69
import cPickle as pickle
62
import cPickle as pickle
72
63
import multiprocessing
81
66
import dbus.service
82
from gi.repository import GLib
83
69
from dbus.mainloop.glib import DBusGMainLoop
86
72
import xml.dom.minidom
89
# Try to find the value of SO_BINDTODEVICE:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
77
except AttributeError:
96
# This is where SO_BINDTODEVICE was up to and including Python
98
79
from IN import SO_BINDTODEVICE
99
80
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
112
SO_BINDTODEVICE = None
114
if sys.version_info.major == 2:
118
stored_state_file = "clients.pickle"
120
logger = logging.getLogger()
124
if_nametoindex = ctypes.cdll.LoadLibrary(
125
ctypes.util.find_library("c")).if_nametoindex
126
except (OSError, AttributeError):
128
def if_nametoindex(interface):
129
"Get an interface index the hard way, i.e. using fcntl()"
130
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
131
with contextlib.closing(socket.socket()) as s:
132
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
133
struct.pack(b"16s16x", interface))
134
interface_index = struct.unpack("I", ifreq[16:20])[0]
135
return interface_index
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
147
return types.FunctionType(func.__code__,
154
def initlogger(debug, level=logging.WARNING):
155
"""init logger and add loglevel"""
158
syslogger = (logging.handlers.SysLogHandler(
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
syslogger.setFormatter(logging.Formatter
162
('Mandos [%(process)d]: %(levelname)s:'
164
logger.addHandler(syslogger)
167
console = logging.StreamHandler()
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
172
logger.addHandler(console)
173
logger.setLevel(level)
176
class PGPError(Exception):
177
"""Exception if encryption/decryption fails"""
181
class PGPEngine(object):
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
185
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
195
if e.errno != errno.ENOENT:
197
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
208
def __exit__(self, exc_type, exc_value, traceback):
216
if self.tempdir is not None:
217
# Delete contents of tempdir
218
for root, dirs, files in os.walk(self.tempdir,
220
for filename in files:
221
os.remove(os.path.join(root, filename))
223
os.rmdir(os.path.join(root, dirname))
225
os.rmdir(self.tempdir)
228
def password_encode(self, password):
229
# Passphrase can not be empty and can not contain newlines or
230
# NUL bytes. So we prefix it and hex encode it.
231
encoded = b"mandos" + binascii.hexlify(password)
232
if len(encoded) > 2048:
233
# GnuPG can't handle long passwords, so encode differently
234
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
235
.replace(b"\n", b"\\n")
236
.replace(b"\0", b"\\x00"))
239
def encrypt(self, data, password):
240
passphrase = self.password_encode(password)
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
243
passfile.write(passphrase)
245
proc = subprocess.Popen([self.gpg, '--symmetric',
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
253
if proc.returncode != 0:
257
def decrypt(self, data, password):
258
passphrase = self.password_encode(password)
259
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
261
passfile.write(passphrase)
263
proc = subprocess.Popen([self.gpg, '--decrypt',
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
271
if proc.returncode != 0:
273
return decrypted_plaintext
276
# Pretend that we have an Avahi module
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
81
SO_BINDTODEVICE = None
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
syslogger = (logging.handlers.SysLogHandler
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
91
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
94
logger.addHandler(syslogger)
96
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
100
logger.addHandler(console)
303
102
class AvahiError(Exception):
304
103
def __init__(self, value, *args, **kwargs):
305
104
self.value = value
306
return super(AvahiError, self).__init__(value, *args,
105
super(AvahiError, self).__init__(value, *args, **kwargs)
106
def __unicode__(self):
107
return unicode(repr(self.value))
310
109
class AvahiServiceError(AvahiError):
314
112
class AvahiGroupError(AvahiError):
318
116
class AvahiService(object):
319
117
"""An Avahi (Zeroconf) service.
322
120
interface: integer; avahi.IF_UNSPEC or an interface index.
323
121
Used to optionally bind to the specified interface.
324
name: string; Example: 'Mandos'
325
type: string; Example: '_mandos._tcp'.
326
See <https://www.iana.org/assignments/service-names-port-numbers>
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
124
See <http://www.dns-sd.org/ServiceTypes.html>
327
125
port: integer; what port to announce
328
126
TXT: list of strings; TXT record for the service
329
127
domain: string; Domain to publish on, default to .local if empty.
418
197
dbus.UInt16(self.port),
419
198
avahi.string_array_to_txt_array(self.TXT))
420
199
self.group.Commit()
422
200
def entry_group_state_changed(self, state, error):
423
201
"""Derived from the Avahi example code"""
424
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
426
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
427
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
428
206
elif state == avahi.ENTRY_GROUP_COLLISION:
429
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
431
209
elif state == avahi.ENTRY_GROUP_FAILURE:
432
logger.critical("Avahi: Error in group state changed %s",
434
raise AvahiGroupError("State changed: {!s}".format(error))
210
logger.critical(u"Avahi: Error in group state changed %s",
212
raise AvahiGroupError(u"State changed: %s"
436
214
def cleanup(self):
437
215
"""Derived from the Avahi example code"""
438
216
if self.group is not None:
441
except (dbus.exceptions.UnknownMethodException,
442
dbus.exceptions.DBusException):
444
218
self.group = None
447
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
448
220
"""Derived from the Avahi example code"""
449
logger.debug("Avahi server state change: %i", state)
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
452
avahi.SERVER_REGISTERING: None,
453
avahi.SERVER_COLLISION: "Zeroconf server name collision",
454
avahi.SERVER_FAILURE: "Zeroconf server failure",
456
if state in bad_states:
457
if bad_states[state] is not None:
459
logger.error(bad_states[state])
461
logger.error(bad_states[state] + ": %r", error)
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
463
225
elif state == avahi.SERVER_RUNNING:
466
except dbus.exceptions.DBusException as error:
467
if (error.get_dbus_name()
468
== "org.freedesktop.Avahi.CollisionError"):
469
logger.info("Local Zeroconf service name"
471
return self.rename(remove=False)
473
logger.critical("D-Bus Exception", exc_info=error)
478
logger.debug("Unknown state: %r", state)
480
logger.debug("Unknown state: %r: %r", state, error)
482
227
def activate(self):
483
228
"""Derived from the Avahi example code"""
484
229
if self.server is None:
485
230
self.server = dbus.Interface(
486
231
self.bus.get_object(avahi.DBUS_NAME,
487
avahi.DBUS_PATH_SERVER,
488
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
489
233
avahi.DBUS_INTERFACE_SERVER)
490
self.server.connect_to_signal("StateChanged",
491
self.server_state_changed)
234
self.server.connect_to_signal(u"StateChanged",
235
self.server_state_changed)
492
236
self.server_state_changed(self.server.GetState())
495
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
497
"""Add the new name to the syslog messages"""
498
ret = AvahiService.rename(self, *args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
510
library = ctypes.util.find_library("gnutls")
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
515
_need_version = b"3.3.0"
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
524
# Unless otherwise indicated, the constants and types below are
525
# all from the gnutls/gnutls.h C header file.
535
E_NO_CERTIFICATE_FOUND = -49
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
539
class session_int(ctypes.Structure):
541
session_t = ctypes.POINTER(session_int)
543
class certificate_credentials_st(ctypes.Structure):
545
certificate_credentials_t = ctypes.POINTER(
546
certificate_credentials_st)
547
certificate_type_t = ctypes.c_int
549
class datum_t(ctypes.Structure):
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
('size', ctypes.c_uint)]
553
class openpgp_crt_int(ctypes.Structure):
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
credentials_type_t = ctypes.c_int
559
transport_ptr_t = ctypes.c_void_p
560
close_request_t = ctypes.c_int
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
573
if message is None and code is not None:
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
578
class CertificateSecurityError(Error):
582
class Credentials(object):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
590
gnutls.certificate_free_credentials(self._c_object)
592
class ClientSession(object):
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
gnutls.set_default_priority(self._c_object)
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
598
gnutls.handshake_set_private_extensions(self._c_object,
601
if credentials is None:
602
credentials = gnutls.Credentials()
603
gnutls.credentials_set(self._c_object, credentials.type,
604
ctypes.cast(credentials._c_object,
606
self.credentials = credentials
609
gnutls.deinit(self._c_object)
612
return gnutls.handshake(self._c_object)
614
def send(self, data):
618
data_len -= gnutls.record_send(self._c_object,
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
625
# Error handling functions
626
def _error_code(result):
627
"""A function to raise exceptions on errors, suitable
628
for the 'restype' attribute on ctypes functions"""
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
635
def _retry_on_error(result, func, arguments):
636
"""A function to retry on some errors, suitable
637
for the 'errcheck' attribute on ctypes functions"""
639
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
640
return _error_code(result)
641
result = func(*arguments)
644
# Unless otherwise indicated, the function declarations below are
645
# all from the gnutls/gnutls.h C header file.
648
priority_set_direct = _library.gnutls_priority_set_direct
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
ctypes.POINTER(ctypes.c_char_p)]
651
priority_set_direct.restype = _error_code
653
init = _library.gnutls_init
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
init.restype = _error_code
657
set_default_priority = _library.gnutls_set_default_priority
658
set_default_priority.argtypes = [session_t]
659
set_default_priority.restype = _error_code
661
record_send = _library.gnutls_record_send
662
record_send.argtypes = [session_t, ctypes.c_void_p,
664
record_send.restype = ctypes.c_ssize_t
665
record_send.errcheck = _retry_on_error
667
certificate_allocate_credentials = (
668
_library.gnutls_certificate_allocate_credentials)
669
certificate_allocate_credentials.argtypes = [
670
ctypes.POINTER(certificate_credentials_t)]
671
certificate_allocate_credentials.restype = _error_code
673
certificate_free_credentials = (
674
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
677
certificate_free_credentials.restype = None
679
handshake_set_private_extensions = (
680
_library.gnutls_handshake_set_private_extensions)
681
handshake_set_private_extensions.argtypes = [session_t,
683
handshake_set_private_extensions.restype = None
685
credentials_set = _library.gnutls_credentials_set
686
credentials_set.argtypes = [session_t, credentials_type_t,
688
credentials_set.restype = _error_code
690
strerror = _library.gnutls_strerror
691
strerror.argtypes = [ctypes.c_int]
692
strerror.restype = ctypes.c_char_p
694
certificate_type_get = _library.gnutls_certificate_type_get
695
certificate_type_get.argtypes = [session_t]
696
certificate_type_get.restype = _error_code
698
certificate_get_peers = _library.gnutls_certificate_get_peers
699
certificate_get_peers.argtypes = [session_t,
700
ctypes.POINTER(ctypes.c_uint)]
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
global_set_log_level = _library.gnutls_global_set_log_level
704
global_set_log_level.argtypes = [ctypes.c_int]
705
global_set_log_level.restype = None
707
global_set_log_function = _library.gnutls_global_set_log_function
708
global_set_log_function.argtypes = [log_func]
709
global_set_log_function.restype = None
711
deinit = _library.gnutls_deinit
712
deinit.argtypes = [session_t]
713
deinit.restype = None
715
handshake = _library.gnutls_handshake
716
handshake.argtypes = [session_t]
717
handshake.restype = _error_code
718
handshake.errcheck = _retry_on_error
720
transport_set_ptr = _library.gnutls_transport_set_ptr
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
transport_set_ptr.restype = None
724
bye = _library.gnutls_bye
725
bye.argtypes = [session_t, close_request_t]
726
bye.restype = _error_code
727
bye.errcheck = _retry_on_error
729
check_version = _library.gnutls_check_version
730
check_version.argtypes = [ctypes.c_char_p]
731
check_version.restype = ctypes.c_char_p
733
# All the function declarations below are from gnutls/openpgp.h
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
743
openpgp_crt_import.restype = _error_code
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
760
openpgp_crt_get_fingerprint.restype = _error_code
762
# Remove non-public functions
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
768
def call_pipe(connection, # : multiprocessing.Connection
769
func, *args, **kwargs):
770
"""This function is meant to be called by multiprocessing.Process
772
This function runs func(*args, **kwargs), and writes the resulting
773
return value on the provided multiprocessing.Connection.
775
connection.send(func(*args, **kwargs))
779
239
class Client(object):
780
240
"""A representation of a client host served by this server.
783
approved: bool(); 'None' if not yet approved/disapproved
784
approval_delay: datetime.timedelta(); Time to wait for approval
785
approval_duration: datetime.timedelta(); Duration of one approval
243
name: string; from the config file, used in log messages and
245
fingerprint: string (40 or 32 hexadecimal digits); used to
246
uniquely identify the client
247
secret: bytestring; sent verbatim (over TLS) to client
248
host: string; available for use by the checker command
249
created: datetime.datetime(); (UTC) object creation
250
last_enabled: datetime.datetime(); (UTC)
252
last_checked_ok: datetime.datetime(); (UTC) or None
253
timeout: datetime.timedelta(); How long from last_checked_ok
254
until this client is disabled
255
interval: datetime.timedelta(); How often to start a new checker
256
disable_hook: If set, called by disable() as disable_hook(self)
786
257
checker: subprocess.Popen(); a running checker process used
787
258
to see if the client lives.
788
259
'None' if no process is running.
789
checker_callback_tag: a GLib event source tag, or None
790
checker_command: string; External command which is run to check
791
if client lives. %() expansions are done at
260
checker_initiator_tag: a gobject event source tag, or None
261
disable_initiator_tag: - '' -
262
checker_callback_tag: - '' -
263
checker_command: string; External command which is run to check if
264
client lives. %() expansions are done at
792
265
runtime with vars(self) as dict, so that for
793
266
instance %(name)s can be used in the command.
794
checker_initiator_tag: a GLib event source tag, or None
795
created: datetime.datetime(); (UTC) object creation
796
client_structure: Object describing what attributes a client has
797
and is used for storing the client at exit
798
267
current_checker_command: string; current running checker_command
799
disable_initiator_tag: a GLib event source tag, or None
801
fingerprint: string (40 or 32 hexadecimal digits); used to
802
uniquely identify the client
803
host: string; available for use by the checker command
804
interval: datetime.timedelta(); How often to start a new checker
805
last_approval_request: datetime.datetime(); (UTC) or None
806
last_checked_ok: datetime.datetime(); (UTC) or None
807
last_checker_status: integer between 0 and 255 reflecting exit
808
status of last checker. -1 reflects crashed
809
checker, -2 means no checker completed yet.
810
last_checker_signal: The signal which killed the last checker, if
811
last_checker_status is -1
812
last_enabled: datetime.datetime(); (UTC) or None
813
name: string; from the config file, used in log messages and
815
secret: bytestring; sent verbatim (over TLS) to client
816
timeout: datetime.timedelta(); How long from last_checked_ok
817
until this client is disabled
818
extended_timeout: extra long timeout when secret has been sent
819
runtime_expansions: Allowed attributes for runtime expansion.
820
expires: datetime.datetime(); time (UTC) when a client will be
822
server_settings: The server_settings dict from main()
268
approved_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approved_duration: datetime.timedelta(); Duration of one approval
825
runtime_expansions = ("approval_delay", "approval_duration",
826
"created", "enabled", "expires",
827
"fingerprint", "host", "interval",
828
"last_approval_request", "last_checked_ok",
829
"last_enabled", "name", "timeout")
832
"extended_timeout": "PT15M",
834
"checker": "fping -q -- %%(host)s",
836
"approval_delay": "PT0S",
837
"approval_duration": "PT1S",
838
"approved_by_default": "True",
843
def config_parser(config):
844
"""Construct a new dict of client settings of this form:
845
{ client_name: {setting_name: value, ...}, ...}
846
with exceptions for any special settings as defined above.
847
NOTE: Must be a pure function. Must return the same result
848
value given the same arguments.
851
for client_name in config.sections():
852
section = dict(config.items(client_name))
853
client = settings[client_name] = {}
855
client["host"] = section["host"]
856
# Reformat values from string types to Python types
857
client["approved_by_default"] = config.getboolean(
858
client_name, "approved_by_default")
859
client["enabled"] = config.getboolean(client_name,
862
# Uppercase and remove spaces from fingerprint for later
863
# comparison purposes with return value from the
864
# fingerprint() function
865
client["fingerprint"] = (section["fingerprint"].upper()
867
if "secret" in section:
868
client["secret"] = codecs.decode(section["secret"]
871
elif "secfile" in section:
872
with open(os.path.expanduser(os.path.expandvars
873
(section["secfile"])),
875
client["secret"] = secfile.read()
877
raise TypeError("No secret or secfile for section {}"
879
client["timeout"] = string_to_delta(section["timeout"])
880
client["extended_timeout"] = string_to_delta(
881
section["extended_timeout"])
882
client["interval"] = string_to_delta(section["interval"])
883
client["approval_delay"] = string_to_delta(
884
section["approval_delay"])
885
client["approval_duration"] = string_to_delta(
886
section["approval_duration"])
887
client["checker_command"] = section["checker"]
888
client["last_approval_request"] = None
889
client["last_checked_ok"] = None
890
client["last_checker_status"] = -2
894
def __init__(self, settings, name=None, server_settings=None):
274
def _timedelta_to_milliseconds(td):
275
"Convert a datetime.timedelta() to milliseconds"
276
return ((td.days * 24 * 60 * 60 * 1000)
277
+ (td.seconds * 1000)
278
+ (td.microseconds // 1000))
280
def timeout_milliseconds(self):
281
"Return the 'timeout' attribute in milliseconds"
282
return self._timedelta_to_milliseconds(self.timeout)
284
def interval_milliseconds(self):
285
"Return the 'interval' attribute in milliseconds"
286
return self._timedelta_to_milliseconds(self.interval)
288
def approved_delay_milliseconds(self):
289
return self._timedelta_to_milliseconds(self.approved_delay)
291
def __init__(self, name = None, disable_hook=None, config=None):
292
"""Note: the 'checker' key in 'config' sets the
293
'checker_command' attribute and *not* the 'checker'
896
if server_settings is None:
898
self.server_settings = server_settings
899
# adding all client settings
900
for setting, value in settings.items():
901
setattr(self, setting, value)
904
if not hasattr(self, "last_enabled"):
905
self.last_enabled = datetime.datetime.utcnow()
906
if not hasattr(self, "expires"):
907
self.expires = (datetime.datetime.utcnow()
298
logger.debug(u"Creating client %r", self.name)
299
# Uppercase and remove spaces from fingerprint for later
300
# comparison purposes with return value from the fingerprint()
302
self.fingerprint = (config[u"fingerprint"].upper()
304
logger.debug(u" Fingerprint: %s", self.fingerprint)
305
if u"secret" in config:
306
self.secret = config[u"secret"].decode(u"base64")
307
elif u"secfile" in config:
308
with open(os.path.expanduser(os.path.expandvars
309
(config[u"secfile"])),
311
self.secret = secfile.read()
910
self.last_enabled = None
913
logger.debug("Creating client %r", self.name)
914
logger.debug(" Fingerprint: %s", self.fingerprint)
915
self.created = settings.get("created",
916
datetime.datetime.utcnow())
918
# attributes specific for this server instance
313
raise TypeError(u"No secret or secfile for client %s"
315
self.host = config.get(u"host", u"")
316
self.created = datetime.datetime.utcnow()
318
self.last_enabled = None
319
self.last_checked_ok = None
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
322
self.disable_hook = disable_hook
919
323
self.checker = None
920
324
self.checker_initiator_tag = None
921
325
self.disable_initiator_tag = None
922
326
self.checker_callback_tag = None
327
self.checker_command = config[u"checker"]
923
328
self.current_checker_command = None
329
self.last_connect = None
330
self._approved = None
331
self.approved_by_default = config.get(u"approved_by_default",
925
333
self.approvals_pending = 0
926
self.changedstate = multiprocessing_manager.Condition(
927
multiprocessing_manager.Lock())
928
self.client_structure = [attr
929
for attr in self.__dict__.keys()
930
if not attr.startswith("_")]
931
self.client_structure.append("client_structure")
933
for name, t in inspect.getmembers(
934
type(self), lambda obj: isinstance(obj, property)):
935
if not name.startswith("_"):
936
self.client_structure.append(name)
938
# Send notice to process children that client state has changed
334
self.approved_delay = string_to_delta(
335
config[u"approved_delay"])
336
self.approved_duration = string_to_delta(
337
config[u"approved_duration"])
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
939
340
def send_changedstate(self):
940
with self.changedstate:
941
self.changedstate.notify_all()
341
self.changedstate.acquire()
342
self.changedstate.notify_all()
343
self.changedstate.release()
943
345
def enable(self):
944
346
"""Start this client's checker and timeout hooks"""
945
if getattr(self, "enabled", False):
347
if getattr(self, u"enabled", False):
946
348
# Already enabled
948
self.expires = datetime.datetime.utcnow() + self.timeout
350
self.send_changedstate()
950
351
self.last_enabled = datetime.datetime.utcnow()
952
self.send_changedstate()
352
# Schedule a new checker to be started an 'interval' from now,
353
# and every interval from then on.
354
self.checker_initiator_tag = (gobject.timeout_add
355
(self.interval_milliseconds(),
357
# Schedule a disable() when 'timeout' has passed
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
362
# Also start a new checker *right now*.
954
365
def disable(self, quiet=True):
955
366
"""Disable this client."""
956
367
if not getattr(self, "enabled", False):
959
logger.info("Disabling client %s", self.name)
960
if getattr(self, "disable_initiator_tag", None) is not None:
961
GLib.source_remove(self.disable_initiator_tag)
370
self.send_changedstate()
372
logger.info(u"Disabling client %s", self.name)
373
if getattr(self, u"disable_initiator_tag", False):
374
gobject.source_remove(self.disable_initiator_tag)
962
375
self.disable_initiator_tag = None
964
if getattr(self, "checker_initiator_tag", None) is not None:
965
GLib.source_remove(self.checker_initiator_tag)
376
if getattr(self, u"checker_initiator_tag", False):
377
gobject.source_remove(self.checker_initiator_tag)
966
378
self.checker_initiator_tag = None
967
379
self.stop_checker()
380
if self.disable_hook:
381
self.disable_hook(self)
968
382
self.enabled = False
970
self.send_changedstate()
971
# Do not run this again if called by a GLib.timeout_add
383
# Do not run this again if called by a gobject.timeout_add
974
386
def __del__(self):
387
self.disable_hook = None
977
def init_checker(self):
978
# Schedule a new checker to be started an 'interval' from now,
979
# and every interval from then on.
980
if self.checker_initiator_tag is not None:
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
983
int(self.interval.total_seconds() * 1000),
985
# Schedule a disable() when 'timeout' has passed
986
if self.disable_initiator_tag is not None:
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
989
int(self.timeout.total_seconds() * 1000), self.disable)
990
# Also start a new checker *right now*.
993
def checker_callback(self, source, condition, connection,
390
def checker_callback(self, pid, condition, command):
995
391
"""The checker has completed, so take appropriate actions."""
996
392
self.checker_callback_tag = None
997
393
self.checker = None
998
# Read return code from connection (see call_pipe)
999
returncode = connection.recv()
1003
self.last_checker_status = returncode
1004
self.last_checker_signal = None
1005
if self.last_checker_status == 0:
1006
logger.info("Checker for %(name)s succeeded",
394
if os.WIFEXITED(condition):
395
exitstatus = os.WEXITSTATUS(condition)
397
logger.info(u"Checker for %(name)s succeeded",
1008
399
self.checked_ok()
1010
logger.info("Checker for %(name)s failed", vars(self))
401
logger.info(u"Checker for %(name)s failed",
1012
self.last_checker_status = -1
1013
self.last_checker_signal = -returncode
1014
logger.warning("Checker for %(name)s crashed?",
404
logger.warning(u"Checker for %(name)s crashed?",
1018
407
def checked_ok(self):
1019
"""Assert that the client has been seen, alive and well."""
408
"""Bump up the timeout for this client.
410
This should only be called when the client has been seen,
1020
413
self.last_checked_ok = datetime.datetime.utcnow()
1021
self.last_checker_status = 0
1022
self.last_checker_signal = None
1025
def bump_timeout(self, timeout=None):
1026
"""Bump up the timeout for this client."""
1028
timeout = self.timeout
1029
if self.disable_initiator_tag is not None:
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = None
1032
if getattr(self, "enabled", False):
1033
self.disable_initiator_tag = GLib.timeout_add(
1034
int(timeout.total_seconds() * 1000), self.disable)
1035
self.expires = datetime.datetime.utcnow() + timeout
1037
def need_approval(self):
1038
self.last_approval_request = datetime.datetime.utcnow()
414
gobject.source_remove(self.disable_initiator_tag)
415
self.disable_initiator_tag = (gobject.timeout_add
416
(self.timeout_milliseconds(),
1040
419
def start_checker(self):
1041
420
"""Start a new checker subprocess if one is not running.
1043
422
If a checker already exists, leave it running and do
1045
424
# The reason for not killing a running checker is that if we
1046
# did that, and if a checker (for some reason) started running
1047
# slowly and taking more than 'interval' time, then the client
1048
# would inevitably timeout, since no checker would get a
1049
# chance to run to completion. If we instead leave running
425
# did that, then if a checker (for some reason) started
426
# running slowly and taking more than 'interval' time, the
427
# client would inevitably timeout, since no checker would get
428
# a chance to run to completion. If we instead leave running
1050
429
# checkers alone, the checker would have to take more time
1051
430
# than 'timeout' for the client to be disabled, which is as it
1054
if self.checker is not None and not self.checker.is_alive():
1055
logger.warning("Checker was not alive; joining")
433
# If a checker exists, make sure it is not a zombie
435
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
436
except (AttributeError, OSError), error:
437
if (isinstance(error, OSError)
438
and error.errno != errno.ECHILD):
442
logger.warning(u"Checker was a zombie")
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status,
445
self.current_checker_command)
1058
446
# Start a new checker if needed
1059
447
if self.checker is None:
1060
# Escape attributes for the shell
1062
attr: re.escape(str(getattr(self, attr)))
1063
for attr in self.runtime_expansions}
1065
command = self.checker_command % escaped_attrs
1066
except TypeError as error:
1067
logger.error('Could not format string "%s"',
1068
self.checker_command,
1070
return True # Try again later
449
# In case checker_command has exactly one % operator
450
command = self.checker_command % self.host
452
# Escape attributes for the shell
453
escaped_attrs = dict((key,
454
re.escape(unicode(str(val),
458
vars(self).iteritems())
460
command = self.checker_command % escaped_attrs
461
except TypeError, error:
462
logger.error(u'Could not format string "%s":'
463
u' %s', self.checker_command, error)
464
return True # Try again later
1071
465
self.current_checker_command = command
1072
logger.info("Starting checker %r for %s", command,
1074
# We don't need to redirect stdout and stderr, since
1075
# in normal mode, that is already done by daemon(),
1076
# and in debug mode we don't want to. (Stdin is
1077
# always replaced by /dev/null.)
1078
# The exception is when not debugging but nevertheless
1079
# running in the foreground; use the previously
1081
popen_args = {"close_fds": True,
1084
if (not self.server_settings["debug"]
1085
and self.server_settings["foreground"]):
1086
popen_args.update({"stdout": wnull,
1088
pipe = multiprocessing.Pipe(duplex=False)
1089
self.checker = multiprocessing.Process(
1091
args=(pipe[1], subprocess.call, command),
1093
self.checker.start()
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1096
self.checker_callback, pipe[0], command)
1097
# Re-run this periodically if run by GLib.timeout_add
467
logger.info(u"Starting checker %r for %s",
469
# We don't need to redirect stdout and stderr, since
470
# in normal mode, that is already done by daemon(),
471
# and in debug mode we don't want to. (Stdin is
472
# always replaced by /dev/null.)
473
self.checker = subprocess.Popen(command,
475
shell=True, cwd=u"/")
476
self.checker_callback_tag = (gobject.child_watch_add
478
self.checker_callback,
480
# The checker may have completed before the gobject
481
# watch was added. Check for this.
482
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
484
gobject.source_remove(self.checker_callback_tag)
485
self.checker_callback(pid, status, command)
486
except OSError, error:
487
logger.error(u"Failed to start subprocess: %s",
489
# Re-run this periodically if run by gobject.timeout_add
1100
492
def stop_checker(self):
1101
493
"""Force the checker process, if any, to stop."""
1102
494
if self.checker_callback_tag:
1103
GLib.source_remove(self.checker_callback_tag)
495
gobject.source_remove(self.checker_callback_tag)
1104
496
self.checker_callback_tag = None
1105
if getattr(self, "checker", None) is None:
497
if getattr(self, u"checker", None) is None:
1107
logger.debug("Stopping checker for %(name)s", vars(self))
1108
self.checker.terminate()
499
logger.debug(u"Stopping checker for %(name)s", vars(self))
501
os.kill(self.checker.pid, signal.SIGTERM)
503
#if self.checker.poll() is None:
504
# os.kill(self.checker.pid, signal.SIGKILL)
505
except OSError, error:
506
if error.errno != errno.ESRCH: # No such process
1109
508
self.checker = None
1112
def dbus_service_property(dbus_interface,
510
def dbus_service_property(dbus_interface, signature=u"v",
511
access=u"readwrite", byte_arrays=False):
1116
512
"""Decorators for marking methods of a DBusObjectWithProperties to
1117
513
become properties on the D-Bus.
1119
515
The decorated method will be called with no arguments by "Get"
1120
516
and with one argument by "Set".
1122
518
The parameters, where they are supported, are the same as
1123
519
dbus.service.method, except there is only "signature", since the
1124
520
type from Get() and the type sent to Set() is the same.
1126
522
# Encoding deeply encoded byte arrays is not supported yet by the
1127
523
# "Set" method, so we fail early here:
1128
if byte_arrays and signature != "ay":
1129
raise ValueError("Byte arrays not supported for non-'ay'"
1130
" signature {!r}".format(signature))
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
1132
527
def decorator(func):
1133
528
func._dbus_is_property = True
1134
529
func._dbus_interface = dbus_interface
1135
530
func._dbus_signature = signature
1136
531
func._dbus_access = access
1137
532
func._dbus_name = func.__name__
1138
if func._dbus_name.endswith("_dbus_property"):
533
if func._dbus_name.endswith(u"_dbus_property"):
1139
534
func._dbus_name = func._dbus_name[:-14]
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1146
def dbus_interface_annotations(dbus_interface):
1147
"""Decorator for marking functions returning interface annotations
1151
@dbus_interface_annotations("org.example.Interface")
1152
def _foo(self): # Function name does not matter
1153
return {"org.freedesktop.DBus.Deprecated": "true",
1154
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1158
def decorator(func):
1159
func._dbus_is_interface = True
1160
func._dbus_interface = dbus_interface
1161
func._dbus_name = dbus_interface
1167
def dbus_annotations(annotations):
1168
"""Decorator to annotate D-Bus methods, signals or properties
1171
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1172
"org.freedesktop.DBus.Property."
1173
"EmitsChangedSignal": "false"})
1174
@dbus_service_property("org.example.Interface", signature="b",
1176
def Property_dbus_property(self):
1177
return dbus.Boolean(False)
1179
See also the DBusObjectWithAnnotations class.
1182
def decorator(func):
1183
func._dbus_annotations = annotations
535
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
1186
537
return decorator
1189
540
class DBusPropertyException(dbus.exceptions.DBusException):
1190
541
"""A base class for D-Bus property-related exceptions
543
def __unicode__(self):
544
return unicode(str(self))
1195
547
class DBusPropertyAccessException(DBusPropertyException):
1207
class DBusObjectWithAnnotations(dbus.service.Object):
1208
"""A D-Bus object with annotations.
1210
Classes inheriting from this can use the dbus_annotations
1211
decorator to add annotations to methods or signals.
1215
def _is_dbus_thing(thing):
1216
"""Returns a function testing if an attribute is a D-Bus thing
1218
If called like _is_dbus_thing("method") it returns a function
1219
suitable for use as predicate to inspect.getmembers().
1221
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1224
def _get_all_dbus_things(self, thing):
1225
"""Returns a generator of (name, attribute) pairs
1227
return ((getattr(athing.__get__(self), "_dbus_name", name),
1228
athing.__get__(self))
1229
for cls in self.__class__.__mro__
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1237
def Introspect(self, object_path, connection):
1238
"""Overloading of standard D-Bus method.
1240
Inserts annotation tags on methods and signals.
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1245
document = xml.dom.minidom.parseString(xmlstring)
1247
for if_tag in document.getElementsByTagName("interface"):
1248
# Add annotation tags
1249
for typ in ("method", "signal"):
1250
for tag in if_tag.getElementsByTagName(typ):
1252
for name, prop in (self.
1253
_get_all_dbus_things(typ)):
1254
if (name == tag.getAttribute("name")
1255
and prop._dbus_interface
1256
== if_tag.getAttribute("name")):
1257
annots.update(getattr(
1258
prop, "_dbus_annotations", {}))
1259
for name, value in annots.items():
1260
ann_tag = document.createElement(
1262
ann_tag.setAttribute("name", name)
1263
ann_tag.setAttribute("value", value)
1264
tag.appendChild(ann_tag)
1265
# Add interface annotation tags
1266
for annotation, value in dict(
1267
itertools.chain.from_iterable(
1268
annotations().items()
1269
for name, annotations
1270
in self._get_all_dbus_things("interface")
1271
if name == if_tag.getAttribute("name")
1273
ann_tag = document.createElement("annotation")
1274
ann_tag.setAttribute("name", annotation)
1275
ann_tag.setAttribute("value", value)
1276
if_tag.appendChild(ann_tag)
1277
# Fix argument name for the Introspect method itself
1278
if (if_tag.getAttribute("name")
1279
== dbus.INTROSPECTABLE_IFACE):
1280
for cn in if_tag.getElementsByTagName("method"):
1281
if cn.getAttribute("name") == "Introspect":
1282
for arg in cn.getElementsByTagName("arg"):
1283
if (arg.getAttribute("direction")
1285
arg.setAttribute("name",
1287
xmlstring = document.toxml("utf-8")
1289
except (AttributeError, xml.dom.DOMException,
1290
xml.parsers.expat.ExpatError) as error:
1291
logger.error("Failed to override Introspection method",
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
559
class DBusObjectWithProperties(dbus.service.Object):
1297
560
"""A D-Bus object with properties.
1299
562
Classes inheriting from this can use the dbus_service_property
1300
563
decorator to expose methods as D-Bus properties. It exposes the
1301
564
standard Get(), Set(), and GetAll() methods on the D-Bus.
568
def _is_dbus_property(obj):
569
return getattr(obj, u"_dbus_is_property", False)
571
def _get_all_dbus_properties(self):
572
"""Returns a generator of (name, attribute) pairs
574
return ((prop._dbus_name, prop)
576
inspect.getmembers(self, self._is_dbus_property))
1304
578
def _get_dbus_property(self, interface_name, property_name):
1305
579
"""Returns a bound method if one exists which is a D-Bus
1306
580
property with the specified name and interface.
1308
for cls in self.__class__.__mro__:
1309
for name, value in inspect.getmembers(
1310
cls, self._is_dbus_thing("property")):
1311
if (value._dbus_name == property_name
1312
and value._dbus_interface == interface_name):
1313
return value.__get__(self)
582
for name in (property_name,
583
property_name + u"_dbus_property"):
584
prop = getattr(self, name, None)
586
or not self._is_dbus_property(prop)
587
or prop._dbus_name != property_name
588
or (interface_name and prop._dbus_interface
589
and interface_name != prop._dbus_interface)):
1315
592
# No such property
1316
raise DBusPropertyNotFound("{}:{}.{}".format(
1317
self.dbus_object_path, interface_name, property_name))
1320
def _get_all_interface_names(cls):
1321
"""Get a sequence of all interfaces supported by an object"""
1322
return (name for name in set(getattr(getattr(x, attr),
1323
"_dbus_interface", None)
1324
for x in (inspect.getmro(cls))
1326
if name is not None)
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
593
raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
+ interface_name + u"."
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
1331
599
def Get(self, interface_name, property_name):
1332
600
"""Standard D-Bus property Get() method, see D-Bus standard.
1334
602
prop = self._get_dbus_property(interface_name, property_name)
1335
if prop._dbus_access == "write":
603
if prop._dbus_access == u"write":
1336
604
raise DBusPropertyAccessException(property_name)
1338
if not hasattr(value, "variant_level"):
606
if not hasattr(value, u"variant_level"):
1340
608
return type(value)(value, variant_level=value.variant_level+1)
1342
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
1343
611
def Set(self, interface_name, property_name, value):
1344
612
"""Standard D-Bus property Set() method, see D-Bus standard.
1346
614
prop = self._get_dbus_property(interface_name, property_name)
1347
if prop._dbus_access == "read":
615
if prop._dbus_access == u"read":
1348
616
raise DBusPropertyAccessException(property_name)
1349
if prop._dbus_get_args_options["byte_arrays"]:
617
if prop._dbus_get_args_options[u"byte_arrays"]:
1350
618
# The byte_arrays option is not supported yet on
1351
619
# signatures other than "ay".
1352
if prop._dbus_signature != "ay":
1353
raise ValueError("Byte arrays not supported for non-"
1354
"'ay' signature {!r}"
1355
.format(prop._dbus_signature))
1356
value = dbus.ByteArray(b''.join(chr(byte)
620
if prop._dbus_signature != u"ay":
622
value = dbus.ByteArray(''.join(unichr(byte)
1360
@dbus.service.method(dbus.PROPERTIES_IFACE,
1362
out_signature="a{sv}")
626
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
out_signature=u"a{sv}")
1363
628
def GetAll(self, interface_name):
1364
629
"""Standard D-Bus property GetAll() method, see D-Bus
1367
632
Note: Will not include properties with access="write".
1370
for name, prop in self._get_all_dbus_things("property"):
635
for name, prop in self._get_all_dbus_properties():
1371
636
if (interface_name
1372
637
and interface_name != prop._dbus_interface):
1373
638
# Interface non-empty but did not match
1375
640
# Ignore write-only properties
1376
if prop._dbus_access == "write":
641
if prop._dbus_access == u"write":
1379
if not hasattr(value, "variant_level"):
1380
properties[name] = value
644
if not hasattr(value, u"variant_level"):
1382
properties[name] = type(value)(
1383
value, variant_level=value.variant_level + 1)
1384
return dbus.Dictionary(properties, signature="sv")
1386
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1387
def PropertiesChanged(self, interface_name, changed_properties,
1388
invalidated_properties):
1389
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
647
all[name] = type(value)(value, variant_level=
648
value.variant_level+1)
649
return dbus.Dictionary(all, signature=u"sv")
1394
651
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1396
653
path_keyword='object_path',
1397
654
connection_keyword='connection')
1398
655
def Introspect(self, object_path, connection):
1399
"""Overloading of standard D-Bus method.
1401
Inserts property tags and interface annotation tags.
656
"""Standard D-Bus method, overloaded to insert property tags.
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
658
xmlstring = dbus.service.Object.Introspect(self, object_path,
1407
661
document = xml.dom.minidom.parseString(xmlstring)
1409
662
def make_tag(document, name, prop):
1410
e = document.createElement("property")
1411
e.setAttribute("name", name)
1412
e.setAttribute("type", prop._dbus_signature)
1413
e.setAttribute("access", prop._dbus_access)
663
e = document.createElement(u"property")
664
e.setAttribute(u"name", name)
665
e.setAttribute(u"type", prop._dbus_signature)
666
e.setAttribute(u"access", prop._dbus_access)
1416
for if_tag in document.getElementsByTagName("interface"):
668
for if_tag in document.getElementsByTagName(u"interface"):
1418
669
for tag in (make_tag(document, name, prop)
1420
in self._get_all_dbus_things("property")
671
in self._get_all_dbus_properties()
1421
672
if prop._dbus_interface
1422
== if_tag.getAttribute("name")):
673
== if_tag.getAttribute(u"name")):
1423
674
if_tag.appendChild(tag)
1424
# Add annotation tags for properties
1425
for tag in if_tag.getElementsByTagName("property"):
1427
for name, prop in self._get_all_dbus_things(
1429
if (name == tag.getAttribute("name")
1430
and prop._dbus_interface
1431
== if_tag.getAttribute("name")):
1432
annots.update(getattr(
1433
prop, "_dbus_annotations", {}))
1434
for name, value in annots.items():
1435
ann_tag = document.createElement(
1437
ann_tag.setAttribute("name", name)
1438
ann_tag.setAttribute("value", value)
1439
tag.appendChild(ann_tag)
1440
675
# Add the names to the return values for the
1441
676
# "org.freedesktop.DBus.Properties" methods
1442
if (if_tag.getAttribute("name")
1443
== "org.freedesktop.DBus.Properties"):
1444
for cn in if_tag.getElementsByTagName("method"):
1445
if cn.getAttribute("name") == "Get":
1446
for arg in cn.getElementsByTagName("arg"):
1447
if (arg.getAttribute("direction")
1449
arg.setAttribute("name", "value")
1450
elif cn.getAttribute("name") == "GetAll":
1451
for arg in cn.getElementsByTagName("arg"):
1452
if (arg.getAttribute("direction")
1454
arg.setAttribute("name", "props")
1455
xmlstring = document.toxml("utf-8")
1457
except (AttributeError, xml.dom.DOMException,
1458
xml.parsers.expat.ExpatError) as error:
1459
logger.error("Failed to override Introspection method",
1465
dbus.OBJECT_MANAGER_IFACE
1466
except AttributeError:
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
"""A D-Bus object with an ObjectManager.
1473
Classes inheriting from this exposes the standard
1474
GetManagedObjects call and the InterfacesAdded and
1475
InterfacesRemoved signals on the standard
1476
"org.freedesktop.DBus.ObjectManager" interface.
1478
Note: No signals are sent automatically; they must be sent
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1483
def GetManagedObjects(self):
1484
"""This function must be overridden"""
1485
raise NotImplementedError()
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1493
def InterfacesRemoved(self, object_path, interfaces):
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1500
def Introspect(self, object_path, connection):
1501
"""Overloading of standard D-Bus method.
1503
Override return argument name of GetManagedObjects to be
1504
"objpath_interfaces_and_properties"
1506
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1510
document = xml.dom.minidom.parseString(xmlstring)
1512
for if_tag in document.getElementsByTagName("interface"):
1513
# Fix argument name for the GetManagedObjects method
1514
if (if_tag.getAttribute("name")
1515
== dbus.OBJECT_MANAGER_IFACE):
1516
for cn in if_tag.getElementsByTagName("method"):
1517
if (cn.getAttribute("name")
1518
== "GetManagedObjects"):
1519
for arg in cn.getElementsByTagName("arg"):
1520
if (arg.getAttribute("direction")
1524
"objpath_interfaces"
1526
xmlstring = document.toxml("utf-8")
1528
except (AttributeError, xml.dom.DOMException,
1529
xml.parsers.expat.ExpatError) as error:
1530
logger.error("Failed to override Introspection method",
1535
def datetime_to_dbus(dt, variant_level=0):
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1538
return dbus.String("", variant_level=variant_level)
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1542
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1543
"""A class decorator; applied to a subclass of
1544
dbus.service.Object, it will add alternate D-Bus attributes with
1545
interface names according to the "alt_interface_names" mapping.
1548
@alternate_dbus_interfaces({"org.example.Interface":
1549
"net.example.AlternateInterface"})
1550
class SampleDBusObject(dbus.service.Object):
1551
@dbus.service.method("org.example.Interface")
1552
def SampleDBusMethod():
1555
The above "SampleDBusMethod" on "SampleDBusObject" will be
1556
reachable via two interfaces: "org.example.Interface" and
1557
"net.example.AlternateInterface", the latter of which will have
1558
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1559
"true", unless "deprecate" is passed with a False value.
1561
This works for methods and signals, and also for D-Bus properties
1562
(from DBusObjectWithProperties) and interfaces (from the
1563
dbus_interface_annotations decorator).
1567
for orig_interface_name, alt_interface_name in (
1568
alt_interface_names.items()):
1570
interface_names = set()
1571
# Go though all attributes of the class
1572
for attrname, attribute in inspect.getmembers(cls):
1573
# Ignore non-D-Bus attributes, and D-Bus attributes
1574
# with the wrong interface name
1575
if (not hasattr(attribute, "_dbus_interface")
1576
or not attribute._dbus_interface.startswith(
1577
orig_interface_name)):
1579
# Create an alternate D-Bus interface name based on
1581
alt_interface = attribute._dbus_interface.replace(
1582
orig_interface_name, alt_interface_name)
1583
interface_names.add(alt_interface)
1584
# Is this a D-Bus signal?
1585
if getattr(attribute, "_dbus_is_signal", False):
1586
# Extract the original non-method undecorated
1587
# function by black magic
1588
if sys.version_info.major == 2:
1589
nonmethod_func = (dict(
1590
zip(attribute.func_code.co_freevars,
1591
attribute.__closure__))
1592
["func"].cell_contents)
1594
nonmethod_func = (dict(
1595
zip(attribute.__code__.co_freevars,
1596
attribute.__closure__))
1597
["func"].cell_contents)
1598
# Create a new, but exactly alike, function
1599
# object, and decorate it to be a new D-Bus signal
1600
# with the alternate D-Bus interface name
1601
new_function = copy_function(nonmethod_func)
1602
new_function = (dbus.service.signal(
1604
attribute._dbus_signature)(new_function))
1605
# Copy annotations, if any
1607
new_function._dbus_annotations = dict(
1608
attribute._dbus_annotations)
1609
except AttributeError:
1612
# Define a creator of a function to call both the
1613
# original and alternate functions, so both the
1614
# original and alternate signals gets sent when
1615
# the function is called
1616
def fixscope(func1, func2):
1617
"""This function is a scope container to pass
1618
func1 and func2 to the "call_both" function
1619
outside of its arguments"""
1621
@functools.wraps(func2)
1622
def call_both(*args, **kwargs):
1623
"""This function will emit two D-Bus
1624
signals by calling func1 and func2"""
1625
func1(*args, **kwargs)
1626
func2(*args, **kwargs)
1627
# Make wrapper function look like a D-Bus
1629
for name, attr in inspect.getmembers(func2):
1630
if name.startswith("_dbus_"):
1631
setattr(call_both, name, attr)
1634
# Create the "call_both" function and add it to
1636
attr[attrname] = fixscope(attribute, new_function)
1637
# Is this a D-Bus method?
1638
elif getattr(attribute, "_dbus_is_method", False):
1639
# Create a new, but exactly alike, function
1640
# object. Decorate it to be a new D-Bus method
1641
# with the alternate D-Bus interface name. Add it
1644
dbus.service.method(
1646
attribute._dbus_in_signature,
1647
attribute._dbus_out_signature)
1648
(copy_function(attribute)))
1649
# Copy annotations, if any
1651
attr[attrname]._dbus_annotations = dict(
1652
attribute._dbus_annotations)
1653
except AttributeError:
1655
# Is this a D-Bus property?
1656
elif getattr(attribute, "_dbus_is_property", False):
1657
# Create a new, but exactly alike, function
1658
# object, and decorate it to be a new D-Bus
1659
# property with the alternate D-Bus interface
1660
# name. Add it to the class.
1661
attr[attrname] = (dbus_service_property(
1662
alt_interface, attribute._dbus_signature,
1663
attribute._dbus_access,
1664
attribute._dbus_get_args_options
1666
(copy_function(attribute)))
1667
# Copy annotations, if any
1669
attr[attrname]._dbus_annotations = dict(
1670
attribute._dbus_annotations)
1671
except AttributeError:
1673
# Is this a D-Bus interface?
1674
elif getattr(attribute, "_dbus_is_interface", False):
1675
# Create a new, but exactly alike, function
1676
# object. Decorate it to be a new D-Bus interface
1677
# with the alternate D-Bus interface name. Add it
1680
dbus_interface_annotations(alt_interface)
1681
(copy_function(attribute)))
1683
# Deprecate all alternate interfaces
1684
iname = "_AlternateDBusNames_interface_annotation{}"
1685
for interface_name in interface_names:
1687
@dbus_interface_annotations(interface_name)
1689
return {"org.freedesktop.DBus.Deprecated":
1691
# Find an unused name
1692
for aname in (iname.format(i)
1693
for i in itertools.count()):
1694
if aname not in attr:
1698
# Replace the class with a new subclass of it with
1699
# methods, signals, etc. as created above.
1700
if sys.version_info.major == 2:
1701
cls = type(b"{}Alternate".format(cls.__name__),
1704
cls = type("{}Alternate".format(cls.__name__),
1711
@alternate_dbus_interfaces({"se.recompile.Mandos":
1712
"se.bsnet.fukt.Mandos"})
677
if (if_tag.getAttribute(u"name")
678
== u"org.freedesktop.DBus.Properties"):
679
for cn in if_tag.getElementsByTagName(u"method"):
680
if cn.getAttribute(u"name") == u"Get":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
684
arg.setAttribute(u"name", u"value")
685
elif cn.getAttribute(u"name") == u"GetAll":
686
for arg in cn.getElementsByTagName(u"arg"):
687
if (arg.getAttribute(u"direction")
689
arg.setAttribute(u"name", u"props")
690
xmlstring = document.toxml(u"utf-8")
692
except (AttributeError, xml.dom.DOMException,
693
xml.parsers.expat.ExpatError), error:
694
logger.error(u"Failed to override Introspection method",
1713
699
class ClientDBus(Client, DBusObjectWithProperties):
1714
700
"""A Client class using D-Bus
1717
703
dbus_object_path: dbus.ObjectPath
1718
704
bus: dbus.SystemBus()
1721
runtime_expansions = (Client.runtime_expansions
1722
+ ("dbus_object_path", ))
1724
_interface = "se.recompile.Mandos.Client"
1726
706
# dbus.service.Object doesn't use super(), so we can't either.
1728
def __init__(self, bus=None, *args, **kwargs):
708
def __init__(self, bus = None, *args, **kwargs):
709
self._approvals_pending = 0
1730
711
Client.__init__(self, *args, **kwargs)
1731
712
# Only now, when this client is initialized, can it show up on
1733
client_object_name = str(self.name).translate(
1734
{ord("."): ord("_"),
1735
ord("-"): ord("_")})
1736
self.dbus_object_path = dbus.ObjectPath(
1737
"/clients/" + client_object_name)
714
self.dbus_object_path = (dbus.ObjectPath
716
+ self.name.replace(u".", u"_")))
1738
717
DBusObjectWithProperties.__init__(self, self.bus,
1739
718
self.dbus_object_path)
1741
def notifychangeproperty(transform_func, dbus_name,
1742
type_func=lambda x: x,
1744
invalidate_only=False,
1745
_interface=_interface):
1746
""" Modify a variable so that it's a property which announces
1747
its changes to DBus.
1749
transform_fun: Function that takes a value and a variant_level
1750
and transforms it to a D-Bus type.
1751
dbus_name: D-Bus name of the variable
1752
type_func: Function that transform the value before sending it
1753
to the D-Bus. Default: no transform
1754
variant_level: D-Bus variant level. Default: 1
1756
attrname = "_{}".format(dbus_name)
1758
def setter(self, value):
1759
if hasattr(self, "dbus_object_path"):
1760
if (not hasattr(self, attrname) or
1761
type_func(getattr(self, attrname, None))
1762
!= type_func(value)):
1764
self.PropertiesChanged(
1765
_interface, dbus.Dictionary(),
1766
dbus.Array((dbus_name, )))
1768
dbus_value = transform_func(
1770
variant_level=variant_level)
1771
self.PropertyChanged(dbus.String(dbus_name),
1773
self.PropertiesChanged(
1775
dbus.Dictionary({dbus.String(dbus_name):
1778
setattr(self, attrname, value)
1780
return property(lambda self: getattr(self, attrname), setter)
1782
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1783
approvals_pending = notifychangeproperty(dbus.Boolean,
1786
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1787
last_enabled = notifychangeproperty(datetime_to_dbus,
1789
checker = notifychangeproperty(
1790
dbus.Boolean, "CheckerRunning",
1791
type_func=lambda checker: checker is not None)
1792
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1794
last_checker_status = notifychangeproperty(dbus.Int16,
1795
"LastCheckerStatus")
1796
last_approval_request = notifychangeproperty(
1797
datetime_to_dbus, "LastApprovalRequest")
1798
approved_by_default = notifychangeproperty(dbus.Boolean,
1799
"ApprovedByDefault")
1800
approval_delay = notifychangeproperty(
1801
dbus.UInt64, "ApprovalDelay",
1802
type_func=lambda td: td.total_seconds() * 1000)
1803
approval_duration = notifychangeproperty(
1804
dbus.UInt64, "ApprovalDuration",
1805
type_func=lambda td: td.total_seconds() * 1000)
1806
host = notifychangeproperty(dbus.String, "Host")
1807
timeout = notifychangeproperty(
1808
dbus.UInt64, "Timeout",
1809
type_func=lambda td: td.total_seconds() * 1000)
1810
extended_timeout = notifychangeproperty(
1811
dbus.UInt64, "ExtendedTimeout",
1812
type_func=lambda td: td.total_seconds() * 1000)
1813
interval = notifychangeproperty(
1814
dbus.UInt64, "Interval",
1815
type_func=lambda td: td.total_seconds() * 1000)
1816
checker_command = notifychangeproperty(dbus.String, "Checker")
1817
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1818
invalidate_only=True)
1820
del notifychangeproperty
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"approved_pending"),
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
737
def _datetime_to_dbus(dt, variant_level=0):
738
"""Convert a UTC datetime.datetime() to a D-Bus type."""
739
return dbus.String(dt.isoformat(),
740
variant_level=variant_level)
743
oldstate = getattr(self, u"enabled", False)
744
r = Client.enable(self)
745
if oldstate != self.enabled:
747
self.PropertyChanged(dbus.String(u"enabled"),
748
dbus.Boolean(True, variant_level=1))
749
self.PropertyChanged(
750
dbus.String(u"last_enabled"),
751
self._datetime_to_dbus(self.last_enabled,
755
def disable(self, quiet = False):
756
oldstate = getattr(self, u"enabled", False)
757
r = Client.disable(self, quiet=quiet)
758
if not quiet and oldstate != self.enabled:
760
self.PropertyChanged(dbus.String(u"enabled"),
761
dbus.Boolean(False, variant_level=1))
1822
764
def __del__(self, *args, **kwargs):
1824
766
self.remove_from_connection()
1825
767
except LookupError:
1827
if hasattr(DBusObjectWithProperties, "__del__"):
769
if hasattr(DBusObjectWithProperties, u"__del__"):
1828
770
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1829
771
Client.__del__(self, *args, **kwargs)
1831
def checker_callback(self, source, condition,
1832
connection, command, *args, **kwargs):
1833
ret = Client.checker_callback(self, source, condition,
1834
connection, command, *args,
1836
exitstatus = self.last_checker_status
773
def checker_callback(self, pid, condition, command,
775
self.checker_callback_tag = None
778
self.PropertyChanged(dbus.String(u"checker_running"),
779
dbus.Boolean(False, variant_level=1))
780
if os.WIFEXITED(condition):
781
exitstatus = os.WEXITSTATUS(condition)
1838
782
# Emit D-Bus signal
1839
783
self.CheckerCompleted(dbus.Int16(exitstatus),
1840
# This is specific to GNU libC
1841
dbus.Int64(exitstatus << 8),
784
dbus.Int64(condition),
1842
785
dbus.String(command))
1844
787
# Emit D-Bus signal
1845
788
self.CheckerCompleted(dbus.Int16(-1),
1847
# This is specific to GNU libC
1849
| self.last_checker_signal),
789
dbus.Int64(condition),
1850
790
dbus.String(command))
792
return Client.checker_callback(self, pid, condition, command,
795
def checked_ok(self, *args, **kwargs):
796
r = Client.checked_ok(self, *args, **kwargs)
798
self.PropertyChanged(
799
dbus.String(u"last_checked_ok"),
800
(self._datetime_to_dbus(self.last_checked_ok,
1853
804
def start_checker(self, *args, **kwargs):
1854
old_checker_pid = getattr(self.checker, "pid", None)
805
old_checker = self.checker
806
if self.checker is not None:
807
old_checker_pid = self.checker.pid
809
old_checker_pid = None
1855
810
r = Client.start_checker(self, *args, **kwargs)
1856
811
# Only if new checker process was started
1857
812
if (self.checker is not None
1858
813
and old_checker_pid != self.checker.pid):
1859
814
# Emit D-Bus signal
1860
815
self.CheckerStarted(self.current_checker_command)
816
self.PropertyChanged(
817
dbus.String(u"checker_running"),
818
dbus.Boolean(True, variant_level=1))
821
def stop_checker(self, *args, **kwargs):
822
old_checker = getattr(self, u"checker", None)
823
r = Client.stop_checker(self, *args, **kwargs)
824
if (old_checker is not None
825
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"checker_running"),
827
dbus.Boolean(False, variant_level=1))
1863
830
def _reset_approved(self):
1864
self.approved = None
831
self._approved = None
1867
834
def approve(self, value=True):
1868
self.approved = value
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
1871
835
self.send_changedstate()
1873
# D-Bus methods, signals & properties
836
self._approved = value
837
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
838
self._reset_approved)
841
## D-Bus methods, signals & properties
842
_interface = u"se.bsnet.fukt.Mandos.Client"
1879
846
# CheckerCompleted - signal
1880
@dbus.service.signal(_interface, signature="nxs")
847
@dbus.service.signal(_interface, signature=u"nxs")
1881
848
def CheckerCompleted(self, exitcode, waitstatus, command):
1885
852
# CheckerStarted - signal
1886
@dbus.service.signal(_interface, signature="s")
853
@dbus.service.signal(_interface, signature=u"s")
1887
854
def CheckerStarted(self, command):
1891
858
# PropertyChanged - signal
1892
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1893
@dbus.service.signal(_interface, signature="sv")
859
@dbus.service.signal(_interface, signature=u"sv")
1894
860
def PropertyChanged(self, property, value):
1898
864
# GotSecret - signal
1899
865
@dbus.service.signal(_interface)
1900
866
def GotSecret(self):
1903
869
server to mandos-client
1907
873
# Rejected - signal
1908
@dbus.service.signal(_interface, signature="s")
874
@dbus.service.signal(_interface, signature=u"s")
1909
875
def Rejected(self, reason):
1913
879
# NeedApproval - signal
1914
@dbus.service.signal(_interface, signature="tb")
880
@dbus.service.signal(_interface, signature=u"db")
1915
881
def NeedApproval(self, timeout, default):
1917
return self.need_approval()
1921
887
# Approve - method
1922
@dbus.service.method(_interface, in_signature="b")
888
@dbus.service.method(_interface, in_signature=u"b")
1923
889
def Approve(self, value):
1924
890
self.approve(value)
1926
892
# CheckedOK - method
1927
893
@dbus.service.method(_interface)
1928
894
def CheckedOK(self):
895
return self.checked_ok()
1931
897
# Enable - method
1932
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1933
898
@dbus.service.method(_interface)
1934
899
def Enable(self):
1938
903
# StartChecker - method
1939
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1940
904
@dbus.service.method(_interface)
1941
905
def StartChecker(self):
1943
907
self.start_checker()
1945
909
# Disable - method
1946
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1947
910
@dbus.service.method(_interface)
1948
911
def Disable(self):
1952
915
# StopChecker - method
1953
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1954
916
@dbus.service.method(_interface)
1955
917
def StopChecker(self):
1956
918
self.stop_checker()
1960
# ApprovalPending - property
1961
@dbus_service_property(_interface, signature="b", access="read")
1962
def ApprovalPending_dbus_property(self):
922
# approved_pending - property
923
@dbus_service_property(_interface, signature=u"b", access=u"read")
924
def approved_pending_dbus_property(self):
1963
925
return dbus.Boolean(bool(self.approvals_pending))
1965
# ApprovedByDefault - property
1966
@dbus_service_property(_interface,
1969
def ApprovedByDefault_dbus_property(self, value=None):
1970
if value is None: # get
1971
return dbus.Boolean(self.approved_by_default)
1972
self.approved_by_default = bool(value)
1974
# ApprovalDelay - property
1975
@dbus_service_property(_interface,
1978
def ApprovalDelay_dbus_property(self, value=None):
1979
if value is None: # get
1980
return dbus.UInt64(self.approval_delay.total_seconds()
1982
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1984
# ApprovalDuration - property
1985
@dbus_service_property(_interface,
1988
def ApprovalDuration_dbus_property(self, value=None):
1989
if value is None: # get
1990
return dbus.UInt64(self.approval_duration.total_seconds()
1992
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1996
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1997
@dbus_service_property(_interface, signature="s", access="read")
1998
def Name_dbus_property(self):
927
# approved_by_default - property
928
@dbus_service_property(_interface, signature=u"b",
930
def approved_by_default_dbus_property(self):
931
return dbus.Boolean(self.approved_by_default)
933
# approved_delay - property
934
@dbus_service_property(_interface, signature=u"t",
936
def approved_delay_dbus_property(self):
937
return dbus.UInt64(self.approved_delay_milliseconds())
939
# approved_duration - property
940
@dbus_service_property(_interface, signature=u"t",
942
def approved_duration_dbus_property(self):
943
return dbus.UInt64(self._timedelta_to_milliseconds(
944
self.approved_duration))
947
@dbus_service_property(_interface, signature=u"s", access=u"read")
948
def name_dbus_property(self):
1999
949
return dbus.String(self.name)
2001
# Fingerprint - property
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2004
@dbus_service_property(_interface, signature="s", access="read")
2005
def Fingerprint_dbus_property(self):
951
# fingerprint - property
952
@dbus_service_property(_interface, signature=u"s", access=u"read")
953
def fingerprint_dbus_property(self):
2006
954
return dbus.String(self.fingerprint)
2009
@dbus_service_property(_interface,
2012
def Host_dbus_property(self, value=None):
957
@dbus_service_property(_interface, signature=u"s",
959
def host_dbus_property(self, value=None):
2013
960
if value is None: # get
2014
961
return dbus.String(self.host)
2015
self.host = str(value)
2017
# Created - property
2019
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2020
@dbus_service_property(_interface, signature="s", access="read")
2021
def Created_dbus_property(self):
2022
return datetime_to_dbus(self.created)
2024
# LastEnabled - property
2025
@dbus_service_property(_interface, signature="s", access="read")
2026
def LastEnabled_dbus_property(self):
2027
return datetime_to_dbus(self.last_enabled)
2029
# Enabled - property
2030
@dbus_service_property(_interface,
2033
def Enabled_dbus_property(self, value=None):
964
self.PropertyChanged(dbus.String(u"host"),
965
dbus.String(value, variant_level=1))
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
969
def created_dbus_property(self):
970
return dbus.String(self._datetime_to_dbus(self.created))
972
# last_enabled - property
973
@dbus_service_property(_interface, signature=u"s", access=u"read")
974
def last_enabled_dbus_property(self):
975
if self.last_enabled is None:
976
return dbus.String(u"")
977
return dbus.String(self._datetime_to_dbus(self.last_enabled))
980
@dbus_service_property(_interface, signature=u"b",
982
def enabled_dbus_property(self, value=None):
2034
983
if value is None: # get
2035
984
return dbus.Boolean(self.enabled)
2041
# LastCheckedOK - property
2042
@dbus_service_property(_interface,
2045
def LastCheckedOK_dbus_property(self, value=None):
990
# last_checked_ok - property
991
@dbus_service_property(_interface, signature=u"s",
993
def last_checked_ok_dbus_property(self, value=None):
2046
994
if value is not None:
2047
995
self.checked_ok()
2049
return datetime_to_dbus(self.last_checked_ok)
2051
# LastCheckerStatus - property
2052
@dbus_service_property(_interface, signature="n", access="read")
2053
def LastCheckerStatus_dbus_property(self):
2054
return dbus.Int16(self.last_checker_status)
2056
# Expires - property
2057
@dbus_service_property(_interface, signature="s", access="read")
2058
def Expires_dbus_property(self):
2059
return datetime_to_dbus(self.expires)
2061
# LastApprovalRequest - property
2062
@dbus_service_property(_interface, signature="s", access="read")
2063
def LastApprovalRequest_dbus_property(self):
2064
return datetime_to_dbus(self.last_approval_request)
2066
# Timeout - property
2067
@dbus_service_property(_interface,
2070
def Timeout_dbus_property(self, value=None):
997
if self.last_checked_ok is None:
998
return dbus.String(u"")
999
return dbus.String(self._datetime_to_dbus(self
1002
# timeout - property
1003
@dbus_service_property(_interface, signature=u"t",
1004
access=u"readwrite")
1005
def timeout_dbus_property(self, value=None):
2071
1006
if value is None: # get
2072
return dbus.UInt64(self.timeout.total_seconds() * 1000)
2073
old_timeout = self.timeout
1007
return dbus.UInt64(self.timeout_milliseconds())
2074
1008
self.timeout = datetime.timedelta(0, 0, 0, value)
2075
# Reschedule disabling
2077
now = datetime.datetime.utcnow()
2078
self.expires += self.timeout - old_timeout
2079
if self.expires <= now:
2080
# The timeout has passed
2083
if (getattr(self, "disable_initiator_tag", None)
2086
GLib.source_remove(self.disable_initiator_tag)
2087
self.disable_initiator_tag = GLib.timeout_add(
2088
int((self.expires - now).total_seconds() * 1000),
2091
# ExtendedTimeout - property
2092
@dbus_service_property(_interface,
2095
def ExtendedTimeout_dbus_property(self, value=None):
2096
if value is None: # get
2097
return dbus.UInt64(self.extended_timeout.total_seconds()
2099
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2101
# Interval - property
2102
@dbus_service_property(_interface,
2105
def Interval_dbus_property(self, value=None):
2106
if value is None: # get
2107
return dbus.UInt64(self.interval.total_seconds() * 1000)
1010
self.PropertyChanged(dbus.String(u"timeout"),
1011
dbus.UInt64(value, variant_level=1))
1012
if getattr(self, u"disable_initiator_tag", None) is None:
1014
# Reschedule timeout
1015
gobject.source_remove(self.disable_initiator_tag)
1016
self.disable_initiator_tag = None
1017
time_to_die = (self.
1018
_timedelta_to_milliseconds((self
1023
if time_to_die <= 0:
1024
# The timeout has passed
1027
self.disable_initiator_tag = (gobject.timeout_add
1028
(time_to_die, self.disable))
1030
# interval - property
1031
@dbus_service_property(_interface, signature=u"t",
1032
access=u"readwrite")
1033
def interval_dbus_property(self, value=None):
1034
if value is None: # get
1035
return dbus.UInt64(self.interval_milliseconds())
2108
1036
self.interval = datetime.timedelta(0, 0, 0, value)
2109
if getattr(self, "checker_initiator_tag", None) is None:
1038
self.PropertyChanged(dbus.String(u"interval"),
1039
dbus.UInt64(value, variant_level=1))
1040
if getattr(self, u"checker_initiator_tag", None) is None:
2112
# Reschedule checker run
2113
GLib.source_remove(self.checker_initiator_tag)
2114
self.checker_initiator_tag = GLib.timeout_add(
2115
value, self.start_checker)
2116
self.start_checker() # Start one now, too
1042
# Reschedule checker run
1043
gobject.source_remove(self.checker_initiator_tag)
1044
self.checker_initiator_tag = (gobject.timeout_add
1045
(value, self.start_checker))
1046
self.start_checker() # Start one now, too
2118
# Checker - property
2119
@dbus_service_property(_interface,
2122
def Checker_dbus_property(self, value=None):
1048
# checker - property
1049
@dbus_service_property(_interface, signature=u"s",
1050
access=u"readwrite")
1051
def checker_dbus_property(self, value=None):
2123
1052
if value is None: # get
2124
1053
return dbus.String(self.checker_command)
2125
self.checker_command = str(value)
2127
# CheckerRunning - property
2128
@dbus_service_property(_interface,
2131
def CheckerRunning_dbus_property(self, value=None):
1054
self.checker_command = value
1056
self.PropertyChanged(dbus.String(u"checker"),
1057
dbus.String(self.checker_command,
1060
# checker_running - property
1061
@dbus_service_property(_interface, signature=u"b",
1062
access=u"readwrite")
1063
def checker_running_dbus_property(self, value=None):
2132
1064
if value is None: # get
2133
1065
return dbus.Boolean(self.checker is not None)
2135
1067
self.start_checker()
2137
1069
self.stop_checker()
2139
# ObjectPath - property
2141
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2142
"org.freedesktop.DBus.Deprecated": "true"})
2143
@dbus_service_property(_interface, signature="o", access="read")
2144
def ObjectPath_dbus_property(self):
2145
return self.dbus_object_path # is already a dbus.ObjectPath
2149
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2151
@dbus_service_property(_interface,
2155
def Secret_dbus_property(self, value):
2156
self.secret = bytes(value)
1071
# object_path - property
1072
@dbus_service_property(_interface, signature=u"o", access=u"read")
1073
def object_path_dbus_property(self):
1074
return self.dbus_object_path # is already a dbus.ObjectPath
1077
@dbus_service_property(_interface, signature=u"ay",
1078
access=u"write", byte_arrays=True)
1079
def secret_dbus_property(self, value):
1080
self.secret = str(value)
2297
1228
if self.server.use_dbus:
2298
1229
# Emit D-Bus signal
2299
client.Rejected("Approval timed out")
1230
client.Rejected("Time out")
2304
1235
delay -= time2 - time
2307
session.send(client.secret)
2308
except gnutls.Error as error:
2309
logger.warning("gnutls send failed",
2313
logger.info("Sending secret to %s", client.name)
2314
# bump the timeout using extended_timeout
2315
client.bump_timeout(client.extended_timeout)
1238
while sent_size < len(client.secret):
1240
sent = session.send(client.secret[sent_size:])
1241
except (gnutls.errors.GNUTLSError), error:
1242
logger.warning("gnutls send failed")
1244
logger.debug(u"Sent: %d, remaining: %d",
1245
sent, len(client.secret)
1246
- (sent_size + sent))
1249
logger.info(u"Sending secret to %s", client.name)
1250
# bump the timeout as if seen
2316
1252
if self.server.use_dbus:
2317
1253
# Emit D-Bus signal
2318
1254
client.GotSecret()
2321
1257
if approval_required:
2322
1258
client.approvals_pending -= 1
2325
except gnutls.Error as error:
2326
logger.warning("GnuTLS bye failed",
1261
except (gnutls.errors.GNUTLSError), error:
1262
logger.warning("gnutls bye failed")
2330
1265
def peer_certificate(session):
2331
1266
"Return the peer's OpenPGP certificate as a bytestring"
2332
1267
# If not an OpenPGP certificate...
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2335
# ...return invalid data
1268
if (gnutls.library.functions
1269
.gnutls_certificate_type_get(session._c_object)
1270
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1271
# ...do the normal thing
1272
return session.peer_certificate
2337
1273
list_size = ctypes.c_uint(1)
2338
cert_list = (gnutls.certificate_get_peers
1274
cert_list = (gnutls.library.functions
1275
.gnutls_certificate_get_peers
2339
1276
(session._c_object, ctypes.byref(list_size)))
2340
1277
if not bool(cert_list) and list_size.value != 0:
2341
raise gnutls.Error("error getting peer certificate")
1278
raise gnutls.errors.GNUTLSError(u"error getting peer"
2342
1280
if list_size.value == 0:
2344
1282
cert = cert_list[0]
2345
1283
return ctypes.string_at(cert.data, cert.size)
2348
1286
def fingerprint(openpgp):
2349
1287
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2350
1288
# New GnuTLS "datum" with the OpenPGP public key
2351
datum = gnutls.datum_t(
2352
ctypes.cast(ctypes.c_char_p(openpgp),
2353
ctypes.POINTER(ctypes.c_ubyte)),
2354
ctypes.c_uint(len(openpgp)))
1289
datum = (gnutls.library.types
1290
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1293
ctypes.c_uint(len(openpgp))))
2355
1294
# New empty GnuTLS certificate
2356
crt = gnutls.openpgp_crt_t()
2357
gnutls.openpgp_crt_init(ctypes.byref(crt))
1295
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1296
(gnutls.library.functions
1297
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2358
1298
# Import the OpenPGP public key into the certificate
2359
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2360
gnutls.OPENPGP_FMT_RAW)
1299
(gnutls.library.functions
1300
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1301
gnutls.library.constants
1302
.GNUTLS_OPENPGP_FMT_RAW))
2361
1303
# Verify the self signature in the key
2362
1304
crtverify = ctypes.c_uint()
2363
gnutls.openpgp_crt_verify_self(crt, 0,
2364
ctypes.byref(crtverify))
1305
(gnutls.library.functions
1306
.gnutls_openpgp_crt_verify_self(crt, 0,
1307
ctypes.byref(crtverify)))
2365
1308
if crtverify.value != 0:
2366
gnutls.openpgp_crt_deinit(crt)
2367
raise gnutls.CertificateSecurityError("Verify failed")
1309
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1310
raise (gnutls.errors.CertificateSecurityError
2368
1312
# New buffer for the fingerprint
2369
1313
buf = ctypes.create_string_buffer(20)
2370
1314
buf_len = ctypes.c_size_t()
2371
1315
# Get the fingerprint from the certificate into the buffer
2372
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2373
ctypes.byref(buf_len))
1316
(gnutls.library.functions
1317
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1318
ctypes.byref(buf_len)))
2374
1319
# Deinit the certificate
2375
gnutls.openpgp_crt_deinit(crt)
1320
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2376
1321
# Convert the buffer to a Python bytestring
2377
1322
fpr = ctypes.string_at(buf, buf_len.value)
2378
1323
# Convert the bytestring to hexadecimal notation
2379
hex_fpr = binascii.hexlify(fpr).upper()
1324
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
2383
1328
class MultiprocessingMixIn(object):
2384
1329
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2386
1330
def sub_process_main(self, request, address):
2388
1332
self.finish_request(request, address)
2390
1334
self.handle_error(request, address)
2391
1335
self.close_request(request)
2393
1337
def process_request(self, request, address):
2394
1338
"""Start a new process to process the request."""
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
1339
multiprocessing.Process(target = self.sub_process_main,
1340
args = (request, address)).start()
2401
1342
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2402
1343
""" adds a pipe to the MixIn """
2404
1344
def process_request(self, request, client_address):
2405
1345
"""Overrides and wraps the original process_request().
2407
1347
This function creates a new pipe in self.pipe
2409
1349
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2411
proc = MultiprocessingMixIn.process_request(self, request,
1351
super(MultiprocessingMixInWithPipe,
1352
self).process_request(request, client_address)
2413
1353
self.child_pipe.close()
2414
self.add_pipe(parent_pipe, proc)
1354
self.add_pipe(parent_pipe)
2416
def add_pipe(self, parent_pipe, proc):
1356
def add_pipe(self, parent_pipe):
2417
1357
"""Dummy function; override as necessary"""
2418
raise NotImplementedError()
2421
1360
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2422
1361
socketserver.TCPServer, object):
2423
1362
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2426
1365
enabled: Boolean; whether this server is activated yet
2427
1366
interface: None or a network interface name (string)
2428
1367
use_ipv6: Boolean; to use IPv6 or not
2431
1369
def __init__(self, server_address, RequestHandlerClass,
2435
"""If socketfd is set, use that file descriptor instead of
2436
creating a new one with socket.socket().
1370
interface=None, use_ipv6=True):
2438
1371
self.interface = interface
2440
1373
self.address_family = socket.AF_INET6
2441
if socketfd is not None:
2442
# Save the file descriptor
2443
self.socketfd = socketfd
2444
# Save the original socket.socket() function
2445
self.socket_socket = socket.socket
2447
# To implement --socket, we monkey patch socket.socket.
2449
# (When socketserver.TCPServer is a new-style class, we
2450
# could make self.socket into a property instead of monkey
2451
# patching socket.socket.)
2453
# Create a one-time-only replacement for socket.socket()
2454
@functools.wraps(socket.socket)
2455
def socket_wrapper(*args, **kwargs):
2456
# Restore original function so subsequent calls are
2458
socket.socket = self.socket_socket
2459
del self.socket_socket
2460
# This time only, return a new socket object from the
2461
# saved file descriptor.
2462
return socket.fromfd(self.socketfd, *args, **kwargs)
2463
# Replace socket.socket() function with wrapper
2464
socket.socket = socket_wrapper
2465
# The socketserver.TCPServer.__init__ will call
2466
# socket.socket(), which might be our replacement,
2467
# socket_wrapper(), if socketfd was set.
2468
1374
socketserver.TCPServer.__init__(self, server_address,
2469
1375
RequestHandlerClass)
2471
1376
def server_bind(self):
2472
1377
"""This overrides the normal server_bind() function
2473
1378
to bind to an interface if one was specified, and also NOT to
2474
1379
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2476
1380
if self.interface is not None:
2477
1381
if SO_BINDTODEVICE is None:
2478
# Fall back to a hard-coded value which seems to be
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
1382
logger.error(u"SO_BINDTODEVICE does not exist;"
1383
u" cannot bind to interface %s",
1387
self.socket.setsockopt(socket.SOL_SOCKET,
1391
except socket.error, error:
1392
if error[0] == errno.EPERM:
1393
logger.error(u"No permission to"
1394
u" bind to interface %s",
1396
elif error[0] == errno.ENOPROTOOPT:
1397
logger.error(u"SO_BINDTODEVICE not available;"
1398
u" cannot bind to interface %s",
2499
1402
# Only bind(2) the socket if we really need to.
2500
1403
if self.server_address[0] or self.server_address[1]:
2501
1404
if not self.server_address[0]:
2502
1405
if self.address_family == socket.AF_INET6:
2503
any_address = "::" # in6addr_any
1406
any_address = u"::" # in6addr_any
2505
any_address = "0.0.0.0" # INADDR_ANY
1408
any_address = socket.INADDR_ANY
2506
1409
self.server_address = (any_address,
2507
1410
self.server_address[1])
2508
1411
elif not self.server_address[1]:
2509
self.server_address = (self.server_address[0], 0)
1412
self.server_address = (self.server_address[0],
2510
1414
# if self.interface:
2511
1415
# self.server_address = (self.server_address[0],
2634
def rfc3339_duration_to_delta(duration):
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2637
>>> rfc3339_duration_to_delta("P7D")
2638
datetime.timedelta(7)
2639
>>> rfc3339_duration_to_delta("PT60S")
2640
datetime.timedelta(0, 60)
2641
>>> rfc3339_duration_to_delta("PT60M")
2642
datetime.timedelta(0, 3600)
2643
>>> rfc3339_duration_to_delta("PT24H")
2644
datetime.timedelta(1)
2645
>>> rfc3339_duration_to_delta("P1W")
2646
datetime.timedelta(7)
2647
>>> rfc3339_duration_to_delta("PT5M30S")
2648
datetime.timedelta(0, 330)
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
datetime.timedelta(1, 200)
2653
# Parsing an RFC 3339 duration with regular expressions is not
2654
# possible - there would have to be multiple places for the same
2655
# values, like seconds. The current code, while more esoteric, is
2656
# cleaner without depending on a parsing library. If Python had a
2657
# built-in library for parsing we would use it, but we'd like to
2658
# avoid excessive use of external libraries.
2660
# New type for defining tokens, syntax, and semantics all-in-one
2661
Token = collections.namedtuple("Token", (
2662
"regexp", # To match token; if "value" is not None, must have
2663
# a "group" containing digits
2664
"value", # datetime.timedelta or None
2665
"followers")) # Tokens valid after this token
2666
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2667
# the "duration" ABNF definition in RFC 3339, Appendix A.
2668
token_end = Token(re.compile(r"$"), None, frozenset())
2669
token_second = Token(re.compile(r"(\d+)S"),
2670
datetime.timedelta(seconds=1),
2671
frozenset((token_end, )))
2672
token_minute = Token(re.compile(r"(\d+)M"),
2673
datetime.timedelta(minutes=1),
2674
frozenset((token_second, token_end)))
2675
token_hour = Token(re.compile(r"(\d+)H"),
2676
datetime.timedelta(hours=1),
2677
frozenset((token_minute, token_end)))
2678
token_time = Token(re.compile(r"T"),
2680
frozenset((token_hour, token_minute,
2682
token_day = Token(re.compile(r"(\d+)D"),
2683
datetime.timedelta(days=1),
2684
frozenset((token_time, token_end)))
2685
token_month = Token(re.compile(r"(\d+)M"),
2686
datetime.timedelta(weeks=4),
2687
frozenset((token_day, token_end)))
2688
token_year = Token(re.compile(r"(\d+)Y"),
2689
datetime.timedelta(weeks=52),
2690
frozenset((token_month, token_end)))
2691
token_week = Token(re.compile(r"(\d+)W"),
2692
datetime.timedelta(weeks=1),
2693
frozenset((token_end, )))
2694
token_duration = Token(re.compile(r"P"), None,
2695
frozenset((token_year, token_month,
2696
token_day, token_time,
2698
# Define starting values:
2700
value = datetime.timedelta()
2702
# Following valid tokens
2703
followers = frozenset((token_duration, ))
2704
# String left to parse
2706
# Loop until end token is found
2707
while found_token is not token_end:
2708
# Search for any currently valid tokens
2709
for token in followers:
2710
match = token.regexp.match(s)
2711
if match is not None:
2713
if token.value is not None:
2714
# Value found, parse digits
2715
factor = int(match.group(1), 10)
2716
# Add to value so far
2717
value += factor * token.value
2718
# Strip token from string
2719
s = token.regexp.sub("", s, 1)
2722
# Set valid next tokens
2723
followers = found_token.followers
2726
# No currently valid tokens were found
2727
raise ValueError("Invalid RFC 3339 duration: {!r}"
2733
1533
def string_to_delta(interval):
2734
1534
"""Parse a string and return a datetime.timedelta
2736
>>> string_to_delta('7d')
1536
>>> string_to_delta(u'7d')
2737
1537
datetime.timedelta(7)
2738
>>> string_to_delta('60s')
1538
>>> string_to_delta(u'60s')
2739
1539
datetime.timedelta(0, 60)
2740
>>> string_to_delta('60m')
1540
>>> string_to_delta(u'60m')
2741
1541
datetime.timedelta(0, 3600)
2742
>>> string_to_delta('24h')
1542
>>> string_to_delta(u'24h')
2743
1543
datetime.timedelta(1)
2744
>>> string_to_delta('1w')
1544
>>> string_to_delta(u'1w')
2745
1545
datetime.timedelta(7)
2746
>>> string_to_delta('5m 30s')
1546
>>> string_to_delta(u'5m 30s')
2747
1547
datetime.timedelta(0, 330)
2751
return rfc3339_duration_to_delta(interval)
2755
1549
timevalue = datetime.timedelta(0)
2756
1550
for s in interval.split():
1552
suffix = unicode(s[-1])
2759
1553
value = int(s[:-1])
2761
1555
delta = datetime.timedelta(value)
1556
elif suffix == u"s":
2763
1557
delta = datetime.timedelta(0, value)
1558
elif suffix == u"m":
2765
1559
delta = datetime.timedelta(0, 0, 0, 0, value)
1560
elif suffix == u"h":
2767
1561
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1562
elif suffix == u"w":
2769
1563
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2771
raise ValueError("Unknown suffix {!r}".format(suffix))
2772
except IndexError as e:
2773
raise ValueError(*(e.args))
1565
raise ValueError(u"Unknown suffix %r" % suffix)
1566
except (ValueError, IndexError), e:
1567
raise ValueError(e.message)
2774
1568
timevalue += delta
2775
1569
return timevalue
2778
def daemon(nochdir=False, noclose=False):
1572
def if_nametoindex(interface):
1573
"""Call the C function if_nametoindex(), or equivalent
1575
Note: This function cannot accept a unicode string."""
1576
global if_nametoindex
1578
if_nametoindex = (ctypes.cdll.LoadLibrary
1579
(ctypes.util.find_library(u"c"))
1581
except (OSError, AttributeError):
1582
logger.warning(u"Doing if_nametoindex the hard way")
1583
def if_nametoindex(interface):
1584
"Get an interface index the hard way, i.e. using fcntl()"
1585
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1586
with contextlib.closing(socket.socket()) as s:
1587
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1588
struct.pack(str(u"16s16x"),
1590
interface_index = struct.unpack(str(u"I"),
1592
return interface_index
1593
return if_nametoindex(interface)
1596
def daemon(nochdir = False, noclose = False):
2779
1597
"""See daemon(3). Standard BSD Unix function.
2781
1599
This should really exist as os.daemon, but it doesn't (yet)."""
2785
1603
if not nochdir:
2789
1607
if not noclose:
2790
1608
# Close all standard open file descriptors
2791
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1609
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2792
1610
if not stat.S_ISCHR(os.fstat(null).st_mode):
2793
1611
raise OSError(errno.ENODEV,
2794
"{} not a character device"
2795
.format(os.devnull))
1612
u"%s not a character device"
2796
1614
os.dup2(null, sys.stdin.fileno())
2797
1615
os.dup2(null, sys.stdout.fileno())
2798
1616
os.dup2(null, sys.stderr.fileno())
2805
1623
##################################################################
2806
1624
# Parsing of options, both command line and config file
2808
parser = argparse.ArgumentParser()
2809
parser.add_argument("-v", "--version", action="version",
2810
version="%(prog)s {}".format(version),
2811
help="show version number and exit")
2812
parser.add_argument("-i", "--interface", metavar="IF",
2813
help="Bind to interface IF")
2814
parser.add_argument("-a", "--address",
2815
help="Address to listen for requests on")
2816
parser.add_argument("-p", "--port", type=int,
2817
help="Port number to receive requests on")
2818
parser.add_argument("--check", action="store_true",
2819
help="Run self-test")
2820
parser.add_argument("--debug", action="store_true",
2821
help="Debug mode; run in foreground and log"
2822
" to terminal", default=None)
2823
parser.add_argument("--debuglevel", metavar="LEVEL",
2824
help="Debug level for stdout output")
2825
parser.add_argument("--priority", help="GnuTLS"
2826
" priority string (see GnuTLS documentation)")
2827
parser.add_argument("--servicename",
2828
metavar="NAME", help="Zeroconf service name")
2829
parser.add_argument("--configdir",
2830
default="/etc/mandos", metavar="DIR",
2831
help="Directory to search for configuration"
2833
parser.add_argument("--no-dbus", action="store_false",
2834
dest="use_dbus", help="Do not provide D-Bus"
2835
" system bus interface", default=None)
2836
parser.add_argument("--no-ipv6", action="store_false",
2837
dest="use_ipv6", help="Do not use IPv6",
2839
parser.add_argument("--no-restore", action="store_false",
2840
dest="restore", help="Do not restore stored"
2841
" state", default=None)
2842
parser.add_argument("--socket", type=int,
2843
help="Specify a file descriptor to a network"
2844
" socket to use instead of creating one")
2845
parser.add_argument("--statedir", metavar="DIR",
2846
help="Directory to save/restore state in")
2847
parser.add_argument("--foreground", action="store_true",
2848
help="Run in foreground", default=None)
2849
parser.add_argument("--no-zeroconf", action="store_false",
2850
dest="zeroconf", help="Do not use Zeroconf",
2853
options = parser.parse_args()
1626
parser = optparse.OptionParser(version = "%%prog %s" % version)
1627
parser.add_option("-i", u"--interface", type=u"string",
1628
metavar="IF", help=u"Bind to interface IF")
1629
parser.add_option("-a", u"--address", type=u"string",
1630
help=u"Address to listen for requests on")
1631
parser.add_option("-p", u"--port", type=u"int",
1632
help=u"Port number to receive requests on")
1633
parser.add_option("--check", action=u"store_true",
1634
help=u"Run self-test")
1635
parser.add_option("--debug", action=u"store_true",
1636
help=u"Debug mode; run in foreground and log to"
1638
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1639
help=u"Debug level for stdout output")
1640
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1641
u" priority string (see GnuTLS documentation)")
1642
parser.add_option("--servicename", type=u"string",
1643
metavar=u"NAME", help=u"Zeroconf service name")
1644
parser.add_option("--configdir", type=u"string",
1645
default=u"/etc/mandos", metavar=u"DIR",
1646
help=u"Directory to search for configuration"
1648
parser.add_option("--no-dbus", action=u"store_false",
1649
dest=u"use_dbus", help=u"Do not provide D-Bus"
1650
u" system bus interface")
1651
parser.add_option("--no-ipv6", action=u"store_false",
1652
dest=u"use_ipv6", help=u"Do not use IPv6")
1653
options = parser.parse_args()[0]
2855
1655
if options.check:
2857
fail_count, test_count = doctest.testmod()
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2860
1660
# Default values for config file for server-global settings
2861
server_defaults = {"interface": "",
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
1661
server_defaults = { u"interface": u"",
1666
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1667
u"servicename": u"Mandos",
1668
u"use_dbus": u"True",
1669
u"use_ipv6": u"True",
2879
1673
# Parse config file for server-global settings
2880
1674
server_config = configparser.SafeConfigParser(server_defaults)
2881
1675
del server_defaults
2882
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1676
server_config.read(os.path.join(options.configdir,
2883
1678
# Convert the SafeConfigParser object to a dict
2884
1679
server_settings = server_config.defaults()
2885
1680
# Use the appropriate methods on the non-string config options
2886
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2887
"foreground", "zeroconf"):
2888
server_settings[option] = server_config.getboolean("DEFAULT",
1681
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1682
server_settings[option] = server_config.getboolean(u"DEFAULT",
2890
1684
if server_settings["port"]:
2891
server_settings["port"] = server_config.getint("DEFAULT",
2893
if server_settings["socket"]:
2894
server_settings["socket"] = server_config.getint("DEFAULT",
2896
# Later, stdin will, and stdout and stderr might, be dup'ed
2897
# over with an opened os.devnull. But we don't want this to
2898
# happen with a supplied network socket.
2899
if 0 <= server_settings["socket"] <= 2:
2900
server_settings["socket"] = os.dup(server_settings
1685
server_settings["port"] = server_config.getint(u"DEFAULT",
2902
1687
del server_config
2904
1689
# Override the settings from the config file with command line
2905
1690
# options, if set.
2906
for option in ("interface", "address", "port", "debug",
2907
"priority", "servicename", "configdir", "use_dbus",
2908
"use_ipv6", "debuglevel", "restore", "statedir",
2909
"socket", "foreground", "zeroconf"):
1691
for option in (u"interface", u"address", u"port", u"debug",
1692
u"priority", u"servicename", u"configdir",
1693
u"use_dbus", u"use_ipv6", u"debuglevel"):
2910
1694
value = getattr(options, option)
2911
1695
if value is not None:
2912
1696
server_settings[option] = value
2914
1698
# Force all strings to be unicode
2915
1699
for option in server_settings.keys():
2916
if isinstance(server_settings[option], bytes):
2917
server_settings[option] = (server_settings[option]
2919
# Force all boolean options to be boolean
2920
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2921
"foreground", "zeroconf"):
2922
server_settings[option] = bool(server_settings[option])
2923
# Debug implies foreground
2924
if server_settings["debug"]:
2925
server_settings["foreground"] = True
1700
if type(server_settings[option]) is str:
1701
server_settings[option] = unicode(server_settings[option])
2926
1702
# Now we have our good server settings in "server_settings"
2928
1704
##################################################################
2930
if (not server_settings["zeroconf"]
2931
and not (server_settings["port"]
2932
or server_settings["socket"] != "")):
2933
parser.error("Needs port or socket to work without Zeroconf")
2935
1706
# For convenience
2936
debug = server_settings["debug"]
2937
debuglevel = server_settings["debuglevel"]
2938
use_dbus = server_settings["use_dbus"]
2939
use_ipv6 = server_settings["use_ipv6"]
2940
stored_state_path = os.path.join(server_settings["statedir"],
2942
foreground = server_settings["foreground"]
2943
zeroconf = server_settings["zeroconf"]
2946
initlogger(debug, logging.DEBUG)
2951
level = getattr(logging, debuglevel.upper())
2952
initlogger(debug, level)
2954
if server_settings["servicename"] != "Mandos":
2955
syslogger.setFormatter(
2956
logging.Formatter('Mandos ({}) [%(process)d]:'
2957
' %(levelname)s: %(message)s'.format(
2958
server_settings["servicename"])))
1707
debug = server_settings[u"debug"]
1708
debuglevel = server_settings[u"debuglevel"]
1709
use_dbus = server_settings[u"use_dbus"]
1710
use_ipv6 = server_settings[u"use_ipv6"]
1712
if server_settings[u"servicename"] != u"Mandos":
1713
syslogger.setFormatter(logging.Formatter
1714
(u'Mandos (%s) [%%(process)d]:'
1715
u' %%(levelname)s: %%(message)s'
1716
% server_settings[u"servicename"]))
2960
1718
# Parse config file with clients
2961
client_config = configparser.SafeConfigParser(Client
2963
client_config.read(os.path.join(server_settings["configdir"],
1719
client_defaults = { u"timeout": u"1h",
1721
u"checker": u"fping -q -- %%(host)s",
1723
u"approved_delay": u"0s",
1724
u"approved_duration": u"1s",
1726
client_config = configparser.SafeConfigParser(client_defaults)
1727
client_config.read(os.path.join(server_settings[u"configdir"],
2966
1730
global mandos_dbus_service
2967
1731
mandos_dbus_service = None
2970
if server_settings["socket"] != "":
2971
socketfd = server_settings["socket"]
2972
tcp_server = MandosServer(
2973
(server_settings["address"], server_settings["port"]),
2975
interface=(server_settings["interface"] or None),
2977
gnutls_priority=server_settings["priority"],
2981
pidfilename = "/run/mandos.pid"
2982
if not os.path.isdir("/run/."):
2983
pidfilename = "/var/run/mandos.pid"
2986
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2987
except IOError as e:
2988
logger.error("Could not open file %r", pidfilename,
2991
for name, group in (("_mandos", "_mandos"),
2992
("mandos", "mandos"),
2993
("nobody", "nogroup")):
2995
uid = pwd.getpwnam(name).pw_uid
2996
gid = pwd.getpwnam(group).pw_gid
1733
tcp_server = MandosServer((server_settings[u"address"],
1734
server_settings[u"port"]),
1736
interface=(server_settings[u"interface"]
1740
server_settings[u"priority"],
1742
pidfilename = u"/var/run/mandos.pid"
1744
pidfile = open(pidfilename, u"w")
1746
logger.error(u"Could not open file %r", pidfilename)
1749
uid = pwd.getpwnam(u"_mandos").pw_uid
1750
gid = pwd.getpwnam(u"_mandos").pw_gid
1753
uid = pwd.getpwnam(u"mandos").pw_uid
1754
gid = pwd.getpwnam(u"mandos").pw_gid
2998
1755
except KeyError:
1757
uid = pwd.getpwnam(u"nobody").pw_uid
1758
gid = pwd.getpwnam(u"nobody").pw_gid
3007
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3009
except OSError as error:
3010
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3011
.format(uid, gid, os.strerror(error.errno)))
3012
if error.errno != errno.EPERM:
1765
except OSError, error:
1766
if error[0] != errno.EPERM:
1769
# Enable all possible GnuTLS debugging
1772
if not debug and not debuglevel:
1773
syslogger.setLevel(logging.WARNING)
1774
console.setLevel(logging.WARNING)
1776
level = getattr(logging, debuglevel.upper())
1777
syslogger.setLevel(level)
1778
console.setLevel(level)
3016
# Enable all possible GnuTLS debugging
3018
1781
# "Use a log level over 10 to enable all debugging options."
3019
1782
# - GnuTLS manual
3020
gnutls.global_set_log_level(11)
1783
gnutls.library.functions.gnutls_global_set_log_level(11)
1785
@gnutls.library.types.gnutls_log_func
3023
1786
def debug_gnutls(level, string):
3024
logger.debug("GnuTLS: %s", string[:-1])
3026
gnutls.global_set_log_function(debug_gnutls)
1787
logger.debug(u"GnuTLS: %s", string[:-1])
1789
(gnutls.library.functions
1790
.gnutls_global_set_log_function(debug_gnutls))
3028
1792
# Redirect stdin so all checkers get /dev/null
3029
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1793
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
3030
1794
os.dup2(null, sys.stdin.fileno())
3034
# Need to fork before connecting to D-Bus
3036
# Close all input and output, do double fork, etc.
3039
# multiprocessing will use threads, so before we use GLib we need
3040
# to inform GLib that threads will be used.
1798
# No console logging
1799
logger.removeHandler(console)
3043
1802
global main_loop
3044
1803
# From the Avahi example code
3045
DBusGMainLoop(set_as_default=True)
3046
main_loop = GLib.MainLoop()
1804
DBusGMainLoop(set_as_default=True )
1805
main_loop = gobject.MainLoop()
3047
1806
bus = dbus.SystemBus()
3048
1807
# End of Avahi example code
3051
bus_name = dbus.service.BusName("se.recompile.Mandos",
3054
old_bus_name = dbus.service.BusName(
3055
"se.bsnet.fukt.Mandos", bus,
3057
except dbus.exceptions.DBusException as e:
3058
logger.error("Disabling D-Bus:", exc_info=e)
1810
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1811
bus, do_not_queue=True)
1812
except dbus.exceptions.NameExistsException, e:
1813
logger.error(unicode(e) + u", disabling D-Bus")
3059
1814
use_dbus = False
3060
server_settings["use_dbus"] = False
1815
server_settings[u"use_dbus"] = False
3061
1816
tcp_server.use_dbus = False
3063
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3064
service = AvahiServiceToSyslog(
3065
name=server_settings["servicename"],
3066
servicetype="_mandos._tcp",
3069
if server_settings["interface"]:
3070
service.interface = if_nametoindex(
3071
server_settings["interface"].encode("utf-8"))
1817
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1818
service = AvahiService(name = server_settings[u"servicename"],
1819
servicetype = u"_mandos._tcp",
1820
protocol = protocol, bus = bus)
1821
if server_settings["interface"]:
1822
service.interface = (if_nametoindex
1823
(str(server_settings[u"interface"])))
1826
# Close all input and output, do double fork, etc.
3073
1829
global multiprocessing_manager
3074
1830
multiprocessing_manager = multiprocessing.Manager()
3076
1832
client_class = Client
3078
client_class = functools.partial(ClientDBus, bus=bus)
3080
client_settings = Client.config_parser(client_config)
3081
old_client_settings = {}
3084
# This is used to redirect stdout and stderr for checker processes
3086
wnull = open(os.devnull, "w") # A writable /dev/null
3087
# Only used if server is running in foreground but not in debug
3089
if debug or not foreground:
3092
# Get client data and settings from last running state.
3093
if server_settings["restore"]:
3095
with open(stored_state_path, "rb") as stored_state:
3096
if sys.version_info.major == 2:
3097
clients_data, old_client_settings = pickle.load(
3100
bytes_clients_data, bytes_old_client_settings = (
3101
pickle.load(stored_state, encoding="bytes"))
3102
# Fix bytes to strings
3105
clients_data = {(key.decode("utf-8")
3106
if isinstance(key, bytes)
3109
bytes_clients_data.items()}
3110
del bytes_clients_data
3111
for key in clients_data:
3112
value = {(k.decode("utf-8")
3113
if isinstance(k, bytes) else k): v
3115
clients_data[key].items()}
3116
clients_data[key] = value
3118
value["client_structure"] = [
3120
if isinstance(s, bytes)
3122
value["client_structure"]]
3124
for k in ("name", "host"):
3125
if isinstance(value[k], bytes):
3126
value[k] = value[k].decode("utf-8")
3127
# old_client_settings
3129
old_client_settings = {
3130
(key.decode("utf-8")
3131
if isinstance(key, bytes)
3134
bytes_old_client_settings.items()}
3135
del bytes_old_client_settings
3137
for value in old_client_settings.values():
3138
if isinstance(value["host"], bytes):
3139
value["host"] = (value["host"]
3141
os.remove(stored_state_path)
3142
except IOError as e:
3143
if e.errno == errno.ENOENT:
3144
logger.warning("Could not load persistent state:"
3145
" {}".format(os.strerror(e.errno)))
3147
logger.critical("Could not load persistent state:",
3150
except EOFError as e:
3151
logger.warning("Could not load persistent state: "
3155
with PGPEngine() as pgp:
3156
for client_name, client in clients_data.items():
3157
# Skip removed clients
3158
if client_name not in client_settings:
3161
# Decide which value to use after restoring saved state.
3162
# We have three different values: Old config file,
3163
# new config file, and saved state.
3164
# New config value takes precedence if it differs from old
3165
# config value, otherwise use saved state.
3166
for name, value in client_settings[client_name].items():
3168
# For each value in new config, check if it
3169
# differs from the old config value (Except for
3170
# the "secret" attribute)
3171
if (name != "secret"
3173
old_client_settings[client_name][name])):
3174
client[name] = value
3178
# Clients who has passed its expire date can still be
3179
# enabled if its last checker was successful. A Client
3180
# whose checker succeeded before we stored its state is
3181
# assumed to have successfully run all checkers during
3183
if client["enabled"]:
3184
if datetime.datetime.utcnow() >= client["expires"]:
3185
if not client["last_checked_ok"]:
3187
"disabling client {} - Client never "
3188
"performed a successful checker".format(
3190
client["enabled"] = False
3191
elif client["last_checker_status"] != 0:
3193
"disabling client {} - Client last"
3194
" checker failed with error code"
3197
client["last_checker_status"]))
3198
client["enabled"] = False
3200
client["expires"] = (
3201
datetime.datetime.utcnow()
3202
+ client["timeout"])
3203
logger.debug("Last checker succeeded,"
3204
" keeping {} enabled".format(
1834
client_class = functools.partial(ClientDBus, bus = bus)
1835
def client_config_items(config, section):
1836
special_settings = {
1837
"approved_by_default":
1838
lambda: config.getboolean(section,
1839
"approved_by_default"),
1841
for name, value in config.items(section):
3207
client["secret"] = pgp.decrypt(
3208
client["encrypted_secret"],
3209
client_settings[client_name]["secret"])
3211
# If decryption fails, we use secret from new settings
3212
logger.debug("Failed to decrypt {} old secret".format(
3214
client["secret"] = (client_settings[client_name]
3217
# Add/remove clients based on new changes made to config
3218
for client_name in (set(old_client_settings)
3219
- set(client_settings)):
3220
del clients_data[client_name]
3221
for client_name in (set(client_settings)
3222
- set(old_client_settings)):
3223
clients_data[client_name] = client_settings[client_name]
3225
# Create all client objects
3226
for client_name, client in clients_data.items():
3227
tcp_server.clients[client_name] = client_class(
3230
server_settings=server_settings)
1843
yield (name, special_settings[name]())
1847
tcp_server.clients.update(set(
1848
client_class(name = section,
1849
config= dict(client_config_items(
1850
client_config, section)))
1851
for section in client_config.sections()))
3232
1852
if not tcp_server.clients:
3233
logger.warning("No clients defined")
3236
if pidfile is not None:
1853
logger.warning(u"No clients defined")
3237
1857
pid = os.getpid()
3240
print(pid, file=pidfile)
3242
logger.error("Could not write to file %r with PID %d",
1858
pidfile.write(str(pid) + "\n")
3247
for termsig in (signal.SIGHUP, signal.SIGTERM):
3248
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3249
lambda: main_loop.quit() and False)
1861
logger.error(u"Could not write to file %r with PID %d",
1864
# "pidfile" was never created
1869
signal.signal(signal.SIGINT, signal.SIG_IGN)
1870
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1871
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3253
@alternate_dbus_interfaces(
3254
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3255
class MandosDBusService(DBusObjectWithObjectManager):
1874
class MandosDBusService(dbus.service.Object):
3256
1875
"""A D-Bus proxy object"""
3258
1876
def __init__(self):
3259
dbus.service.Object.__init__(self, bus, "/")
3261
_interface = "se.recompile.Mandos"
3263
@dbus.service.signal(_interface, signature="o")
1877
dbus.service.Object.__init__(self, bus, u"/")
1878
_interface = u"se.bsnet.fukt.Mandos"
1880
@dbus.service.signal(_interface, signature=u"o")
3264
1881
def ClientAdded(self, objpath):
3268
@dbus.service.signal(_interface, signature="ss")
1885
@dbus.service.signal(_interface, signature=u"ss")
3269
1886
def ClientNotFound(self, fingerprint, address):
3273
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3275
@dbus.service.signal(_interface, signature="os")
1890
@dbus.service.signal(_interface, signature=u"os")
3276
1891
def ClientRemoved(self, objpath, name):
3280
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3282
@dbus.service.method(_interface, out_signature="ao")
1895
@dbus.service.method(_interface, out_signature=u"ao")
3283
1896
def GetAllClients(self):
3285
return dbus.Array(c.dbus_object_path for c in
3286
tcp_server.clients.values())
3288
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
1898
return dbus.Array(c.dbus_object_path
1899
for c in tcp_server.clients)
3290
1901
@dbus.service.method(_interface,
3291
out_signature="a{oa{sv}}")
1902
out_signature=u"a{oa{sv}}")
3292
1903
def GetAllClientsWithProperties(self):
3294
1905
return dbus.Dictionary(
3295
{c.dbus_object_path: c.GetAll(
3296
"se.recompile.Mandos.Client")
3297
for c in tcp_server.clients.values()},
3300
@dbus.service.method(_interface, in_signature="o")
1906
((c.dbus_object_path, c.GetAll(u""))
1907
for c in tcp_server.clients),
1908
signature=u"oa{sv}")
1910
@dbus.service.method(_interface, in_signature=u"o")
3301
1911
def RemoveClient(self, object_path):
3303
for c in tcp_server.clients.values():
1913
for c in tcp_server.clients:
3304
1914
if c.dbus_object_path == object_path:
3305
del tcp_server.clients[c.name]
1915
tcp_server.clients.remove(c)
3306
1916
c.remove_from_connection()
3307
# Don't signal the disabling
1917
# Don't signal anything except ClientRemoved
3308
1918
c.disable(quiet=True)
3309
# Emit D-Bus signal for removal
3310
self.client_removed_signal(c)
1920
self.ClientRemoved(object_path, c.name)
3312
1922
raise KeyError(object_path)
3316
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3317
out_signature="a{oa{sa{sv}}}")
3318
def GetManagedObjects(self):
3320
return dbus.Dictionary(
3321
{client.dbus_object_path:
3323
{interface: client.GetAll(interface)
3325
client._get_all_interface_names()})
3326
for client in tcp_server.clients.values()})
3328
def client_added_signal(self, client):
3329
"""Send the new standard signal and the old signal"""
3331
# New standard signal
3332
self.InterfacesAdded(
3333
client.dbus_object_path,
3335
{interface: client.GetAll(interface)
3337
client._get_all_interface_names()}))
3339
self.ClientAdded(client.dbus_object_path)
3341
def client_removed_signal(self, client):
3342
"""Send the new standard signal and the old signal"""
3344
# New standard signal
3345
self.InterfacesRemoved(
3346
client.dbus_object_path,
3347
client._get_all_interface_names())
3349
self.ClientRemoved(client.dbus_object_path,
3352
1926
mandos_dbus_service = MandosDBusService()
3354
# Save modules to variables to exempt the modules from being
3355
# unloaded before the function registered with atexit() is run.
3356
mp = multiprocessing
3360
1929
"Cleanup function; run on exit"
3364
mp.active_children()
3366
if not (tcp_server.clients or client_settings):
3369
# Store client before exiting. Secrets are encrypted with key
3370
# based on what config file has. If config file is
3371
# removed/edited, old secret will thus be unrecovable.
3373
with PGPEngine() as pgp:
3374
for client in tcp_server.clients.values():
3375
key = client_settings[client.name]["secret"]
3376
client.encrypted_secret = pgp.encrypt(client.secret,
3380
# A list of attributes that can not be pickled
3382
exclude = {"bus", "changedstate", "secret",
3383
"checker", "server_settings"}
3384
for name, typ in inspect.getmembers(dbus.service
3388
client_dict["encrypted_secret"] = (client
3390
for attr in client.client_structure:
3391
if attr not in exclude:
3392
client_dict[attr] = getattr(client, attr)
3394
clients[client.name] = client_dict
3395
del client_settings[client.name]["secret"]
3398
with tempfile.NamedTemporaryFile(
3402
dir=os.path.dirname(stored_state_path),
3403
delete=False) as stored_state:
3404
pickle.dump((clients, client_settings), stored_state,
3406
tempname = stored_state.name
3407
os.rename(tempname, stored_state_path)
3408
except (IOError, OSError) as e:
3414
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3415
logger.warning("Could not save persistent state: {}"
3416
.format(os.strerror(e.errno)))
3418
logger.warning("Could not save persistent state:",
3422
# Delete all clients, and settings from config
3423
1932
while tcp_server.clients:
3424
name, client = tcp_server.clients.popitem()
1933
client = tcp_server.clients.pop()
3426
1935
client.remove_from_connection()
3427
# Don't signal the disabling
1936
client.disable_hook = None
1937
# Don't signal anything except ClientRemoved
3428
1938
client.disable(quiet=True)
3429
# Emit D-Bus signal for removal
3431
mandos_dbus_service.client_removed_signal(client)
3432
client_settings.clear()
1941
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
3434
1944
atexit.register(cleanup)
3436
for client in tcp_server.clients.values():
1946
for client in tcp_server.clients:
3438
# Emit D-Bus signal for adding
3439
mandos_dbus_service.client_added_signal(client)
3440
# Need to initiate checking of clients
3442
client.init_checker()
1949
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3444
1952
tcp_server.enable()
3445
1953
tcp_server.server_activate()
3447
1955
# Find out what port we got
3449
service.port = tcp_server.socket.getsockname()[1]
1956
service.port = tcp_server.socket.getsockname()[1]
3451
logger.info("Now listening on address %r, port %d,"
3452
" flowinfo %d, scope_id %d",
3453
*tcp_server.socket.getsockname())
1958
logger.info(u"Now listening on address %r, port %d,"
1959
" flowinfo %d, scope_id %d"
1960
% tcp_server.socket.getsockname())
3455
logger.info("Now listening on address %r, port %d",
3456
*tcp_server.socket.getsockname())
3458
# service.interface = tcp_server.socket.getsockname()[3]
1962
logger.info(u"Now listening on address %r, port %d"
1963
% tcp_server.socket.getsockname())
1965
#service.interface = tcp_server.socket.getsockname()[3]
3462
# From the Avahi example code
3465
except dbus.exceptions.DBusException as error:
3466
logger.critical("D-Bus Exception", exc_info=error)
3469
# End of Avahi example code
3471
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3472
lambda *args, **kwargs:
3473
(tcp_server.handle_request
3474
(*args[2:], **kwargs) or True))
3476
logger.debug("Starting main loop")
1968
# From the Avahi example code
1971
except dbus.exceptions.DBusException, error:
1972
logger.critical(u"DBusException: %s", error)
1975
# End of Avahi example code
1977
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1978
lambda *args, **kwargs:
1979
(tcp_server.handle_request
1980
(*args[2:], **kwargs) or True))
1982
logger.debug(u"Starting main loop")
3477
1983
main_loop.run()
3478
except AvahiError as error:
3479
logger.critical("Avahi Error", exc_info=error)
1984
except AvahiError, error:
1985
logger.critical(u"AvahiError: %s", error)
3482
1988
except KeyboardInterrupt:
3484
print("", file=sys.stderr)
3485
logger.debug("Server received KeyboardInterrupt")
3486
logger.debug("Server exiting")
1991
logger.debug(u"Server received KeyboardInterrupt")
1992
logger.debug(u"Server exiting")
3487
1993
# Must run before the D-Bus bus name gets deregistered
3491
1996
if __name__ == '__main__':