute._dbus_get_args_options
1342
(types.FunctionType(
1343
attribute.func_code,
1344
attribute.func_globals,
1345
attribute.func_name,
1346
attribute.func_defaults,
1347
attribute.func_closure)))
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1348
1153
# Copy annotations, if any
1350
attr[attrname]._dbus_annotations = dict(
1351
attribute._dbus_annotations)
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1352
1157
except AttributeError:
1354
1159
# Is this a D-Bus interface?
1411
1213
Client.__init__(self, *args, **kwargs)
1412
1214
# Only now, when this client is initialized, can it show up on
1414
client_object_name = str(self.name).translate(
1216
client_object_name = unicode(self.name).translate(
1415
1217
{ord("."): ord("_"),
1416
1218
ord("-"): ord("_")})
1417
self.dbus_object_path = dbus.ObjectPath(
1418
"/clients/" + client_object_name)
1219
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
1419
1221
DBusObjectWithProperties.__init__(self, self.bus,
1420
1222
self.dbus_object_path)
1422
def notifychangeproperty(transform_func, dbus_name,
1423
type_func=lambda x: x,
1425
invalidate_only=False,
1426
_interface=_interface):
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1427
1227
""" Modify a variable so that it's a property which announces
1428
1228
its changes to DBus.
1434
1234
to the D-Bus. Default: no transform
1435
1235
variant_level: D-Bus variant level. Default: 1
1437
attrname = "_{}".format(dbus_name)
1237
attrname = "_{0}".format(dbus_name)
1439
1238
def setter(self, value):
1440
1239
if hasattr(self, "dbus_object_path"):
1441
1240
if (not hasattr(self, attrname) or
1442
1241
type_func(getattr(self, attrname, None))
1443
1242
!= type_func(value)):
1445
self.PropertiesChanged(
1446
_interface, dbus.Dictionary(),
1447
dbus.Array((dbus_name, )))
1449
dbus_value = transform_func(
1451
variant_level = variant_level)
1452
self.PropertyChanged(dbus.String(dbus_name),
1454
self.PropertiesChanged(
1456
dbus.Dictionary({ dbus.String(dbus_name):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1459
1248
setattr(self, attrname, value)
1461
1250
return property(lambda self: getattr(self, attrname), setter)
1478
1267
datetime_to_dbus, "LastApprovalRequest")
1479
1268
approved_by_default = notifychangeproperty(dbus.Boolean,
1480
1269
"ApprovedByDefault")
1481
approval_delay = notifychangeproperty(
1482
dbus.UInt64, "ApprovalDelay",
1483
type_func = lambda td: td.total_seconds() * 1000)
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1484
1274
approval_duration = notifychangeproperty(
1485
1275
dbus.UInt64, "ApprovalDuration",
1486
type_func = lambda td: td.total_seconds() * 1000)
1276
type_func = timedelta_to_milliseconds)
1487
1277
host = notifychangeproperty(dbus.String, "Host")
1488
timeout = notifychangeproperty(
1489
dbus.UInt64, "Timeout",
1490
type_func = lambda td: td.total_seconds() * 1000)
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1491
1281
extended_timeout = notifychangeproperty(
1492
1282
dbus.UInt64, "ExtendedTimeout",
1493
type_func = lambda td: td.total_seconds() * 1000)
1494
interval = notifychangeproperty(
1495
dbus.UInt64, "Interval",
1496
type_func = lambda td: td.total_seconds() * 1000)
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1497
1288
checker_command = notifychangeproperty(dbus.String, "Checker")
1498
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1499
invalidate_only=True)
1501
1290
del notifychangeproperty
1509
1298
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1510
1299
Client.__del__(self, *args, **kwargs)
1512
def checker_callback(self, source, condition,
1513
connection, command, *args, **kwargs):
1514
ret = Client.checker_callback(self, source, condition,
1515
connection, command, *args,
1517
exitstatus = self.last_checker_status
1301
def checker_callback(self, pid, condition, command,
1303
self.checker_callback_tag = None
1305
if os.WIFEXITED(condition):
1306
exitstatus = os.WEXITSTATUS(condition)
1519
1307
# Emit D-Bus signal
1520
1308
self.CheckerCompleted(dbus.Int16(exitstatus),
1521
# This is specific to GNU libC
1522
dbus.Int64(exitstatus << 8),
1309
dbus.Int64(condition),
1523
1310
dbus.String(command))
1525
1312
# Emit D-Bus signal
1526
1313
self.CheckerCompleted(dbus.Int16(-1),
1528
# This is specific to GNU libC
1530
| self.last_checker_signal),
1314
dbus.Int64(condition),
1531
1315
dbus.String(command))
1317
return Client.checker_callback(self, pid, condition, command,
1534
1320
def start_checker(self, *args, **kwargs):
1535
old_checker_pid = getattr(self.checker, "pid", None)
1321
old_checker = self.checker
1322
if self.checker is not None:
1323
old_checker_pid = self.checker.pid
1325
old_checker_pid = None
1536
1326
r = Client.start_checker(self, *args, **kwargs)
1537
1327
# Only if new checker process was started
1538
1328
if (self.checker is not None
1653
1444
self.approved_by_default = bool(value)
1655
1446
# ApprovalDelay - property
1656
@dbus_service_property(_interface,
1447
@dbus_service_property(_interface, signature="t",
1658
1448
access="readwrite")
1659
1449
def ApprovalDelay_dbus_property(self, value=None):
1660
1450
if value is None: # get
1661
return dbus.UInt64(self.approval_delay.total_seconds()
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1663
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1665
1454
# ApprovalDuration - property
1666
@dbus_service_property(_interface,
1455
@dbus_service_property(_interface, signature="t",
1668
1456
access="readwrite")
1669
1457
def ApprovalDuration_dbus_property(self, value=None):
1670
1458
if value is None: # get
1671
return dbus.UInt64(self.approval_duration.total_seconds()
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1673
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1675
1463
# Name - property
1677
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1678
1464
@dbus_service_property(_interface, signature="s", access="read")
1679
1465
def Name_dbus_property(self):
1680
1466
return dbus.String(self.name)
1682
1468
# Fingerprint - property
1684
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1685
1469
@dbus_service_property(_interface, signature="s", access="read")
1686
1470
def Fingerprint_dbus_property(self):
1687
1471
return dbus.String(self.fingerprint)
1689
1473
# Host - property
1690
@dbus_service_property(_interface,
1474
@dbus_service_property(_interface, signature="s",
1692
1475
access="readwrite")
1693
1476
def Host_dbus_property(self, value=None):
1694
1477
if value is None: # get
1695
1478
return dbus.String(self.host)
1696
self.host = str(value)
1479
self.host = unicode(value)
1698
1481
# Created - property
1700
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1701
1482
@dbus_service_property(_interface, signature="s", access="read")
1702
1483
def Created_dbus_property(self):
1703
1484
return datetime_to_dbus(self.created)
1767
1546
gobject.source_remove(self.disable_initiator_tag)
1768
self.disable_initiator_tag = gobject.timeout_add(
1769
int((self.expires - now).total_seconds() * 1000),
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1772
1552
# ExtendedTimeout - property
1773
@dbus_service_property(_interface,
1553
@dbus_service_property(_interface, signature="t",
1775
1554
access="readwrite")
1776
1555
def ExtendedTimeout_dbus_property(self, value=None):
1777
1556
if value is None: # get
1778
return dbus.UInt64(self.extended_timeout.total_seconds()
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1780
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1782
1560
# Interval - property
1783
@dbus_service_property(_interface,
1561
@dbus_service_property(_interface, signature="t",
1785
1562
access="readwrite")
1786
1563
def Interval_dbus_property(self, value=None):
1787
1564
if value is None: # get
1788
return dbus.UInt64(self.interval.total_seconds() * 1000)
1565
return dbus.UInt64(self.interval_milliseconds())
1789
1566
self.interval = datetime.timedelta(0, 0, 0, value)
1790
1567
if getattr(self, "checker_initiator_tag", None) is None:
1792
1569
if self.enabled:
1793
1570
# Reschedule checker run
1794
1571
gobject.source_remove(self.checker_initiator_tag)
1795
self.checker_initiator_tag = gobject.timeout_add(
1796
value, self.start_checker)
1797
self.start_checker() # Start one now, too
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1799
1576
# Checker - property
1800
@dbus_service_property(_interface,
1577
@dbus_service_property(_interface, signature="s",
1802
1578
access="readwrite")
1803
1579
def Checker_dbus_property(self, value=None):
1804
1580
if value is None: # get
1805
1581
return dbus.String(self.checker_command)
1806
self.checker_command = str(value)
1582
self.checker_command = unicode(value)
1808
1584
# CheckerRunning - property
1809
@dbus_service_property(_interface,
1585
@dbus_service_property(_interface, signature="b",
1811
1586
access="readwrite")
1812
1587
def CheckerRunning_dbus_property(self, value=None):
1813
1588
if value is None: # get
2044
1814
def fingerprint(openpgp):
2045
1815
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2046
1816
# New GnuTLS "datum" with the OpenPGP public key
2047
datum = gnutls.library.types.gnutls_datum_t(
2048
ctypes.cast(ctypes.c_char_p(openpgp),
2049
ctypes.POINTER(ctypes.c_ubyte)),
2050
ctypes.c_uint(len(openpgp)))
1817
datum = (gnutls.library.types
1818
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1821
ctypes.c_uint(len(openpgp))))
2051
1822
# New empty GnuTLS certificate
2052
1823
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2053
gnutls.library.functions.gnutls_openpgp_crt_init(
1824
(gnutls.library.functions
1825
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2055
1826
# Import the OpenPGP public key into the certificate
2056
gnutls.library.functions.gnutls_openpgp_crt_import(
2057
crt, ctypes.byref(datum),
2058
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1827
(gnutls.library.functions
1828
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
gnutls.library.constants
1830
.GNUTLS_OPENPGP_FMT_RAW))
2059
1831
# Verify the self signature in the key
2060
1832
crtverify = ctypes.c_uint()
2061
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2062
crt, 0, ctypes.byref(crtverify))
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_verify_self(crt, 0,
1835
ctypes.byref(crtverify)))
2063
1836
if crtverify.value != 0:
2064
1837
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2065
raise gnutls.errors.CertificateSecurityError(
1838
raise (gnutls.errors.CertificateSecurityError
2067
1840
# New buffer for the fingerprint
2068
1841
buf = ctypes.create_string_buffer(20)
2069
1842
buf_len = ctypes.c_size_t()
2070
1843
# Get the fingerprint from the certificate into the buffer
2071
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2072
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1844
(gnutls.library.functions
1845
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
ctypes.byref(buf_len)))
2073
1847
# Deinit the certificate
2074
1848
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2075
1849
# Convert the buffer to a Python bytestring
2253
2017
def add_pipe(self, parent_pipe, proc):
2254
2018
# Call "handle_ipc" for both data and EOF events
2255
gobject.io_add_watch(
2256
parent_pipe.fileno(),
2257
gobject.IO_IN | gobject.IO_HUP,
2258
functools.partial(self.handle_ipc,
2259
parent_pipe = parent_pipe,
2019
gobject.io_add_watch(parent_pipe.fileno(),
2020
gobject.IO_IN | gobject.IO_HUP,
2021
functools.partial(self.handle_ipc,
2262
def handle_ipc(self, source, condition,
2265
client_object=None):
2026
def handle_ipc(self, source, condition, parent_pipe=None,
2027
proc = None, client_object=None):
2266
2028
# error, or the other end of multiprocessing.Pipe has closed
2267
2029
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2268
2030
# Wait for other process to exit
2331
def rfc3339_duration_to_delta(duration):
2332
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2334
>>> rfc3339_duration_to_delta("P7D")
2335
datetime.timedelta(7)
2336
>>> rfc3339_duration_to_delta("PT60S")
2337
datetime.timedelta(0, 60)
2338
>>> rfc3339_duration_to_delta("PT60M")
2339
datetime.timedelta(0, 3600)
2340
>>> rfc3339_duration_to_delta("PT24H")
2341
datetime.timedelta(1)
2342
>>> rfc3339_duration_to_delta("P1W")
2343
datetime.timedelta(7)
2344
>>> rfc3339_duration_to_delta("PT5M30S")
2345
datetime.timedelta(0, 330)
2346
>>> rfc3339_duration_to_delta("P1DT3M20S")
2347
datetime.timedelta(1, 200)
2350
# Parsing an RFC 3339 duration with regular expressions is not
2351
# possible - there would have to be multiple places for the same
2352
# values, like seconds. The current code, while more esoteric, is
2353
# cleaner without depending on a parsing library. If Python had a
2354
# built-in library for parsing we would use it, but we'd like to
2355
# avoid excessive use of external libraries.
2357
# New type for defining tokens, syntax, and semantics all-in-one
2358
Token = collections.namedtuple("Token", (
2359
"regexp", # To match token; if "value" is not None, must have
2360
# a "group" containing digits
2361
"value", # datetime.timedelta or None
2362
"followers")) # Tokens valid after this token
2363
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2364
# the "duration" ABNF definition in RFC 3339, Appendix A.
2365
token_end = Token(re.compile(r"$"), None, frozenset())
2366
token_second = Token(re.compile(r"(\d+)S"),
2367
datetime.timedelta(seconds=1),
2368
frozenset((token_end, )))
2369
token_minute = Token(re.compile(r"(\d+)M"),
2370
datetime.timedelta(minutes=1),
2371
frozenset((token_second, token_end)))
2372
token_hour = Token(re.compile(r"(\d+)H"),
2373
datetime.timedelta(hours=1),
2374
frozenset((token_minute, token_end)))
2375
token_time = Token(re.compile(r"T"),
2377
frozenset((token_hour, token_minute,
2379
token_day = Token(re.compile(r"(\d+)D"),
2380
datetime.timedelta(days=1),
2381
frozenset((token_time, token_end)))
2382
token_month = Token(re.compile(r"(\d+)M"),
2383
datetime.timedelta(weeks=4),
2384
frozenset((token_day, token_end)))
2385
token_year = Token(re.compile(r"(\d+)Y"),
2386
datetime.timedelta(weeks=52),
2387
frozenset((token_month, token_end)))
2388
token_week = Token(re.compile(r"(\d+)W"),
2389
datetime.timedelta(weeks=1),
2390
frozenset((token_end, )))
2391
token_duration = Token(re.compile(r"P"), None,
2392
frozenset((token_year, token_month,
2393
token_day, token_time,
2395
# Define starting values
2396
value = datetime.timedelta() # Value so far
2398
followers = frozenset((token_duration, )) # Following valid tokens
2399
s = duration # String left to parse
2400
# Loop until end token is found
2401
while found_token is not token_end:
2402
# Search for any currently valid tokens
2403
for token in followers:
2404
match = token.regexp.match(s)
2405
if match is not None:
2407
if token.value is not None:
2408
# Value found, parse digits
2409
factor = int(match.group(1), 10)
2410
# Add to value so far
2411
value += factor * token.value
2412
# Strip token from string
2413
s = token.regexp.sub("", s, 1)
2416
# Set valid next tokens
2417
followers = found_token.followers
2420
# No currently valid tokens were found
2421
raise ValueError("Invalid RFC 3339 duration: {!r}"
2427
2093
def string_to_delta(interval):
2428
2094
"""Parse a string and return a datetime.timedelta
2527
2188
parser.add_argument("--no-dbus", action="store_false",
2528
2189
dest="use_dbus", help="Do not provide D-Bus"
2529
" system bus interface", default=None)
2190
" system bus interface")
2530
2191
parser.add_argument("--no-ipv6", action="store_false",
2531
dest="use_ipv6", help="Do not use IPv6",
2192
dest="use_ipv6", help="Do not use IPv6")
2533
2193
parser.add_argument("--no-restore", action="store_false",
2534
2194
dest="restore", help="Do not restore stored"
2535
" state", default=None)
2536
2196
parser.add_argument("--socket", type=int,
2537
2197
help="Specify a file descriptor to a network"
2538
2198
" socket to use instead of creating one")
2539
2199
parser.add_argument("--statedir", metavar="DIR",
2540
2200
help="Directory to save/restore state in")
2541
2201
parser.add_argument("--foreground", action="store_true",
2542
help="Run in foreground", default=None)
2543
parser.add_argument("--no-zeroconf", action="store_false",
2544
dest="zeroconf", help="Do not use Zeroconf",
2202
help="Run in foreground")
2547
2204
options = parser.parse_args()
2549
2206
if options.check:
2551
fail_count, test_count = doctest.testmod()
2552
sys.exit(os.EX_OK if fail_count == 0 else 1)
2554
2211
# Default values for config file for server-global settings
2555
2212
server_defaults = { "interface": "",
2597
2253
# Override the settings from the config file with command line
2598
2254
# options, if set.
2599
2255
for option in ("interface", "address", "port", "debug",
2600
"priority", "servicename", "configdir", "use_dbus",
2601
"use_ipv6", "debuglevel", "restore", "statedir",
2602
"socket", "foreground", "zeroconf"):
2256
"priority", "servicename", "configdir",
2257
"use_dbus", "use_ipv6", "debuglevel", "restore",
2258
"statedir", "socket", "foreground"):
2603
2259
value = getattr(options, option)
2604
2260
if value is not None:
2605
2261
server_settings[option] = value
2607
2263
# Force all strings to be unicode
2608
2264
for option in server_settings.keys():
2609
if isinstance(server_settings[option], bytes):
2610
server_settings[option] = (server_settings[option]
2612
# Force all boolean options to be boolean
2613
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2614
"foreground", "zeroconf"):
2615
server_settings[option] = bool(server_settings[option])
2265
if type(server_settings[option]) is str:
2266
server_settings[option] = unicode(server_settings[option])
2616
2267
# Debug implies foreground
2617
2268
if server_settings["debug"]:
2618
2269
server_settings["foreground"] = True
2659
2305
global mandos_dbus_service
2660
2306
mandos_dbus_service = None
2663
if server_settings["socket"] != "":
2664
socketfd = server_settings["socket"]
2665
tcp_server = MandosServer(
2666
(server_settings["address"], server_settings["port"]),
2668
interface=(server_settings["interface"] or None),
2670
gnutls_priority=server_settings["priority"],
2308
tcp_server = MandosServer((server_settings["address"],
2309
server_settings["port"]),
2311
interface=(server_settings["interface"]
2315
server_settings["priority"],
2317
socketfd=(server_settings["socket"]
2673
2319
if not foreground:
2674
pidfilename = "/run/mandos.pid"
2675
if not os.path.isdir("/run/."):
2676
pidfilename = "/var/run/mandos.pid"
2320
pidfilename = "/var/run/mandos.pid"
2679
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2323
pidfile = open(pidfilename, "w")
2680
2324
except IOError as e:
2681
2325
logger.error("Could not open file %r", pidfilename,
2738
2382
bus_name = dbus.service.BusName("se.recompile.Mandos",
2741
old_bus_name = dbus.service.BusName(
2742
"se.bsnet.fukt.Mandos", bus,
2744
except dbus.exceptions.DBusException as e:
2383
bus, do_not_queue=True)
2384
old_bus_name = (dbus.service.BusName
2385
("se.bsnet.fukt.Mandos", bus,
2387
except dbus.exceptions.NameExistsException as e:
2745
2388
logger.error("Disabling D-Bus:", exc_info=e)
2746
2389
use_dbus = False
2747
2390
server_settings["use_dbus"] = False
2748
2391
tcp_server.use_dbus = False
2750
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2751
service = AvahiServiceToSyslog(
2752
name = server_settings["servicename"],
2753
servicetype = "_mandos._tcp",
2754
protocol = protocol,
2756
if server_settings["interface"]:
2757
service.interface = if_nametoindex(
2758
server_settings["interface"].encode("utf-8"))
2392
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2393
service = AvahiServiceToSyslog(name =
2394
server_settings["servicename"],
2395
servicetype = "_mandos._tcp",
2396
protocol = protocol, bus = bus)
2397
if server_settings["interface"]:
2398
service.interface = (if_nametoindex
2399
(str(server_settings["interface"])))
2760
2401
global multiprocessing_manager
2761
2402
multiprocessing_manager = multiprocessing.Manager()
2768
2409
old_client_settings = {}
2769
2410
clients_data = {}
2771
# This is used to redirect stdout and stderr for checker processes
2773
wnull = open(os.devnull, "w") # A writable /dev/null
2774
# Only used if server is running in foreground but not in debug
2776
if debug or not foreground:
2779
2412
# Get client data and settings from last running state.
2780
2413
if server_settings["restore"]:
2782
2415
with open(stored_state_path, "rb") as stored_state:
2783
clients_data, old_client_settings = pickle.load(
2416
clients_data, old_client_settings = (pickle.load
2785
2418
os.remove(stored_state_path)
2786
2419
except IOError as e:
2787
2420
if e.errno == errno.ENOENT:
2788
logger.warning("Could not load persistent state:"
2789
" {}".format(os.strerror(e.errno)))
2421
logger.warning("Could not load persistent state: {0}"
2422
.format(os.strerror(e.errno)))
2791
2424
logger.critical("Could not load persistent state:",
2794
2427
except EOFError as e:
2795
2428
logger.warning("Could not load persistent state: "
2429
"EOFError:", exc_info=e)
2799
2431
with PGPEngine() as pgp:
2800
for client_name, client in clients_data.items():
2801
# Skip removed clients
2802
if client_name not in client_settings:
2432
for client_name, client in clients_data.iteritems():
2805
2433
# Decide which value to use after restoring saved state.
2806
2434
# We have three different values: Old config file,
2807
2435
# new config file, and saved state.
2828
2456
if datetime.datetime.utcnow() >= client["expires"]:
2829
2457
if not client["last_checked_ok"]:
2830
2458
logger.warning(
2831
"disabling client {} - Client never "
2832
"performed a successful checker".format(
2459
"disabling client {0} - Client never "
2460
"performed a successful checker"
2461
.format(client_name))
2834
2462
client["enabled"] = False
2835
2463
elif client["last_checker_status"] != 0:
2836
2464
logger.warning(
2837
"disabling client {} - Client last"
2838
" checker failed with error code"
2841
client["last_checker_status"]))
2465
"disabling client {0} - Client "
2466
"last checker failed with error code {1}"
2467
.format(client_name,
2468
client["last_checker_status"]))
2842
2469
client["enabled"] = False
2844
client["expires"] = (
2845
datetime.datetime.utcnow()
2846
+ client["timeout"])
2471
client["expires"] = (datetime.datetime
2473
+ client["timeout"])
2847
2474
logger.debug("Last checker succeeded,"
2848
" keeping {} enabled".format(
2475
" keeping {0} enabled"
2476
.format(client_name))
2851
client["secret"] = pgp.decrypt(
2852
client["encrypted_secret"],
2853
client_settings[client_name]["secret"])
2478
client["secret"] = (
2479
pgp.decrypt(client["encrypted_secret"],
2480
client_settings[client_name]
2854
2482
except PGPError:
2855
2483
# If decryption fails, we use secret from new settings
2856
logger.debug("Failed to decrypt {} old secret".format(
2858
client["secret"] = (client_settings[client_name]
2484
logger.debug("Failed to decrypt {0} old secret"
2485
.format(client_name))
2486
client["secret"] = (
2487
client_settings[client_name]["secret"])
2861
2489
# Add/remove clients based on new changes made to config
2862
2490
for client_name in (set(old_client_settings)
2916
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2918
2545
@dbus.service.signal(_interface, signature="os")
2919
2546
def ClientRemoved(self, objpath, name):
2923
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2925
2550
@dbus.service.method(_interface, out_signature="ao")
2926
2551
def GetAllClients(self):
2928
return dbus.Array(c.dbus_object_path for c in
2553
return dbus.Array(c.dbus_object_path
2929
2555
tcp_server.clients.itervalues())
2931
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2933
2557
@dbus.service.method(_interface,
2934
2558
out_signature="a{oa{sv}}")
2935
2559
def GetAllClientsWithProperties(self):
2937
2561
return dbus.Dictionary(
2938
{ c.dbus_object_path: c.GetAll(
2939
"se.recompile.Mandos.Client")
2940
for c in tcp_server.clients.itervalues() },
2562
((c.dbus_object_path, c.GetAll(""))
2563
for c in tcp_server.clients.itervalues()),
2941
2564
signature="oa{sv}")
2943
2566
@dbus.service.method(_interface, in_signature="o")
2947
2570
if c.dbus_object_path == object_path:
2948
2571
del tcp_server.clients[c.name]
2949
2572
c.remove_from_connection()
2950
# Don't signal the disabling
2573
# Don't signal anything except ClientRemoved
2951
2574
c.disable(quiet=True)
2952
# Emit D-Bus signal for removal
2953
self.client_removed_signal(c)
2576
self.ClientRemoved(object_path, c.name)
2955
2578
raise KeyError(object_path)
2959
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
2960
out_signature = "a{oa{sa{sv}}}")
2961
def GetManagedObjects(self):
2963
return dbus.Dictionary(
2964
{ client.dbus_object_path:
2966
{ interface: client.GetAll(interface)
2968
client._get_all_interface_names()})
2969
for client in tcp_server.clients.values()})
2971
def client_added_signal(self, client):
2972
"""Send the new standard signal and the old signal"""
2974
# New standard signal
2975
self.InterfacesAdded(
2976
client.dbus_object_path,
2978
{ interface: client.GetAll(interface)
2980
client._get_all_interface_names()}))
2982
self.ClientAdded(client.dbus_object_path)
2984
def client_removed_signal(self, client):
2985
"""Send the new standard signal and the old signal"""
2987
# New standard signal
2988
self.InterfacesRemoved(
2989
client.dbus_object_path,
2990
client._get_all_interface_names())
2992
self.ClientRemoved(client.dbus_object_path,
2995
2582
mandos_dbus_service = MandosDBusService()
2998
2585
"Cleanup function; run on exit"
3002
2588
multiprocessing.active_children()
3004
2589
if not (tcp_server.clients or client_settings):
3033
2618
del client_settings[client.name]["secret"]
3036
with tempfile.NamedTemporaryFile(
3040
dir=os.path.dirname(stored_state_path),
3041
delete=False) as stored_state:
2621
with (tempfile.NamedTemporaryFile
2622
(mode='wb', suffix=".pickle", prefix='clients-',
2623
dir=os.path.dirname(stored_state_path),
2624
delete=False)) as stored_state:
3042
2625
pickle.dump((clients, client_settings), stored_state)
3043
tempname = stored_state.name
2626
tempname=stored_state.name
3044
2627
os.rename(tempname, stored_state_path)
3045
2628
except (IOError, OSError) as e:
3049
2632
except NameError:
3051
2634
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3052
logger.warning("Could not save persistent state: {}"
2635
logger.warning("Could not save persistent state: {0}"
3053
2636
.format(os.strerror(e.errno)))
3055
2638
logger.warning("Could not save persistent state:",
3059
2642
# Delete all clients, and settings from config
3060
2643
while tcp_server.clients:
3061
2644
name, client = tcp_server.clients.popitem()
3063
2646
client.remove_from_connection()
3064
# Don't signal the disabling
2647
# Don't signal anything except ClientRemoved
3065
2648
client.disable(quiet=True)
3066
# Emit D-Bus signal for removal
3067
mandos_dbus_service.client_removed_signal(client)
2651
mandos_dbus_service.ClientRemoved(client
3068
2654
client_settings.clear()
3070
2656
atexit.register(cleanup)
3072
2658
for client in tcp_server.clients.itervalues():
3074
# Emit D-Bus signal for adding
3075
mandos_dbus_service.client_added_signal(client)
2661
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3076
2662
# Need to initiate checking of clients
3077
2663
if client.enabled:
3078
2664
client.init_checker()