To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 423
- compare with another revision
- download diff
- download tarball
- view history from revision 423
- Committer: Teddy Hogeborn
- Date: 2010-09-12 03:00:40 UTC
- Revision ID: teddy@fukt.bsnet.se-20100912030040-b0uopyennste9fdh
Documentation changes:
* DBUS-API: New file documenting the server D-Bus interface.
* clients.conf: Add examples of new approval settings.
* debian/mandos.docs: Added "DBUS-API".
* mandos-clients.conf.xml (OPTIONS): Added "approved_by_default",
"approval_delay", and
"approval_duration".
* mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file.
(BUGS): Remove mention of lack of a remote query interface.
* DBUS-API: New file documenting the server D-Bus interface.
* clients.conf: Add examples of new approval settings.
* debian/mandos.docs: Added "DBUS-API".
* mandos-clients.conf.xml (OPTIONS): Added "approved_by_default",
"approval_delay", and
"approval_duration".
* mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file.
(BUGS): Remove mention of lack of a remote query interface.
- files removed:
- debian/mandos-client.examples
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
36
37
from future_builtins import *
34
from __future__ import division, with_statement, absolute_import
38
35
39
36
import SocketServer as socketserver
40
37
import socket
41
import argparse
38
import optparse
42
39
import datetime
43
40
import errno
44
41
import gnutls.crypto
64
61
import functools
65
62
import cPickle as pickle
66
63
import multiprocessing
67
import types
68
import binascii
69
import tempfile
70
import itertools
71
import collections
72
64
73
65
import dbus
74
66
import dbus.service
79
71
import ctypes.util
80
72
import xml.dom.minidom
81
73
import inspect
82
import GnuPGInterface
83
74
84
75
try:
85
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
89
80
except ImportError:
90
81
SO_BINDTODEVICE = None
91
82
92
version = "1.6.0"
93
stored_state_file = "clients.pickle"
94
95
logger = logging.getLogger()
83
84
version = "1.0.14"
85
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
96
88
syslogger = (logging.handlers.SysLogHandler
97
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
98
address = str("/dev/log")))
99
100
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
104
except (OSError, AttributeError):
105
def if_nametoindex(interface):
106
"Get an interface index the hard way, i.e. using fcntl()"
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
with contextlib.closing(socket.socket()) as s:
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(str("16s16x"),
111
interface))
112
interface_index = struct.unpack(str("I"),
113
ifreq[16:20])[0]
114
return interface_index
115
116
117
def initlogger(debug, level=logging.WARNING):
118
"""init logger and add loglevel"""
119
120
syslogger.setFormatter(logging.Formatter
121
('Mandos [%(process)d]: %(levelname)s:'
122
' %(message)s'))
123
logger.addHandler(syslogger)
124
125
if debug:
126
console = logging.StreamHandler()
127
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
128
' [%(process)d]:'
129
' %(levelname)s:'
130
' %(message)s'))
131
logger.addHandler(console)
132
logger.setLevel(level)
133
134
135
class PGPError(Exception):
136
"""Exception if encryption/decryption fails"""
137
pass
138
139
140
class PGPEngine(object):
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
def __init__(self):
143
self.gnupg = GnuPGInterface.GnuPG()
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
149
'--quiet',
150
'--no-use-agent'])
151
152
def __enter__(self):
153
return self
154
155
def __exit__(self, exc_type, exc_value, traceback):
156
self._cleanup()
157
return False
158
159
def __del__(self):
160
self._cleanup()
161
162
def _cleanup(self):
163
if self.tempdir is not None:
164
# Delete contents of tempdir
165
for root, dirs, files in os.walk(self.tempdir,
166
topdown = False):
167
for filename in files:
168
os.remove(os.path.join(root, filename))
169
for dirname in dirs:
170
os.rmdir(os.path.join(root, dirname))
171
# Remove tempdir
172
os.rmdir(self.tempdir)
173
self.tempdir = None
174
175
def password_encode(self, password):
176
# Passphrase can not be empty and can not contain newlines or
177
# NUL bytes. So we prefix it and hex encode it.
178
return b"mandos" + binascii.hexlify(password)
179
180
def encrypt(self, data, password):
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
183
try:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
188
f.write(data)
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
191
proc.wait()
192
except IOError as e:
193
raise PGPError(e)
194
self.gnupg.passphrase = None
195
return ciphertext
196
197
def decrypt(self, data, password):
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
200
try:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
205
f.write(data)
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
208
proc.wait()
209
except IOError as e:
210
raise PGPError(e)
211
self.gnupg.passphrase = None
212
return decrypted_plaintext
213
90
address = "/dev/log"))
91
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
logger.addHandler(syslogger)
95
96
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
100
logger.addHandler(console)
214
101
215
102
class AvahiError(Exception):
216
103
def __init__(self, value, *args, **kwargs):
232
119
Attributes:
233
120
interface: integer; avahi.IF_UNSPEC or an interface index.
234
121
Used to optionally bind to the specified interface.
235
name: string; Example: 'Mandos'
236
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
237
124
See <http://www.dns-sd.org/ServiceTypes.html>
238
125
port: integer; what port to announce
239
126
TXT: list of strings; TXT record for the service
246
133
server: D-Bus Server
247
134
bus: dbus.SystemBus()
248
135
"""
249
250
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
137
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
253
139
protocol = avahi.PROTO_UNSPEC, bus = None):
254
140
self.interface = interface
255
141
self.name = name
264
150
self.group = None # our entry group
265
151
self.server = None
266
152
self.bus = bus
267
self.entry_group_state_changed_match = None
268
269
153
def rename(self):
270
154
"""Derived from the Avahi example code"""
271
155
if self.rename_count >= self.max_renames:
272
logger.critical("No suitable Zeroconf service name found"
273
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
274
158
self.rename_count)
275
raise AvahiServiceError("Too many renames")
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
278
logger.info("Changing Zeroconf service name to %r ...",
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
279
162
self.name)
163
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
166
% self.name))
280
167
self.remove()
281
168
try:
282
169
self.add()
283
except dbus.exceptions.DBusException as error:
284
logger.critical("D-Bus Exception", exc_info=error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
285
172
self.cleanup()
286
173
os._exit(1)
287
174
self.rename_count += 1
288
289
175
def remove(self):
290
176
"""Derived from the Avahi example code"""
291
if self.entry_group_state_changed_match is not None:
292
self.entry_group_state_changed_match.remove()
293
self.entry_group_state_changed_match = None
294
177
if self.group is not None:
295
178
self.group.Reset()
296
297
179
def add(self):
298
180
"""Derived from the Avahi example code"""
299
self.remove()
300
181
if self.group is None:
301
182
self.group = dbus.Interface(
302
183
self.bus.get_object(avahi.DBUS_NAME,
303
184
self.server.EntryGroupNew()),
304
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
305
self.entry_group_state_changed_match = (
306
self.group.connect_to_signal(
307
'StateChanged', self.entry_group_state_changed))
308
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
309
190
self.name, self.type)
310
191
self.group.AddService(
311
192
self.interface,
316
197
dbus.UInt16(self.port),
317
198
avahi.string_array_to_txt_array(self.TXT))
318
199
self.group.Commit()
319
320
200
def entry_group_state_changed(self, state, error):
321
201
"""Derived from the Avahi example code"""
322
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
323
203
324
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
325
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
326
206
elif state == avahi.ENTRY_GROUP_COLLISION:
327
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
328
208
self.rename()
329
209
elif state == avahi.ENTRY_GROUP_FAILURE:
330
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
331
211
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
334
212
raise AvahiGroupError(u"State changed: %s"
213
% unicode(error))
335
214
def cleanup(self):
336
215
"""Derived from the Avahi example code"""
337
216
if self.group is not None:
338
try:
339
self.group.Free()
340
except (dbus.exceptions.UnknownMethodException,
341
dbus.exceptions.DBusException):
342
pass
217
self.group.Free()
343
218
self.group = None
344
self.remove()
345
346
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
347
220
"""Derived from the Avahi example code"""
348
logger.debug("Avahi server state change: %i", state)
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
356
if state in bad_states:
357
if bad_states[state] is not None:
358
if error is None:
359
logger.error(bad_states[state])
360
else:
361
logger.error(bad_states[state] + ": %r", error)
362
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
363
225
elif state == avahi.SERVER_RUNNING:
364
226
self.add()
365
else:
366
if error is None:
367
logger.debug("Unknown state: %r", state)
368
else:
369
logger.debug("Unknown state: %r: %r", state, error)
370
371
227
def activate(self):
372
228
"""Derived from the Avahi example code"""
373
229
if self.server is None:
374
230
self.server = dbus.Interface(
375
231
self.bus.get_object(avahi.DBUS_NAME,
376
avahi.DBUS_PATH_SERVER,
377
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
378
233
avahi.DBUS_INTERFACE_SERVER)
379
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
380
235
self.server_state_changed)
381
236
self.server_state_changed(self.server.GetState())
382
237
383
238
384
class AvahiServiceToSyslog(AvahiService):
385
def rename(self):
386
"""Add the new name to the syslog messages"""
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
392
return ret
393
394
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
401
402
239
class Client(object):
403
240
"""A representation of a client host served by this server.
404
241
405
242
Attributes:
406
approved: bool(); 'None' if not yet approved/disapproved
407
approval_delay: datetime.timedelta(); Time to wait for approval
408
approval_duration: datetime.timedelta(); Duration of one approval
243
name: string; from the config file, used in log messages and
244
D-Bus identifiers
245
fingerprint: string (40 or 32 hexadecimal digits); used to
246
uniquely identify the client
247
secret: bytestring; sent verbatim (over TLS) to client
248
host: string; available for use by the checker command
249
created: datetime.datetime(); (UTC) object creation
250
last_enabled: datetime.datetime(); (UTC)
251
enabled: bool()
252
last_checked_ok: datetime.datetime(); (UTC) or None
253
timeout: datetime.timedelta(); How long from last_checked_ok
254
until this client is disabled
255
interval: datetime.timedelta(); How often to start a new checker
256
disable_hook: If set, called by disable() as disable_hook(self)
409
257
checker: subprocess.Popen(); a running checker process used
410
258
to see if the client lives.
411
259
'None' if no process is running.
412
checker_callback_tag: a gobject event source tag, or None
413
checker_command: string; External command which is run to check
414
if client lives. %() expansions are done at
260
checker_initiator_tag: a gobject event source tag, or None
261
disable_initiator_tag: - '' -
262
checker_callback_tag: - '' -
263
checker_command: string; External command which is run to check if
264
client lives. %() expansions are done at
415
265
runtime with vars(self) as dict, so that for
416
266
instance %(name)s can be used in the command.
417
checker_initiator_tag: a gobject event source tag, or None
418
created: datetime.datetime(); (UTC) object creation
419
client_structure: Object describing what attributes a client has
420
and is used for storing the client at exit
421
267
current_checker_command: string; current running checker_command
422
disable_initiator_tag: a gobject event source tag, or None
423
enabled: bool()
424
fingerprint: string (40 or 32 hexadecimal digits); used to
425
uniquely identify the client
426
host: string; available for use by the checker command
427
interval: datetime.timedelta(); How often to start a new checker
428
last_approval_request: datetime.datetime(); (UTC) or None
429
last_checked_ok: datetime.datetime(); (UTC) or None
430
last_checker_status: integer between 0 and 255 reflecting exit
431
status of last checker. -1 reflects crashed
432
checker, -2 means no checker completed yet.
433
last_enabled: datetime.datetime(); (UTC) or None
434
name: string; from the config file, used in log messages and
435
D-Bus identifiers
436
secret: bytestring; sent verbatim (over TLS) to client
437
timeout: datetime.timedelta(); How long from last_checked_ok
438
until this client is disabled
439
extended_timeout: extra long timeout when secret has been sent
440
runtime_expansions: Allowed attributes for runtime expansion.
441
expires: datetime.datetime(); time (UTC) when a client will be
442
disabled, or None
268
approval_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approval_duration: datetime.timedelta(); Duration of one approval
443
271
"""
444
272
445
runtime_expansions = ("approval_delay", "approval_duration",
446
"created", "enabled", "expires",
447
"fingerprint", "host", "interval",
448
"last_approval_request", "last_checked_ok",
449
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
273
@staticmethod
274
def _timedelta_to_milliseconds(td):
275
"Convert a datetime.timedelta() to milliseconds"
276
return ((td.days * 24 * 60 * 60 * 1000)
277
+ (td.seconds * 1000)
278
+ (td.microseconds // 1000))
460
279
461
280
def timeout_milliseconds(self):
462
281
"Return the 'timeout' attribute in milliseconds"
463
return timedelta_to_milliseconds(self.timeout)
464
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
282
return self._timedelta_to_milliseconds(self.timeout)
468
283
469
284
def interval_milliseconds(self):
470
285
"Return the 'interval' attribute in milliseconds"
471
return timedelta_to_milliseconds(self.interval)
472
286
return self._timedelta_to_milliseconds(self.interval)
287
473
288
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
475
476
@staticmethod
477
def config_parser(config):
478
"""Construct a new dict of client settings of this form:
479
{ client_name: {setting_name: value, ...}, ...}
480
with exceptions for any special settings as defined above.
481
NOTE: Must be a pure function. Must return the same result
482
value given the same arguments.
483
"""
484
settings = {}
485
for client_name in config.sections():
486
section = dict(config.items(client_name))
487
client = settings[client_name] = {}
488
489
client["host"] = section["host"]
490
# Reformat values from string types to Python types
491
client["approved_by_default"] = config.getboolean(
492
client_name, "approved_by_default")
493
client["enabled"] = config.getboolean(client_name,
494
"enabled")
495
496
client["fingerprint"] = (section["fingerprint"].upper()
497
.replace(" ", ""))
498
if "secret" in section:
499
client["secret"] = section["secret"].decode("base64")
500
elif "secfile" in section:
501
with open(os.path.expanduser(os.path.expandvars
502
(section["secfile"])),
503
"rb") as secfile:
504
client["secret"] = secfile.read()
505
else:
506
raise TypeError("No secret or secfile for section {0}"
507
.format(section))
508
client["timeout"] = string_to_delta(section["timeout"])
509
client["extended_timeout"] = string_to_delta(
510
section["extended_timeout"])
511
client["interval"] = string_to_delta(section["interval"])
512
client["approval_delay"] = string_to_delta(
513
section["approval_delay"])
514
client["approval_duration"] = string_to_delta(
515
section["approval_duration"])
516
client["checker_command"] = section["checker"]
517
client["last_approval_request"] = None
518
client["last_checked_ok"] = None
519
client["last_checker_status"] = -2
520
521
return settings
522
523
def __init__(self, settings, name = None):
289
return self._timedelta_to_milliseconds(self.approval_delay)
290
291
def __init__(self, name = None, disable_hook=None, config=None):
292
"""Note: the 'checker' key in 'config' sets the
293
'checker_command' attribute and *not* the 'checker'
294
attribute."""
524
295
self.name = name
525
# adding all client settings
526
for setting, value in settings.iteritems():
527
setattr(self, setting, value)
528
529
if self.enabled:
530
if not hasattr(self, "last_enabled"):
531
self.last_enabled = datetime.datetime.utcnow()
532
if not hasattr(self, "expires"):
533
self.expires = (datetime.datetime.utcnow()
534
+ self.timeout)
535
else:
536
self.last_enabled = None
537
self.expires = None
538
539
logger.debug("Creating client %r", self.name)
296
if config is None:
297
config = {}
298
logger.debug(u"Creating client %r", self.name)
540
299
# Uppercase and remove spaces from fingerprint for later
541
300
# comparison purposes with return value from the fingerprint()
542
301
# function
543
logger.debug(" Fingerprint: %s", self.fingerprint)
544
self.created = settings.get("created",
545
datetime.datetime.utcnow())
546
547
# attributes specific for this server instance
302
self.fingerprint = (config[u"fingerprint"].upper()
303
.replace(u" ", u""))
304
logger.debug(u" Fingerprint: %s", self.fingerprint)
305
if u"secret" in config:
306
self.secret = config[u"secret"].decode(u"base64")
307
elif u"secfile" in config:
308
with open(os.path.expanduser(os.path.expandvars
309
(config[u"secfile"])),
310
"rb") as secfile:
311
self.secret = secfile.read()
312
else:
313
raise TypeError(u"No secret or secfile for client %s"
314
% self.name)
315
self.host = config.get(u"host", u"")
316
self.created = datetime.datetime.utcnow()
317
self.enabled = False
318
self.last_enabled = None
319
self.last_checked_ok = None
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
322
self.disable_hook = disable_hook
548
323
self.checker = None
549
324
self.checker_initiator_tag = None
550
325
self.disable_initiator_tag = None
551
326
self.checker_callback_tag = None
327
self.checker_command = config[u"checker"]
552
328
self.current_checker_command = None
553
self.approved = None
329
self.last_connect = None
330
self._approved = None
331
self.approved_by_default = config.get(u"approved_by_default",
332
True)
554
333
self.approvals_pending = 0
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
557
.Lock()))
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
560
if not attr.startswith("_")]
561
self.client_structure.append("client_structure")
562
563
for name, t in inspect.getmembers(type(self),
564
lambda obj:
565
isinstance(obj,
566
property)):
567
if not name.startswith("_"):
568
self.client_structure.append(name)
334
self.approval_delay = string_to_delta(
335
config[u"approval_delay"])
336
self.approval_duration = string_to_delta(
337
config[u"approval_duration"])
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
569
339
570
# Send notice to process children that client state has changed
571
340
def send_changedstate(self):
572
with self.changedstate:
573
self.changedstate.notify_all()
574
341
self.changedstate.acquire()
342
self.changedstate.notify_all()
343
self.changedstate.release()
344
575
345
def enable(self):
576
346
"""Start this client's checker and timeout hooks"""
577
if getattr(self, "enabled", False):
347
if getattr(self, u"enabled", False):
578
348
# Already enabled
579
349
return
580
self.expires = datetime.datetime.utcnow() + self.timeout
581
self.enabled = True
350
self.send_changedstate()
582
351
self.last_enabled = datetime.datetime.utcnow()
583
self.init_checker()
584
self.send_changedstate()
585
586
def disable(self, quiet=True):
587
"""Disable this client."""
588
if not getattr(self, "enabled", False):
589
return False
590
if not quiet:
591
logger.info("Disabling client %s", self.name)
592
if getattr(self, "disable_initiator_tag", None) is not None:
593
gobject.source_remove(self.disable_initiator_tag)
594
self.disable_initiator_tag = None
595
self.expires = None
596
if getattr(self, "checker_initiator_tag", None) is not None:
597
gobject.source_remove(self.checker_initiator_tag)
598
self.checker_initiator_tag = None
599
self.stop_checker()
600
self.enabled = False
601
if not quiet:
602
self.send_changedstate()
603
# Do not run this again if called by a gobject.timeout_add
604
return False
605
606
def __del__(self):
607
self.disable()
608
609
def init_checker(self):
610
352
# Schedule a new checker to be started an 'interval' from now,
611
353
# and every interval from then on.
612
if self.checker_initiator_tag is not None:
613
gobject.source_remove(self.checker_initiator_tag)
614
354
self.checker_initiator_tag = (gobject.timeout_add
615
355
(self.interval_milliseconds(),
616
356
self.start_checker))
617
357
# Schedule a disable() when 'timeout' has passed
618
if self.disable_initiator_tag is not None:
619
gobject.source_remove(self.disable_initiator_tag)
620
358
self.disable_initiator_tag = (gobject.timeout_add
621
359
(self.timeout_milliseconds(),
622
360
self.disable))
361
self.enabled = True
623
362
# Also start a new checker *right now*.
624
363
self.start_checker()
625
364
365
def disable(self, quiet=True):
366
"""Disable this client."""
367
if not getattr(self, "enabled", False):
368
return False
369
if not quiet:
370
self.send_changedstate()
371
if not quiet:
372
logger.info(u"Disabling client %s", self.name)
373
if getattr(self, u"disable_initiator_tag", False):
374
gobject.source_remove(self.disable_initiator_tag)
375
self.disable_initiator_tag = None
376
if getattr(self, u"checker_initiator_tag", False):
377
gobject.source_remove(self.checker_initiator_tag)
378
self.checker_initiator_tag = None
379
self.stop_checker()
380
if self.disable_hook:
381
self.disable_hook(self)
382
self.enabled = False
383
# Do not run this again if called by a gobject.timeout_add
384
return False
385
386
def __del__(self):
387
self.disable_hook = None
388
self.disable()
389
626
390
def checker_callback(self, pid, condition, command):
627
391
"""The checker has completed, so take appropriate actions."""
628
392
self.checker_callback_tag = None
629
393
self.checker = None
630
394
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
632
if self.last_checker_status == 0:
633
logger.info("Checker for %(name)s succeeded",
395
exitstatus = os.WEXITSTATUS(condition)
396
if exitstatus == 0:
397
logger.info(u"Checker for %(name)s succeeded",
634
398
vars(self))
635
399
self.checked_ok()
636
400
else:
637
logger.info("Checker for %(name)s failed",
401
logger.info(u"Checker for %(name)s failed",
638
402
vars(self))
639
403
else:
640
self.last_checker_status = -1
641
logger.warning("Checker for %(name)s crashed?",
404
logger.warning(u"Checker for %(name)s crashed?",
642
405
vars(self))
643
406
644
407
def checked_ok(self):
645
"""Assert that the client has been seen, alive and well."""
408
"""Bump up the timeout for this client.
409
410
This should only be called when the client has been seen,
411
alive and well.
412
"""
646
413
self.last_checked_ok = datetime.datetime.utcnow()
647
self.last_checker_status = 0
648
self.bump_timeout()
649
650
def bump_timeout(self, timeout=None):
651
"""Bump up the timeout for this client."""
652
if timeout is None:
653
timeout = self.timeout
654
if self.disable_initiator_tag is not None:
655
gobject.source_remove(self.disable_initiator_tag)
656
self.disable_initiator_tag = None
657
if getattr(self, "enabled", False):
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
661
self.expires = datetime.datetime.utcnow() + timeout
662
663
def need_approval(self):
664
self.last_approval_request = datetime.datetime.utcnow()
414
gobject.source_remove(self.disable_initiator_tag)
415
self.disable_initiator_tag = (gobject.timeout_add
416
(self.timeout_milliseconds(),
417
self.disable))
665
418
666
419
def start_checker(self):
667
420
"""Start a new checker subprocess if one is not running.
669
422
If a checker already exists, leave it running and do
670
423
nothing."""
671
424
# The reason for not killing a running checker is that if we
672
# did that, and if a checker (for some reason) started running
673
# slowly and taking more than 'interval' time, then the client
674
# would inevitably timeout, since no checker would get a
675
# chance to run to completion. If we instead leave running
425
# did that, then if a checker (for some reason) started
426
# running slowly and taking more than 'interval' time, the
427
# client would inevitably timeout, since no checker would get
428
# a chance to run to completion. If we instead leave running
676
429
# checkers alone, the checker would have to take more time
677
430
# than 'timeout' for the client to be disabled, which is as it
678
431
# should be.
680
433
# If a checker exists, make sure it is not a zombie
681
434
try:
682
435
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
436
except (AttributeError, OSError), error:
684
437
if (isinstance(error, OSError)
685
438
and error.errno != errno.ECHILD):
686
439
raise error
687
440
else:
688
441
if pid:
689
logger.warning("Checker was a zombie")
442
logger.warning(u"Checker was a zombie")
690
443
gobject.source_remove(self.checker_callback_tag)
691
444
self.checker_callback(pid, status,
692
445
self.current_checker_command)
693
446
# Start a new checker if needed
694
447
if self.checker is None:
695
# Escape attributes for the shell
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
698
for attr in
699
self.runtime_expansions)
700
448
try:
701
command = self.checker_command % escaped_attrs
702
except TypeError as error:
703
logger.error('Could not format string "%s"',
704
self.checker_command, exc_info=error)
705
return True # Try again later
449
# In case checker_command has exactly one % operator
450
command = self.checker_command % self.host
451
except TypeError:
452
# Escape attributes for the shell
453
escaped_attrs = dict((key,
454
re.escape(unicode(str(val),
455
errors=
456
u'replace')))
457
for key, val in
458
vars(self).iteritems())
459
try:
460
command = self.checker_command % escaped_attrs
461
except TypeError, error:
462
logger.error(u'Could not format string "%s":'
463
u' %s', self.checker_command, error)
464
return True # Try again later
706
465
self.current_checker_command = command
707
466
try:
708
logger.info("Starting checker %r for %s",
467
logger.info(u"Starting checker %r for %s",
709
468
command, self.name)
710
469
# We don't need to redirect stdout and stderr, since
711
470
# in normal mode, that is already done by daemon(),
713
472
# always replaced by /dev/null.)
714
473
self.checker = subprocess.Popen(command,
715
474
close_fds=True,
716
shell=True, cwd="/")
717
except OSError as error:
718
logger.error("Failed to start subprocess",
719
exc_info=error)
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
475
shell=True, cwd=u"/")
476
self.checker_callback_tag = (gobject.child_watch_add
477
(self.checker.pid,
478
self.checker_callback,
479
data=command))
480
# The checker may have completed before the gobject
481
# watch was added. Check for this.
728
482
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
729
except OSError as error:
730
if error.errno == errno.ECHILD:
731
logger.error("Child process vanished", exc_info=error)
732
return True
733
raise
734
if pid:
735
gobject.source_remove(self.checker_callback_tag)
736
self.checker_callback(pid, status, command)
483
if pid:
484
gobject.source_remove(self.checker_callback_tag)
485
self.checker_callback(pid, status, command)
486
except OSError, error:
487
logger.error(u"Failed to start subprocess: %s",
488
error)
737
489
# Re-run this periodically if run by gobject.timeout_add
738
490
return True
739
491
742
494
if self.checker_callback_tag:
743
495
gobject.source_remove(self.checker_callback_tag)
744
496
self.checker_callback_tag = None
745
if getattr(self, "checker", None) is None:
497
if getattr(self, u"checker", None) is None:
746
498
return
747
logger.debug("Stopping checker for %(name)s", vars(self))
499
logger.debug(u"Stopping checker for %(name)s", vars(self))
748
500
try:
749
self.checker.terminate()
501
os.kill(self.checker.pid, signal.SIGTERM)
750
502
#time.sleep(0.5)
751
503
#if self.checker.poll() is None:
752
# self.checker.kill()
753
except OSError as error:
504
# os.kill(self.checker.pid, signal.SIGKILL)
505
except OSError, error:
754
506
if error.errno != errno.ESRCH: # No such process
755
507
raise
756
508
self.checker = None
757
509
758
759
def dbus_service_property(dbus_interface, signature="v",
760
access="readwrite", byte_arrays=False):
510
def dbus_service_property(dbus_interface, signature=u"v",
511
access=u"readwrite", byte_arrays=False):
761
512
"""Decorators for marking methods of a DBusObjectWithProperties to
762
513
become properties on the D-Bus.
763
514
770
521
"""
771
522
# Encoding deeply encoded byte arrays is not supported yet by the
772
523
# "Set" method, so we fail early here:
773
if byte_arrays and signature != "ay":
774
raise ValueError("Byte arrays not supported for non-'ay'"
775
" signature {0!r}".format(signature))
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
776
527
def decorator(func):
777
528
func._dbus_is_property = True
778
529
func._dbus_interface = dbus_interface
779
530
func._dbus_signature = signature
780
531
func._dbus_access = access
781
532
func._dbus_name = func.__name__
782
if func._dbus_name.endswith("_dbus_property"):
533
if func._dbus_name.endswith(u"_dbus_property"):
783
534
func._dbus_name = func._dbus_name[:-14]
784
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
785
return func
786
return decorator
787
788
789
def dbus_interface_annotations(dbus_interface):
790
"""Decorator for marking functions returning interface annotations
791
792
Usage:
793
794
@dbus_interface_annotations("org.example.Interface")
795
def _foo(self): # Function name does not matter
796
return {"org.freedesktop.DBus.Deprecated": "true",
797
"org.freedesktop.DBus.Property.EmitsChangedSignal":
798
"false"}
799
"""
800
def decorator(func):
801
func._dbus_is_interface = True
802
func._dbus_interface = dbus_interface
803
func._dbus_name = dbus_interface
804
return func
805
return decorator
806
807
808
def dbus_annotations(annotations):
809
"""Decorator to annotate D-Bus methods, signals or properties
810
Usage:
811
812
@dbus_service_property("org.example.Interface", signature="b",
813
access="r")
814
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
815
"org.freedesktop.DBus.Property."
816
"EmitsChangedSignal": "false"})
817
def Property_dbus_property(self):
818
return dbus.Boolean(False)
819
"""
820
def decorator(func):
821
func._dbus_annotations = annotations
535
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
822
536
return func
823
537
return decorator
824
538
844
558
845
559
class DBusObjectWithProperties(dbus.service.Object):
846
560
"""A D-Bus object with properties.
847
561
848
562
Classes inheriting from this can use the dbus_service_property
849
563
decorator to expose methods as D-Bus properties. It exposes the
850
564
standard Get(), Set(), and GetAll() methods on the D-Bus.
851
565
"""
852
566
853
567
@staticmethod
854
def _is_dbus_thing(thing):
855
"""Returns a function testing if an attribute is a D-Bus thing
856
857
If called like _is_dbus_thing("method") it returns a function
858
suitable for use as predicate to inspect.getmembers().
859
"""
860
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
861
False)
568
def _is_dbus_property(obj):
569
return getattr(obj, u"_dbus_is_property", False)
862
570
863
def _get_all_dbus_things(self, thing):
571
def _get_all_dbus_properties(self):
864
572
"""Returns a generator of (name, attribute) pairs
865
573
"""
866
return ((getattr(athing.__get__(self), "_dbus_name",
867
name),
868
athing.__get__(self))
869
for cls in self.__class__.__mro__
870
for name, athing in
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
574
return ((prop._dbus_name, prop)
575
for name, prop in
576
inspect.getmembers(self, self._is_dbus_property))
873
577
874
578
def _get_dbus_property(self, interface_name, property_name):
875
579
"""Returns a bound method if one exists which is a D-Bus
876
580
property with the specified name and interface.
877
581
"""
878
for cls in self.__class__.__mro__:
879
for name, value in (inspect.getmembers
880
(cls,
881
self._is_dbus_thing("property"))):
882
if (value._dbus_name == property_name
883
and value._dbus_interface == interface_name):
884
return value.__get__(self)
885
582
for name in (property_name,
583
property_name + u"_dbus_property"):
584
prop = getattr(self, name, None)
585
if (prop is None
586
or not self._is_dbus_property(prop)
587
or prop._dbus_name != property_name
588
or (interface_name and prop._dbus_interface
589
and interface_name != prop._dbus_interface)):
590
continue
591
return prop
886
592
# No such property
887
raise DBusPropertyNotFound(self.dbus_object_path + ":"
888
+ interface_name + "."
593
raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
+ interface_name + u"."
889
595
+ property_name)
890
596
891
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
892
out_signature="v")
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
598
out_signature=u"v")
893
599
def Get(self, interface_name, property_name):
894
600
"""Standard D-Bus property Get() method, see D-Bus standard.
895
601
"""
896
602
prop = self._get_dbus_property(interface_name, property_name)
897
if prop._dbus_access == "write":
603
if prop._dbus_access == u"write":
898
604
raise DBusPropertyAccessException(property_name)
899
605
value = prop()
900
if not hasattr(value, "variant_level"):
606
if not hasattr(value, u"variant_level"):
901
607
return value
902
608
return type(value)(value, variant_level=value.variant_level+1)
903
609
904
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
905
611
def Set(self, interface_name, property_name, value):
906
612
"""Standard D-Bus property Set() method, see D-Bus standard.
907
613
"""
908
614
prop = self._get_dbus_property(interface_name, property_name)
909
if prop._dbus_access == "read":
615
if prop._dbus_access == u"read":
910
616
raise DBusPropertyAccessException(property_name)
911
if prop._dbus_get_args_options["byte_arrays"]:
617
if prop._dbus_get_args_options[u"byte_arrays"]:
912
618
# The byte_arrays option is not supported yet on
913
619
# signatures other than "ay".
914
if prop._dbus_signature != "ay":
620
if prop._dbus_signature != u"ay":
915
621
raise ValueError
916
value = dbus.ByteArray(b''.join(chr(byte)
917
for byte in value))
622
value = dbus.ByteArray(''.join(unichr(byte)
623
for byte in value))
918
624
prop(value)
919
625
920
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
921
out_signature="a{sv}")
626
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
out_signature=u"a{sv}")
922
628
def GetAll(self, interface_name):
923
629
"""Standard D-Bus property GetAll() method, see D-Bus
924
630
standard.
925
631
926
632
Note: Will not include properties with access="write".
927
633
"""
928
properties = {}
929
for name, prop in self._get_all_dbus_things("property"):
634
all = {}
635
for name, prop in self._get_all_dbus_properties():
930
636
if (interface_name
931
637
and interface_name != prop._dbus_interface):
932
638
# Interface non-empty but did not match
933
639
continue
934
640
# Ignore write-only properties
935
if prop._dbus_access == "write":
641
if prop._dbus_access == u"write":
936
642
continue
937
643
value = prop()
938
if not hasattr(value, "variant_level"):
939
properties[name] = value
644
if not hasattr(value, u"variant_level"):
645
all[name] = value
940
646
continue
941
properties[name] = type(value)(value, variant_level=
942
value.variant_level+1)
943
return dbus.Dictionary(properties, signature="sv")
647
all[name] = type(value)(value, variant_level=
648
value.variant_level+1)
649
return dbus.Dictionary(all, signature=u"sv")
944
650
945
651
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
946
out_signature="s",
652
out_signature=u"s",
947
653
path_keyword='object_path',
948
654
connection_keyword='connection')
949
655
def Introspect(self, object_path, connection):
950
"""Overloading of standard D-Bus method.
951
952
Inserts property tags and interface annotation tags.
656
"""Standard D-Bus method, overloaded to insert property tags.
953
657
"""
954
658
xmlstring = dbus.service.Object.Introspect(self, object_path,
955
659
connection)
956
660
try:
957
661
document = xml.dom.minidom.parseString(xmlstring)
958
662
def make_tag(document, name, prop):
959
e = document.createElement("property")
960
e.setAttribute("name", name)
961
e.setAttribute("type", prop._dbus_signature)
962
e.setAttribute("access", prop._dbus_access)
663
e = document.createElement(u"property")
664
e.setAttribute(u"name", name)
665
e.setAttribute(u"type", prop._dbus_signature)
666
e.setAttribute(u"access", prop._dbus_access)
963
667
return e
964
for if_tag in document.getElementsByTagName("interface"):
965
# Add property tags
668
for if_tag in document.getElementsByTagName(u"interface"):
966
669
for tag in (make_tag(document, name, prop)
967
670
for name, prop
968
in self._get_all_dbus_things("property")
671
in self._get_all_dbus_properties()
969
672
if prop._dbus_interface
970
== if_tag.getAttribute("name")):
673
== if_tag.getAttribute(u"name")):
971
674
if_tag.appendChild(tag)
972
# Add annotation tags
973
for typ in ("method", "signal", "property"):
974
for tag in if_tag.getElementsByTagName(typ):
975
annots = dict()
976
for name, prop in (self.
977
_get_all_dbus_things(typ)):
978
if (name == tag.getAttribute("name")
979
and prop._dbus_interface
980
== if_tag.getAttribute("name")):
981
annots.update(getattr
982
(prop,
983
"_dbus_annotations",
984
{}))
985
for name, value in annots.iteritems():
986
ann_tag = document.createElement(
987
"annotation")
988
ann_tag.setAttribute("name", name)
989
ann_tag.setAttribute("value", value)
990
tag.appendChild(ann_tag)
991
# Add interface annotation tags
992
for annotation, value in dict(
993
itertools.chain.from_iterable(
994
annotations().iteritems()
995
for name, annotations in
996
self._get_all_dbus_things("interface")
997
if name == if_tag.getAttribute("name")
998
)).iteritems():
999
ann_tag = document.createElement("annotation")
1000
ann_tag.setAttribute("name", annotation)
1001
ann_tag.setAttribute("value", value)
1002
if_tag.appendChild(ann_tag)
1003
675
# Add the names to the return values for the
1004
676
# "org.freedesktop.DBus.Properties" methods
1005
if (if_tag.getAttribute("name")
1006
== "org.freedesktop.DBus.Properties"):
1007
for cn in if_tag.getElementsByTagName("method"):
1008
if cn.getAttribute("name") == "Get":
1009
for arg in cn.getElementsByTagName("arg"):
1010
if (arg.getAttribute("direction")
1011
== "out"):
1012
arg.setAttribute("name", "value")
1013
elif cn.getAttribute("name") == "GetAll":
1014
for arg in cn.getElementsByTagName("arg"):
1015
if (arg.getAttribute("direction")
1016
== "out"):
1017
arg.setAttribute("name", "props")
1018
xmlstring = document.toxml("utf-8")
677
if (if_tag.getAttribute(u"name")
678
== u"org.freedesktop.DBus.Properties"):
679
for cn in if_tag.getElementsByTagName(u"method"):
680
if cn.getAttribute(u"name") == u"Get":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
683
== u"out"):
684
arg.setAttribute(u"name", u"value")
685
elif cn.getAttribute(u"name") == u"GetAll":
686
for arg in cn.getElementsByTagName(u"arg"):
687
if (arg.getAttribute(u"direction")
688
== u"out"):
689
arg.setAttribute(u"name", u"props")
690
xmlstring = document.toxml(u"utf-8")
1019
691
document.unlink()
1020
692
except (AttributeError, xml.dom.DOMException,
1021
xml.parsers.expat.ExpatError) as error:
1022
logger.error("Failed to override Introspection method",
1023
exc_info=error)
693
xml.parsers.expat.ExpatError), error:
694
logger.error(u"Failed to override Introspection method",
695
error)
1024
696
return xmlstring
1025
697
1026
698
1027
def datetime_to_dbus(dt, variant_level=0):
1028
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1029
if dt is None:
1030
return dbus.String("", variant_level = variant_level)
1031
return dbus.String(dt.isoformat(),
1032
variant_level=variant_level)
1033
1034
1035
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1036
"""A class decorator; applied to a subclass of
1037
dbus.service.Object, it will add alternate D-Bus attributes with
1038
interface names according to the "alt_interface_names" mapping.
1039
Usage:
1040
1041
@alternate_dbus_interfaces({"org.example.Interface":
1042
"net.example.AlternateInterface"})
1043
class SampleDBusObject(dbus.service.Object):
1044
@dbus.service.method("org.example.Interface")
1045
def SampleDBusMethod():
1046
pass
1047
1048
The above "SampleDBusMethod" on "SampleDBusObject" will be
1049
reachable via two interfaces: "org.example.Interface" and
1050
"net.example.AlternateInterface", the latter of which will have
1051
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1052
"true", unless "deprecate" is passed with a False value.
1053
1054
This works for methods and signals, and also for D-Bus properties
1055
(from DBusObjectWithProperties) and interfaces (from the
1056
dbus_interface_annotations decorator).
1057
"""
1058
def wrapper(cls):
1059
for orig_interface_name, alt_interface_name in (
1060
alt_interface_names.iteritems()):
1061
attr = {}
1062
interface_names = set()
1063
# Go though all attributes of the class
1064
for attrname, attribute in inspect.getmembers(cls):
1065
# Ignore non-D-Bus attributes, and D-Bus attributes
1066
# with the wrong interface name
1067
if (not hasattr(attribute, "_dbus_interface")
1068
or not attribute._dbus_interface
1069
.startswith(orig_interface_name)):
1070
continue
1071
# Create an alternate D-Bus interface name based on
1072
# the current name
1073
alt_interface = (attribute._dbus_interface
1074
.replace(orig_interface_name,
1075
alt_interface_name))
1076
interface_names.add(alt_interface)
1077
# Is this a D-Bus signal?
1078
if getattr(attribute, "_dbus_is_signal", False):
1079
# Extract the original non-method function by
1080
# black magic
1081
nonmethod_func = (dict(
1082
zip(attribute.func_code.co_freevars,
1083
attribute.__closure__))["func"]
1084
.cell_contents)
1085
# Create a new, but exactly alike, function
1086
# object, and decorate it to be a new D-Bus signal
1087
# with the alternate D-Bus interface name
1088
new_function = (dbus.service.signal
1089
(alt_interface,
1090
attribute._dbus_signature)
1091
(types.FunctionType(
1092
nonmethod_func.func_code,
1093
nonmethod_func.func_globals,
1094
nonmethod_func.func_name,
1095
nonmethod_func.func_defaults,
1096
nonmethod_func.func_closure)))
1097
# Copy annotations, if any
1098
try:
1099
new_function._dbus_annotations = (
1100
dict(attribute._dbus_annotations))
1101
except AttributeError:
1102
pass
1103
# Define a creator of a function to call both the
1104
# original and alternate functions, so both the
1105
# original and alternate signals gets sent when
1106
# the function is called
1107
def fixscope(func1, func2):
1108
"""This function is a scope container to pass
1109
func1 and func2 to the "call_both" function
1110
outside of its arguments"""
1111
def call_both(*args, **kwargs):
1112
"""This function will emit two D-Bus
1113
signals by calling func1 and func2"""
1114
func1(*args, **kwargs)
1115
func2(*args, **kwargs)
1116
return call_both
1117
# Create the "call_both" function and add it to
1118
# the class
1119
attr[attrname] = fixscope(attribute, new_function)
1120
# Is this a D-Bus method?
1121
elif getattr(attribute, "_dbus_is_method", False):
1122
# Create a new, but exactly alike, function
1123
# object. Decorate it to be a new D-Bus method
1124
# with the alternate D-Bus interface name. Add it
1125
# to the class.
1126
attr[attrname] = (dbus.service.method
1127
(alt_interface,
1128
attribute._dbus_in_signature,
1129
attribute._dbus_out_signature)
1130
(types.FunctionType
1131
(attribute.func_code,
1132
attribute.func_globals,
1133
attribute.func_name,
1134
attribute.func_defaults,
1135
attribute.func_closure)))
1136
# Copy annotations, if any
1137
try:
1138
attr[attrname]._dbus_annotations = (
1139
dict(attribute._dbus_annotations))
1140
except AttributeError:
1141
pass
1142
# Is this a D-Bus property?
1143
elif getattr(attribute, "_dbus_is_property", False):
1144
# Create a new, but exactly alike, function
1145
# object, and decorate it to be a new D-Bus
1146
# property with the alternate D-Bus interface
1147
# name. Add it to the class.
1148
attr[attrname] = (dbus_service_property
1149
(alt_interface,
1150
attribute._dbus_signature,
1151
attribute._dbus_access,
1152
attribute
1153
._dbus_get_args_options
1154
["byte_arrays"])
1155
(types.FunctionType
1156
(attribute.func_code,
1157
attribute.func_globals,
1158
attribute.func_name,
1159
attribute.func_defaults,
1160
attribute.func_closure)))
1161
# Copy annotations, if any
1162
try:
1163
attr[attrname]._dbus_annotations = (
1164
dict(attribute._dbus_annotations))
1165
except AttributeError:
1166
pass
1167
# Is this a D-Bus interface?
1168
elif getattr(attribute, "_dbus_is_interface", False):
1169
# Create a new, but exactly alike, function
1170
# object. Decorate it to be a new D-Bus interface
1171
# with the alternate D-Bus interface name. Add it
1172
# to the class.
1173
attr[attrname] = (dbus_interface_annotations
1174
(alt_interface)
1175
(types.FunctionType
1176
(attribute.func_code,
1177
attribute.func_globals,
1178
attribute.func_name,
1179
attribute.func_defaults,
1180
attribute.func_closure)))
1181
if deprecate:
1182
# Deprecate all alternate interfaces
1183
iname="_AlternateDBusNames_interface_annotation{0}"
1184
for interface_name in interface_names:
1185
@dbus_interface_annotations(interface_name)
1186
def func(self):
1187
return { "org.freedesktop.DBus.Deprecated":
1188
"true" }
1189
# Find an unused name
1190
for aname in (iname.format(i)
1191
for i in itertools.count()):
1192
if aname not in attr:
1193
attr[aname] = func
1194
break
1195
if interface_names:
1196
# Replace the class with a new subclass of it with
1197
# methods, signals, etc. as created above.
1198
cls = type(b"{0}Alternate".format(cls.__name__),
1199
(cls,), attr)
1200
return cls
1201
return wrapper
1202
1203
1204
@alternate_dbus_interfaces({"se.recompile.Mandos":
1205
"se.bsnet.fukt.Mandos"})
1206
699
class ClientDBus(Client, DBusObjectWithProperties):
1207
700
"""A Client class using D-Bus
1208
701
1210
703
dbus_object_path: dbus.ObjectPath
1211
704
bus: dbus.SystemBus()
1212
705
"""
1213
1214
runtime_expansions = (Client.runtime_expansions
1215
+ ("dbus_object_path",))
1216
1217
706
# dbus.service.Object doesn't use super(), so we can't either.
1218
707
1219
708
def __init__(self, bus = None, *args, **kwargs):
709
self._approvals_pending = 0
1220
710
self.bus = bus
1221
711
Client.__init__(self, *args, **kwargs)
1222
712
# Only now, when this client is initialized, can it show up on
1223
713
# the D-Bus
1224
client_object_name = unicode(self.name).translate(
1225
{ord("."): ord("_"),
1226
ord("-"): ord("_")})
1227
714
self.dbus_object_path = (dbus.ObjectPath
1228
("/clients/" + client_object_name))
715
(u"/clients/"
716
+ self.name.replace(u".", u"_")))
1229
717
DBusObjectWithProperties.__init__(self, self.bus,
1230
718
self.dbus_object_path)
1231
1232
def notifychangeproperty(transform_func,
1233
dbus_name, type_func=lambda x: x,
1234
variant_level=1):
1235
""" Modify a variable so that it's a property which announces
1236
its changes to DBus.
1237
1238
transform_fun: Function that takes a value and a variant_level
1239
and transforms it to a D-Bus type.
1240
dbus_name: D-Bus name of the variable
1241
type_func: Function that transform the value before sending it
1242
to the D-Bus. Default: no transform
1243
variant_level: D-Bus variant level. Default: 1
1244
"""
1245
attrname = "_{0}".format(dbus_name)
1246
def setter(self, value):
1247
if hasattr(self, "dbus_object_path"):
1248
if (not hasattr(self, attrname) or
1249
type_func(getattr(self, attrname, None))
1250
!= type_func(value)):
1251
dbus_value = transform_func(type_func(value),
1252
variant_level
1253
=variant_level)
1254
self.PropertyChanged(dbus.String(dbus_name),
1255
dbus_value)
1256
setattr(self, attrname, value)
1257
1258
return property(lambda self: getattr(self, attrname), setter)
1259
1260
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1261
approvals_pending = notifychangeproperty(dbus.Boolean,
1262
"ApprovalPending",
1263
type_func = bool)
1264
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1265
last_enabled = notifychangeproperty(datetime_to_dbus,
1266
"LastEnabled")
1267
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1268
type_func = lambda checker:
1269
checker is not None)
1270
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1271
"LastCheckedOK")
1272
last_checker_status = notifychangeproperty(dbus.Int16,
1273
"LastCheckerStatus")
1274
last_approval_request = notifychangeproperty(
1275
datetime_to_dbus, "LastApprovalRequest")
1276
approved_by_default = notifychangeproperty(dbus.Boolean,
1277
"ApprovedByDefault")
1278
approval_delay = notifychangeproperty(dbus.UInt64,
1279
"ApprovalDelay",
1280
type_func =
1281
timedelta_to_milliseconds)
1282
approval_duration = notifychangeproperty(
1283
dbus.UInt64, "ApprovalDuration",
1284
type_func = timedelta_to_milliseconds)
1285
host = notifychangeproperty(dbus.String, "Host")
1286
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1287
type_func =
1288
timedelta_to_milliseconds)
1289
extended_timeout = notifychangeproperty(
1290
dbus.UInt64, "ExtendedTimeout",
1291
type_func = timedelta_to_milliseconds)
1292
interval = notifychangeproperty(dbus.UInt64,
1293
"Interval",
1294
type_func =
1295
timedelta_to_milliseconds)
1296
checker_command = notifychangeproperty(dbus.String, "Checker")
1297
1298
del notifychangeproperty
719
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
725
bval = bool(value)
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
dbus_bool)
731
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
735
736
@staticmethod
737
def _datetime_to_dbus(dt, variant_level=0):
738
"""Convert a UTC datetime.datetime() to a D-Bus type."""
739
return dbus.String(dt.isoformat(),
740
variant_level=variant_level)
741
742
def enable(self):
743
oldstate = getattr(self, u"enabled", False)
744
r = Client.enable(self)
745
if oldstate != self.enabled:
746
# Emit D-Bus signals
747
self.PropertyChanged(dbus.String(u"Enabled"),
748
dbus.Boolean(True, variant_level=1))
749
self.PropertyChanged(
750
dbus.String(u"LastEnabled"),
751
self._datetime_to_dbus(self.last_enabled,
752
variant_level=1))
753
return r
754
755
def disable(self, quiet = False):
756
oldstate = getattr(self, u"enabled", False)
757
r = Client.disable(self, quiet=quiet)
758
if not quiet and oldstate != self.enabled:
759
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"Enabled"),
761
dbus.Boolean(False, variant_level=1))
762
return r
1299
763
1300
764
def __del__(self, *args, **kwargs):
1301
765
try:
1302
766
self.remove_from_connection()
1303
767
except LookupError:
1304
768
pass
1305
if hasattr(DBusObjectWithProperties, "__del__"):
769
if hasattr(DBusObjectWithProperties, u"__del__"):
1306
770
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1307
771
Client.__del__(self, *args, **kwargs)
1308
772
1310
774
*args, **kwargs):
1311
775
self.checker_callback_tag = None
1312
776
self.checker = None
777
# Emit D-Bus signal
778
self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
dbus.Boolean(False, variant_level=1))
1313
780
if os.WIFEXITED(condition):
1314
781
exitstatus = os.WEXITSTATUS(condition)
1315
782
# Emit D-Bus signal
1325
792
return Client.checker_callback(self, pid, condition, command,
1326
793
*args, **kwargs)
1327
794
795
def checked_ok(self, *args, **kwargs):
796
r = Client.checked_ok(self, *args, **kwargs)
797
# Emit D-Bus signal
798
self.PropertyChanged(
799
dbus.String(u"LastCheckedOK"),
800
(self._datetime_to_dbus(self.last_checked_ok,
801
variant_level=1)))
802
return r
803
1328
804
def start_checker(self, *args, **kwargs):
1329
805
old_checker = self.checker
1330
806
if self.checker is not None:
1337
813
and old_checker_pid != self.checker.pid):
1338
814
# Emit D-Bus signal
1339
815
self.CheckerStarted(self.current_checker_command)
816
self.PropertyChanged(
817
dbus.String(u"CheckerRunning"),
818
dbus.Boolean(True, variant_level=1))
1340
819
return r
1341
820
821
def stop_checker(self, *args, **kwargs):
822
old_checker = getattr(self, u"checker", None)
823
r = Client.stop_checker(self, *args, **kwargs)
824
if (old_checker is not None
825
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"CheckerRunning"),
827
dbus.Boolean(False, variant_level=1))
828
return r
829
1342
830
def _reset_approved(self):
1343
self.approved = None
831
self._approved = None
1344
832
return False
1345
833
1346
834
def approve(self, value=True):
1347
self.approved = value
1348
gobject.timeout_add(timedelta_to_milliseconds
835
self.send_changedstate()
836
self._approved = value
837
gobject.timeout_add(self._timedelta_to_milliseconds
1349
838
(self.approval_duration),
1350
839
self._reset_approved)
1351
self.send_changedstate()
840
1352
841
1353
842
## D-Bus methods, signals & properties
1354
_interface = "se.recompile.Mandos.Client"
1355
1356
## Interfaces
1357
1358
@dbus_interface_annotations(_interface)
1359
def _foo(self):
1360
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1361
"false"}
843
_interface = u"se.bsnet.fukt.Mandos.Client"
1362
844
1363
845
## Signals
1364
846
1365
847
# CheckerCompleted - signal
1366
@dbus.service.signal(_interface, signature="nxs")
848
@dbus.service.signal(_interface, signature=u"nxs")
1367
849
def CheckerCompleted(self, exitcode, waitstatus, command):
1368
850
"D-Bus signal"
1369
851
pass
1370
852
1371
853
# CheckerStarted - signal
1372
@dbus.service.signal(_interface, signature="s")
854
@dbus.service.signal(_interface, signature=u"s")
1373
855
def CheckerStarted(self, command):
1374
856
"D-Bus signal"
1375
857
pass
1376
858
1377
859
# PropertyChanged - signal
1378
@dbus.service.signal(_interface, signature="sv")
860
@dbus.service.signal(_interface, signature=u"sv")
1379
861
def PropertyChanged(self, property, value):
1380
862
"D-Bus signal"
1381
863
pass
1390
872
pass
1391
873
1392
874
# Rejected - signal
1393
@dbus.service.signal(_interface, signature="s")
875
@dbus.service.signal(_interface, signature=u"s")
1394
876
def Rejected(self, reason):
1395
877
"D-Bus signal"
1396
878
pass
1397
879
1398
880
# NeedApproval - signal
1399
@dbus.service.signal(_interface, signature="tb")
881
@dbus.service.signal(_interface, signature=u"tb")
1400
882
def NeedApproval(self, timeout, default):
1401
883
"D-Bus signal"
1402
return self.need_approval()
884
pass
1403
885
1404
886
## Methods
1405
887
1406
888
# Approve - method
1407
@dbus.service.method(_interface, in_signature="b")
889
@dbus.service.method(_interface, in_signature=u"b")
1408
890
def Approve(self, value):
1409
891
self.approve(value)
1410
892
1411
893
# CheckedOK - method
1412
894
@dbus.service.method(_interface)
1413
895
def CheckedOK(self):
1414
self.checked_ok()
896
return self.checked_ok()
1415
897
1416
898
# Enable - method
1417
899
@dbus.service.method(_interface)
1439
921
## Properties
1440
922
1441
923
# ApprovalPending - property
1442
@dbus_service_property(_interface, signature="b", access="read")
924
@dbus_service_property(_interface, signature=u"b", access=u"read")
1443
925
def ApprovalPending_dbus_property(self):
1444
926
return dbus.Boolean(bool(self.approvals_pending))
1445
927
1446
928
# ApprovedByDefault - property
1447
@dbus_service_property(_interface, signature="b",
1448
access="readwrite")
929
@dbus_service_property(_interface, signature=u"b",
930
access=u"readwrite")
1449
931
def ApprovedByDefault_dbus_property(self, value=None):
1450
932
if value is None: # get
1451
933
return dbus.Boolean(self.approved_by_default)
1452
934
self.approved_by_default = bool(value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
dbus.Boolean(value, variant_level=1))
1453
938
1454
939
# ApprovalDelay - property
1455
@dbus_service_property(_interface, signature="t",
1456
access="readwrite")
940
@dbus_service_property(_interface, signature=u"t",
941
access=u"readwrite")
1457
942
def ApprovalDelay_dbus_property(self, value=None):
1458
943
if value is None: # get
1459
944
return dbus.UInt64(self.approval_delay_milliseconds())
1460
945
self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
# Emit D-Bus signal
947
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
dbus.UInt64(value, variant_level=1))
1461
949
1462
950
# ApprovalDuration - property
1463
@dbus_service_property(_interface, signature="t",
1464
access="readwrite")
951
@dbus_service_property(_interface, signature=u"t",
952
access=u"readwrite")
1465
953
def ApprovalDuration_dbus_property(self, value=None):
1466
954
if value is None: # get
1467
return dbus.UInt64(timedelta_to_milliseconds(
955
return dbus.UInt64(self._timedelta_to_milliseconds(
1468
956
self.approval_duration))
1469
957
self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
dbus.UInt64(value, variant_level=1))
1470
961
1471
962
# Name - property
1472
@dbus_service_property(_interface, signature="s", access="read")
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
1473
964
def Name_dbus_property(self):
1474
965
return dbus.String(self.name)
1475
966
1476
967
# Fingerprint - property
1477
@dbus_service_property(_interface, signature="s", access="read")
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
1478
969
def Fingerprint_dbus_property(self):
1479
970
return dbus.String(self.fingerprint)
1480
971
1481
972
# Host - property
1482
@dbus_service_property(_interface, signature="s",
1483
access="readwrite")
973
@dbus_service_property(_interface, signature=u"s",
974
access=u"readwrite")
1484
975
def Host_dbus_property(self, value=None):
1485
976
if value is None: # get
1486
977
return dbus.String(self.host)
1487
self.host = unicode(value)
978
self.host = value
979
# Emit D-Bus signal
980
self.PropertyChanged(dbus.String(u"Host"),
981
dbus.String(value, variant_level=1))
1488
982
1489
983
# Created - property
1490
@dbus_service_property(_interface, signature="s", access="read")
984
@dbus_service_property(_interface, signature=u"s", access=u"read")
1491
985
def Created_dbus_property(self):
1492
return datetime_to_dbus(self.created)
986
return dbus.String(self._datetime_to_dbus(self.created))
1493
987
1494
988
# LastEnabled - property
1495
@dbus_service_property(_interface, signature="s", access="read")
989
@dbus_service_property(_interface, signature=u"s", access=u"read")
1496
990
def LastEnabled_dbus_property(self):
1497
return datetime_to_dbus(self.last_enabled)
991
if self.last_enabled is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1498
994
1499
995
# Enabled - property
1500
@dbus_service_property(_interface, signature="b",
1501
access="readwrite")
996
@dbus_service_property(_interface, signature=u"b",
997
access=u"readwrite")
1502
998
def Enabled_dbus_property(self, value=None):
1503
999
if value is None: # get
1504
1000
return dbus.Boolean(self.enabled)
1508
1004
self.disable()
1509
1005
1510
1006
# LastCheckedOK - property
1511
@dbus_service_property(_interface, signature="s",
1512
access="readwrite")
1007
@dbus_service_property(_interface, signature=u"s",
1008
access=u"readwrite")
1513
1009
def LastCheckedOK_dbus_property(self, value=None):
1514
1010
if value is not None:
1515
1011
self.checked_ok()
1516
1012
return
1517
return datetime_to_dbus(self.last_checked_ok)
1518
1519
# LastCheckerStatus - property
1520
@dbus_service_property(_interface, signature="n",
1521
access="read")
1522
def LastCheckerStatus_dbus_property(self):
1523
return dbus.Int16(self.last_checker_status)
1524
1525
# Expires - property
1526
@dbus_service_property(_interface, signature="s", access="read")
1527
def Expires_dbus_property(self):
1528
return datetime_to_dbus(self.expires)
1529
1530
# LastApprovalRequest - property
1531
@dbus_service_property(_interface, signature="s", access="read")
1532
def LastApprovalRequest_dbus_property(self):
1533
return datetime_to_dbus(self.last_approval_request)
1013
if self.last_checked_ok is None:
1014
return dbus.String(u"")
1015
return dbus.String(self._datetime_to_dbus(self
1016
.last_checked_ok))
1534
1017
1535
1018
# Timeout - property
1536
@dbus_service_property(_interface, signature="t",
1537
access="readwrite")
1019
@dbus_service_property(_interface, signature=u"t",
1020
access=u"readwrite")
1538
1021
def Timeout_dbus_property(self, value=None):
1539
1022
if value is None: # get
1540
1023
return dbus.UInt64(self.timeout_milliseconds())
1541
old_timeout = self.timeout
1542
1024
self.timeout = datetime.timedelta(0, 0, 0, value)
1543
# Reschedule disabling
1544
if self.enabled:
1545
now = datetime.datetime.utcnow()
1546
self.expires += self.timeout - old_timeout
1547
if self.expires <= now:
1548
# The timeout has passed
1549
self.disable()
1550
else:
1551
if (getattr(self, "disable_initiator_tag", None)
1552
is None):
1553
return
1554
gobject.source_remove(self.disable_initiator_tag)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
timedelta_to_milliseconds(self.expires - now),
1558
self.disable))
1559
1560
# ExtendedTimeout - property
1561
@dbus_service_property(_interface, signature="t",
1562
access="readwrite")
1563
def ExtendedTimeout_dbus_property(self, value=None):
1564
if value is None: # get
1565
return dbus.UInt64(self.extended_timeout_milliseconds())
1566
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1025
# Emit D-Bus signal
1026
self.PropertyChanged(dbus.String(u"Timeout"),
1027
dbus.UInt64(value, variant_level=1))
1028
if getattr(self, u"disable_initiator_tag", None) is None:
1029
return
1030
# Reschedule timeout
1031
gobject.source_remove(self.disable_initiator_tag)
1032
self.disable_initiator_tag = None
1033
time_to_die = (self.
1034
_timedelta_to_milliseconds((self
1035
.last_checked_ok
1036
+ self.timeout)
1037
- datetime.datetime
1038
.utcnow()))
1039
if time_to_die <= 0:
1040
# The timeout has passed
1041
self.disable()
1042
else:
1043
self.disable_initiator_tag = (gobject.timeout_add
1044
(time_to_die, self.disable))
1567
1045
1568
1046
# Interval - property
1569
@dbus_service_property(_interface, signature="t",
1570
access="readwrite")
1047
@dbus_service_property(_interface, signature=u"t",
1048
access=u"readwrite")
1571
1049
def Interval_dbus_property(self, value=None):
1572
1050
if value is None: # get
1573
1051
return dbus.UInt64(self.interval_milliseconds())
1574
1052
self.interval = datetime.timedelta(0, 0, 0, value)
1575
if getattr(self, "checker_initiator_tag", None) is None:
1053
# Emit D-Bus signal
1054
self.PropertyChanged(dbus.String(u"Interval"),
1055
dbus.UInt64(value, variant_level=1))
1056
if getattr(self, u"checker_initiator_tag", None) is None:
1576
1057
return
1577
if self.enabled:
1578
# Reschedule checker run
1579
gobject.source_remove(self.checker_initiator_tag)
1580
self.checker_initiator_tag = (gobject.timeout_add
1581
(value, self.start_checker))
1582
self.start_checker() # Start one now, too
1583
1058
# Reschedule checker run
1059
gobject.source_remove(self.checker_initiator_tag)
1060
self.checker_initiator_tag = (gobject.timeout_add
1061
(value, self.start_checker))
1062
self.start_checker() # Start one now, too
1063
1584
1064
# Checker - property
1585
@dbus_service_property(_interface, signature="s",
1586
access="readwrite")
1065
@dbus_service_property(_interface, signature=u"s",
1066
access=u"readwrite")
1587
1067
def Checker_dbus_property(self, value=None):
1588
1068
if value is None: # get
1589
1069
return dbus.String(self.checker_command)
1590
self.checker_command = unicode(value)
1070
self.checker_command = value
1071
# Emit D-Bus signal
1072
self.PropertyChanged(dbus.String(u"Checker"),
1073
dbus.String(self.checker_command,
1074
variant_level=1))
1591
1075
1592
1076
# CheckerRunning - property
1593
@dbus_service_property(_interface, signature="b",
1594
access="readwrite")
1077
@dbus_service_property(_interface, signature=u"b",
1078
access=u"readwrite")
1595
1079
def CheckerRunning_dbus_property(self, value=None):
1596
1080
if value is None: # get
1597
1081
return dbus.Boolean(self.checker is not None)
1601
1085
self.stop_checker()
1602
1086
1603
1087
# ObjectPath - property
1604
@dbus_service_property(_interface, signature="o", access="read")
1088
@dbus_service_property(_interface, signature=u"o", access=u"read")
1605
1089
def ObjectPath_dbus_property(self):
1606
1090
return self.dbus_object_path # is already a dbus.ObjectPath
1607
1091
1608
1092
# Secret = property
1609
@dbus_service_property(_interface, signature="ay",
1610
access="write", byte_arrays=True)
1093
@dbus_service_property(_interface, signature=u"ay",
1094
access=u"write", byte_arrays=True)
1611
1095
def Secret_dbus_property(self, value):
1612
1096
self.secret = str(value)
1613
1097
1620
1104
self._pipe.send(('init', fpr, address))
1621
1105
if not self._pipe.recv():
1622
1106
raise KeyError()
1623
1107
1624
1108
def __getattribute__(self, name):
1625
if name == '_pipe':
1109
if(name == '_pipe'):
1626
1110
return super(ProxyClient, self).__getattribute__(name)
1627
1111
self._pipe.send(('getattr', name))
1628
1112
data = self._pipe.recv()
1633
1117
self._pipe.send(('funcall', name, args, kwargs))
1634
1118
return self._pipe.recv()[1]
1635
1119
return func
1636
1120
1637
1121
def __setattr__(self, name, value):
1638
if name == '_pipe':
1122
if(name == '_pipe'):
1639
1123
return super(ProxyClient, self).__setattr__(name, value)
1640
1124
self._pipe.send(('setattr', name, value))
1641
1125
1648
1132
1649
1133
def handle(self):
1650
1134
with contextlib.closing(self.server.child_pipe) as child_pipe:
1651
logger.info("TCP connection from: %s",
1135
logger.info(u"TCP connection from: %s",
1652
1136
unicode(self.client_address))
1653
logger.debug("Pipe FD: %d",
1137
logger.debug(u"Pipe FD: %d",
1654
1138
self.server.child_pipe.fileno())
1655
1139
1656
1140
session = (gnutls.connection
1657
1141
.ClientSession(self.request,
1658
1142
gnutls.connection
1659
1143
.X509Credentials()))
1660
1144
1661
1145
# Note: gnutls.connection.X509Credentials is really a
1662
1146
# generic GnuTLS certificate credentials object so long as
1663
1147
# no X.509 keys are added to it. Therefore, we can use it
1664
1148
# here despite using OpenPGP certificates.
1665
1666
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1667
# "+AES-256-CBC", "+SHA1",
1668
# "+COMP-NULL", "+CTYPE-OPENPGP",
1669
# "+DHE-DSS"))
1149
1150
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
# u"+AES-256-CBC", u"+SHA1",
1152
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1153
# u"+DHE-DSS"))
1670
1154
# Use a fallback default, since this MUST be set.
1671
1155
priority = self.server.gnutls_priority
1672
1156
if priority is None:
1673
priority = "NORMAL"
1157
priority = u"NORMAL"
1674
1158
(gnutls.library.functions
1675
1159
.gnutls_priority_set_direct(session._c_object,
1676
1160
priority, None))
1677
1161
1678
1162
# Start communication using the Mandos protocol
1679
1163
# Get protocol number
1680
1164
line = self.request.makefile().readline()
1681
logger.debug("Protocol version: %r", line)
1165
logger.debug(u"Protocol version: %r", line)
1682
1166
try:
1683
1167
if int(line.strip().split()[0]) > 1:
1684
1168
raise RuntimeError
1685
except (ValueError, IndexError, RuntimeError) as error:
1686
logger.error("Unknown protocol version: %s", error)
1169
except (ValueError, IndexError, RuntimeError), error:
1170
logger.error(u"Unknown protocol version: %s", error)
1687
1171
return
1688
1172
1689
1173
# Start GnuTLS connection
1690
1174
try:
1691
1175
session.handshake()
1692
except gnutls.errors.GNUTLSError as error:
1693
logger.warning("Handshake failed: %s", error)
1176
except gnutls.errors.GNUTLSError, error:
1177
logger.warning(u"Handshake failed: %s", error)
1694
1178
# Do not run session.bye() here: the session is not
1695
1179
# established. Just abandon the request.
1696
1180
return
1697
logger.debug("Handshake succeeded")
1698
1181
logger.debug(u"Handshake succeeded")
1182
1699
1183
approval_required = False
1700
1184
try:
1701
1185
try:
1702
1186
fpr = self.fingerprint(self.peer_certificate
1703
1187
(session))
1704
except (TypeError,
1705
gnutls.errors.GNUTLSError) as error:
1706
logger.warning("Bad certificate: %s", error)
1188
except (TypeError, gnutls.errors.GNUTLSError), error:
1189
logger.warning(u"Bad certificate: %s", error)
1707
1190
return
1708
logger.debug("Fingerprint: %s", fpr)
1709
1191
logger.debug(u"Fingerprint: %s", fpr)
1192
1710
1193
try:
1711
1194
client = ProxyClient(child_pipe, fpr,
1712
1195
self.client_address)
1720
1203
1721
1204
while True:
1722
1205
if not client.enabled:
1723
logger.info("Client %s is disabled",
1206
logger.warning(u"Client %s is disabled",
1724
1207
client.name)
1725
1208
if self.server.use_dbus:
1726
1209
# Emit D-Bus signal
1727
client.Rejected("Disabled")
1210
client.Rejected("Disabled")
1728
1211
return
1729
1212
1730
if client.approved or not client.approval_delay:
1213
if client._approved or not client.approval_delay:
1731
1214
#We are approved or approval is disabled
1732
1215
break
1733
elif client.approved is None:
1734
logger.info("Client %s needs approval",
1216
elif client._approved is None:
1217
logger.info(u"Client %s needs approval",
1735
1218
client.name)
1736
1219
if self.server.use_dbus:
1737
1220
# Emit D-Bus signal
1739
1222
client.approval_delay_milliseconds(),
1740
1223
client.approved_by_default)
1741
1224
else:
1742
logger.warning("Client %s was not approved",
1225
logger.warning(u"Client %s was not approved",
1743
1226
client.name)
1744
1227
if self.server.use_dbus:
1745
1228
# Emit D-Bus signal
1747
1230
return
1748
1231
1749
1232
#wait until timeout or approved
1233
#x = float(client._timedelta_to_milliseconds(delay))
1750
1234
time = datetime.datetime.now()
1751
1235
client.changedstate.acquire()
1752
client.changedstate.wait(
1753
float(timedelta_to_milliseconds(delay)
1754
/ 1000))
1236
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1755
1237
client.changedstate.release()
1756
1238
time2 = datetime.datetime.now()
1757
1239
if (time2 - time) >= delay:
1761
1243
client.name)
1762
1244
if self.server.use_dbus:
1763
1245
# Emit D-Bus signal
1764
client.Rejected("Approval timed out")
1246
client.Rejected("Timed out")
1765
1247
return
1766
1248
else:
1767
1249
break
1772
1254
while sent_size < len(client.secret):
1773
1255
try:
1774
1256
sent = session.send(client.secret[sent_size:])
1775
except gnutls.errors.GNUTLSError as error:
1776
logger.warning("gnutls send failed",
1777
exc_info=error)
1257
except (gnutls.errors.GNUTLSError), error:
1258
logger.warning("gnutls send failed")
1778
1259
return
1779
logger.debug("Sent: %d, remaining: %d",
1260
logger.debug(u"Sent: %d, remaining: %d",
1780
1261
sent, len(client.secret)
1781
1262
- (sent_size + sent))
1782
1263
sent_size += sent
1783
1784
logger.info("Sending secret to %s", client.name)
1785
# bump the timeout using extended_timeout
1786
client.bump_timeout(client.extended_timeout)
1264
1265
logger.info(u"Sending secret to %s", client.name)
1266
# bump the timeout as if seen
1267
client.checked_ok()
1787
1268
if self.server.use_dbus:
1788
1269
# Emit D-Bus signal
1789
1270
client.GotSecret()
1793
1274
client.approvals_pending -= 1
1794
1275
try:
1795
1276
session.bye()
1796
except gnutls.errors.GNUTLSError as error:
1797
logger.warning("GnuTLS bye failed",
1798
exc_info=error)
1277
except (gnutls.errors.GNUTLSError), error:
1278
logger.warning("GnuTLS bye failed")
1799
1279
1800
1280
@staticmethod
1801
1281
def peer_certificate(session):
1811
1291
.gnutls_certificate_get_peers
1812
1292
(session._c_object, ctypes.byref(list_size)))
1813
1293
if not bool(cert_list) and list_size.value != 0:
1814
raise gnutls.errors.GNUTLSError("error getting peer"
1815
" certificate")
1294
raise gnutls.errors.GNUTLSError(u"error getting peer"
1295
u" certificate")
1816
1296
if list_size.value == 0:
1817
1297
return None
1818
1298
cert = cert_list[0]
1844
1324
if crtverify.value != 0:
1845
1325
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1846
1326
raise (gnutls.errors.CertificateSecurityError
1847
("Verify failed"))
1327
(u"Verify failed"))
1848
1328
# New buffer for the fingerprint
1849
1329
buf = ctypes.create_string_buffer(20)
1850
1330
buf_len = ctypes.c_size_t()
1857
1337
# Convert the buffer to a Python bytestring
1858
1338
fpr = ctypes.string_at(buf, buf_len.value)
1859
1339
# Convert the bytestring to hexadecimal notation
1860
hex_fpr = binascii.hexlify(fpr).upper()
1340
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1861
1341
return hex_fpr
1862
1342
1863
1343
1866
1346
def sub_process_main(self, request, address):
1867
1347
try:
1868
1348
self.finish_request(request, address)
1869
except Exception:
1349
except:
1870
1350
self.handle_error(request, address)
1871
1351
self.close_request(request)
1872
1352
1873
1353
def process_request(self, request, address):
1874
1354
"""Start a new process to process the request."""
1875
proc = multiprocessing.Process(target = self.sub_process_main,
1876
args = (request, address))
1877
proc.start()
1878
return proc
1879
1355
multiprocessing.Process(target = self.sub_process_main,
1356
args = (request, address)).start()
1880
1357
1881
1358
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1882
1359
""" adds a pipe to the MixIn """
1886
1363
This function creates a new pipe in self.pipe
1887
1364
"""
1888
1365
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1889
1890
proc = MultiprocessingMixIn.process_request(self, request,
1891
client_address)
1366
1367
super(MultiprocessingMixInWithPipe,
1368
self).process_request(request, client_address)
1892
1369
self.child_pipe.close()
1893
self.add_pipe(parent_pipe, proc)
1894
1895
def add_pipe(self, parent_pipe, proc):
1370
self.add_pipe(parent_pipe)
1371
1372
def add_pipe(self, parent_pipe):
1896
1373
"""Dummy function; override as necessary"""
1897
raise NotImplementedError
1898
1374
pass
1899
1375
1900
1376
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1901
1377
socketserver.TCPServer, object):
1907
1383
use_ipv6: Boolean; to use IPv6 or not
1908
1384
"""
1909
1385
def __init__(self, server_address, RequestHandlerClass,
1910
interface=None, use_ipv6=True, socketfd=None):
1911
"""If socketfd is set, use that file descriptor instead of
1912
creating a new one with socket.socket().
1913
"""
1386
interface=None, use_ipv6=True):
1914
1387
self.interface = interface
1915
1388
if use_ipv6:
1916
1389
self.address_family = socket.AF_INET6
1917
if socketfd is not None:
1918
# Save the file descriptor
1919
self.socketfd = socketfd
1920
# Save the original socket.socket() function
1921
self.socket_socket = socket.socket
1922
# To implement --socket, we monkey patch socket.socket.
1923
#
1924
# (When socketserver.TCPServer is a new-style class, we
1925
# could make self.socket into a property instead of monkey
1926
# patching socket.socket.)
1927
#
1928
# Create a one-time-only replacement for socket.socket()
1929
@functools.wraps(socket.socket)
1930
def socket_wrapper(*args, **kwargs):
1931
# Restore original function so subsequent calls are
1932
# not affected.
1933
socket.socket = self.socket_socket
1934
del self.socket_socket
1935
# This time only, return a new socket object from the
1936
# saved file descriptor.
1937
return socket.fromfd(self.socketfd, *args, **kwargs)
1938
# Replace socket.socket() function with wrapper
1939
socket.socket = socket_wrapper
1940
# The socketserver.TCPServer.__init__ will call
1941
# socket.socket(), which might be our replacement,
1942
# socket_wrapper(), if socketfd was set.
1943
1390
socketserver.TCPServer.__init__(self, server_address,
1944
1391
RequestHandlerClass)
1945
1946
1392
def server_bind(self):
1947
1393
"""This overrides the normal server_bind() function
1948
1394
to bind to an interface if one was specified, and also NOT to
1949
1395
bind to an address or port if they were not specified."""
1950
1396
if self.interface is not None:
1951
1397
if SO_BINDTODEVICE is None:
1952
logger.error("SO_BINDTODEVICE does not exist;"
1953
" cannot bind to interface %s",
1398
logger.error(u"SO_BINDTODEVICE does not exist;"
1399
u" cannot bind to interface %s",
1954
1400
self.interface)
1955
1401
else:
1956
1402
try:
1957
1403
self.socket.setsockopt(socket.SOL_SOCKET,
1958
1404
SO_BINDTODEVICE,
1959
str(self.interface + '\0'))
1960
except socket.error as error:
1961
if error.errno == errno.EPERM:
1962
logger.error("No permission to bind to"
1963
" interface %s", self.interface)
1964
elif error.errno == errno.ENOPROTOOPT:
1965
logger.error("SO_BINDTODEVICE not available;"
1966
" cannot bind to interface %s",
1967
self.interface)
1968
elif error.errno == errno.ENODEV:
1969
logger.error("Interface %s does not exist,"
1970
" cannot bind", self.interface)
1405
str(self.interface
1406
+ u'\0'))
1407
except socket.error, error:
1408
if error[0] == errno.EPERM:
1409
logger.error(u"No permission to"
1410
u" bind to interface %s",
1411
self.interface)
1412
elif error[0] == errno.ENOPROTOOPT:
1413
logger.error(u"SO_BINDTODEVICE not available;"
1414
u" cannot bind to interface %s",
1415
self.interface)
1971
1416
else:
1972
1417
raise
1973
1418
# Only bind(2) the socket if we really need to.
1974
1419
if self.server_address[0] or self.server_address[1]:
1975
1420
if not self.server_address[0]:
1976
1421
if self.address_family == socket.AF_INET6:
1977
any_address = "::" # in6addr_any
1422
any_address = u"::" # in6addr_any
1978
1423
else:
1979
1424
any_address = socket.INADDR_ANY
1980
1425
self.server_address = (any_address,
2003
1448
"""
2004
1449
def __init__(self, server_address, RequestHandlerClass,
2005
1450
interface=None, use_ipv6=True, clients=None,
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
1451
gnutls_priority=None, use_dbus=True):
2007
1452
self.enabled = False
2008
1453
self.clients = clients
2009
1454
if self.clients is None:
2010
self.clients = {}
1455
self.clients = set()
2011
1456
self.use_dbus = use_dbus
2012
1457
self.gnutls_priority = gnutls_priority
2013
1458
IPv6_TCPServer.__init__(self, server_address,
2014
1459
RequestHandlerClass,
2015
1460
interface = interface,
2016
use_ipv6 = use_ipv6,
2017
socketfd = socketfd)
1461
use_ipv6 = use_ipv6)
2018
1462
def server_activate(self):
2019
1463
if self.enabled:
2020
1464
return socketserver.TCPServer.server_activate(self)
2021
2022
1465
def enable(self):
2023
1466
self.enabled = True
2024
2025
def add_pipe(self, parent_pipe, proc):
1467
def add_pipe(self, parent_pipe):
2026
1468
# Call "handle_ipc" for both data and EOF events
2027
1469
gobject.io_add_watch(parent_pipe.fileno(),
2028
1470
gobject.IO_IN | gobject.IO_HUP,
2029
1471
functools.partial(self.handle_ipc,
2030
parent_pipe =
2031
parent_pipe,
2032
proc = proc))
2033
1472
parent_pipe = parent_pipe))
1473
2034
1474
def handle_ipc(self, source, condition, parent_pipe=None,
2035
proc = None, client_object=None):
2036
# error, or the other end of multiprocessing.Pipe has closed
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2038
# Wait for other process to exit
2039
proc.join()
1475
client_object=None):
1476
condition_names = {
1477
gobject.IO_IN: u"IN", # There is data to read.
1478
gobject.IO_OUT: u"OUT", # Data can be written (without
1479
# blocking).
1480
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1481
gobject.IO_ERR: u"ERR", # Error condition.
1482
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1483
# broken, usually for pipes and
1484
# sockets).
1485
}
1486
conditions_string = ' | '.join(name
1487
for cond, name in
1488
condition_names.iteritems()
1489
if cond & condition)
1490
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1491
conditions_string)
1492
1493
# error or the other end of multiprocessing.Pipe has closed
1494
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2040
1495
return False
2041
1496
2042
1497
# Read a request from the child
2043
1498
request = parent_pipe.recv()
1499
logger.debug(u"IPC request: %s", repr(request))
2044
1500
command = request[0]
2045
1501
2046
1502
if command == 'init':
2047
1503
fpr = request[1]
2048
1504
address = request[2]
2049
1505
2050
for c in self.clients.itervalues():
1506
for c in self.clients:
2051
1507
if c.fingerprint == fpr:
2052
1508
client = c
2053
1509
break
2054
1510
else:
2055
logger.info("Client not found for fingerprint: %s, ad"
2056
"dress: %s", fpr, address)
1511
logger.warning(u"Client not found for fingerprint: %s, ad"
1512
u"dress: %s", fpr, address)
2057
1513
if self.use_dbus:
2058
1514
# Emit D-Bus signal
2059
mandos_dbus_service.ClientNotFound(fpr,
2060
address[0])
1515
mandos_dbus_service.ClientNotFound(fpr, address)
2061
1516
parent_pipe.send(False)
2062
1517
return False
2063
1518
2064
1519
gobject.io_add_watch(parent_pipe.fileno(),
2065
1520
gobject.IO_IN | gobject.IO_HUP,
2066
1521
functools.partial(self.handle_ipc,
2067
parent_pipe =
2068
parent_pipe,
2069
proc = proc,
2070
client_object =
2071
client))
1522
parent_pipe = parent_pipe,
1523
client_object = client))
2072
1524
parent_pipe.send(True)
2073
# remove the old hook in favor of the new above hook on
2074
# same fileno
1525
# remove the old hook in favor of the new above hook on same fileno
2075
1526
return False
2076
1527
if command == 'funcall':
2077
1528
funcname = request[1]
2078
1529
args = request[2]
2079
1530
kwargs = request[3]
2080
1531
2081
parent_pipe.send(('data', getattr(client_object,
2082
funcname)(*args,
2083
**kwargs)))
2084
1532
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1533
2085
1534
if command == 'getattr':
2086
1535
attrname = request[1]
2087
1536
if callable(client_object.__getattribute__(attrname)):
2088
1537
parent_pipe.send(('function',))
2089
1538
else:
2090
parent_pipe.send(('data', client_object
2091
.__getattribute__(attrname)))
1539
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2092
1540
2093
1541
if command == 'setattr':
2094
1542
attrname = request[1]
2095
1543
value = request[2]
2096
1544
setattr(client_object, attrname, value)
2097
1545
2098
1546
return True
2099
1547
2100
1548
2101
def rfc3339_duration_to_delta(duration):
2102
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2103
2104
>>> rfc3339_duration_to_delta("P7D")
2105
datetime.timedelta(7)
2106
>>> rfc3339_duration_to_delta("PT60S")
2107
datetime.timedelta(0, 60)
2108
>>> rfc3339_duration_to_delta("PT60M")
2109
datetime.timedelta(0, 3600)
2110
>>> rfc3339_duration_to_delta("PT24H")
2111
datetime.timedelta(1)
2112
>>> rfc3339_duration_to_delta("P1W")
2113
datetime.timedelta(7)
2114
>>> rfc3339_duration_to_delta("PT5M30S")
2115
datetime.timedelta(0, 330)
2116
>>> rfc3339_duration_to_delta("P1DT3M20S")
2117
datetime.timedelta(1, 200)
2118
"""
2119
2120
# Parsing an RFC 3339 duration with regular expressions is not
2121
# possible - there would have to be multiple places for the same
2122
# values, like seconds. The current code, while more esoteric, is
2123
# cleaner without depending on a parsing library. If Python had a
2124
# built-in library for parsing we would use it, but we'd like to
2125
# avoid excessive use of external libraries.
2126
2127
# New type for defining tokens, syntax, and semantics all-in-one
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2132
# containing digits
2133
"value", # datetime.timedelta or
2134
# None
2135
"followers")) # Tokens valid after
2136
# this token
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2140
token_second = Token(re.compile(r"(\d+)S"),
2141
datetime.timedelta(seconds=1),
2142
frozenset((token_end,)))
2143
token_minute = Token(re.compile(r"(\d+)M"),
2144
datetime.timedelta(minutes=1),
2145
frozenset((token_second, token_end)))
2146
token_hour = Token(re.compile(r"(\d+)H"),
2147
datetime.timedelta(hours=1),
2148
frozenset((token_minute, token_end)))
2149
token_time = Token(re.compile(r"T"),
2150
None,
2151
frozenset((token_hour, token_minute,
2152
token_second)))
2153
token_day = Token(re.compile(r"(\d+)D"),
2154
datetime.timedelta(days=1),
2155
frozenset((token_time, token_end)))
2156
token_month = Token(re.compile(r"(\d+)M"),
2157
datetime.timedelta(weeks=4),
2158
frozenset((token_day, token_end)))
2159
token_year = Token(re.compile(r"(\d+)Y"),
2160
datetime.timedelta(weeks=52),
2161
frozenset((token_month, token_end)))
2162
token_week = Token(re.compile(r"(\d+)W"),
2163
datetime.timedelta(weeks=1),
2164
frozenset((token_end,)))
2165
token_duration = Token(re.compile(r"P"), None,
2166
frozenset((token_year, token_month,
2167
token_day, token_time,
2168
token_week))),
2169
# Define starting values
2170
value = datetime.timedelta() # Value so far
2171
found_token = None
2172
followers = frozenset(token_duration,) # Following valid tokens
2173
s = duration # String left to parse
2174
# Loop until end token is found
2175
while found_token is not token_end:
2176
# Search for any currently valid tokens
2177
for token in followers:
2178
match = token.regexp.match(s)
2179
if match is not None:
2180
# Token found
2181
if token.value is not None:
2182
# Value found, parse digits
2183
factor = int(match.group(1), 10)
2184
# Add to value so far
2185
value += factor * token.value
2186
# Strip token from string
2187
s = token.regexp.sub("", s, 1)
2188
# Go to found token
2189
found_token = token
2190
# Set valid next tokens
2191
followers = found_token.followers
2192
break
2193
else:
2194
# No currently valid tokens were found
2195
raise ValueError("Invalid RFC 3339 duration")
2196
# End token found
2197
return value
2198
2199
2200
1549
def string_to_delta(interval):
2201
1550
"""Parse a string and return a datetime.timedelta
2202
1551
2203
>>> string_to_delta('7d')
1552
>>> string_to_delta(u'7d')
2204
1553
datetime.timedelta(7)
2205
>>> string_to_delta('60s')
1554
>>> string_to_delta(u'60s')
2206
1555
datetime.timedelta(0, 60)
2207
>>> string_to_delta('60m')
1556
>>> string_to_delta(u'60m')
2208
1557
datetime.timedelta(0, 3600)
2209
>>> string_to_delta('24h')
1558
>>> string_to_delta(u'24h')
2210
1559
datetime.timedelta(1)
2211
>>> string_to_delta('1w')
1560
>>> string_to_delta(u'1w')
2212
1561
datetime.timedelta(7)
2213
>>> string_to_delta('5m 30s')
1562
>>> string_to_delta(u'5m 30s')
2214
1563
datetime.timedelta(0, 330)
2215
1564
"""
2216
2217
try:
2218
return rfc3339_duration_to_delta(interval)
2219
except ValueError:
2220
pass
2221
2222
1565
timevalue = datetime.timedelta(0)
2223
1566
for s in interval.split():
2224
1567
try:
2225
1568
suffix = unicode(s[-1])
2226
1569
value = int(s[:-1])
2227
if suffix == "d":
1570
if suffix == u"d":
2228
1571
delta = datetime.timedelta(value)
2229
elif suffix == "s":
1572
elif suffix == u"s":
2230
1573
delta = datetime.timedelta(0, value)
2231
elif suffix == "m":
1574
elif suffix == u"m":
2232
1575
delta = datetime.timedelta(0, 0, 0, 0, value)
2233
elif suffix == "h":
1576
elif suffix == u"h":
2234
1577
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
2235
elif suffix == "w":
1578
elif suffix == u"w":
2236
1579
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2237
1580
else:
2238
raise ValueError("Unknown suffix {0!r}"
2239
.format(suffix))
2240
except (ValueError, IndexError) as e:
2241
raise ValueError(*(e.args))
1581
raise ValueError(u"Unknown suffix %r" % suffix)
1582
except (ValueError, IndexError), e:
1583
raise ValueError(e.message)
2242
1584
timevalue += delta
2243
1585
return timevalue
2244
1586
2245
1587
1588
def if_nametoindex(interface):
1589
"""Call the C function if_nametoindex(), or equivalent
1590
1591
Note: This function cannot accept a unicode string."""
1592
global if_nametoindex
1593
try:
1594
if_nametoindex = (ctypes.cdll.LoadLibrary
1595
(ctypes.util.find_library(u"c"))
1596
.if_nametoindex)
1597
except (OSError, AttributeError):
1598
logger.warning(u"Doing if_nametoindex the hard way")
1599
def if_nametoindex(interface):
1600
"Get an interface index the hard way, i.e. using fcntl()"
1601
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1602
with contextlib.closing(socket.socket()) as s:
1603
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1604
struct.pack(str(u"16s16x"),
1605
interface))
1606
interface_index = struct.unpack(str(u"I"),
1607
ifreq[16:20])[0]
1608
return interface_index
1609
return if_nametoindex(interface)
1610
1611
2246
1612
def daemon(nochdir = False, noclose = False):
2247
1613
"""See daemon(3). Standard BSD Unix function.
2248
1614
2251
1617
sys.exit()
2252
1618
os.setsid()
2253
1619
if not nochdir:
2254
os.chdir("/")
1620
os.chdir(u"/")
2255
1621
if os.fork():
2256
1622
sys.exit()
2257
1623
if not noclose:
2258
1624
# Close all standard open file descriptors
2259
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1625
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2260
1626
if not stat.S_ISCHR(os.fstat(null).st_mode):
2261
1627
raise OSError(errno.ENODEV,
2262
"{0} not a character device"
2263
.format(os.devnull))
1628
u"%s not a character device"
1629
% os.path.devnull)
2264
1630
os.dup2(null, sys.stdin.fileno())
2265
1631
os.dup2(null, sys.stdout.fileno())
2266
1632
os.dup2(null, sys.stderr.fileno())
2273
1639
##################################################################
2274
1640
# Parsing of options, both command line and config file
2275
1641
2276
parser = argparse.ArgumentParser()
2277
parser.add_argument("-v", "--version", action="version",
2278
version = "%(prog)s {0}".format(version),
2279
help="show version number and exit")
2280
parser.add_argument("-i", "--interface", metavar="IF",
2281
help="Bind to interface IF")
2282
parser.add_argument("-a", "--address",
2283
help="Address to listen for requests on")
2284
parser.add_argument("-p", "--port", type=int,
2285
help="Port number to receive requests on")
2286
parser.add_argument("--check", action="store_true",
2287
help="Run self-test")
2288
parser.add_argument("--debug", action="store_true",
2289
help="Debug mode; run in foreground and log"
2290
" to terminal")
2291
parser.add_argument("--debuglevel", metavar="LEVEL",
2292
help="Debug level for stdout output")
2293
parser.add_argument("--priority", help="GnuTLS"
2294
" priority string (see GnuTLS documentation)")
2295
parser.add_argument("--servicename",
2296
metavar="NAME", help="Zeroconf service name")
2297
parser.add_argument("--configdir",
2298
default="/etc/mandos", metavar="DIR",
2299
help="Directory to search for configuration"
2300
" files")
2301
parser.add_argument("--no-dbus", action="store_false",
2302
dest="use_dbus", help="Do not provide D-Bus"
2303
" system bus interface")
2304
parser.add_argument("--no-ipv6", action="store_false",
2305
dest="use_ipv6", help="Do not use IPv6")
2306
parser.add_argument("--no-restore", action="store_false",
2307
dest="restore", help="Do not restore stored"
2308
" state")
2309
parser.add_argument("--socket", type=int,
2310
help="Specify a file descriptor to a network"
2311
" socket to use instead of creating one")
2312
parser.add_argument("--statedir", metavar="DIR",
2313
help="Directory to save/restore state in")
2314
parser.add_argument("--foreground", action="store_true",
2315
help="Run in foreground")
2316
2317
options = parser.parse_args()
1642
parser = optparse.OptionParser(version = "%%prog %s" % version)
1643
parser.add_option("-i", u"--interface", type=u"string",
1644
metavar="IF", help=u"Bind to interface IF")
1645
parser.add_option("-a", u"--address", type=u"string",
1646
help=u"Address to listen for requests on")
1647
parser.add_option("-p", u"--port", type=u"int",
1648
help=u"Port number to receive requests on")
1649
parser.add_option("--check", action=u"store_true",
1650
help=u"Run self-test")
1651
parser.add_option("--debug", action=u"store_true",
1652
help=u"Debug mode; run in foreground and log to"
1653
u" terminal")
1654
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1655
help=u"Debug level for stdout output")
1656
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1657
u" priority string (see GnuTLS documentation)")
1658
parser.add_option("--servicename", type=u"string",
1659
metavar=u"NAME", help=u"Zeroconf service name")
1660
parser.add_option("--configdir", type=u"string",
1661
default=u"/etc/mandos", metavar=u"DIR",
1662
help=u"Directory to search for configuration"
1663
u" files")
1664
parser.add_option("--no-dbus", action=u"store_false",
1665
dest=u"use_dbus", help=u"Do not provide D-Bus"
1666
u" system bus interface")
1667
parser.add_option("--no-ipv6", action=u"store_false",
1668
dest=u"use_ipv6", help=u"Do not use IPv6")
1669
options = parser.parse_args()[0]
2318
1670
2319
1671
if options.check:
2320
1672
import doctest
2322
1674
sys.exit()
2323
1675
2324
1676
# Default values for config file for server-global settings
2325
server_defaults = { "interface": "",
2326
"address": "",
2327
"port": "",
2328
"debug": "False",
2329
"priority":
2330
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2331
"servicename": "Mandos",
2332
"use_dbus": "True",
2333
"use_ipv6": "True",
2334
"debuglevel": "",
2335
"restore": "True",
2336
"socket": "",
2337
"statedir": "/var/lib/mandos",
2338
"foreground": "False",
1677
server_defaults = { u"interface": u"",
1678
u"address": u"",
1679
u"port": u"",
1680
u"debug": u"False",
1681
u"priority":
1682
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1683
u"servicename": u"Mandos",
1684
u"use_dbus": u"True",
1685
u"use_ipv6": u"True",
1686
u"debuglevel": u"",
2339
1687
}
2340
1688
2341
1689
# Parse config file for server-global settings
2342
1690
server_config = configparser.SafeConfigParser(server_defaults)
2343
1691
del server_defaults
2344
1692
server_config.read(os.path.join(options.configdir,
2345
"mandos.conf"))
1693
u"mandos.conf"))
2346
1694
# Convert the SafeConfigParser object to a dict
2347
1695
server_settings = server_config.defaults()
2348
1696
# Use the appropriate methods on the non-string config options
2349
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2350
server_settings[option] = server_config.getboolean("DEFAULT",
1697
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1698
server_settings[option] = server_config.getboolean(u"DEFAULT",
2351
1699
option)
2352
1700
if server_settings["port"]:
2353
server_settings["port"] = server_config.getint("DEFAULT",
2354
"port")
2355
if server_settings["socket"]:
2356
server_settings["socket"] = server_config.getint("DEFAULT",
2357
"socket")
2358
# Later, stdin will, and stdout and stderr might, be dup'ed
2359
# over with an opened os.devnull. But we don't want this to
2360
# happen with a supplied network socket.
2361
if 0 <= server_settings["socket"] <= 2:
2362
server_settings["socket"] = os.dup(server_settings
2363
["socket"])
1701
server_settings["port"] = server_config.getint(u"DEFAULT",
1702
u"port")
2364
1703
del server_config
2365
1704
2366
1705
# Override the settings from the config file with command line
2367
1706
# options, if set.
2368
for option in ("interface", "address", "port", "debug",
2369
"priority", "servicename", "configdir",
2370
"use_dbus", "use_ipv6", "debuglevel", "restore",
2371
"statedir", "socket", "foreground"):
1707
for option in (u"interface", u"address", u"port", u"debug",
1708
u"priority", u"servicename", u"configdir",
1709
u"use_dbus", u"use_ipv6", u"debuglevel"):
2372
1710
value = getattr(options, option)
2373
1711
if value is not None:
2374
1712
server_settings[option] = value
2377
1715
for option in server_settings.keys():
2378
1716
if type(server_settings[option]) is str:
2379
1717
server_settings[option] = unicode(server_settings[option])
2380
# Debug implies foreground
2381
if server_settings["debug"]:
2382
server_settings["foreground"] = True
2383
1718
# Now we have our good server settings in "server_settings"
2384
1719
2385
1720
##################################################################
2386
1721
2387
1722
# For convenience
2388
debug = server_settings["debug"]
2389
debuglevel = server_settings["debuglevel"]
2390
use_dbus = server_settings["use_dbus"]
2391
use_ipv6 = server_settings["use_ipv6"]
2392
stored_state_path = os.path.join(server_settings["statedir"],
2393
stored_state_file)
2394
foreground = server_settings["foreground"]
2395
2396
if debug:
2397
initlogger(debug, logging.DEBUG)
2398
else:
2399
if not debuglevel:
2400
initlogger(debug)
2401
else:
2402
level = getattr(logging, debuglevel.upper())
2403
initlogger(debug, level)
2404
2405
if server_settings["servicename"] != "Mandos":
1723
debug = server_settings[u"debug"]
1724
debuglevel = server_settings[u"debuglevel"]
1725
use_dbus = server_settings[u"use_dbus"]
1726
use_ipv6 = server_settings[u"use_ipv6"]
1727
1728
if server_settings[u"servicename"] != u"Mandos":
2406
1729
syslogger.setFormatter(logging.Formatter
2407
('Mandos ({0}) [%(process)d]:'
2408
' %(levelname)s: %(message)s'
2409
.format(server_settings
2410
["servicename"])))
1730
(u'Mandos (%s) [%%(process)d]:'
1731
u' %%(levelname)s: %%(message)s'
1732
% server_settings[u"servicename"]))
2411
1733
2412
1734
# Parse config file with clients
2413
client_config = configparser.SafeConfigParser(Client
2414
.client_defaults)
2415
client_config.read(os.path.join(server_settings["configdir"],
2416
"clients.conf"))
1735
client_defaults = { u"timeout": u"1h",
1736
u"interval": u"5m",
1737
u"checker": u"fping -q -- %%(host)s",
1738
u"host": u"",
1739
u"approval_delay": u"0s",
1740
u"approval_duration": u"1s",
1741
}
1742
client_config = configparser.SafeConfigParser(client_defaults)
1743
client_config.read(os.path.join(server_settings[u"configdir"],
1744
u"clients.conf"))
2417
1745
2418
1746
global mandos_dbus_service
2419
1747
mandos_dbus_service = None
2420
1748
2421
tcp_server = MandosServer((server_settings["address"],
2422
server_settings["port"]),
1749
tcp_server = MandosServer((server_settings[u"address"],
1750
server_settings[u"port"]),
2423
1751
ClientHandler,
2424
interface=(server_settings["interface"]
1752
interface=(server_settings[u"interface"]
2425
1753
or None),
2426
1754
use_ipv6=use_ipv6,
2427
1755
gnutls_priority=
2428
server_settings["priority"],
2429
use_dbus=use_dbus,
2430
socketfd=(server_settings["socket"]
2431
or None))
2432
if not foreground:
2433
pidfilename = "/var/run/mandos.pid"
2434
pidfile = None
2435
try:
2436
pidfile = open(pidfilename, "w")
2437
except IOError as e:
2438
logger.error("Could not open file %r", pidfilename,
2439
exc_info=e)
1756
server_settings[u"priority"],
1757
use_dbus=use_dbus)
1758
pidfilename = u"/var/run/mandos.pid"
1759
try:
1760
pidfile = open(pidfilename, u"w")
1761
except IOError:
1762
logger.error(u"Could not open file %r", pidfilename)
2440
1763
2441
for name in ("_mandos", "mandos", "nobody"):
1764
try:
1765
uid = pwd.getpwnam(u"_mandos").pw_uid
1766
gid = pwd.getpwnam(u"_mandos").pw_gid
1767
except KeyError:
2442
1768
try:
2443
uid = pwd.getpwnam(name).pw_uid
2444
gid = pwd.getpwnam(name).pw_gid
2445
break
1769
uid = pwd.getpwnam(u"mandos").pw_uid
1770
gid = pwd.getpwnam(u"mandos").pw_gid
2446
1771
except KeyError:
2447
continue
2448
else:
2449
uid = 65534
2450
gid = 65534
1772
try:
1773
uid = pwd.getpwnam(u"nobody").pw_uid
1774
gid = pwd.getpwnam(u"nobody").pw_gid
1775
except KeyError:
1776
uid = 65534
1777
gid = 65534
2451
1778
try:
2452
1779
os.setgid(gid)
2453
1780
os.setuid(uid)
2454
except OSError as error:
2455
if error.errno != errno.EPERM:
1781
except OSError, error:
1782
if error[0] != errno.EPERM:
2456
1783
raise error
2457
1784
1785
if not debug and not debuglevel:
1786
syslogger.setLevel(logging.WARNING)
1787
console.setLevel(logging.WARNING)
1788
if debuglevel:
1789
level = getattr(logging, debuglevel.upper())
1790
syslogger.setLevel(level)
1791
console.setLevel(level)
1792
2458
1793
if debug:
2459
1794
# Enable all possible GnuTLS debugging
2460
1795
2464
1799
2465
1800
@gnutls.library.types.gnutls_log_func
2466
1801
def debug_gnutls(level, string):
2467
logger.debug("GnuTLS: %s", string[:-1])
1802
logger.debug(u"GnuTLS: %s", string[:-1])
2468
1803
2469
1804
(gnutls.library.functions
2470
1805
.gnutls_global_set_log_function(debug_gnutls))
2471
1806
2472
1807
# Redirect stdin so all checkers get /dev/null
2473
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1808
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2474
1809
os.dup2(null, sys.stdin.fileno())
2475
1810
if null > 2:
2476
1811
os.close(null)
2477
2478
# Need to fork before connecting to D-Bus
2479
if not foreground:
2480
# Close all input and output, do double fork, etc.
2481
daemon()
2482
2483
# multiprocessing will use threads, so before we use gobject we
2484
# need to inform gobject that threads will be used.
2485
gobject.threads_init()
1812
else:
1813
# No console logging
1814
logger.removeHandler(console)
1815
2486
1816
2487
1817
global main_loop
2488
1818
# From the Avahi example code
2489
DBusGMainLoop(set_as_default=True)
1819
DBusGMainLoop(set_as_default=True )
2490
1820
main_loop = gobject.MainLoop()
2491
1821
bus = dbus.SystemBus()
2492
1822
# End of Avahi example code
2493
1823
if use_dbus:
2494
1824
try:
2495
bus_name = dbus.service.BusName("se.recompile.Mandos",
1825
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2496
1826
bus, do_not_queue=True)
2497
old_bus_name = (dbus.service.BusName
2498
("se.bsnet.fukt.Mandos", bus,
2499
do_not_queue=True))
2500
except dbus.exceptions.NameExistsException as e:
2501
logger.error("Disabling D-Bus:", exc_info=e)
1827
except dbus.exceptions.NameExistsException, e:
1828
logger.error(unicode(e) + u", disabling D-Bus")
2502
1829
use_dbus = False
2503
server_settings["use_dbus"] = False
1830
server_settings[u"use_dbus"] = False
2504
1831
tcp_server.use_dbus = False
2505
1832
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2506
service = AvahiServiceToSyslog(name =
2507
server_settings["servicename"],
2508
servicetype = "_mandos._tcp",
2509
protocol = protocol, bus = bus)
1833
service = AvahiService(name = server_settings[u"servicename"],
1834
servicetype = u"_mandos._tcp",
1835
protocol = protocol, bus = bus)
2510
1836
if server_settings["interface"]:
2511
1837
service.interface = (if_nametoindex
2512
(str(server_settings["interface"])))
2513
1838
(str(server_settings[u"interface"])))
1839
1840
if not debug:
1841
# Close all input and output, do double fork, etc.
1842
daemon()
1843
2514
1844
global multiprocessing_manager
2515
1845
multiprocessing_manager = multiprocessing.Manager()
2516
1846
2517
1847
client_class = Client
2518
1848
if use_dbus:
2519
1849
client_class = functools.partial(ClientDBus, bus = bus)
2520
2521
client_settings = Client.config_parser(client_config)
2522
old_client_settings = {}
2523
clients_data = {}
2524
2525
# Get client data and settings from last running state.
2526
if server_settings["restore"]:
2527
try:
2528
with open(stored_state_path, "rb") as stored_state:
2529
clients_data, old_client_settings = (pickle.load
2530
(stored_state))
2531
os.remove(stored_state_path)
2532
except IOError as e:
2533
if e.errno == errno.ENOENT:
2534
logger.warning("Could not load persistent state: {0}"
2535
.format(os.strerror(e.errno)))
2536
else:
2537
logger.critical("Could not load persistent state:",
2538
exc_info=e)
2539
raise
2540
except EOFError as e:
2541
logger.warning("Could not load persistent state: "
2542
"EOFError:", exc_info=e)
2543
2544
with PGPEngine() as pgp:
2545
for client_name, client in clients_data.iteritems():
2546
# Decide which value to use after restoring saved state.
2547
# We have three different values: Old config file,
2548
# new config file, and saved state.
2549
# New config value takes precedence if it differs from old
2550
# config value, otherwise use saved state.
2551
for name, value in client_settings[client_name].items():
2552
try:
2553
# For each value in new config, check if it
2554
# differs from the old config value (Except for
2555
# the "secret" attribute)
2556
if (name != "secret" and
2557
value != old_client_settings[client_name]
2558
[name]):
2559
client[name] = value
2560
except KeyError:
2561
pass
2562
2563
# Clients who has passed its expire date can still be
2564
# enabled if its last checker was successful. Clients
2565
# whose checker succeeded before we stored its state is
2566
# assumed to have successfully run all checkers during
2567
# downtime.
2568
if client["enabled"]:
2569
if datetime.datetime.utcnow() >= client["expires"]:
2570
if not client["last_checked_ok"]:
2571
logger.warning(
2572
"disabling client {0} - Client never "
2573
"performed a successful checker"
2574
.format(client_name))
2575
client["enabled"] = False
2576
elif client["last_checker_status"] != 0:
2577
logger.warning(
2578
"disabling client {0} - Client "
2579
"last checker failed with error code {1}"
2580
.format(client_name,
2581
client["last_checker_status"]))
2582
client["enabled"] = False
2583
else:
2584
client["expires"] = (datetime.datetime
2585
.utcnow()
2586
+ client["timeout"])
2587
logger.debug("Last checker succeeded,"
2588
" keeping {0} enabled"
2589
.format(client_name))
1850
def client_config_items(config, section):
1851
special_settings = {
1852
"approved_by_default":
1853
lambda: config.getboolean(section,
1854
"approved_by_default"),
1855
}
1856
for name, value in config.items(section):
2590
1857
try:
2591
client["secret"] = (
2592
pgp.decrypt(client["encrypted_secret"],
2593
client_settings[client_name]
2594
["secret"]))
2595
except PGPError:
2596
# If decryption fails, we use secret from new settings
2597
logger.debug("Failed to decrypt {0} old secret"
2598
.format(client_name))
2599
client["secret"] = (
2600
client_settings[client_name]["secret"])
2601
2602
# Add/remove clients based on new changes made to config
2603
for client_name in (set(old_client_settings)
2604
- set(client_settings)):
2605
del clients_data[client_name]
2606
for client_name in (set(client_settings)
2607
- set(old_client_settings)):
2608
clients_data[client_name] = client_settings[client_name]
2609
2610
# Create all client objects
2611
for client_name, client in clients_data.iteritems():
2612
tcp_server.clients[client_name] = client_class(
2613
name = client_name, settings = client)
2614
1858
yield (name, special_settings[name]())
1859
except KeyError:
1860
yield (name, value)
1861
1862
tcp_server.clients.update(set(
1863
client_class(name = section,
1864
config= dict(client_config_items(
1865
client_config, section)))
1866
for section in client_config.sections()))
2615
1867
if not tcp_server.clients:
2616
logger.warning("No clients defined")
2617
2618
if not foreground:
2619
if pidfile is not None:
2620
try:
2621
with pidfile:
2622
pid = os.getpid()
2623
pidfile.write(str(pid) + "\n".encode("utf-8"))
2624
except IOError:
2625
logger.error("Could not write to file %r with PID %d",
2626
pidfilename, pid)
1868
logger.warning(u"No clients defined")
1869
1870
try:
1871
with pidfile:
1872
pid = os.getpid()
1873
pidfile.write(str(pid) + "\n")
2627
1874
del pidfile
2628
del pidfilename
1875
except IOError:
1876
logger.error(u"Could not write to file %r with PID %d",
1877
pidfilename, pid)
1878
except NameError:
1879
# "pidfile" was never created
1880
pass
1881
del pidfilename
2629
1882
1883
if not debug:
1884
signal.signal(signal.SIGINT, signal.SIG_IGN)
2630
1885
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2631
1886
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2632
1887
2633
1888
if use_dbus:
2634
@alternate_dbus_interfaces({"se.recompile.Mandos":
2635
"se.bsnet.fukt.Mandos"})
2636
class MandosDBusService(DBusObjectWithProperties):
1889
class MandosDBusService(dbus.service.Object):
2637
1890
"""A D-Bus proxy object"""
2638
1891
def __init__(self):
2639
dbus.service.Object.__init__(self, bus, "/")
2640
_interface = "se.recompile.Mandos"
2641
2642
@dbus_interface_annotations(_interface)
2643
def _foo(self):
2644
return { "org.freedesktop.DBus.Property"
2645
".EmitsChangedSignal":
2646
"false"}
2647
2648
@dbus.service.signal(_interface, signature="o")
1892
dbus.service.Object.__init__(self, bus, u"/")
1893
_interface = u"se.bsnet.fukt.Mandos"
1894
1895
@dbus.service.signal(_interface, signature=u"o")
2649
1896
def ClientAdded(self, objpath):
2650
1897
"D-Bus signal"
2651
1898
pass
2652
1899
2653
@dbus.service.signal(_interface, signature="ss")
1900
@dbus.service.signal(_interface, signature=u"ss")
2654
1901
def ClientNotFound(self, fingerprint, address):
2655
1902
"D-Bus signal"
2656
1903
pass
2657
1904
2658
@dbus.service.signal(_interface, signature="os")
1905
@dbus.service.signal(_interface, signature=u"os")
2659
1906
def ClientRemoved(self, objpath, name):
2660
1907
"D-Bus signal"
2661
1908
pass
2662
1909
2663
@dbus.service.method(_interface, out_signature="ao")
1910
@dbus.service.method(_interface, out_signature=u"ao")
2664
1911
def GetAllClients(self):
2665
1912
"D-Bus method"
2666
1913
return dbus.Array(c.dbus_object_path
2667
for c in
2668
tcp_server.clients.itervalues())
1914
for c in tcp_server.clients)
2669
1915
2670
1916
@dbus.service.method(_interface,
2671
out_signature="a{oa{sv}}")
1917
out_signature=u"a{oa{sv}}")
2672
1918
def GetAllClientsWithProperties(self):
2673
1919
"D-Bus method"
2674
1920
return dbus.Dictionary(
2675
((c.dbus_object_path, c.GetAll(""))
2676
for c in tcp_server.clients.itervalues()),
2677
signature="oa{sv}")
1921
((c.dbus_object_path, c.GetAll(u""))
1922
for c in tcp_server.clients),
1923
signature=u"oa{sv}")
2678
1924
2679
@dbus.service.method(_interface, in_signature="o")
1925
@dbus.service.method(_interface, in_signature=u"o")
2680
1926
def RemoveClient(self, object_path):
2681
1927
"D-Bus method"
2682
for c in tcp_server.clients.itervalues():
1928
for c in tcp_server.clients:
2683
1929
if c.dbus_object_path == object_path:
2684
del tcp_server.clients[c.name]
1930
tcp_server.clients.remove(c)
2685
1931
c.remove_from_connection()
2686
1932
# Don't signal anything except ClientRemoved
2687
1933
c.disable(quiet=True)
2698
1944
"Cleanup function; run on exit"
2699
1945
service.cleanup()
2700
1946
2701
multiprocessing.active_children()
2702
if not (tcp_server.clients or client_settings):
2703
return
2704
2705
# Store client before exiting. Secrets are encrypted with key
2706
# based on what config file has. If config file is
2707
# removed/edited, old secret will thus be unrecovable.
2708
clients = {}
2709
with PGPEngine() as pgp:
2710
for client in tcp_server.clients.itervalues():
2711
key = client_settings[client.name]["secret"]
2712
client.encrypted_secret = pgp.encrypt(client.secret,
2713
key)
2714
client_dict = {}
2715
2716
# A list of attributes that can not be pickled
2717
# + secret.
2718
exclude = set(("bus", "changedstate", "secret",
2719
"checker"))
2720
for name, typ in (inspect.getmembers
2721
(dbus.service.Object)):
2722
exclude.add(name)
2723
2724
client_dict["encrypted_secret"] = (client
2725
.encrypted_secret)
2726
for attr in client.client_structure:
2727
if attr not in exclude:
2728
client_dict[attr] = getattr(client, attr)
2729
2730
clients[client.name] = client_dict
2731
del client_settings[client.name]["secret"]
2732
2733
try:
2734
with (tempfile.NamedTemporaryFile
2735
(mode='wb', suffix=".pickle", prefix='clients-',
2736
dir=os.path.dirname(stored_state_path),
2737
delete=False)) as stored_state:
2738
pickle.dump((clients, client_settings), stored_state)
2739
tempname=stored_state.name
2740
os.rename(tempname, stored_state_path)
2741
except (IOError, OSError) as e:
2742
if not debug:
2743
try:
2744
os.remove(tempname)
2745
except NameError:
2746
pass
2747
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2748
logger.warning("Could not save persistent state: {0}"
2749
.format(os.strerror(e.errno)))
2750
else:
2751
logger.warning("Could not save persistent state:",
2752
exc_info=e)
2753
raise e
2754
2755
# Delete all clients, and settings from config
2756
1947
while tcp_server.clients:
2757
name, client = tcp_server.clients.popitem()
1948
client = tcp_server.clients.pop()
2758
1949
if use_dbus:
2759
1950
client.remove_from_connection()
1951
client.disable_hook = None
2760
1952
# Don't signal anything except ClientRemoved
2761
1953
client.disable(quiet=True)
2762
1954
if use_dbus:
2763
1955
# Emit D-Bus signal
2764
mandos_dbus_service.ClientRemoved(client
2765
.dbus_object_path,
1956
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2766
1957
client.name)
2767
client_settings.clear()
2768
1958
2769
1959
atexit.register(cleanup)
2770
1960
2771
for client in tcp_server.clients.itervalues():
1961
for client in tcp_server.clients:
2772
1962
if use_dbus:
2773
1963
# Emit D-Bus signal
2774
1964
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2775
# Need to initiate checking of clients
2776
if client.enabled:
2777
client.init_checker()
1965
client.enable()
2778
1966
2779
1967
tcp_server.enable()
2780
1968
tcp_server.server_activate()
2782
1970
# Find out what port we got
2783
1971
service.port = tcp_server.socket.getsockname()[1]
2784
1972
if use_ipv6:
2785
logger.info("Now listening on address %r, port %d,"
2786
" flowinfo %d, scope_id %d",
2787
*tcp_server.socket.getsockname())
1973
logger.info(u"Now listening on address %r, port %d,"
1974
" flowinfo %d, scope_id %d"
1975
% tcp_server.socket.getsockname())
2788
1976
else: # IPv4
2789
logger.info("Now listening on address %r, port %d",
2790
*tcp_server.socket.getsockname())
1977
logger.info(u"Now listening on address %r, port %d"
1978
% tcp_server.socket.getsockname())
2791
1979
2792
1980
#service.interface = tcp_server.socket.getsockname()[3]
2793
1981
2795
1983
# From the Avahi example code
2796
1984
try:
2797
1985
service.activate()
2798
except dbus.exceptions.DBusException as error:
2799
logger.critical("D-Bus Exception", exc_info=error)
1986
except dbus.exceptions.DBusException, error:
1987
logger.critical(u"DBusException: %s", error)
2800
1988
cleanup()
2801
1989
sys.exit(1)
2802
1990
# End of Avahi example code
2806
1994
(tcp_server.handle_request
2807
1995
(*args[2:], **kwargs) or True))
2808
1996
2809
logger.debug("Starting main loop")
1997
logger.debug(u"Starting main loop")
2810
1998
main_loop.run()
2811
except AvahiError as error:
2812
logger.critical("Avahi Error", exc_info=error)
1999
except AvahiError, error:
2000
logger.critical(u"AvahiError: %s", error)
2813
2001
cleanup()
2814
2002
sys.exit(1)
2815
2003
except KeyboardInterrupt:
2816
2004
if debug:
2817
print("", file=sys.stderr)
2818
logger.debug("Server received KeyboardInterrupt")
2819
logger.debug("Server exiting")
2005
print >> sys.stderr
2006
logger.debug(u"Server received KeyboardInterrupt")
2007
logger.debug(u"Server exiting")
2820
2008
# Must run before the D-Bus bus name gets deregistered
2821
2009
cleanup()
2822
2010
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0