To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 423
- compare with another revision
- download diff
- download tarball
- view history from revision 423
- Committer: Teddy Hogeborn
- Date: 2010-09-12 03:00:40 UTC
- Revision ID: teddy@fukt.bsnet.se-20100912030040-b0uopyennste9fdh
Documentation changes:
* DBUS-API: New file documenting the server D-Bus interface.
* clients.conf: Add examples of new approval settings.
* debian/mandos.docs: Added "DBUS-API".
* mandos-clients.conf.xml (OPTIONS): Added "approved_by_default",
"approval_delay", and
"approval_duration".
* mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file.
(BUGS): Remove mention of lack of a remote query interface.
* DBUS-API: New file documenting the server D-Bus interface.
* clients.conf: Add examples of new approval settings.
* debian/mandos.docs: Added "DBUS-API".
* mandos-clients.conf.xml (OPTIONS): Added "approved_by_default",
"approval_delay", and
"approval_duration".
* mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file.
(BUGS): Remove mention of lack of a remote query interface.
- files removed:
- debian/mandos-client.examples
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
36
37
from future_builtins import *
34
from __future__ import division, with_statement, absolute_import
38
35
39
36
import SocketServer as socketserver
40
37
import socket
41
import argparse
38
import optparse
42
39
import datetime
43
40
import errno
44
41
import gnutls.crypto
64
61
import functools
65
62
import cPickle as pickle
66
63
import multiprocessing
67
import types
68
import binascii
69
import tempfile
70
import itertools
71
import collections
72
64
73
65
import dbus
74
66
import dbus.service
79
71
import ctypes.util
80
72
import xml.dom.minidom
81
73
import inspect
82
import GnuPGInterface
83
74
84
75
try:
85
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
89
80
except ImportError:
90
81
SO_BINDTODEVICE = None
91
82
92
version = "1.6.0"
93
stored_state_file = "clients.pickle"
94
95
logger = logging.getLogger()
83
84
version = "1.0.14"
85
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
96
88
syslogger = (logging.handlers.SysLogHandler
97
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
98
address = str("/dev/log")))
99
100
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
104
except (OSError, AttributeError):
105
def if_nametoindex(interface):
106
"Get an interface index the hard way, i.e. using fcntl()"
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
with contextlib.closing(socket.socket()) as s:
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(str("16s16x"),
111
interface))
112
interface_index = struct.unpack(str("I"),
113
ifreq[16:20])[0]
114
return interface_index
115
116
117
def initlogger(debug, level=logging.WARNING):
118
"""init logger and add loglevel"""
119
120
syslogger.setFormatter(logging.Formatter
121
('Mandos [%(process)d]: %(levelname)s:'
122
' %(message)s'))
123
logger.addHandler(syslogger)
124
125
if debug:
126
console = logging.StreamHandler()
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
128
' [%(process)d]:'
129
' %(levelname)s:'
130
' %(message)s'))
131
logger.addHandler(console)
132
logger.setLevel(level)
133
134
135
class PGPError(Exception):
136
"""Exception if encryption/decryption fails"""
137
pass
138
139
140
class PGPEngine(object):
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
def __init__(self):
143
self.gnupg = GnuPGInterface.GnuPG()
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
149
'--quiet',
150
'--no-use-agent'])
151
152
def __enter__(self):
153
return self
154
155
def __exit__(self, exc_type, exc_value, traceback):
156
self._cleanup()
157
return False
158
159
def __del__(self):
160
self._cleanup()
161
162
def _cleanup(self):
163
if self.tempdir is not None:
164
# Delete contents of tempdir
165
for root, dirs, files in os.walk(self.tempdir,
166
topdown = False):
167
for filename in files:
168
os.remove(os.path.join(root, filename))
169
for dirname in dirs:
170
os.rmdir(os.path.join(root, dirname))
171
# Remove tempdir
172
os.rmdir(self.tempdir)
173
self.tempdir = None
174
175
def password_encode(self, password):
176
# Passphrase can not be empty and can not contain newlines or
177
# NUL bytes. So we prefix it and hex encode it.
178
return b"mandos" + binascii.hexlify(password)
179
180
def encrypt(self, data, password):
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
183
try:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
188
f.write(data)
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
191
proc.wait()
192
except IOError as e:
193
raise PGPError(e)
194
self.gnupg.passphrase = None
195
return ciphertext
196
197
def decrypt(self, data, password):
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
200
try:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
205
f.write(data)
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
208
proc.wait()
209
except IOError as e:
210
raise PGPError(e)
211
self.gnupg.passphrase = None
212
return decrypted_plaintext
213
90
address = "/dev/log"))
91
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
logger.addHandler(syslogger)
95
96
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
100
logger.addHandler(console)
214
101
215
102
class AvahiError(Exception):
216
103
def __init__(self, value, *args, **kwargs):
232
119
Attributes:
233
120
interface: integer; avahi.IF_UNSPEC or an interface index.
234
121
Used to optionally bind to the specified interface.
235
name: string; Example: 'Mandos'
236
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
237
124
See <http://www.dns-sd.org/ServiceTypes.html>
238
125
port: integer; what port to announce
239
126
TXT: list of strings; TXT record for the service
246
133
server: D-Bus Server
247
134
bus: dbus.SystemBus()
248
135
"""
249
250
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
137
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
253
139
protocol = avahi.PROTO_UNSPEC, bus = None):
254
140
self.interface = interface
255
141
self.name = name
264
150
self.group = None # our entry group
265
151
self.server = None
266
152
self.bus = bus
267
self.entry_group_state_changed_match = None
268
269
153
def rename(self):
270
154
"""Derived from the Avahi example code"""
271
155
if self.rename_count >= self.max_renames:
272
logger.critical("No suitable Zeroconf service name found"
273
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
274
158
self.rename_count)
275
raise AvahiServiceError("Too many renames")
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
278
logger.info("Changing Zeroconf service name to %r ...",
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
279
162
self.name)
163
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
166
% self.name))
280
167
self.remove()
281
168
try:
282
169
self.add()
283
except dbus.exceptions.DBusException as error:
284
logger.critical("D-Bus Exception", exc_info=error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
285
172
self.cleanup()
286
173
os._exit(1)
287
174
self.rename_count += 1
288
289
175
def remove(self):
290
176
"""Derived from the Avahi example code"""
291
if self.entry_group_state_changed_match is not None:
292
self.entry_group_state_changed_match.remove()
293
self.entry_group_state_changed_match = None
294
177
if self.group is not None:
295
178
self.group.Reset()
296
297
179
def add(self):
298
180
"""Derived from the Avahi example code"""
299
self.remove()
300
181
if self.group is None:
301
182
self.group = dbus.Interface(
302
183
self.bus.get_object(avahi.DBUS_NAME,
303
184
self.server.EntryGroupNew()),
304
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
305
self.entry_group_state_changed_match = (
306
self.group.connect_to_signal(
307
'StateChanged', self.entry_group_state_changed))
308
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
309
190
self.name, self.type)
310
191
self.group.AddService(
311
192
self.interface,
316
197
dbus.UInt16(self.port),
317
198
avahi.string_array_to_txt_array(self.TXT))
318
199
self.group.Commit()
319
320
200
def entry_group_state_changed(self, state, error):
321
201
"""Derived from the Avahi example code"""
322
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
323
203
324
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
325
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
326
206
elif state == avahi.ENTRY_GROUP_COLLISION:
327
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
328
208
self.rename()
329
209
elif state == avahi.ENTRY_GROUP_FAILURE:
330
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
331
211
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
334
212
raise AvahiGroupError(u"State changed: %s"
213
% unicode(error))
335
214
def cleanup(self):
336
215
"""Derived from the Avahi example code"""
337
216
if self.group is not None:
338
try:
339
self.group.Free()
340
except (dbus.exceptions.UnknownMethodException,
341
dbus.exceptions.DBusException):
342
pass
217
self.group.Free()
343
218
self.group = None
344
self.remove()
345
346
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
347
220
"""Derived from the Avahi example code"""
348
logger.debug("Avahi server state change: %i", state)
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
356
if state in bad_states:
357
if bad_states[state] is not None:
358
if error is None:
359
logger.error(bad_states[state])
360
else:
361
logger.error(bad_states[state] + ": %r", error)
362
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
363
225
elif state == avahi.SERVER_RUNNING:
364
226
self.add()
365
else:
366
if error is None:
367
logger.debug("Unknown state: %r", state)
368
else:
369
logger.debug("Unknown state: %r: %r", state, error)
370
371
227
def activate(self):
372
228
"""Derived from the Avahi example code"""
373
229
if self.server is None:
374
230
self.server = dbus.Interface(
375
231
self.bus.get_object(avahi.DBUS_NAME,
376
avahi.DBUS_PATH_SERVER,
377
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
378
233
avahi.DBUS_INTERFACE_SERVER)
379
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
380
235
self.server_state_changed)
381
236
self.server_state_changed(self.server.GetState())
382
237
383
238
384
class AvahiServiceToSyslog(AvahiService):
385
def rename(self):
386
"""Add the new name to the syslog messages"""
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
392
return ret
393
394
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
401
402
239
class Client(object):
403
240
"""A representation of a client host served by this server.
404
241
405
242
Attributes:
406
approved: bool(); 'None' if not yet approved/disapproved
407
approval_delay: datetime.timedelta(); Time to wait for approval
408
approval_duration: datetime.timedelta(); Duration of one approval
243
name: string; from the config file, used in log messages and
244
D-Bus identifiers
245
fingerprint: string (40 or 32 hexadecimal digits); used to
246
uniquely identify the client
247
secret: bytestring; sent verbatim (over TLS) to client
248
host: string; available for use by the checker command
249
created: datetime.datetime(); (UTC) object creation
250
last_enabled: datetime.datetime(); (UTC)
251
enabled: bool()
252
last_checked_ok: datetime.datetime(); (UTC) or None
253
timeout: datetime.timedelta(); How long from last_checked_ok
254
until this client is disabled
255
interval: datetime.timedelta(); How often to start a new checker
256
disable_hook: If set, called by disable() as disable_hook(self)
409
257
checker: subprocess.Popen(); a running checker process used
410
258
to see if the client lives.
411
259
'None' if no process is running.
412
checker_callback_tag: a gobject event source tag, or None
413
checker_command: string; External command which is run to check
414
if client lives. %() expansions are done at
260
checker_initiator_tag: a gobject event source tag, or None
261
disable_initiator_tag: - '' -
262
checker_callback_tag: - '' -
263
checker_command: string; External command which is run to check if
264
client lives. %() expansions are done at
415
265
runtime with vars(self) as dict, so that for
416
266
instance %(name)s can be used in the command.
417
checker_initiator_tag: a gobject event source tag, or None
418
created: datetime.datetime(); (UTC) object creation
419
client_structure: Object describing what attributes a client has
420
and is used for storing the client at exit
421
267
current_checker_command: string; current running checker_command
422
disable_initiator_tag: a gobject event source tag, or None
423
enabled: bool()
424
fingerprint: string (40 or 32 hexadecimal digits); used to
425
uniquely identify the client
426
host: string; available for use by the checker command
427
interval: datetime.timedelta(); How often to start a new checker
428
last_approval_request: datetime.datetime(); (UTC) or None
429
last_checked_ok: datetime.datetime(); (UTC) or None
430
last_checker_status: integer between 0 and 255 reflecting exit
431
status of last checker. -1 reflects crashed
432
checker, -2 means no checker completed yet.
433
last_enabled: datetime.datetime(); (UTC) or None
434
name: string; from the config file, used in log messages and
435
D-Bus identifiers
436
secret: bytestring; sent verbatim (over TLS) to client
437
timeout: datetime.timedelta(); How long from last_checked_ok
438
until this client is disabled
439
extended_timeout: extra long timeout when secret has been sent
440
runtime_expansions: Allowed attributes for runtime expansion.
441
expires: datetime.datetime(); time (UTC) when a client will be
442
disabled, or None
268
approval_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approval_duration: datetime.timedelta(); Duration of one approval
443
271
"""
444
272
445
runtime_expansions = ("approval_delay", "approval_duration",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
449
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
273
@staticmethod
274
def _timedelta_to_milliseconds(td):
275
"Convert a datetime.timedelta() to milliseconds"
276
return ((td.days * 24 * 60 * 60 * 1000)
277
+ (td.seconds * 1000)
278
+ (td.microseconds // 1000))
460
279
461
280
def timeout_milliseconds(self):
462
281
"Return the 'timeout' attribute in milliseconds"
463
return timedelta_to_milliseconds(self.timeout)
464
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
282
return self._timedelta_to_milliseconds(self.timeout)
468
283
469
284
def interval_milliseconds(self):
470
285
"Return the 'interval' attribute in milliseconds"
471
return timedelta_to_milliseconds(self.interval)
472
286
return self._timedelta_to_milliseconds(self.interval)
287
473
288
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
475
476
@staticmethod
477
def config_parser(config):
478
"""Construct a new dict of client settings of this form:
479
{ client_name: {setting_name: value, ...}, ...}
480
with exceptions for any special settings as defined above.
481
NOTE: Must be a pure function. Must return the same result
482
value given the same arguments.
483
"""
484
settings = {}
485
for client_name in config.sections():
486
section = dict(config.items(client_name))
487
client = settings[client_name] = {}
488
489
client["host"] = section["host"]
490
# Reformat values from string types to Python types
491
client["approved_by_default"] = config.getboolean(
492
client_name, "approved_by_default")
493
client["enabled"] = config.getboolean(client_name,
494
"enabled")
495
496
client["fingerprint"] = (section["fingerprint"].upper()
497
.replace(" ", ""))
498
if "secret" in section:
499
client["secret"] = section["secret"].decode("base64")
500
elif "secfile" in section:
501
with open(os.path.expanduser(os.path.expandvars
502
(section["secfile"])),
503
"rb") as secfile:
504
client["secret"] = secfile.read()
505
else:
506
raise TypeError("No secret or secfile for section {0}"
507
.format(section))
508
client["timeout"] = string_to_delta(section["timeout"])
509
client["extended_timeout"] = string_to_delta(
510
section["extended_timeout"])
511
client["interval"] = string_to_delta(section["interval"])
512
client["approval_delay"] = string_to_delta(
513
section["approval_delay"])
514
client["approval_duration"] = string_to_delta(
515
section["approval_duration"])
516
client["checker_command"] = section["checker"]
517
client["last_approval_request"] = None
518
client["last_checked_ok"] = None
519
client["last_checker_status"] = -2
520
521
return settings
522
523
def __init__(self, settings, name = None):
289
return self._timedelta_to_milliseconds(self.approval_delay)
290
291
def __init__(self, name = None, disable_hook=None, config=None):
292
"""Note: the 'checker' key in 'config' sets the
293
'checker_command' attribute and *not* the 'checker'
294
attribute."""
524
295
self.name = name
525
# adding all client settings
526
for setting, value in settings.iteritems():
527
setattr(self, setting, value)
528
529
if self.enabled:
530
if not hasattr(self, "last_enabled"):
531
self.last_enabled = datetime.datetime.utcnow()
532
if not hasattr(self, "expires"):
533
self.expires = (datetime.datetime.utcnow()
534
+ self.timeout)
535
else:
536
self.last_enabled = None
537
self.expires = None
538
539
logger.debug("Creating client %r", self.name)
296
if config is None:
297
config = {}
298
logger.debug(u"Creating client %r", self.name)
540
299
# Uppercase and remove spaces from fingerprint for later
541
300
# comparison purposes with return value from the fingerprint()
542
301
# function
543
logger.debug(" Fingerprint: %s", self.fingerprint)
544
self.created = settings.get("created",
545
datetime.datetime.utcnow())
546
547
# attributes specific for this server instance
302
self.fingerprint = (config[u"fingerprint"].upper()
303
.replace(u" ", u""))
304
logger.debug(u" Fingerprint: %s", self.fingerprint)
305
if u"secret" in config:
306
self.secret = config[u"secret"].decode(u"base64")
307
elif u"secfile" in config:
308
with open(os.path.expanduser(os.path.expandvars
309
(config[u"secfile"])),
310
"rb") as secfile:
311
self.secret = secfile.read()
312
else:
313
raise TypeError(u"No secret or secfile for client %s"
314
% self.name)
315
self.host = config.get(u"host", u"")
316
self.created = datetime.datetime.utcnow()
317
self.enabled = False
318
self.last_enabled = None
319
self.last_checked_ok = None
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
322
self.disable_hook = disable_hook
548
323
self.checker = None
549
324
self.checker_initiator_tag = None
550
325
self.disable_initiator_tag = None
551
326
self.checker_callback_tag = None
327
self.checker_command = config[u"checker"]
552
328
self.current_checker_command = None
553
self.approved = None
329
self.last_connect = None
330
self._approved = None
331
self.approved_by_default = config.get(u"approved_by_default",
332
True)
554
333
self.approvals_pending = 0
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
557
.Lock()))
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
560
if not attr.startswith("_")]
561
self.client_structure.append("client_structure")
562
563
for name, t in inspect.getmembers(type(self),
564
lambda obj:
565
isinstance(obj,
566
property)):
567
if not name.startswith("_"):
568
self.client_structure.append(name)
334
self.approval_delay = string_to_delta(
335
config[u"approval_delay"])
336
self.approval_duration = string_to_delta(
337
config[u"approval_duration"])
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
569
339
570
# Send notice to process children that client state has changed
571
340
def send_changedstate(self):
572
with self.changedstate:
573
self.changedstate.notify_all()
574
341
self.changedstate.acquire()
342
self.changedstate.notify_all()
343
self.changedstate.release()
344
575
345
def enable(self):
576
346
"""Start this client's checker and timeout hooks"""
577
if getattr(self, "enabled", False):
347
if getattr(self, u"enabled", False):
578
348
# Already enabled
579
349
return
580
self.expires = datetime.datetime.utcnow() + self.timeout
581
self.enabled = True
350
self.send_changedstate()
582
351
self.last_enabled = datetime.datetime.utcnow()
583
self.init_checker()
584
self.send_changedstate()
585
586
def disable(self, quiet=True):
587
"""Disable this client."""
588
if not getattr(self, "enabled", False):
589
return False
590
if not quiet:
591
logger.info("Disabling client %s", self.name)
592
if getattr(self, "disable_initiator_tag", None) is not None:
593
gobject.source_remove(self.disable_initiator_tag)
594
self.disable_initiator_tag = None
595
self.expires = None
596
if getattr(self, "checker_initiator_tag", None) is not None:
597
gobject.source_remove(self.checker_initiator_tag)
598
self.checker_initiator_tag = None
599
self.stop_checker()
600
self.enabled = False
601
if not quiet:
602
self.send_changedstate()
603
# Do not run this again if called by a gobject.timeout_add
604
return False
605
606
def __del__(self):
607
self.disable()
608
609
def init_checker(self):
610
352
# Schedule a new checker to be started an 'interval' from now,
611
353
# and every interval from then on.
612
if self.checker_initiator_tag is not None:
613
gobject.source_remove(self.checker_initiator_tag)
614
354
self.checker_initiator_tag = (gobject.timeout_add
615
355
(self.interval_milliseconds(),
616
356
self.start_checker))
617
357
# Schedule a disable() when 'timeout' has passed
618
if self.disable_initiator_tag is not None:
619
gobject.source_remove(self.disable_initiator_tag)
620
358
self.disable_initiator_tag = (gobject.timeout_add
621
359
(self.timeout_milliseconds(),
622
360
self.disable))
361
self.enabled = True
623
362
# Also start a new checker *right now*.
624
363
self.start_checker()
625
364
365
def disable(self, quiet=True):
366
"""Disable this client."""
367
if not getattr(self, "enabled", False):
368
return False
369
if not quiet:
370
self.send_changedstate()
371
if not quiet:
372
logger.info(u"Disabling client %s", self.name)
373
if getattr(self, u"disable_initiator_tag", False):
374
gobject.source_remove(self.disable_initiator_tag)
375
self.disable_initiator_tag = None
376
if getattr(self, u"checker_initiator_tag", False):
377
gobject.source_remove(self.checker_initiator_tag)
378
self.checker_initiator_tag = None
379
self.stop_checker()
380
if self.disable_hook:
381
self.disable_hook(self)
382
self.enabled = False
383
# Do not run this again if called by a gobject.timeout_add
384
return False
385
386
def __del__(self):
387
self.disable_hook = None
388
self.disable()
389
626
390
def checker_callback(self, pid, condition, command):
627
391
"""The checker has completed, so take appropriate actions."""
628
392
self.checker_callback_tag = None
629
393
self.checker = None
630
394
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
632
if self.last_checker_status == 0:
633
logger.info("Checker for %(name)s succeeded",
395
exitstatus = os.WEXITSTATUS(condition)
396
if exitstatus == 0:
397
logger.info(u"Checker for %(name)s succeeded",
634
398
vars(self))
635
399
self.checked_ok()
636
400
else:
637
logger.info("Checker for %(name)s failed",
401
logger.info(u"Checker for %(name)s failed",
638
402
vars(self))
639
403
else:
640
self.last_checker_status = -1
641
logger.warning("Checker for %(name)s crashed?",
404
logger.warning(u"Checker for %(name)s crashed?",
642
405
vars(self))
643
406
644
407
def checked_ok(self):
645
"""Assert that the client has been seen, alive and well."""
408
"""Bump up the timeout for this client.
409
410
This should only be called when the client has been seen,
411
alive and well.
412
"""
646
413
self.last_checked_ok = datetime.datetime.utcnow()
647
self.last_checker_status = 0
648
self.bump_timeout()
649
650
def bump_timeout(self, timeout=None):
651
"""Bump up the timeout for this client."""
652
if timeout is None:
653
timeout = self.timeout
654
if self.disable_initiator_tag is not None:
655
gobject.source_remove(self.disable_initiator_tag)
656
self.disable_initiator_tag = None
657
if getattr(self, "enabled", False):
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
661
self.expires = datetime.datetime.utcnow() + timeout
662
663
def need_approval(self):
664
self.last_approval_request = datetime.datetime.utcnow()
414
gobject.source_remove(self.disable_initiator_tag)
415
self.disable_initiator_tag = (gobject.timeout_add
416
(self.timeout_milliseconds(),
417
self.disable))
665
418
666
419
def start_checker(self):
667
420
"""Start a new checker subprocess if one is not running.
669
422
If a checker already exists, leave it running and do
670
423
nothing."""
671
424
# The reason for not killing a running checker is that if we
672
# did that, and if a checker (for some reason) started running
673
# slowly and taking more than 'interval' time, then the client
674
# would inevitably timeout, since no checker would get a
675
# chance to run to completion. If we instead leave running
425
# did that, then if a checker (for some reason) started
426
# running slowly and taking more than 'interval' time, the
427
# client would inevitably timeout, since no checker would get
428
# a chance to run to completion. If we instead leave running
676
429
# checkers alone, the checker would have to take more time
677
430
# than 'timeout' for the client to be disabled, which is as it
678
431
# should be.
680
433
# If a checker exists, make sure it is not a zombie
681
434
try:
682
435
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
436
except (AttributeError, OSError), error:
684
437
if (isinstance(error, OSError)
685
438
and error.errno != errno.ECHILD):
686
439
raise error
687
440
else:
688
441
if pid:
689
logger.warning("Checker was a zombie")
442
logger.warning(u"Checker was a zombie")
690
443
gobject.source_remove(self.checker_callback_tag)
691
444
self.checker_callback(pid, status,
692
445
self.current_checker_command)
693
446
# Start a new checker if needed
694
447
if self.checker is None:
695
# Escape attributes for the shell
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
698
for attr in
699
self.runtime_expansions)
700
448
try:
701
command = self.checker_command % escaped_attrs
702
except TypeError as error:
703
logger.error('Could not format string "%s"',
704
self.checker_command, exc_info=error)
705
return True # Try again later
449
# In case checker_command has exactly one % operator
450
command = self.checker_command % self.host
451
except TypeError:
452
# Escape attributes for the shell
453
escaped_attrs = dict((key,
454
re.escape(unicode(str(val),
455
errors=
456
u'replace')))
457
for key, val in
458
vars(self).iteritems())
459
try:
460
command = self.checker_command % escaped_attrs
461
except TypeError, error:
462
logger.error(u'Could not format string "%s":'
463
u' %s', self.checker_command, error)
464
return True # Try again later
706
465
self.current_checker_command = command
707
466
try:
708
logger.info("Starting checker %r for %s",
467
logger.info(u"Starting checker %r for %s",
709
468
command, self.name)
710
469
# We don't need to redirect stdout and stderr, since
711
470
# in normal mode, that is already done by daemon(),
713
472
# always replaced by /dev/null.)
714
473
self.checker = subprocess.Popen(command,
715
474
close_fds=True,
716
shell=True, cwd="/")
717
except OSError as error:
718
logger.error("Failed to start subprocess",
719
exc_info=error)
720
self.checker_callback_tag = (gobject.child_watch_add
721
(self.checker.pid,
722
self.checker_callback,
723
data=command))
724
# The checker may have completed before the gobject
725
# watch was added. Check for this.
726
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
727
if pid:
728
gobject.source_remove(self.checker_callback_tag)
729
self.checker_callback(pid, status, command)
475
shell=True, cwd=u"/")
476
self.checker_callback_tag = (gobject.child_watch_add
477
(self.checker.pid,
478
self.checker_callback,
479
data=command))
480
# The checker may have completed before the gobject
481
# watch was added. Check for this.
482
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
483
if pid:
484
gobject.source_remove(self.checker_callback_tag)
485
self.checker_callback(pid, status, command)
486
except OSError, error:
487
logger.error(u"Failed to start subprocess: %s",
488
error)
730
489
# Re-run this periodically if run by gobject.timeout_add
731
490
return True
732
491
735
494
if self.checker_callback_tag:
736
495
gobject.source_remove(self.checker_callback_tag)
737
496
self.checker_callback_tag = None
738
if getattr(self, "checker", None) is None:
497
if getattr(self, u"checker", None) is None:
739
498
return
740
logger.debug("Stopping checker for %(name)s", vars(self))
499
logger.debug(u"Stopping checker for %(name)s", vars(self))
741
500
try:
742
self.checker.terminate()
501
os.kill(self.checker.pid, signal.SIGTERM)
743
502
#time.sleep(0.5)
744
503
#if self.checker.poll() is None:
745
# self.checker.kill()
746
except OSError as error:
504
# os.kill(self.checker.pid, signal.SIGKILL)
505
except OSError, error:
747
506
if error.errno != errno.ESRCH: # No such process
748
507
raise
749
508
self.checker = None
750
509
751
752
def dbus_service_property(dbus_interface, signature="v",
753
access="readwrite", byte_arrays=False):
510
def dbus_service_property(dbus_interface, signature=u"v",
511
access=u"readwrite", byte_arrays=False):
754
512
"""Decorators for marking methods of a DBusObjectWithProperties to
755
513
become properties on the D-Bus.
756
514
763
521
"""
764
522
# Encoding deeply encoded byte arrays is not supported yet by the
765
523
# "Set" method, so we fail early here:
766
if byte_arrays and signature != "ay":
767
raise ValueError("Byte arrays not supported for non-'ay'"
768
" signature {0!r}".format(signature))
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
769
527
def decorator(func):
770
528
func._dbus_is_property = True
771
529
func._dbus_interface = dbus_interface
772
530
func._dbus_signature = signature
773
531
func._dbus_access = access
774
532
func._dbus_name = func.__name__
775
if func._dbus_name.endswith("_dbus_property"):
533
if func._dbus_name.endswith(u"_dbus_property"):
776
534
func._dbus_name = func._dbus_name[:-14]
777
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
778
return func
779
return decorator
780
781
782
def dbus_interface_annotations(dbus_interface):
783
"""Decorator for marking functions returning interface annotations
784
785
Usage:
786
787
@dbus_interface_annotations("org.example.Interface")
788
def _foo(self): # Function name does not matter
789
return {"org.freedesktop.DBus.Deprecated": "true",
790
"org.freedesktop.DBus.Property.EmitsChangedSignal":
791
"false"}
792
"""
793
def decorator(func):
794
func._dbus_is_interface = True
795
func._dbus_interface = dbus_interface
796
func._dbus_name = dbus_interface
797
return func
798
return decorator
799
800
801
def dbus_annotations(annotations):
802
"""Decorator to annotate D-Bus methods, signals or properties
803
Usage:
804
805
@dbus_service_property("org.example.Interface", signature="b",
806
access="r")
807
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
808
"org.freedesktop.DBus.Property."
809
"EmitsChangedSignal": "false"})
810
def Property_dbus_property(self):
811
return dbus.Boolean(False)
812
"""
813
def decorator(func):
814
func._dbus_annotations = annotations
535
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
815
536
return func
816
537
return decorator
817
538
837
558
838
559
class DBusObjectWithProperties(dbus.service.Object):
839
560
"""A D-Bus object with properties.
840
561
841
562
Classes inheriting from this can use the dbus_service_property
842
563
decorator to expose methods as D-Bus properties. It exposes the
843
564
standard Get(), Set(), and GetAll() methods on the D-Bus.
844
565
"""
845
566
846
567
@staticmethod
847
def _is_dbus_thing(thing):
848
"""Returns a function testing if an attribute is a D-Bus thing
849
850
If called like _is_dbus_thing("method") it returns a function
851
suitable for use as predicate to inspect.getmembers().
852
"""
853
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
854
False)
568
def _is_dbus_property(obj):
569
return getattr(obj, u"_dbus_is_property", False)
855
570
856
def _get_all_dbus_things(self, thing):
571
def _get_all_dbus_properties(self):
857
572
"""Returns a generator of (name, attribute) pairs
858
573
"""
859
return ((getattr(athing.__get__(self), "_dbus_name",
860
name),
861
athing.__get__(self))
862
for cls in self.__class__.__mro__
863
for name, athing in
864
inspect.getmembers(cls,
865
self._is_dbus_thing(thing)))
574
return ((prop._dbus_name, prop)
575
for name, prop in
576
inspect.getmembers(self, self._is_dbus_property))
866
577
867
578
def _get_dbus_property(self, interface_name, property_name):
868
579
"""Returns a bound method if one exists which is a D-Bus
869
580
property with the specified name and interface.
870
581
"""
871
for cls in self.__class__.__mro__:
872
for name, value in (inspect.getmembers
873
(cls,
874
self._is_dbus_thing("property"))):
875
if (value._dbus_name == property_name
876
and value._dbus_interface == interface_name):
877
return value.__get__(self)
878
582
for name in (property_name,
583
property_name + u"_dbus_property"):
584
prop = getattr(self, name, None)
585
if (prop is None
586
or not self._is_dbus_property(prop)
587
or prop._dbus_name != property_name
588
or (interface_name and prop._dbus_interface
589
and interface_name != prop._dbus_interface)):
590
continue
591
return prop
879
592
# No such property
880
raise DBusPropertyNotFound(self.dbus_object_path + ":"
881
+ interface_name + "."
593
raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
+ interface_name + u"."
882
595
+ property_name)
883
596
884
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
885
out_signature="v")
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
598
out_signature=u"v")
886
599
def Get(self, interface_name, property_name):
887
600
"""Standard D-Bus property Get() method, see D-Bus standard.
888
601
"""
889
602
prop = self._get_dbus_property(interface_name, property_name)
890
if prop._dbus_access == "write":
603
if prop._dbus_access == u"write":
891
604
raise DBusPropertyAccessException(property_name)
892
605
value = prop()
893
if not hasattr(value, "variant_level"):
606
if not hasattr(value, u"variant_level"):
894
607
return value
895
608
return type(value)(value, variant_level=value.variant_level+1)
896
609
897
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
898
611
def Set(self, interface_name, property_name, value):
899
612
"""Standard D-Bus property Set() method, see D-Bus standard.
900
613
"""
901
614
prop = self._get_dbus_property(interface_name, property_name)
902
if prop._dbus_access == "read":
615
if prop._dbus_access == u"read":
903
616
raise DBusPropertyAccessException(property_name)
904
if prop._dbus_get_args_options["byte_arrays"]:
617
if prop._dbus_get_args_options[u"byte_arrays"]:
905
618
# The byte_arrays option is not supported yet on
906
619
# signatures other than "ay".
907
if prop._dbus_signature != "ay":
620
if prop._dbus_signature != u"ay":
908
621
raise ValueError
909
value = dbus.ByteArray(b''.join(chr(byte)
910
for byte in value))
622
value = dbus.ByteArray(''.join(unichr(byte)
623
for byte in value))
911
624
prop(value)
912
625
913
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
914
out_signature="a{sv}")
626
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
out_signature=u"a{sv}")
915
628
def GetAll(self, interface_name):
916
629
"""Standard D-Bus property GetAll() method, see D-Bus
917
630
standard.
918
631
919
632
Note: Will not include properties with access="write".
920
633
"""
921
properties = {}
922
for name, prop in self._get_all_dbus_things("property"):
634
all = {}
635
for name, prop in self._get_all_dbus_properties():
923
636
if (interface_name
924
637
and interface_name != prop._dbus_interface):
925
638
# Interface non-empty but did not match
926
639
continue
927
640
# Ignore write-only properties
928
if prop._dbus_access == "write":
641
if prop._dbus_access == u"write":
929
642
continue
930
643
value = prop()
931
if not hasattr(value, "variant_level"):
932
properties[name] = value
644
if not hasattr(value, u"variant_level"):
645
all[name] = value
933
646
continue
934
properties[name] = type(value)(value, variant_level=
935
value.variant_level+1)
936
return dbus.Dictionary(properties, signature="sv")
647
all[name] = type(value)(value, variant_level=
648
value.variant_level+1)
649
return dbus.Dictionary(all, signature=u"sv")
937
650
938
651
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
939
out_signature="s",
652
out_signature=u"s",
940
653
path_keyword='object_path',
941
654
connection_keyword='connection')
942
655
def Introspect(self, object_path, connection):
943
"""Overloading of standard D-Bus method.
944
945
Inserts property tags and interface annotation tags.
656
"""Standard D-Bus method, overloaded to insert property tags.
946
657
"""
947
658
xmlstring = dbus.service.Object.Introspect(self, object_path,
948
659
connection)
949
660
try:
950
661
document = xml.dom.minidom.parseString(xmlstring)
951
662
def make_tag(document, name, prop):
952
e = document.createElement("property")
953
e.setAttribute("name", name)
954
e.setAttribute("type", prop._dbus_signature)
955
e.setAttribute("access", prop._dbus_access)
663
e = document.createElement(u"property")
664
e.setAttribute(u"name", name)
665
e.setAttribute(u"type", prop._dbus_signature)
666
e.setAttribute(u"access", prop._dbus_access)
956
667
return e
957
for if_tag in document.getElementsByTagName("interface"):
958
# Add property tags
668
for if_tag in document.getElementsByTagName(u"interface"):
959
669
for tag in (make_tag(document, name, prop)
960
670
for name, prop
961
in self._get_all_dbus_things("property")
671
in self._get_all_dbus_properties()
962
672
if prop._dbus_interface
963
== if_tag.getAttribute("name")):
673
== if_tag.getAttribute(u"name")):
964
674
if_tag.appendChild(tag)
965
# Add annotation tags
966
for typ in ("method", "signal", "property"):
967
for tag in if_tag.getElementsByTagName(typ):
968
annots = dict()
969
for name, prop in (self.
970
_get_all_dbus_things(typ)):
971
if (name == tag.getAttribute("name")
972
and prop._dbus_interface
973
== if_tag.getAttribute("name")):
974
annots.update(getattr
975
(prop,
976
"_dbus_annotations",
977
{}))
978
for name, value in annots.iteritems():
979
ann_tag = document.createElement(
980
"annotation")
981
ann_tag.setAttribute("name", name)
982
ann_tag.setAttribute("value", value)
983
tag.appendChild(ann_tag)
984
# Add interface annotation tags
985
for annotation, value in dict(
986
itertools.chain.from_iterable(
987
annotations().iteritems()
988
for name, annotations in
989
self._get_all_dbus_things("interface")
990
if name == if_tag.getAttribute("name")
991
)).iteritems():
992
ann_tag = document.createElement("annotation")
993
ann_tag.setAttribute("name", annotation)
994
ann_tag.setAttribute("value", value)
995
if_tag.appendChild(ann_tag)
996
675
# Add the names to the return values for the
997
676
# "org.freedesktop.DBus.Properties" methods
998
if (if_tag.getAttribute("name")
999
== "org.freedesktop.DBus.Properties"):
1000
for cn in if_tag.getElementsByTagName("method"):
1001
if cn.getAttribute("name") == "Get":
1002
for arg in cn.getElementsByTagName("arg"):
1003
if (arg.getAttribute("direction")
1004
== "out"):
1005
arg.setAttribute("name", "value")
1006
elif cn.getAttribute("name") == "GetAll":
1007
for arg in cn.getElementsByTagName("arg"):
1008
if (arg.getAttribute("direction")
1009
== "out"):
1010
arg.setAttribute("name", "props")
1011
xmlstring = document.toxml("utf-8")
677
if (if_tag.getAttribute(u"name")
678
== u"org.freedesktop.DBus.Properties"):
679
for cn in if_tag.getElementsByTagName(u"method"):
680
if cn.getAttribute(u"name") == u"Get":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
683
== u"out"):
684
arg.setAttribute(u"name", u"value")
685
elif cn.getAttribute(u"name") == u"GetAll":
686
for arg in cn.getElementsByTagName(u"arg"):
687
if (arg.getAttribute(u"direction")
688
== u"out"):
689
arg.setAttribute(u"name", u"props")
690
xmlstring = document.toxml(u"utf-8")
1012
691
document.unlink()
1013
692
except (AttributeError, xml.dom.DOMException,
1014
xml.parsers.expat.ExpatError) as error:
1015
logger.error("Failed to override Introspection method",
1016
exc_info=error)
693
xml.parsers.expat.ExpatError), error:
694
logger.error(u"Failed to override Introspection method",
695
error)
1017
696
return xmlstring
1018
697
1019
698
1020
def datetime_to_dbus(dt, variant_level=0):
1021
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1022
if dt is None:
1023
return dbus.String("", variant_level = variant_level)
1024
return dbus.String(dt.isoformat(),
1025
variant_level=variant_level)
1026
1027
1028
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1029
"""A class decorator; applied to a subclass of
1030
dbus.service.Object, it will add alternate D-Bus attributes with
1031
interface names according to the "alt_interface_names" mapping.
1032
Usage:
1033
1034
@alternate_dbus_interfaces({"org.example.Interface":
1035
"net.example.AlternateInterface"})
1036
class SampleDBusObject(dbus.service.Object):
1037
@dbus.service.method("org.example.Interface")
1038
def SampleDBusMethod():
1039
pass
1040
1041
The above "SampleDBusMethod" on "SampleDBusObject" will be
1042
reachable via two interfaces: "org.example.Interface" and
1043
"net.example.AlternateInterface", the latter of which will have
1044
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1045
"true", unless "deprecate" is passed with a False value.
1046
1047
This works for methods and signals, and also for D-Bus properties
1048
(from DBusObjectWithProperties) and interfaces (from the
1049
dbus_interface_annotations decorator).
1050
"""
1051
def wrapper(cls):
1052
for orig_interface_name, alt_interface_name in (
1053
alt_interface_names.iteritems()):
1054
attr = {}
1055
interface_names = set()
1056
# Go though all attributes of the class
1057
for attrname, attribute in inspect.getmembers(cls):
1058
# Ignore non-D-Bus attributes, and D-Bus attributes
1059
# with the wrong interface name
1060
if (not hasattr(attribute, "_dbus_interface")
1061
or not attribute._dbus_interface
1062
.startswith(orig_interface_name)):
1063
continue
1064
# Create an alternate D-Bus interface name based on
1065
# the current name
1066
alt_interface = (attribute._dbus_interface
1067
.replace(orig_interface_name,
1068
alt_interface_name))
1069
interface_names.add(alt_interface)
1070
# Is this a D-Bus signal?
1071
if getattr(attribute, "_dbus_is_signal", False):
1072
# Extract the original non-method function by
1073
# black magic
1074
nonmethod_func = (dict(
1075
zip(attribute.func_code.co_freevars,
1076
attribute.__closure__))["func"]
1077
.cell_contents)
1078
# Create a new, but exactly alike, function
1079
# object, and decorate it to be a new D-Bus signal
1080
# with the alternate D-Bus interface name
1081
new_function = (dbus.service.signal
1082
(alt_interface,
1083
attribute._dbus_signature)
1084
(types.FunctionType(
1085
nonmethod_func.func_code,
1086
nonmethod_func.func_globals,
1087
nonmethod_func.func_name,
1088
nonmethod_func.func_defaults,
1089
nonmethod_func.func_closure)))
1090
# Copy annotations, if any
1091
try:
1092
new_function._dbus_annotations = (
1093
dict(attribute._dbus_annotations))
1094
except AttributeError:
1095
pass
1096
# Define a creator of a function to call both the
1097
# original and alternate functions, so both the
1098
# original and alternate signals gets sent when
1099
# the function is called
1100
def fixscope(func1, func2):
1101
"""This function is a scope container to pass
1102
func1 and func2 to the "call_both" function
1103
outside of its arguments"""
1104
def call_both(*args, **kwargs):
1105
"""This function will emit two D-Bus
1106
signals by calling func1 and func2"""
1107
func1(*args, **kwargs)
1108
func2(*args, **kwargs)
1109
return call_both
1110
# Create the "call_both" function and add it to
1111
# the class
1112
attr[attrname] = fixscope(attribute, new_function)
1113
# Is this a D-Bus method?
1114
elif getattr(attribute, "_dbus_is_method", False):
1115
# Create a new, but exactly alike, function
1116
# object. Decorate it to be a new D-Bus method
1117
# with the alternate D-Bus interface name. Add it
1118
# to the class.
1119
attr[attrname] = (dbus.service.method
1120
(alt_interface,
1121
attribute._dbus_in_signature,
1122
attribute._dbus_out_signature)
1123
(types.FunctionType
1124
(attribute.func_code,
1125
attribute.func_globals,
1126
attribute.func_name,
1127
attribute.func_defaults,
1128
attribute.func_closure)))
1129
# Copy annotations, if any
1130
try:
1131
attr[attrname]._dbus_annotations = (
1132
dict(attribute._dbus_annotations))
1133
except AttributeError:
1134
pass
1135
# Is this a D-Bus property?
1136
elif getattr(attribute, "_dbus_is_property", False):
1137
# Create a new, but exactly alike, function
1138
# object, and decorate it to be a new D-Bus
1139
# property with the alternate D-Bus interface
1140
# name. Add it to the class.
1141
attr[attrname] = (dbus_service_property
1142
(alt_interface,
1143
attribute._dbus_signature,
1144
attribute._dbus_access,
1145
attribute
1146
._dbus_get_args_options
1147
["byte_arrays"])
1148
(types.FunctionType
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1154
# Copy annotations, if any
1155
try:
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1158
except AttributeError:
1159
pass
1160
# Is this a D-Bus interface?
1161
elif getattr(attribute, "_dbus_is_interface", False):
1162
# Create a new, but exactly alike, function
1163
# object. Decorate it to be a new D-Bus interface
1164
# with the alternate D-Bus interface name. Add it
1165
# to the class.
1166
attr[attrname] = (dbus_interface_annotations
1167
(alt_interface)
1168
(types.FunctionType
1169
(attribute.func_code,
1170
attribute.func_globals,
1171
attribute.func_name,
1172
attribute.func_defaults,
1173
attribute.func_closure)))
1174
if deprecate:
1175
# Deprecate all alternate interfaces
1176
iname="_AlternateDBusNames_interface_annotation{0}"
1177
for interface_name in interface_names:
1178
@dbus_interface_annotations(interface_name)
1179
def func(self):
1180
return { "org.freedesktop.DBus.Deprecated":
1181
"true" }
1182
# Find an unused name
1183
for aname in (iname.format(i)
1184
for i in itertools.count()):
1185
if aname not in attr:
1186
attr[aname] = func
1187
break
1188
if interface_names:
1189
# Replace the class with a new subclass of it with
1190
# methods, signals, etc. as created above.
1191
cls = type(b"{0}Alternate".format(cls.__name__),
1192
(cls,), attr)
1193
return cls
1194
return wrapper
1195
1196
1197
@alternate_dbus_interfaces({"se.recompile.Mandos":
1198
"se.bsnet.fukt.Mandos"})
1199
699
class ClientDBus(Client, DBusObjectWithProperties):
1200
700
"""A Client class using D-Bus
1201
701
1203
703
dbus_object_path: dbus.ObjectPath
1204
704
bus: dbus.SystemBus()
1205
705
"""
1206
1207
runtime_expansions = (Client.runtime_expansions
1208
+ ("dbus_object_path",))
1209
1210
706
# dbus.service.Object doesn't use super(), so we can't either.
1211
707
1212
708
def __init__(self, bus = None, *args, **kwargs):
709
self._approvals_pending = 0
1213
710
self.bus = bus
1214
711
Client.__init__(self, *args, **kwargs)
1215
712
# Only now, when this client is initialized, can it show up on
1216
713
# the D-Bus
1217
client_object_name = unicode(self.name).translate(
1218
{ord("."): ord("_"),
1219
ord("-"): ord("_")})
1220
714
self.dbus_object_path = (dbus.ObjectPath
1221
("/clients/" + client_object_name))
715
(u"/clients/"
716
+ self.name.replace(u".", u"_")))
1222
717
DBusObjectWithProperties.__init__(self, self.bus,
1223
718
self.dbus_object_path)
1224
1225
def notifychangeproperty(transform_func,
1226
dbus_name, type_func=lambda x: x,
1227
variant_level=1):
1228
""" Modify a variable so that it's a property which announces
1229
its changes to DBus.
1230
1231
transform_fun: Function that takes a value and a variant_level
1232
and transforms it to a D-Bus type.
1233
dbus_name: D-Bus name of the variable
1234
type_func: Function that transform the value before sending it
1235
to the D-Bus. Default: no transform
1236
variant_level: D-Bus variant level. Default: 1
1237
"""
1238
attrname = "_{0}".format(dbus_name)
1239
def setter(self, value):
1240
if hasattr(self, "dbus_object_path"):
1241
if (not hasattr(self, attrname) or
1242
type_func(getattr(self, attrname, None))
1243
!= type_func(value)):
1244
dbus_value = transform_func(type_func(value),
1245
variant_level
1246
=variant_level)
1247
self.PropertyChanged(dbus.String(dbus_name),
1248
dbus_value)
1249
setattr(self, attrname, value)
1250
1251
return property(lambda self: getattr(self, attrname), setter)
1252
1253
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1254
approvals_pending = notifychangeproperty(dbus.Boolean,
1255
"ApprovalPending",
1256
type_func = bool)
1257
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1258
last_enabled = notifychangeproperty(datetime_to_dbus,
1259
"LastEnabled")
1260
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1261
type_func = lambda checker:
1262
checker is not None)
1263
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1264
"LastCheckedOK")
1265
last_checker_status = notifychangeproperty(dbus.Int16,
1266
"LastCheckerStatus")
1267
last_approval_request = notifychangeproperty(
1268
datetime_to_dbus, "LastApprovalRequest")
1269
approved_by_default = notifychangeproperty(dbus.Boolean,
1270
"ApprovedByDefault")
1271
approval_delay = notifychangeproperty(dbus.UInt64,
1272
"ApprovalDelay",
1273
type_func =
1274
timedelta_to_milliseconds)
1275
approval_duration = notifychangeproperty(
1276
dbus.UInt64, "ApprovalDuration",
1277
type_func = timedelta_to_milliseconds)
1278
host = notifychangeproperty(dbus.String, "Host")
1279
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
type_func =
1281
timedelta_to_milliseconds)
1282
extended_timeout = notifychangeproperty(
1283
dbus.UInt64, "ExtendedTimeout",
1284
type_func = timedelta_to_milliseconds)
1285
interval = notifychangeproperty(dbus.UInt64,
1286
"Interval",
1287
type_func =
1288
timedelta_to_milliseconds)
1289
checker_command = notifychangeproperty(dbus.String, "Checker")
1290
1291
del notifychangeproperty
719
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
725
bval = bool(value)
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
dbus_bool)
731
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
735
736
@staticmethod
737
def _datetime_to_dbus(dt, variant_level=0):
738
"""Convert a UTC datetime.datetime() to a D-Bus type."""
739
return dbus.String(dt.isoformat(),
740
variant_level=variant_level)
741
742
def enable(self):
743
oldstate = getattr(self, u"enabled", False)
744
r = Client.enable(self)
745
if oldstate != self.enabled:
746
# Emit D-Bus signals
747
self.PropertyChanged(dbus.String(u"Enabled"),
748
dbus.Boolean(True, variant_level=1))
749
self.PropertyChanged(
750
dbus.String(u"LastEnabled"),
751
self._datetime_to_dbus(self.last_enabled,
752
variant_level=1))
753
return r
754
755
def disable(self, quiet = False):
756
oldstate = getattr(self, u"enabled", False)
757
r = Client.disable(self, quiet=quiet)
758
if not quiet and oldstate != self.enabled:
759
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"Enabled"),
761
dbus.Boolean(False, variant_level=1))
762
return r
1292
763
1293
764
def __del__(self, *args, **kwargs):
1294
765
try:
1295
766
self.remove_from_connection()
1296
767
except LookupError:
1297
768
pass
1298
if hasattr(DBusObjectWithProperties, "__del__"):
769
if hasattr(DBusObjectWithProperties, u"__del__"):
1299
770
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1300
771
Client.__del__(self, *args, **kwargs)
1301
772
1303
774
*args, **kwargs):
1304
775
self.checker_callback_tag = None
1305
776
self.checker = None
777
# Emit D-Bus signal
778
self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
dbus.Boolean(False, variant_level=1))
1306
780
if os.WIFEXITED(condition):
1307
781
exitstatus = os.WEXITSTATUS(condition)
1308
782
# Emit D-Bus signal
1318
792
return Client.checker_callback(self, pid, condition, command,
1319
793
*args, **kwargs)
1320
794
795
def checked_ok(self, *args, **kwargs):
796
r = Client.checked_ok(self, *args, **kwargs)
797
# Emit D-Bus signal
798
self.PropertyChanged(
799
dbus.String(u"LastCheckedOK"),
800
(self._datetime_to_dbus(self.last_checked_ok,
801
variant_level=1)))
802
return r
803
1321
804
def start_checker(self, *args, **kwargs):
1322
805
old_checker = self.checker
1323
806
if self.checker is not None:
1330
813
and old_checker_pid != self.checker.pid):
1331
814
# Emit D-Bus signal
1332
815
self.CheckerStarted(self.current_checker_command)
816
self.PropertyChanged(
817
dbus.String(u"CheckerRunning"),
818
dbus.Boolean(True, variant_level=1))
1333
819
return r
1334
820
821
def stop_checker(self, *args, **kwargs):
822
old_checker = getattr(self, u"checker", None)
823
r = Client.stop_checker(self, *args, **kwargs)
824
if (old_checker is not None
825
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"CheckerRunning"),
827
dbus.Boolean(False, variant_level=1))
828
return r
829
1335
830
def _reset_approved(self):
1336
self.approved = None
831
self._approved = None
1337
832
return False
1338
833
1339
834
def approve(self, value=True):
1340
self.approved = value
1341
gobject.timeout_add(timedelta_to_milliseconds
835
self.send_changedstate()
836
self._approved = value
837
gobject.timeout_add(self._timedelta_to_milliseconds
1342
838
(self.approval_duration),
1343
839
self._reset_approved)
1344
self.send_changedstate()
840
1345
841
1346
842
## D-Bus methods, signals & properties
1347
_interface = "se.recompile.Mandos.Client"
1348
1349
## Interfaces
1350
1351
@dbus_interface_annotations(_interface)
1352
def _foo(self):
1353
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1354
"false"}
843
_interface = u"se.bsnet.fukt.Mandos.Client"
1355
844
1356
845
## Signals
1357
846
1358
847
# CheckerCompleted - signal
1359
@dbus.service.signal(_interface, signature="nxs")
848
@dbus.service.signal(_interface, signature=u"nxs")
1360
849
def CheckerCompleted(self, exitcode, waitstatus, command):
1361
850
"D-Bus signal"
1362
851
pass
1363
852
1364
853
# CheckerStarted - signal
1365
@dbus.service.signal(_interface, signature="s")
854
@dbus.service.signal(_interface, signature=u"s")
1366
855
def CheckerStarted(self, command):
1367
856
"D-Bus signal"
1368
857
pass
1369
858
1370
859
# PropertyChanged - signal
1371
@dbus.service.signal(_interface, signature="sv")
860
@dbus.service.signal(_interface, signature=u"sv")
1372
861
def PropertyChanged(self, property, value):
1373
862
"D-Bus signal"
1374
863
pass
1383
872
pass
1384
873
1385
874
# Rejected - signal
1386
@dbus.service.signal(_interface, signature="s")
875
@dbus.service.signal(_interface, signature=u"s")
1387
876
def Rejected(self, reason):
1388
877
"D-Bus signal"
1389
878
pass
1390
879
1391
880
# NeedApproval - signal
1392
@dbus.service.signal(_interface, signature="tb")
881
@dbus.service.signal(_interface, signature=u"tb")
1393
882
def NeedApproval(self, timeout, default):
1394
883
"D-Bus signal"
1395
return self.need_approval()
884
pass
1396
885
1397
886
## Methods
1398
887
1399
888
# Approve - method
1400
@dbus.service.method(_interface, in_signature="b")
889
@dbus.service.method(_interface, in_signature=u"b")
1401
890
def Approve(self, value):
1402
891
self.approve(value)
1403
892
1404
893
# CheckedOK - method
1405
894
@dbus.service.method(_interface)
1406
895
def CheckedOK(self):
1407
self.checked_ok()
896
return self.checked_ok()
1408
897
1409
898
# Enable - method
1410
899
@dbus.service.method(_interface)
1432
921
## Properties
1433
922
1434
923
# ApprovalPending - property
1435
@dbus_service_property(_interface, signature="b", access="read")
924
@dbus_service_property(_interface, signature=u"b", access=u"read")
1436
925
def ApprovalPending_dbus_property(self):
1437
926
return dbus.Boolean(bool(self.approvals_pending))
1438
927
1439
928
# ApprovedByDefault - property
1440
@dbus_service_property(_interface, signature="b",
1441
access="readwrite")
929
@dbus_service_property(_interface, signature=u"b",
930
access=u"readwrite")
1442
931
def ApprovedByDefault_dbus_property(self, value=None):
1443
932
if value is None: # get
1444
933
return dbus.Boolean(self.approved_by_default)
1445
934
self.approved_by_default = bool(value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
dbus.Boolean(value, variant_level=1))
1446
938
1447
939
# ApprovalDelay - property
1448
@dbus_service_property(_interface, signature="t",
1449
access="readwrite")
940
@dbus_service_property(_interface, signature=u"t",
941
access=u"readwrite")
1450
942
def ApprovalDelay_dbus_property(self, value=None):
1451
943
if value is None: # get
1452
944
return dbus.UInt64(self.approval_delay_milliseconds())
1453
945
self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
# Emit D-Bus signal
947
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
dbus.UInt64(value, variant_level=1))
1454
949
1455
950
# ApprovalDuration - property
1456
@dbus_service_property(_interface, signature="t",
1457
access="readwrite")
951
@dbus_service_property(_interface, signature=u"t",
952
access=u"readwrite")
1458
953
def ApprovalDuration_dbus_property(self, value=None):
1459
954
if value is None: # get
1460
return dbus.UInt64(timedelta_to_milliseconds(
955
return dbus.UInt64(self._timedelta_to_milliseconds(
1461
956
self.approval_duration))
1462
957
self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
dbus.UInt64(value, variant_level=1))
1463
961
1464
962
# Name - property
1465
@dbus_service_property(_interface, signature="s", access="read")
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
1466
964
def Name_dbus_property(self):
1467
965
return dbus.String(self.name)
1468
966
1469
967
# Fingerprint - property
1470
@dbus_service_property(_interface, signature="s", access="read")
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
1471
969
def Fingerprint_dbus_property(self):
1472
970
return dbus.String(self.fingerprint)
1473
971
1474
972
# Host - property
1475
@dbus_service_property(_interface, signature="s",
1476
access="readwrite")
973
@dbus_service_property(_interface, signature=u"s",
974
access=u"readwrite")
1477
975
def Host_dbus_property(self, value=None):
1478
976
if value is None: # get
1479
977
return dbus.String(self.host)
1480
self.host = unicode(value)
978
self.host = value
979
# Emit D-Bus signal
980
self.PropertyChanged(dbus.String(u"Host"),
981
dbus.String(value, variant_level=1))
1481
982
1482
983
# Created - property
1483
@dbus_service_property(_interface, signature="s", access="read")
984
@dbus_service_property(_interface, signature=u"s", access=u"read")
1484
985
def Created_dbus_property(self):
1485
return datetime_to_dbus(self.created)
986
return dbus.String(self._datetime_to_dbus(self.created))
1486
987
1487
988
# LastEnabled - property
1488
@dbus_service_property(_interface, signature="s", access="read")
989
@dbus_service_property(_interface, signature=u"s", access=u"read")
1489
990
def LastEnabled_dbus_property(self):
1490
return datetime_to_dbus(self.last_enabled)
991
if self.last_enabled is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1491
994
1492
995
# Enabled - property
1493
@dbus_service_property(_interface, signature="b",
1494
access="readwrite")
996
@dbus_service_property(_interface, signature=u"b",
997
access=u"readwrite")
1495
998
def Enabled_dbus_property(self, value=None):
1496
999
if value is None: # get
1497
1000
return dbus.Boolean(self.enabled)
1501
1004
self.disable()
1502
1005
1503
1006
# LastCheckedOK - property
1504
@dbus_service_property(_interface, signature="s",
1505
access="readwrite")
1007
@dbus_service_property(_interface, signature=u"s",
1008
access=u"readwrite")
1506
1009
def LastCheckedOK_dbus_property(self, value=None):
1507
1010
if value is not None:
1508
1011
self.checked_ok()
1509
1012
return
1510
return datetime_to_dbus(self.last_checked_ok)
1511
1512
# LastCheckerStatus - property
1513
@dbus_service_property(_interface, signature="n",
1514
access="read")
1515
def LastCheckerStatus_dbus_property(self):
1516
return dbus.Int16(self.last_checker_status)
1517
1518
# Expires - property
1519
@dbus_service_property(_interface, signature="s", access="read")
1520
def Expires_dbus_property(self):
1521
return datetime_to_dbus(self.expires)
1522
1523
# LastApprovalRequest - property
1524
@dbus_service_property(_interface, signature="s", access="read")
1525
def LastApprovalRequest_dbus_property(self):
1526
return datetime_to_dbus(self.last_approval_request)
1013
if self.last_checked_ok is None:
1014
return dbus.String(u"")
1015
return dbus.String(self._datetime_to_dbus(self
1016
.last_checked_ok))
1527
1017
1528
1018
# Timeout - property
1529
@dbus_service_property(_interface, signature="t",
1530
access="readwrite")
1019
@dbus_service_property(_interface, signature=u"t",
1020
access=u"readwrite")
1531
1021
def Timeout_dbus_property(self, value=None):
1532
1022
if value is None: # get
1533
1023
return dbus.UInt64(self.timeout_milliseconds())
1534
old_timeout = self.timeout
1535
1024
self.timeout = datetime.timedelta(0, 0, 0, value)
1536
# Reschedule disabling
1537
if self.enabled:
1538
now = datetime.datetime.utcnow()
1539
self.expires += self.timeout - old_timeout
1540
if self.expires <= now:
1541
# The timeout has passed
1542
self.disable()
1543
else:
1544
if (getattr(self, "disable_initiator_tag", None)
1545
is None):
1546
return
1547
gobject.source_remove(self.disable_initiator_tag)
1548
self.disable_initiator_tag = (
1549
gobject.timeout_add(
1550
timedelta_to_milliseconds(self.expires - now),
1551
self.disable))
1552
1553
# ExtendedTimeout - property
1554
@dbus_service_property(_interface, signature="t",
1555
access="readwrite")
1556
def ExtendedTimeout_dbus_property(self, value=None):
1557
if value is None: # get
1558
return dbus.UInt64(self.extended_timeout_milliseconds())
1559
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1025
# Emit D-Bus signal
1026
self.PropertyChanged(dbus.String(u"Timeout"),
1027
dbus.UInt64(value, variant_level=1))
1028
if getattr(self, u"disable_initiator_tag", None) is None:
1029
return
1030
# Reschedule timeout
1031
gobject.source_remove(self.disable_initiator_tag)
1032
self.disable_initiator_tag = None
1033
time_to_die = (self.
1034
_timedelta_to_milliseconds((self
1035
.last_checked_ok
1036
+ self.timeout)
1037
- datetime.datetime
1038
.utcnow()))
1039
if time_to_die <= 0:
1040
# The timeout has passed
1041
self.disable()
1042
else:
1043
self.disable_initiator_tag = (gobject.timeout_add
1044
(time_to_die, self.disable))
1560
1045
1561
1046
# Interval - property
1562
@dbus_service_property(_interface, signature="t",
1563
access="readwrite")
1047
@dbus_service_property(_interface, signature=u"t",
1048
access=u"readwrite")
1564
1049
def Interval_dbus_property(self, value=None):
1565
1050
if value is None: # get
1566
1051
return dbus.UInt64(self.interval_milliseconds())
1567
1052
self.interval = datetime.timedelta(0, 0, 0, value)
1568
if getattr(self, "checker_initiator_tag", None) is None:
1053
# Emit D-Bus signal
1054
self.PropertyChanged(dbus.String(u"Interval"),
1055
dbus.UInt64(value, variant_level=1))
1056
if getattr(self, u"checker_initiator_tag", None) is None:
1569
1057
return
1570
if self.enabled:
1571
# Reschedule checker run
1572
gobject.source_remove(self.checker_initiator_tag)
1573
self.checker_initiator_tag = (gobject.timeout_add
1574
(value, self.start_checker))
1575
self.start_checker() # Start one now, too
1576
1058
# Reschedule checker run
1059
gobject.source_remove(self.checker_initiator_tag)
1060
self.checker_initiator_tag = (gobject.timeout_add
1061
(value, self.start_checker))
1062
self.start_checker() # Start one now, too
1063
1577
1064
# Checker - property
1578
@dbus_service_property(_interface, signature="s",
1579
access="readwrite")
1065
@dbus_service_property(_interface, signature=u"s",
1066
access=u"readwrite")
1580
1067
def Checker_dbus_property(self, value=None):
1581
1068
if value is None: # get
1582
1069
return dbus.String(self.checker_command)
1583
self.checker_command = unicode(value)
1070
self.checker_command = value
1071
# Emit D-Bus signal
1072
self.PropertyChanged(dbus.String(u"Checker"),
1073
dbus.String(self.checker_command,
1074
variant_level=1))
1584
1075
1585
1076
# CheckerRunning - property
1586
@dbus_service_property(_interface, signature="b",
1587
access="readwrite")
1077
@dbus_service_property(_interface, signature=u"b",
1078
access=u"readwrite")
1588
1079
def CheckerRunning_dbus_property(self, value=None):
1589
1080
if value is None: # get
1590
1081
return dbus.Boolean(self.checker is not None)
1594
1085
self.stop_checker()
1595
1086
1596
1087
# ObjectPath - property
1597
@dbus_service_property(_interface, signature="o", access="read")
1088
@dbus_service_property(_interface, signature=u"o", access=u"read")
1598
1089
def ObjectPath_dbus_property(self):
1599
1090
return self.dbus_object_path # is already a dbus.ObjectPath
1600
1091
1601
1092
# Secret = property
1602
@dbus_service_property(_interface, signature="ay",
1603
access="write", byte_arrays=True)
1093
@dbus_service_property(_interface, signature=u"ay",
1094
access=u"write", byte_arrays=True)
1604
1095
def Secret_dbus_property(self, value):
1605
1096
self.secret = str(value)
1606
1097
1613
1104
self._pipe.send(('init', fpr, address))
1614
1105
if not self._pipe.recv():
1615
1106
raise KeyError()
1616
1107
1617
1108
def __getattribute__(self, name):
1618
if name == '_pipe':
1109
if(name == '_pipe'):
1619
1110
return super(ProxyClient, self).__getattribute__(name)
1620
1111
self._pipe.send(('getattr', name))
1621
1112
data = self._pipe.recv()
1626
1117
self._pipe.send(('funcall', name, args, kwargs))
1627
1118
return self._pipe.recv()[1]
1628
1119
return func
1629
1120
1630
1121
def __setattr__(self, name, value):
1631
if name == '_pipe':
1122
if(name == '_pipe'):
1632
1123
return super(ProxyClient, self).__setattr__(name, value)
1633
1124
self._pipe.send(('setattr', name, value))
1634
1125
1641
1132
1642
1133
def handle(self):
1643
1134
with contextlib.closing(self.server.child_pipe) as child_pipe:
1644
logger.info("TCP connection from: %s",
1135
logger.info(u"TCP connection from: %s",
1645
1136
unicode(self.client_address))
1646
logger.debug("Pipe FD: %d",
1137
logger.debug(u"Pipe FD: %d",
1647
1138
self.server.child_pipe.fileno())
1648
1139
1649
1140
session = (gnutls.connection
1650
1141
.ClientSession(self.request,
1651
1142
gnutls.connection
1652
1143
.X509Credentials()))
1653
1144
1654
1145
# Note: gnutls.connection.X509Credentials is really a
1655
1146
# generic GnuTLS certificate credentials object so long as
1656
1147
# no X.509 keys are added to it. Therefore, we can use it
1657
1148
# here despite using OpenPGP certificates.
1658
1659
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1660
# "+AES-256-CBC", "+SHA1",
1661
# "+COMP-NULL", "+CTYPE-OPENPGP",
1662
# "+DHE-DSS"))
1149
1150
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
# u"+AES-256-CBC", u"+SHA1",
1152
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1153
# u"+DHE-DSS"))
1663
1154
# Use a fallback default, since this MUST be set.
1664
1155
priority = self.server.gnutls_priority
1665
1156
if priority is None:
1666
priority = "NORMAL"
1157
priority = u"NORMAL"
1667
1158
(gnutls.library.functions
1668
1159
.gnutls_priority_set_direct(session._c_object,
1669
1160
priority, None))
1670
1161
1671
1162
# Start communication using the Mandos protocol
1672
1163
# Get protocol number
1673
1164
line = self.request.makefile().readline()
1674
logger.debug("Protocol version: %r", line)
1165
logger.debug(u"Protocol version: %r", line)
1675
1166
try:
1676
1167
if int(line.strip().split()[0]) > 1:
1677
1168
raise RuntimeError
1678
except (ValueError, IndexError, RuntimeError) as error:
1679
logger.error("Unknown protocol version: %s", error)
1169
except (ValueError, IndexError, RuntimeError), error:
1170
logger.error(u"Unknown protocol version: %s", error)
1680
1171
return
1681
1172
1682
1173
# Start GnuTLS connection
1683
1174
try:
1684
1175
session.handshake()
1685
except gnutls.errors.GNUTLSError as error:
1686
logger.warning("Handshake failed: %s", error)
1176
except gnutls.errors.GNUTLSError, error:
1177
logger.warning(u"Handshake failed: %s", error)
1687
1178
# Do not run session.bye() here: the session is not
1688
1179
# established. Just abandon the request.
1689
1180
return
1690
logger.debug("Handshake succeeded")
1691
1181
logger.debug(u"Handshake succeeded")
1182
1692
1183
approval_required = False
1693
1184
try:
1694
1185
try:
1695
1186
fpr = self.fingerprint(self.peer_certificate
1696
1187
(session))
1697
except (TypeError,
1698
gnutls.errors.GNUTLSError) as error:
1699
logger.warning("Bad certificate: %s", error)
1188
except (TypeError, gnutls.errors.GNUTLSError), error:
1189
logger.warning(u"Bad certificate: %s", error)
1700
1190
return
1701
logger.debug("Fingerprint: %s", fpr)
1702
1191
logger.debug(u"Fingerprint: %s", fpr)
1192
1703
1193
try:
1704
1194
client = ProxyClient(child_pipe, fpr,
1705
1195
self.client_address)
1713
1203
1714
1204
while True:
1715
1205
if not client.enabled:
1716
logger.info("Client %s is disabled",
1206
logger.warning(u"Client %s is disabled",
1717
1207
client.name)
1718
1208
if self.server.use_dbus:
1719
1209
# Emit D-Bus signal
1720
client.Rejected("Disabled")
1210
client.Rejected("Disabled")
1721
1211
return
1722
1212
1723
if client.approved or not client.approval_delay:
1213
if client._approved or not client.approval_delay:
1724
1214
#We are approved or approval is disabled
1725
1215
break
1726
elif client.approved is None:
1727
logger.info("Client %s needs approval",
1216
elif client._approved is None:
1217
logger.info(u"Client %s needs approval",
1728
1218
client.name)
1729
1219
if self.server.use_dbus:
1730
1220
# Emit D-Bus signal
1732
1222
client.approval_delay_milliseconds(),
1733
1223
client.approved_by_default)
1734
1224
else:
1735
logger.warning("Client %s was not approved",
1225
logger.warning(u"Client %s was not approved",
1736
1226
client.name)
1737
1227
if self.server.use_dbus:
1738
1228
# Emit D-Bus signal
1740
1230
return
1741
1231
1742
1232
#wait until timeout or approved
1233
#x = float(client._timedelta_to_milliseconds(delay))
1743
1234
time = datetime.datetime.now()
1744
1235
client.changedstate.acquire()
1745
client.changedstate.wait(
1746
float(timedelta_to_milliseconds(delay)
1747
/ 1000))
1236
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1748
1237
client.changedstate.release()
1749
1238
time2 = datetime.datetime.now()
1750
1239
if (time2 - time) >= delay:
1754
1243
client.name)
1755
1244
if self.server.use_dbus:
1756
1245
# Emit D-Bus signal
1757
client.Rejected("Approval timed out")
1246
client.Rejected("Timed out")
1758
1247
return
1759
1248
else:
1760
1249
break
1765
1254
while sent_size < len(client.secret):
1766
1255
try:
1767
1256
sent = session.send(client.secret[sent_size:])
1768
except gnutls.errors.GNUTLSError as error:
1769
logger.warning("gnutls send failed",
1770
exc_info=error)
1257
except (gnutls.errors.GNUTLSError), error:
1258
logger.warning("gnutls send failed")
1771
1259
return
1772
logger.debug("Sent: %d, remaining: %d",
1260
logger.debug(u"Sent: %d, remaining: %d",
1773
1261
sent, len(client.secret)
1774
1262
- (sent_size + sent))
1775
1263
sent_size += sent
1776
1777
logger.info("Sending secret to %s", client.name)
1778
# bump the timeout using extended_timeout
1779
client.bump_timeout(client.extended_timeout)
1264
1265
logger.info(u"Sending secret to %s", client.name)
1266
# bump the timeout as if seen
1267
client.checked_ok()
1780
1268
if self.server.use_dbus:
1781
1269
# Emit D-Bus signal
1782
1270
client.GotSecret()
1786
1274
client.approvals_pending -= 1
1787
1275
try:
1788
1276
session.bye()
1789
except gnutls.errors.GNUTLSError as error:
1790
logger.warning("GnuTLS bye failed",
1791
exc_info=error)
1277
except (gnutls.errors.GNUTLSError), error:
1278
logger.warning("GnuTLS bye failed")
1792
1279
1793
1280
@staticmethod
1794
1281
def peer_certificate(session):
1804
1291
.gnutls_certificate_get_peers
1805
1292
(session._c_object, ctypes.byref(list_size)))
1806
1293
if not bool(cert_list) and list_size.value != 0:
1807
raise gnutls.errors.GNUTLSError("error getting peer"
1808
" certificate")
1294
raise gnutls.errors.GNUTLSError(u"error getting peer"
1295
u" certificate")
1809
1296
if list_size.value == 0:
1810
1297
return None
1811
1298
cert = cert_list[0]
1837
1324
if crtverify.value != 0:
1838
1325
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1839
1326
raise (gnutls.errors.CertificateSecurityError
1840
("Verify failed"))
1327
(u"Verify failed"))
1841
1328
# New buffer for the fingerprint
1842
1329
buf = ctypes.create_string_buffer(20)
1843
1330
buf_len = ctypes.c_size_t()
1850
1337
# Convert the buffer to a Python bytestring
1851
1338
fpr = ctypes.string_at(buf, buf_len.value)
1852
1339
# Convert the bytestring to hexadecimal notation
1853
hex_fpr = binascii.hexlify(fpr).upper()
1340
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1854
1341
return hex_fpr
1855
1342
1856
1343
1859
1346
def sub_process_main(self, request, address):
1860
1347
try:
1861
1348
self.finish_request(request, address)
1862
except Exception:
1349
except:
1863
1350
self.handle_error(request, address)
1864
1351
self.close_request(request)
1865
1352
1866
1353
def process_request(self, request, address):
1867
1354
"""Start a new process to process the request."""
1868
proc = multiprocessing.Process(target = self.sub_process_main,
1869
args = (request, address))
1870
proc.start()
1871
return proc
1872
1355
multiprocessing.Process(target = self.sub_process_main,
1356
args = (request, address)).start()
1873
1357
1874
1358
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1875
1359
""" adds a pipe to the MixIn """
1879
1363
This function creates a new pipe in self.pipe
1880
1364
"""
1881
1365
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1882
1883
proc = MultiprocessingMixIn.process_request(self, request,
1884
client_address)
1366
1367
super(MultiprocessingMixInWithPipe,
1368
self).process_request(request, client_address)
1885
1369
self.child_pipe.close()
1886
self.add_pipe(parent_pipe, proc)
1887
1888
def add_pipe(self, parent_pipe, proc):
1370
self.add_pipe(parent_pipe)
1371
1372
def add_pipe(self, parent_pipe):
1889
1373
"""Dummy function; override as necessary"""
1890
raise NotImplementedError
1891
1374
pass
1892
1375
1893
1376
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1894
1377
socketserver.TCPServer, object):
1900
1383
use_ipv6: Boolean; to use IPv6 or not
1901
1384
"""
1902
1385
def __init__(self, server_address, RequestHandlerClass,
1903
interface=None, use_ipv6=True, socketfd=None):
1904
"""If socketfd is set, use that file descriptor instead of
1905
creating a new one with socket.socket().
1906
"""
1386
interface=None, use_ipv6=True):
1907
1387
self.interface = interface
1908
1388
if use_ipv6:
1909
1389
self.address_family = socket.AF_INET6
1910
if socketfd is not None:
1911
# Save the file descriptor
1912
self.socketfd = socketfd
1913
# Save the original socket.socket() function
1914
self.socket_socket = socket.socket
1915
# To implement --socket, we monkey patch socket.socket.
1916
#
1917
# (When socketserver.TCPServer is a new-style class, we
1918
# could make self.socket into a property instead of monkey
1919
# patching socket.socket.)
1920
#
1921
# Create a one-time-only replacement for socket.socket()
1922
@functools.wraps(socket.socket)
1923
def socket_wrapper(*args, **kwargs):
1924
# Restore original function so subsequent calls are
1925
# not affected.
1926
socket.socket = self.socket_socket
1927
del self.socket_socket
1928
# This time only, return a new socket object from the
1929
# saved file descriptor.
1930
return socket.fromfd(self.socketfd, *args, **kwargs)
1931
# Replace socket.socket() function with wrapper
1932
socket.socket = socket_wrapper
1933
# The socketserver.TCPServer.__init__ will call
1934
# socket.socket(), which might be our replacement,
1935
# socket_wrapper(), if socketfd was set.
1936
1390
socketserver.TCPServer.__init__(self, server_address,
1937
1391
RequestHandlerClass)
1938
1939
1392
def server_bind(self):
1940
1393
"""This overrides the normal server_bind() function
1941
1394
to bind to an interface if one was specified, and also NOT to
1942
1395
bind to an address or port if they were not specified."""
1943
1396
if self.interface is not None:
1944
1397
if SO_BINDTODEVICE is None:
1945
logger.error("SO_BINDTODEVICE does not exist;"
1946
" cannot bind to interface %s",
1398
logger.error(u"SO_BINDTODEVICE does not exist;"
1399
u" cannot bind to interface %s",
1947
1400
self.interface)
1948
1401
else:
1949
1402
try:
1950
1403
self.socket.setsockopt(socket.SOL_SOCKET,
1951
1404
SO_BINDTODEVICE,
1952
str(self.interface + '\0'))
1953
except socket.error as error:
1954
if error.errno == errno.EPERM:
1955
logger.error("No permission to bind to"
1956
" interface %s", self.interface)
1957
elif error.errno == errno.ENOPROTOOPT:
1958
logger.error("SO_BINDTODEVICE not available;"
1959
" cannot bind to interface %s",
1960
self.interface)
1961
elif error.errno == errno.ENODEV:
1962
logger.error("Interface %s does not exist,"
1963
" cannot bind", self.interface)
1405
str(self.interface
1406
+ u'\0'))
1407
except socket.error, error:
1408
if error[0] == errno.EPERM:
1409
logger.error(u"No permission to"
1410
u" bind to interface %s",
1411
self.interface)
1412
elif error[0] == errno.ENOPROTOOPT:
1413
logger.error(u"SO_BINDTODEVICE not available;"
1414
u" cannot bind to interface %s",
1415
self.interface)
1964
1416
else:
1965
1417
raise
1966
1418
# Only bind(2) the socket if we really need to.
1967
1419
if self.server_address[0] or self.server_address[1]:
1968
1420
if not self.server_address[0]:
1969
1421
if self.address_family == socket.AF_INET6:
1970
any_address = "::" # in6addr_any
1422
any_address = u"::" # in6addr_any
1971
1423
else:
1972
1424
any_address = socket.INADDR_ANY
1973
1425
self.server_address = (any_address,
1996
1448
"""
1997
1449
def __init__(self, server_address, RequestHandlerClass,
1998
1450
interface=None, use_ipv6=True, clients=None,
1999
gnutls_priority=None, use_dbus=True, socketfd=None):
1451
gnutls_priority=None, use_dbus=True):
2000
1452
self.enabled = False
2001
1453
self.clients = clients
2002
1454
if self.clients is None:
2003
self.clients = {}
1455
self.clients = set()
2004
1456
self.use_dbus = use_dbus
2005
1457
self.gnutls_priority = gnutls_priority
2006
1458
IPv6_TCPServer.__init__(self, server_address,
2007
1459
RequestHandlerClass,
2008
1460
interface = interface,
2009
use_ipv6 = use_ipv6,
2010
socketfd = socketfd)
1461
use_ipv6 = use_ipv6)
2011
1462
def server_activate(self):
2012
1463
if self.enabled:
2013
1464
return socketserver.TCPServer.server_activate(self)
2014
2015
1465
def enable(self):
2016
1466
self.enabled = True
2017
2018
def add_pipe(self, parent_pipe, proc):
1467
def add_pipe(self, parent_pipe):
2019
1468
# Call "handle_ipc" for both data and EOF events
2020
1469
gobject.io_add_watch(parent_pipe.fileno(),
2021
1470
gobject.IO_IN | gobject.IO_HUP,
2022
1471
functools.partial(self.handle_ipc,
2023
parent_pipe =
2024
parent_pipe,
2025
proc = proc))
2026
1472
parent_pipe = parent_pipe))
1473
2027
1474
def handle_ipc(self, source, condition, parent_pipe=None,
2028
proc = None, client_object=None):
2029
# error, or the other end of multiprocessing.Pipe has closed
2030
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2031
# Wait for other process to exit
2032
proc.join()
1475
client_object=None):
1476
condition_names = {
1477
gobject.IO_IN: u"IN", # There is data to read.
1478
gobject.IO_OUT: u"OUT", # Data can be written (without
1479
# blocking).
1480
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1481
gobject.IO_ERR: u"ERR", # Error condition.
1482
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1483
# broken, usually for pipes and
1484
# sockets).
1485
}
1486
conditions_string = ' | '.join(name
1487
for cond, name in
1488
condition_names.iteritems()
1489
if cond & condition)
1490
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1491
conditions_string)
1492
1493
# error or the other end of multiprocessing.Pipe has closed
1494
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2033
1495
return False
2034
1496
2035
1497
# Read a request from the child
2036
1498
request = parent_pipe.recv()
1499
logger.debug(u"IPC request: %s", repr(request))
2037
1500
command = request[0]
2038
1501
2039
1502
if command == 'init':
2040
1503
fpr = request[1]
2041
1504
address = request[2]
2042
1505
2043
for c in self.clients.itervalues():
1506
for c in self.clients:
2044
1507
if c.fingerprint == fpr:
2045
1508
client = c
2046
1509
break
2047
1510
else:
2048
logger.info("Client not found for fingerprint: %s, ad"
2049
"dress: %s", fpr, address)
1511
logger.warning(u"Client not found for fingerprint: %s, ad"
1512
u"dress: %s", fpr, address)
2050
1513
if self.use_dbus:
2051
1514
# Emit D-Bus signal
2052
mandos_dbus_service.ClientNotFound(fpr,
2053
address[0])
1515
mandos_dbus_service.ClientNotFound(fpr, address)
2054
1516
parent_pipe.send(False)
2055
1517
return False
2056
1518
2057
1519
gobject.io_add_watch(parent_pipe.fileno(),
2058
1520
gobject.IO_IN | gobject.IO_HUP,
2059
1521
functools.partial(self.handle_ipc,
2060
parent_pipe =
2061
parent_pipe,
2062
proc = proc,
2063
client_object =
2064
client))
1522
parent_pipe = parent_pipe,
1523
client_object = client))
2065
1524
parent_pipe.send(True)
2066
# remove the old hook in favor of the new above hook on
2067
# same fileno
1525
# remove the old hook in favor of the new above hook on same fileno
2068
1526
return False
2069
1527
if command == 'funcall':
2070
1528
funcname = request[1]
2071
1529
args = request[2]
2072
1530
kwargs = request[3]
2073
1531
2074
parent_pipe.send(('data', getattr(client_object,
2075
funcname)(*args,
2076
**kwargs)))
2077
1532
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1533
2078
1534
if command == 'getattr':
2079
1535
attrname = request[1]
2080
1536
if callable(client_object.__getattribute__(attrname)):
2081
1537
parent_pipe.send(('function',))
2082
1538
else:
2083
parent_pipe.send(('data', client_object
2084
.__getattribute__(attrname)))
1539
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2085
1540
2086
1541
if command == 'setattr':
2087
1542
attrname = request[1]
2088
1543
value = request[2]
2089
1544
setattr(client_object, attrname, value)
2090
1545
2091
1546
return True
2092
1547
2093
1548
2094
def rfc3339_duration_to_delta(duration):
2095
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2096
2097
>>> rfc3339_duration_to_delta("P7D")
2098
datetime.timedelta(7)
2099
>>> rfc3339_duration_to_delta("PT60S")
2100
datetime.timedelta(0, 60)
2101
>>> rfc3339_duration_to_delta("PT60M")
2102
datetime.timedelta(0, 3600)
2103
>>> rfc3339_duration_to_delta("PT24H")
2104
datetime.timedelta(1)
2105
>>> rfc3339_duration_to_delta("P1W")
2106
datetime.timedelta(7)
2107
>>> rfc3339_duration_to_delta("PT5M30S")
2108
datetime.timedelta(0, 330)
2109
>>> rfc3339_duration_to_delta("P1DT3M20S")
2110
datetime.timedelta(1, 200)
2111
"""
2112
2113
# Parsing an RFC 3339 duration with regular expressions is not
2114
# possible - there would have to be multiple places for the same
2115
# values, like seconds. The current code, while more esoteric, is
2116
# cleaner without depending on a parsing library. If Python had a
2117
# built-in library for parsing we would use it, but we'd like to
2118
# avoid excessive use of external libraries.
2119
2120
# New type for defining tokens, syntax, and semantics all-in-one
2121
Token = collections.namedtuple("Token",
2122
("regexp", # To match token; if
2123
# "value" is not None,
2124
# must have a "group"
2125
# containing digits
2126
"value", # datetime.timedelta or
2127
# None
2128
"followers")) # Tokens valid after
2129
# this token
2130
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2131
# the "duration" ABNF definition in RFC 3339, Appendix A.
2132
token_end = Token(re.compile(r"$"), None, frozenset())
2133
token_second = Token(re.compile(r"(\d+)S"),
2134
datetime.timedelta(seconds=1),
2135
frozenset((token_end,)))
2136
token_minute = Token(re.compile(r"(\d+)M"),
2137
datetime.timedelta(minutes=1),
2138
frozenset((token_second, token_end)))
2139
token_hour = Token(re.compile(r"(\d+)H"),
2140
datetime.timedelta(hours=1),
2141
frozenset((token_minute, token_end)))
2142
token_time = Token(re.compile(r"T"),
2143
None,
2144
frozenset((token_hour, token_minute,
2145
token_second)))
2146
token_day = Token(re.compile(r"(\d+)D"),
2147
datetime.timedelta(days=1),
2148
frozenset((token_time, token_end)))
2149
token_month = Token(re.compile(r"(\d+)M"),
2150
datetime.timedelta(weeks=4),
2151
frozenset((token_day, token_end)))
2152
token_year = Token(re.compile(r"(\d+)Y"),
2153
datetime.timedelta(weeks=52),
2154
frozenset((token_month, token_end)))
2155
token_week = Token(re.compile(r"(\d+)W"),
2156
datetime.timedelta(weeks=1),
2157
frozenset((token_end,)))
2158
token_duration = Token(re.compile(r"P"), None,
2159
frozenset((token_year, token_month,
2160
token_day, token_time,
2161
token_week))),
2162
# Define starting values
2163
value = datetime.timedelta() # Value so far
2164
found_token = None
2165
followers = frozenset(token_duration,) # Following valid tokens
2166
s = duration # String left to parse
2167
# Loop until end token is found
2168
while found_token is not token_end:
2169
# Search for any currently valid tokens
2170
for token in followers:
2171
match = token.regexp.match(s)
2172
if match is not None:
2173
# Token found
2174
if token.value is not None:
2175
# Value found, parse digits
2176
factor = int(match.group(1), 10)
2177
# Add to value so far
2178
value += factor * token.value
2179
# Strip token from string
2180
s = token.regexp.sub("", s, 1)
2181
# Go to found token
2182
found_token = token
2183
# Set valid next tokens
2184
followers = found_token.followers
2185
break
2186
else:
2187
# No currently valid tokens were found
2188
raise ValueError("Invalid RFC 3339 duration")
2189
# End token found
2190
return value
2191
2192
2193
1549
def string_to_delta(interval):
2194
1550
"""Parse a string and return a datetime.timedelta
2195
1551
2196
>>> string_to_delta('7d')
1552
>>> string_to_delta(u'7d')
2197
1553
datetime.timedelta(7)
2198
>>> string_to_delta('60s')
1554
>>> string_to_delta(u'60s')
2199
1555
datetime.timedelta(0, 60)
2200
>>> string_to_delta('60m')
1556
>>> string_to_delta(u'60m')
2201
1557
datetime.timedelta(0, 3600)
2202
>>> string_to_delta('24h')
1558
>>> string_to_delta(u'24h')
2203
1559
datetime.timedelta(1)
2204
>>> string_to_delta('1w')
1560
>>> string_to_delta(u'1w')
2205
1561
datetime.timedelta(7)
2206
>>> string_to_delta('5m 30s')
1562
>>> string_to_delta(u'5m 30s')
2207
1563
datetime.timedelta(0, 330)
2208
1564
"""
2209
2210
try:
2211
return rfc3339_duration_to_delta(interval)
2212
except ValueError:
2213
pass
2214
2215
1565
timevalue = datetime.timedelta(0)
2216
1566
for s in interval.split():
2217
1567
try:
2218
1568
suffix = unicode(s[-1])
2219
1569
value = int(s[:-1])
2220
if suffix == "d":
1570
if suffix == u"d":
2221
1571
delta = datetime.timedelta(value)
2222
elif suffix == "s":
1572
elif suffix == u"s":
2223
1573
delta = datetime.timedelta(0, value)
2224
elif suffix == "m":
1574
elif suffix == u"m":
2225
1575
delta = datetime.timedelta(0, 0, 0, 0, value)
2226
elif suffix == "h":
1576
elif suffix == u"h":
2227
1577
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
2228
elif suffix == "w":
1578
elif suffix == u"w":
2229
1579
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2230
1580
else:
2231
raise ValueError("Unknown suffix {0!r}"
2232
.format(suffix))
2233
except (ValueError, IndexError) as e:
2234
raise ValueError(*(e.args))
1581
raise ValueError(u"Unknown suffix %r" % suffix)
1582
except (ValueError, IndexError), e:
1583
raise ValueError(e.message)
2235
1584
timevalue += delta
2236
1585
return timevalue
2237
1586
2238
1587
1588
def if_nametoindex(interface):
1589
"""Call the C function if_nametoindex(), or equivalent
1590
1591
Note: This function cannot accept a unicode string."""
1592
global if_nametoindex
1593
try:
1594
if_nametoindex = (ctypes.cdll.LoadLibrary
1595
(ctypes.util.find_library(u"c"))
1596
.if_nametoindex)
1597
except (OSError, AttributeError):
1598
logger.warning(u"Doing if_nametoindex the hard way")
1599
def if_nametoindex(interface):
1600
"Get an interface index the hard way, i.e. using fcntl()"
1601
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1602
with contextlib.closing(socket.socket()) as s:
1603
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1604
struct.pack(str(u"16s16x"),
1605
interface))
1606
interface_index = struct.unpack(str(u"I"),
1607
ifreq[16:20])[0]
1608
return interface_index
1609
return if_nametoindex(interface)
1610
1611
2239
1612
def daemon(nochdir = False, noclose = False):
2240
1613
"""See daemon(3). Standard BSD Unix function.
2241
1614
2244
1617
sys.exit()
2245
1618
os.setsid()
2246
1619
if not nochdir:
2247
os.chdir("/")
1620
os.chdir(u"/")
2248
1621
if os.fork():
2249
1622
sys.exit()
2250
1623
if not noclose:
2251
1624
# Close all standard open file descriptors
2252
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1625
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2253
1626
if not stat.S_ISCHR(os.fstat(null).st_mode):
2254
1627
raise OSError(errno.ENODEV,
2255
"{0} not a character device"
2256
.format(os.devnull))
1628
u"%s not a character device"
1629
% os.path.devnull)
2257
1630
os.dup2(null, sys.stdin.fileno())
2258
1631
os.dup2(null, sys.stdout.fileno())
2259
1632
os.dup2(null, sys.stderr.fileno())
2266
1639
##################################################################
2267
1640
# Parsing of options, both command line and config file
2268
1641
2269
parser = argparse.ArgumentParser()
2270
parser.add_argument("-v", "--version", action="version",
2271
version = "%(prog)s {0}".format(version),
2272
help="show version number and exit")
2273
parser.add_argument("-i", "--interface", metavar="IF",
2274
help="Bind to interface IF")
2275
parser.add_argument("-a", "--address",
2276
help="Address to listen for requests on")
2277
parser.add_argument("-p", "--port", type=int,
2278
help="Port number to receive requests on")
2279
parser.add_argument("--check", action="store_true",
2280
help="Run self-test")
2281
parser.add_argument("--debug", action="store_true",
2282
help="Debug mode; run in foreground and log"
2283
" to terminal")
2284
parser.add_argument("--debuglevel", metavar="LEVEL",
2285
help="Debug level for stdout output")
2286
parser.add_argument("--priority", help="GnuTLS"
2287
" priority string (see GnuTLS documentation)")
2288
parser.add_argument("--servicename",
2289
metavar="NAME", help="Zeroconf service name")
2290
parser.add_argument("--configdir",
2291
default="/etc/mandos", metavar="DIR",
2292
help="Directory to search for configuration"
2293
" files")
2294
parser.add_argument("--no-dbus", action="store_false",
2295
dest="use_dbus", help="Do not provide D-Bus"
2296
" system bus interface")
2297
parser.add_argument("--no-ipv6", action="store_false",
2298
dest="use_ipv6", help="Do not use IPv6")
2299
parser.add_argument("--no-restore", action="store_false",
2300
dest="restore", help="Do not restore stored"
2301
" state")
2302
parser.add_argument("--socket", type=int,
2303
help="Specify a file descriptor to a network"
2304
" socket to use instead of creating one")
2305
parser.add_argument("--statedir", metavar="DIR",
2306
help="Directory to save/restore state in")
2307
parser.add_argument("--foreground", action="store_true",
2308
help="Run in foreground")
2309
2310
options = parser.parse_args()
1642
parser = optparse.OptionParser(version = "%%prog %s" % version)
1643
parser.add_option("-i", u"--interface", type=u"string",
1644
metavar="IF", help=u"Bind to interface IF")
1645
parser.add_option("-a", u"--address", type=u"string",
1646
help=u"Address to listen for requests on")
1647
parser.add_option("-p", u"--port", type=u"int",
1648
help=u"Port number to receive requests on")
1649
parser.add_option("--check", action=u"store_true",
1650
help=u"Run self-test")
1651
parser.add_option("--debug", action=u"store_true",
1652
help=u"Debug mode; run in foreground and log to"
1653
u" terminal")
1654
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1655
help=u"Debug level for stdout output")
1656
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1657
u" priority string (see GnuTLS documentation)")
1658
parser.add_option("--servicename", type=u"string",
1659
metavar=u"NAME", help=u"Zeroconf service name")
1660
parser.add_option("--configdir", type=u"string",
1661
default=u"/etc/mandos", metavar=u"DIR",
1662
help=u"Directory to search for configuration"
1663
u" files")
1664
parser.add_option("--no-dbus", action=u"store_false",
1665
dest=u"use_dbus", help=u"Do not provide D-Bus"
1666
u" system bus interface")
1667
parser.add_option("--no-ipv6", action=u"store_false",
1668
dest=u"use_ipv6", help=u"Do not use IPv6")
1669
options = parser.parse_args()[0]
2311
1670
2312
1671
if options.check:
2313
1672
import doctest
2315
1674
sys.exit()
2316
1675
2317
1676
# Default values for config file for server-global settings
2318
server_defaults = { "interface": "",
2319
"address": "",
2320
"port": "",
2321
"debug": "False",
2322
"priority":
2323
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2324
"servicename": "Mandos",
2325
"use_dbus": "True",
2326
"use_ipv6": "True",
2327
"debuglevel": "",
2328
"restore": "True",
2329
"socket": "",
2330
"statedir": "/var/lib/mandos",
2331
"foreground": "False",
1677
server_defaults = { u"interface": u"",
1678
u"address": u"",
1679
u"port": u"",
1680
u"debug": u"False",
1681
u"priority":
1682
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1683
u"servicename": u"Mandos",
1684
u"use_dbus": u"True",
1685
u"use_ipv6": u"True",
1686
u"debuglevel": u"",
2332
1687
}
2333
1688
2334
1689
# Parse config file for server-global settings
2335
1690
server_config = configparser.SafeConfigParser(server_defaults)
2336
1691
del server_defaults
2337
1692
server_config.read(os.path.join(options.configdir,
2338
"mandos.conf"))
1693
u"mandos.conf"))
2339
1694
# Convert the SafeConfigParser object to a dict
2340
1695
server_settings = server_config.defaults()
2341
1696
# Use the appropriate methods on the non-string config options
2342
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2343
server_settings[option] = server_config.getboolean("DEFAULT",
1697
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1698
server_settings[option] = server_config.getboolean(u"DEFAULT",
2344
1699
option)
2345
1700
if server_settings["port"]:
2346
server_settings["port"] = server_config.getint("DEFAULT",
2347
"port")
2348
if server_settings["socket"]:
2349
server_settings["socket"] = server_config.getint("DEFAULT",
2350
"socket")
2351
# Later, stdin will, and stdout and stderr might, be dup'ed
2352
# over with an opened os.devnull. But we don't want this to
2353
# happen with a supplied network socket.
2354
if 0 <= server_settings["socket"] <= 2:
2355
server_settings["socket"] = os.dup(server_settings
2356
["socket"])
1701
server_settings["port"] = server_config.getint(u"DEFAULT",
1702
u"port")
2357
1703
del server_config
2358
1704
2359
1705
# Override the settings from the config file with command line
2360
1706
# options, if set.
2361
for option in ("interface", "address", "port", "debug",
2362
"priority", "servicename", "configdir",
2363
"use_dbus", "use_ipv6", "debuglevel", "restore",
2364
"statedir", "socket", "foreground"):
1707
for option in (u"interface", u"address", u"port", u"debug",
1708
u"priority", u"servicename", u"configdir",
1709
u"use_dbus", u"use_ipv6", u"debuglevel"):
2365
1710
value = getattr(options, option)
2366
1711
if value is not None:
2367
1712
server_settings[option] = value
2370
1715
for option in server_settings.keys():
2371
1716
if type(server_settings[option]) is str:
2372
1717
server_settings[option] = unicode(server_settings[option])
2373
# Debug implies foreground
2374
if server_settings["debug"]:
2375
server_settings["foreground"] = True
2376
1718
# Now we have our good server settings in "server_settings"
2377
1719
2378
1720
##################################################################
2379
1721
2380
1722
# For convenience
2381
debug = server_settings["debug"]
2382
debuglevel = server_settings["debuglevel"]
2383
use_dbus = server_settings["use_dbus"]
2384
use_ipv6 = server_settings["use_ipv6"]
2385
stored_state_path = os.path.join(server_settings["statedir"],
2386
stored_state_file)
2387
foreground = server_settings["foreground"]
2388
2389
if debug:
2390
initlogger(debug, logging.DEBUG)
2391
else:
2392
if not debuglevel:
2393
initlogger(debug)
2394
else:
2395
level = getattr(logging, debuglevel.upper())
2396
initlogger(debug, level)
2397
2398
if server_settings["servicename"] != "Mandos":
1723
debug = server_settings[u"debug"]
1724
debuglevel = server_settings[u"debuglevel"]
1725
use_dbus = server_settings[u"use_dbus"]
1726
use_ipv6 = server_settings[u"use_ipv6"]
1727
1728
if server_settings[u"servicename"] != u"Mandos":
2399
1729
syslogger.setFormatter(logging.Formatter
2400
('Mandos ({0}) [%(process)d]:'
2401
' %(levelname)s: %(message)s'
2402
.format(server_settings
2403
["servicename"])))
1730
(u'Mandos (%s) [%%(process)d]:'
1731
u' %%(levelname)s: %%(message)s'
1732
% server_settings[u"servicename"]))
2404
1733
2405
1734
# Parse config file with clients
2406
client_config = configparser.SafeConfigParser(Client
2407
.client_defaults)
2408
client_config.read(os.path.join(server_settings["configdir"],
2409
"clients.conf"))
1735
client_defaults = { u"timeout": u"1h",
1736
u"interval": u"5m",
1737
u"checker": u"fping -q -- %%(host)s",
1738
u"host": u"",
1739
u"approval_delay": u"0s",
1740
u"approval_duration": u"1s",
1741
}
1742
client_config = configparser.SafeConfigParser(client_defaults)
1743
client_config.read(os.path.join(server_settings[u"configdir"],
1744
u"clients.conf"))
2410
1745
2411
1746
global mandos_dbus_service
2412
1747
mandos_dbus_service = None
2413
1748
2414
tcp_server = MandosServer((server_settings["address"],
2415
server_settings["port"]),
1749
tcp_server = MandosServer((server_settings[u"address"],
1750
server_settings[u"port"]),
2416
1751
ClientHandler,
2417
interface=(server_settings["interface"]
1752
interface=(server_settings[u"interface"]
2418
1753
or None),
2419
1754
use_ipv6=use_ipv6,
2420
1755
gnutls_priority=
2421
server_settings["priority"],
2422
use_dbus=use_dbus,
2423
socketfd=(server_settings["socket"]
2424
or None))
2425
if not foreground:
2426
pidfilename = "/var/run/mandos.pid"
2427
pidfile = None
2428
try:
2429
pidfile = open(pidfilename, "w")
2430
except IOError as e:
2431
logger.error("Could not open file %r", pidfilename,
2432
exc_info=e)
1756
server_settings[u"priority"],
1757
use_dbus=use_dbus)
1758
pidfilename = u"/var/run/mandos.pid"
1759
try:
1760
pidfile = open(pidfilename, u"w")
1761
except IOError:
1762
logger.error(u"Could not open file %r", pidfilename)
2433
1763
2434
for name in ("_mandos", "mandos", "nobody"):
1764
try:
1765
uid = pwd.getpwnam(u"_mandos").pw_uid
1766
gid = pwd.getpwnam(u"_mandos").pw_gid
1767
except KeyError:
2435
1768
try:
2436
uid = pwd.getpwnam(name).pw_uid
2437
gid = pwd.getpwnam(name).pw_gid
2438
break
1769
uid = pwd.getpwnam(u"mandos").pw_uid
1770
gid = pwd.getpwnam(u"mandos").pw_gid
2439
1771
except KeyError:
2440
continue
2441
else:
2442
uid = 65534
2443
gid = 65534
1772
try:
1773
uid = pwd.getpwnam(u"nobody").pw_uid
1774
gid = pwd.getpwnam(u"nobody").pw_gid
1775
except KeyError:
1776
uid = 65534
1777
gid = 65534
2444
1778
try:
2445
1779
os.setgid(gid)
2446
1780
os.setuid(uid)
2447
except OSError as error:
2448
if error.errno != errno.EPERM:
1781
except OSError, error:
1782
if error[0] != errno.EPERM:
2449
1783
raise error
2450
1784
1785
if not debug and not debuglevel:
1786
syslogger.setLevel(logging.WARNING)
1787
console.setLevel(logging.WARNING)
1788
if debuglevel:
1789
level = getattr(logging, debuglevel.upper())
1790
syslogger.setLevel(level)
1791
console.setLevel(level)
1792
2451
1793
if debug:
2452
1794
# Enable all possible GnuTLS debugging
2453
1795
2457
1799
2458
1800
@gnutls.library.types.gnutls_log_func
2459
1801
def debug_gnutls(level, string):
2460
logger.debug("GnuTLS: %s", string[:-1])
1802
logger.debug(u"GnuTLS: %s", string[:-1])
2461
1803
2462
1804
(gnutls.library.functions
2463
1805
.gnutls_global_set_log_function(debug_gnutls))
2464
1806
2465
1807
# Redirect stdin so all checkers get /dev/null
2466
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1808
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2467
1809
os.dup2(null, sys.stdin.fileno())
2468
1810
if null > 2:
2469
1811
os.close(null)
2470
2471
# Need to fork before connecting to D-Bus
2472
if not foreground:
2473
# Close all input and output, do double fork, etc.
2474
daemon()
2475
2476
# multiprocessing will use threads, so before we use gobject we
2477
# need to inform gobject that threads will be used.
2478
gobject.threads_init()
1812
else:
1813
# No console logging
1814
logger.removeHandler(console)
1815
2479
1816
2480
1817
global main_loop
2481
1818
# From the Avahi example code
2482
DBusGMainLoop(set_as_default=True)
1819
DBusGMainLoop(set_as_default=True )
2483
1820
main_loop = gobject.MainLoop()
2484
1821
bus = dbus.SystemBus()
2485
1822
# End of Avahi example code
2486
1823
if use_dbus:
2487
1824
try:
2488
bus_name = dbus.service.BusName("se.recompile.Mandos",
1825
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2489
1826
bus, do_not_queue=True)
2490
old_bus_name = (dbus.service.BusName
2491
("se.bsnet.fukt.Mandos", bus,
2492
do_not_queue=True))
2493
except dbus.exceptions.NameExistsException as e:
2494
logger.error("Disabling D-Bus:", exc_info=e)
1827
except dbus.exceptions.NameExistsException, e:
1828
logger.error(unicode(e) + u", disabling D-Bus")
2495
1829
use_dbus = False
2496
server_settings["use_dbus"] = False
1830
server_settings[u"use_dbus"] = False
2497
1831
tcp_server.use_dbus = False
2498
1832
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2499
service = AvahiServiceToSyslog(name =
2500
server_settings["servicename"],
2501
servicetype = "_mandos._tcp",
2502
protocol = protocol, bus = bus)
1833
service = AvahiService(name = server_settings[u"servicename"],
1834
servicetype = u"_mandos._tcp",
1835
protocol = protocol, bus = bus)
2503
1836
if server_settings["interface"]:
2504
1837
service.interface = (if_nametoindex
2505
(str(server_settings["interface"])))
2506
1838
(str(server_settings[u"interface"])))
1839
1840
if not debug:
1841
# Close all input and output, do double fork, etc.
1842
daemon()
1843
2507
1844
global multiprocessing_manager
2508
1845
multiprocessing_manager = multiprocessing.Manager()
2509
1846
2510
1847
client_class = Client
2511
1848
if use_dbus:
2512
1849
client_class = functools.partial(ClientDBus, bus = bus)
2513
2514
client_settings = Client.config_parser(client_config)
2515
old_client_settings = {}
2516
clients_data = {}
2517
2518
# Get client data and settings from last running state.
2519
if server_settings["restore"]:
2520
try:
2521
with open(stored_state_path, "rb") as stored_state:
2522
clients_data, old_client_settings = (pickle.load
2523
(stored_state))
2524
os.remove(stored_state_path)
2525
except IOError as e:
2526
if e.errno == errno.ENOENT:
2527
logger.warning("Could not load persistent state: {0}"
2528
.format(os.strerror(e.errno)))
2529
else:
2530
logger.critical("Could not load persistent state:",
2531
exc_info=e)
2532
raise
2533
except EOFError as e:
2534
logger.warning("Could not load persistent state: "
2535
"EOFError:", exc_info=e)
2536
2537
with PGPEngine() as pgp:
2538
for client_name, client in clients_data.iteritems():
2539
# Decide which value to use after restoring saved state.
2540
# We have three different values: Old config file,
2541
# new config file, and saved state.
2542
# New config value takes precedence if it differs from old
2543
# config value, otherwise use saved state.
2544
for name, value in client_settings[client_name].items():
2545
try:
2546
# For each value in new config, check if it
2547
# differs from the old config value (Except for
2548
# the "secret" attribute)
2549
if (name != "secret" and
2550
value != old_client_settings[client_name]
2551
[name]):
2552
client[name] = value
2553
except KeyError:
2554
pass
2555
2556
# Clients who has passed its expire date can still be
2557
# enabled if its last checker was successful. Clients
2558
# whose checker succeeded before we stored its state is
2559
# assumed to have successfully run all checkers during
2560
# downtime.
2561
if client["enabled"]:
2562
if datetime.datetime.utcnow() >= client["expires"]:
2563
if not client["last_checked_ok"]:
2564
logger.warning(
2565
"disabling client {0} - Client never "
2566
"performed a successful checker"
2567
.format(client_name))
2568
client["enabled"] = False
2569
elif client["last_checker_status"] != 0:
2570
logger.warning(
2571
"disabling client {0} - Client "
2572
"last checker failed with error code {1}"
2573
.format(client_name,
2574
client["last_checker_status"]))
2575
client["enabled"] = False
2576
else:
2577
client["expires"] = (datetime.datetime
2578
.utcnow()
2579
+ client["timeout"])
2580
logger.debug("Last checker succeeded,"
2581
" keeping {0} enabled"
2582
.format(client_name))
1850
def client_config_items(config, section):
1851
special_settings = {
1852
"approved_by_default":
1853
lambda: config.getboolean(section,
1854
"approved_by_default"),
1855
}
1856
for name, value in config.items(section):
2583
1857
try:
2584
client["secret"] = (
2585
pgp.decrypt(client["encrypted_secret"],
2586
client_settings[client_name]
2587
["secret"]))
2588
except PGPError:
2589
# If decryption fails, we use secret from new settings
2590
logger.debug("Failed to decrypt {0} old secret"
2591
.format(client_name))
2592
client["secret"] = (
2593
client_settings[client_name]["secret"])
2594
2595
# Add/remove clients based on new changes made to config
2596
for client_name in (set(old_client_settings)
2597
- set(client_settings)):
2598
del clients_data[client_name]
2599
for client_name in (set(client_settings)
2600
- set(old_client_settings)):
2601
clients_data[client_name] = client_settings[client_name]
2602
2603
# Create all client objects
2604
for client_name, client in clients_data.iteritems():
2605
tcp_server.clients[client_name] = client_class(
2606
name = client_name, settings = client)
2607
1858
yield (name, special_settings[name]())
1859
except KeyError:
1860
yield (name, value)
1861
1862
tcp_server.clients.update(set(
1863
client_class(name = section,
1864
config= dict(client_config_items(
1865
client_config, section)))
1866
for section in client_config.sections()))
2608
1867
if not tcp_server.clients:
2609
logger.warning("No clients defined")
2610
2611
if not foreground:
2612
if pidfile is not None:
2613
try:
2614
with pidfile:
2615
pid = os.getpid()
2616
pidfile.write(str(pid) + "\n".encode("utf-8"))
2617
except IOError:
2618
logger.error("Could not write to file %r with PID %d",
2619
pidfilename, pid)
1868
logger.warning(u"No clients defined")
1869
1870
try:
1871
with pidfile:
1872
pid = os.getpid()
1873
pidfile.write(str(pid) + "\n")
2620
1874
del pidfile
2621
del pidfilename
1875
except IOError:
1876
logger.error(u"Could not write to file %r with PID %d",
1877
pidfilename, pid)
1878
except NameError:
1879
# "pidfile" was never created
1880
pass
1881
del pidfilename
2622
1882
1883
if not debug:
1884
signal.signal(signal.SIGINT, signal.SIG_IGN)
2623
1885
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2624
1886
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2625
1887
2626
1888
if use_dbus:
2627
@alternate_dbus_interfaces({"se.recompile.Mandos":
2628
"se.bsnet.fukt.Mandos"})
2629
class MandosDBusService(DBusObjectWithProperties):
1889
class MandosDBusService(dbus.service.Object):
2630
1890
"""A D-Bus proxy object"""
2631
1891
def __init__(self):
2632
dbus.service.Object.__init__(self, bus, "/")
2633
_interface = "se.recompile.Mandos"
2634
2635
@dbus_interface_annotations(_interface)
2636
def _foo(self):
2637
return { "org.freedesktop.DBus.Property"
2638
".EmitsChangedSignal":
2639
"false"}
2640
2641
@dbus.service.signal(_interface, signature="o")
1892
dbus.service.Object.__init__(self, bus, u"/")
1893
_interface = u"se.bsnet.fukt.Mandos"
1894
1895
@dbus.service.signal(_interface, signature=u"o")
2642
1896
def ClientAdded(self, objpath):
2643
1897
"D-Bus signal"
2644
1898
pass
2645
1899
2646
@dbus.service.signal(_interface, signature="ss")
1900
@dbus.service.signal(_interface, signature=u"ss")
2647
1901
def ClientNotFound(self, fingerprint, address):
2648
1902
"D-Bus signal"
2649
1903
pass
2650
1904
2651
@dbus.service.signal(_interface, signature="os")
1905
@dbus.service.signal(_interface, signature=u"os")
2652
1906
def ClientRemoved(self, objpath, name):
2653
1907
"D-Bus signal"
2654
1908
pass
2655
1909
2656
@dbus.service.method(_interface, out_signature="ao")
1910
@dbus.service.method(_interface, out_signature=u"ao")
2657
1911
def GetAllClients(self):
2658
1912
"D-Bus method"
2659
1913
return dbus.Array(c.dbus_object_path
2660
for c in
2661
tcp_server.clients.itervalues())
1914
for c in tcp_server.clients)
2662
1915
2663
1916
@dbus.service.method(_interface,
2664
out_signature="a{oa{sv}}")
1917
out_signature=u"a{oa{sv}}")
2665
1918
def GetAllClientsWithProperties(self):
2666
1919
"D-Bus method"
2667
1920
return dbus.Dictionary(
2668
((c.dbus_object_path, c.GetAll(""))
2669
for c in tcp_server.clients.itervalues()),
2670
signature="oa{sv}")
1921
((c.dbus_object_path, c.GetAll(u""))
1922
for c in tcp_server.clients),
1923
signature=u"oa{sv}")
2671
1924
2672
@dbus.service.method(_interface, in_signature="o")
1925
@dbus.service.method(_interface, in_signature=u"o")
2673
1926
def RemoveClient(self, object_path):
2674
1927
"D-Bus method"
2675
for c in tcp_server.clients.itervalues():
1928
for c in tcp_server.clients:
2676
1929
if c.dbus_object_path == object_path:
2677
del tcp_server.clients[c.name]
1930
tcp_server.clients.remove(c)
2678
1931
c.remove_from_connection()
2679
1932
# Don't signal anything except ClientRemoved
2680
1933
c.disable(quiet=True)
2691
1944
"Cleanup function; run on exit"
2692
1945
service.cleanup()
2693
1946
2694
multiprocessing.active_children()
2695
if not (tcp_server.clients or client_settings):
2696
return
2697
2698
# Store client before exiting. Secrets are encrypted with key
2699
# based on what config file has. If config file is
2700
# removed/edited, old secret will thus be unrecovable.
2701
clients = {}
2702
with PGPEngine() as pgp:
2703
for client in tcp_server.clients.itervalues():
2704
key = client_settings[client.name]["secret"]
2705
client.encrypted_secret = pgp.encrypt(client.secret,
2706
key)
2707
client_dict = {}
2708
2709
# A list of attributes that can not be pickled
2710
# + secret.
2711
exclude = set(("bus", "changedstate", "secret",
2712
"checker"))
2713
for name, typ in (inspect.getmembers
2714
(dbus.service.Object)):
2715
exclude.add(name)
2716
2717
client_dict["encrypted_secret"] = (client
2718
.encrypted_secret)
2719
for attr in client.client_structure:
2720
if attr not in exclude:
2721
client_dict[attr] = getattr(client, attr)
2722
2723
clients[client.name] = client_dict
2724
del client_settings[client.name]["secret"]
2725
2726
try:
2727
with (tempfile.NamedTemporaryFile
2728
(mode='wb', suffix=".pickle", prefix='clients-',
2729
dir=os.path.dirname(stored_state_path),
2730
delete=False)) as stored_state:
2731
pickle.dump((clients, client_settings), stored_state)
2732
tempname=stored_state.name
2733
os.rename(tempname, stored_state_path)
2734
except (IOError, OSError) as e:
2735
if not debug:
2736
try:
2737
os.remove(tempname)
2738
except NameError:
2739
pass
2740
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2741
logger.warning("Could not save persistent state: {0}"
2742
.format(os.strerror(e.errno)))
2743
else:
2744
logger.warning("Could not save persistent state:",
2745
exc_info=e)
2746
raise e
2747
2748
# Delete all clients, and settings from config
2749
1947
while tcp_server.clients:
2750
name, client = tcp_server.clients.popitem()
1948
client = tcp_server.clients.pop()
2751
1949
if use_dbus:
2752
1950
client.remove_from_connection()
1951
client.disable_hook = None
2753
1952
# Don't signal anything except ClientRemoved
2754
1953
client.disable(quiet=True)
2755
1954
if use_dbus:
2756
1955
# Emit D-Bus signal
2757
mandos_dbus_service.ClientRemoved(client
2758
.dbus_object_path,
1956
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2759
1957
client.name)
2760
client_settings.clear()
2761
1958
2762
1959
atexit.register(cleanup)
2763
1960
2764
for client in tcp_server.clients.itervalues():
1961
for client in tcp_server.clients:
2765
1962
if use_dbus:
2766
1963
# Emit D-Bus signal
2767
1964
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2768
# Need to initiate checking of clients
2769
if client.enabled:
2770
client.init_checker()
1965
client.enable()
2771
1966
2772
1967
tcp_server.enable()
2773
1968
tcp_server.server_activate()
2775
1970
# Find out what port we got
2776
1971
service.port = tcp_server.socket.getsockname()[1]
2777
1972
if use_ipv6:
2778
logger.info("Now listening on address %r, port %d,"
2779
" flowinfo %d, scope_id %d",
2780
*tcp_server.socket.getsockname())
1973
logger.info(u"Now listening on address %r, port %d,"
1974
" flowinfo %d, scope_id %d"
1975
% tcp_server.socket.getsockname())
2781
1976
else: # IPv4
2782
logger.info("Now listening on address %r, port %d",
2783
*tcp_server.socket.getsockname())
1977
logger.info(u"Now listening on address %r, port %d"
1978
% tcp_server.socket.getsockname())
2784
1979
2785
1980
#service.interface = tcp_server.socket.getsockname()[3]
2786
1981
2788
1983
# From the Avahi example code
2789
1984
try:
2790
1985
service.activate()
2791
except dbus.exceptions.DBusException as error:
2792
logger.critical("D-Bus Exception", exc_info=error)
1986
except dbus.exceptions.DBusException, error:
1987
logger.critical(u"DBusException: %s", error)
2793
1988
cleanup()
2794
1989
sys.exit(1)
2795
1990
# End of Avahi example code
2799
1994
(tcp_server.handle_request
2800
1995
(*args[2:], **kwargs) or True))
2801
1996
2802
logger.debug("Starting main loop")
1997
logger.debug(u"Starting main loop")
2803
1998
main_loop.run()
2804
except AvahiError as error:
2805
logger.critical("Avahi Error", exc_info=error)
1999
except AvahiError, error:
2000
logger.critical(u"AvahiError: %s", error)
2806
2001
cleanup()
2807
2002
sys.exit(1)
2808
2003
except KeyboardInterrupt:
2809
2004
if debug:
2810
print("", file=sys.stderr)
2811
logger.debug("Server received KeyboardInterrupt")
2812
logger.debug("Server exiting")
2005
print >> sys.stderr
2006
logger.debug(u"Server received KeyboardInterrupt")
2007
logger.debug(u"Server exiting")
2813
2008
# Must run before the D-Bus bus name gets deregistered
2814
2009
cleanup()
2815
2010
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0