/mandos/trunk : revision 472

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

37

import SocketServer as socketserver

43

38

import socket

44

import argparse

39

import optparse

45

40

import datetime

46

41

import errno

47

42

import gnutls.crypto

50

45

import gnutls.library.functions

51

46

import gnutls.library.constants

52

47

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

48

import ConfigParser as configparser

57

49

import sys

58

50

import re

59

51

import os

68

60

import struct

69

61

import fcntl

70

62

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

63

import cPickle as pickle

75

64

import multiprocessing

76

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

81

import codecs

82

65

83

66

import dbus

84

67

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

68

import gobject

89

69

import avahi

90

70

from dbus.mainloop.glib import DBusGMainLoop

91

71

import ctypes

101

81

except ImportError:

102

82

SO_BINDTODEVICE = None

103

83

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

108

stored_state_file = "clients.pickle"

109

110

logger = logging.getLogger()

111

syslogger = None

112

113

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

116

except (OSError, AttributeError):

117

118

def if_nametoindex(interface):

119

"Get an interface index the hard way, i.e. using fcntl()"

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

with contextlib.closing(socket.socket()) as s:

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

125

return interface_index

126

127

128

def initlogger(debug, level=logging.WARNING):

129

"""init logger and add loglevel"""

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

syslogger.setFormatter(logging.Formatter

136

('Mandos [%(process)d]: %(levelname)s:'

137

' %(message)s'))

138

logger.addHandler(syslogger)

139

140

if debug:

141

console = logging.StreamHandler()

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

147

logger.setLevel(level)

148

149

150

class PGPError(Exception):

151

"""Exception if encryption/decryption fails"""

152

pass

153

154

155

class PGPEngine(object):

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

def __init__(self):

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

165

166

def __enter__(self):

167

return self

168

169

def __exit__(self, exc_type, exc_value, traceback):

170

self._cleanup()

171

return False

172

173

def __del__(self):

174

self._cleanup()

175

176

def _cleanup(self):

177

if self.tempdir is not None:

178

# Delete contents of tempdir

179

for root, dirs, files in os.walk(self.tempdir,

180

topdown = False):

181

for filename in files:

182

os.remove(os.path.join(root, filename))

183

for dirname in dirs:

184

os.rmdir(os.path.join(root, dirname))

185

# Remove tempdir

186

os.rmdir(self.tempdir)

187

self.tempdir = None

188

189

def password_encode(self, password):

190

# Passphrase can not be empty and can not contain newlines or

191

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

199

200

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

216

return ciphertext

217

218

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

234

return decrypted_plaintext

235

84

85

version = "1.2.3"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

89

syslogger = (logging.handlers.SysLogHandler

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

236

102

237

103

class AvahiError(Exception):

238

104

def __init__(self, value, *args, **kwargs):

239

105

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

106

super(AvahiError, self).__init__(value, *args, **kwargs)

107

def __unicode__(self):

108

return unicode(repr(self.value))

243

109

244

110

class AvahiServiceError(AvahiError):

245

111

pass

246

112

247

248

113

class AvahiGroupError(AvahiError):

249

114

pass

250

115

257

122

Used to optionally bind to the specified interface.

258

123

name: string; Example: 'Mandos'

259

124

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

125

See <http://www.dns-sd.org/ServiceTypes.html>

261

126

port: integer; what port to announce

262

127

TXT: list of strings; TXT record for the service

263

128

domain: string; Domain to publish on, default to .local if empty.

269

134

server: D-Bus Server

270

135

bus: dbus.SystemBus()

271

136

"""

272

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

284

141

self.interface = interface

285

142

self.name = name

286

143

self.type = servicetype

294

151

self.group = None # our entry group

295

152

self.server = None

296

153

self.bus = bus

297

self.entry_group_state_changed_match = None

298

299

def rename(self, remove=True):

154

def rename(self):

300

155

"""Derived from the Avahi example code"""

301

156

if self.rename_count >= self.max_renames:

302

157

logger.critical("No suitable Zeroconf service name found"

303

158

" after %i retries, exiting.",

304

159

self.rename_count)

305

160

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

161

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

309

162

logger.info("Changing Zeroconf service name to %r ...",

310

163

self.name)

311

if remove:

312

self.remove()

164

syslogger.setFormatter(logging.Formatter

165

('Mandos (%s) [%%(process)d]:'

166

' %%(levelname)s: %%(message)s'

167

% self.name))

168

self.remove()

313

169

try:

314

170

self.add()

315

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

324

171

except dbus.exceptions.DBusException, error:

172

logger.critical("DBusException: %s", error)

173

self.cleanup()

174

os._exit(1)

175

self.rename_count += 1

325

176

def remove(self):

326

177

"""Derived from the Avahi example code"""

327

if self.entry_group_state_changed_match is not None:

328

self.entry_group_state_changed_match.remove()

329

self.entry_group_state_changed_match = None

330

178

if self.group is not None:

331

179

self.group.Reset()

332

333

180

def add(self):

334

181

"""Derived from the Avahi example code"""

335

self.remove()

336

182

if self.group is None:

337

183

self.group = dbus.Interface(

338

184

self.bus.get_object(avahi.DBUS_NAME,

339

185

self.server.EntryGroupNew()),

340

186

avahi.DBUS_INTERFACE_ENTRY_GROUP)

341

self.entry_group_state_changed_match = (

342

self.group.connect_to_signal(

343

'StateChanged', self.entry_group_state_changed))

187

self.group.connect_to_signal('StateChanged',

188

self

189

.entry_group_state_changed)

344

190

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

345

191

self.name, self.type)

346

192

self.group.AddService(

352

198

dbus.UInt16(self.port),

353

199

avahi.string_array_to_txt_array(self.TXT))

354

200

self.group.Commit()

355

356

201

def entry_group_state_changed(self, state, error):

357

202

"""Derived from the Avahi example code"""

358

203

logger.debug("Avahi entry group state change: %i", state)

364

209

self.rename()

365

210

elif state == avahi.ENTRY_GROUP_FAILURE:

366

211

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

369

212

unicode(error))

213

raise AvahiGroupError("State changed: %s"

214

% unicode(error))

370

215

def cleanup(self):

371

216

"""Derived from the Avahi example code"""

372

217

if self.group is not None:

373

try:

374

self.group.Free()

375

except (dbus.exceptions.UnknownMethodException,

376

dbus.exceptions.DBusException):

377

pass

218

self.group.Free()

378

219

self.group = None

379

self.remove()

380

381

def server_state_changed(self, state, error=None):

220

def server_state_changed(self, state):

382

221

"""Derived from the Avahi example code"""

383

222

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

390

if state in bad_states:

391

if bad_states[state] is not None:

392

if error is None:

393

logger.error(bad_states[state])

394

else:

395

logger.error(bad_states[state] + ": %r", error)

396

self.cleanup()

223

if state == avahi.SERVER_COLLISION:

224

logger.error("Zeroconf server name collision")

225

self.remove()

397

226

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

410

else:

411

if error is None:

412

logger.debug("Unknown state: %r", state)

413

else:

414

logger.debug("Unknown state: %r: %r", state, error)

415

227

self.add()

416

228

def activate(self):

417

229

"""Derived from the Avahi example code"""

418

230

if self.server is None:

419

231

self.server = dbus.Interface(

420

232

self.bus.get_object(avahi.DBUS_NAME,

421

avahi.DBUS_PATH_SERVER,

422

follow_name_owner_changes=True),

233

avahi.DBUS_PATH_SERVER),

423

234

avahi.DBUS_INTERFACE_SERVER)

424

235

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

236

self.server_state_changed)

426

237

self.server_state_changed(self.server.GetState())

427

238

428

239

429

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

431

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

436

return ret

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

448

240

class Client(object):

449

241

"""A representation of a client host served by this server.

450

242

451

243

Attributes:

452

approved: bool(); 'None' if not yet approved/disapproved

244

_approved: bool(); 'None' if not yet approved/disapproved

453

245

approval_delay: datetime.timedelta(); Time to wait for approval

454

246

approval_duration: datetime.timedelta(); Duration of one approval

455

247

checker: subprocess.Popen(); a running checker process used

462

254

instance %(name)s can be used in the command.

463

255

checker_initiator_tag: a gobject event source tag, or None

464

256

created: datetime.datetime(); (UTC) object creation

465

client_structure: Object describing what attributes a client has

466

and is used for storing the client at exit

467

257

current_checker_command: string; current running checker_command

258

disable_hook: If set, called by disable() as disable_hook(self)

468

259

disable_initiator_tag: a gobject event source tag, or None

469

260

enabled: bool()

470

261

fingerprint: string (40 or 32 hexadecimal digits); used to

473

264

interval: datetime.timedelta(); How often to start a new checker

474

265

last_approval_request: datetime.datetime(); (UTC) or None

475

266

last_checked_ok: datetime.datetime(); (UTC) or None

476

last_checker_status: integer between 0 and 255 reflecting exit

477

status of last checker. -1 reflects crashed

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

last_enabled: datetime.datetime(); (UTC) or None

267

last_enabled: datetime.datetime(); (UTC)

482

268

name: string; from the config file, used in log messages and

483

269

D-Bus identifiers

484

270

secret: bytestring; sent verbatim (over TLS) to client

485

271

timeout: datetime.timedelta(); How long from last_checked_ok

486

272

until this client is disabled

487

extended_timeout: extra long timeout when secret has been sent

488

273

runtime_expansions: Allowed attributes for runtime expansion.

489

expires: datetime.datetime(); time (UTC) when a client will be

490

disabled, or None

491

server_settings: The server_settings dict from main()

492

274

"""

493

275

494

276

runtime_expansions = ("approval_delay", "approval_duration",

495

"created", "enabled", "expires",

496

"fingerprint", "host", "interval",

497

"last_approval_request", "last_checked_ok",

277

"created", "enabled", "fingerprint",

278

"host", "interval", "last_checked_ok",

498

279

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

510

280

511

281

@staticmethod

512

def config_parser(config):

513

"""Construct a new dict of client settings of this form:

514

{ client_name: {setting_name: value, ...}, ...}

515

with exceptions for any special settings as defined above.

516

NOTE: Must be a pure function. Must return the same result

517

value given the same arguments.

518

"""

519

settings = {}

520

for client_name in config.sections():

521

section = dict(config.items(client_name))

522

client = settings[client_name] = {}

523

524

client["host"] = section["host"]

525

# Reformat values from string types to Python types

526

client["approved_by_default"] = config.getboolean(

527

client_name, "approved_by_default")

528

client["enabled"] = config.getboolean(client_name,

529

"enabled")

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

535

.replace(" ", ""))

536

if "secret" in section:

537

client["secret"] = section["secret"].decode("base64")

538

elif "secfile" in section:

539

with open(os.path.expanduser(os.path.expandvars

540

(section["secfile"])),

541

"rb") as secfile:

542

client["secret"] = secfile.read()

543

else:

544

raise TypeError("No secret or secfile for section {}"

545

.format(section))

546

client["timeout"] = string_to_delta(section["timeout"])

547

client["extended_timeout"] = string_to_delta(

548

section["extended_timeout"])

549

client["interval"] = string_to_delta(section["interval"])

550

client["approval_delay"] = string_to_delta(

551

section["approval_delay"])

552

client["approval_duration"] = string_to_delta(

553

section["approval_duration"])

554

client["checker_command"] = section["checker"]

555

client["last_approval_request"] = None

556

client["last_checked_ok"] = None

557

client["last_checker_status"] = -2

558

559

return settings

560

561

def __init__(self, settings, name = None, server_settings=None):

282

def _timedelta_to_milliseconds(td):

283

"Convert a datetime.timedelta() to milliseconds"

284

return ((td.days * 24 * 60 * 60 * 1000)

285

+ (td.seconds * 1000)

286

+ (td.microseconds // 1000))

287

288

def timeout_milliseconds(self):

289

"Return the 'timeout' attribute in milliseconds"

290

return self._timedelta_to_milliseconds(self.timeout)

291

292

def interval_milliseconds(self):

293

"Return the 'interval' attribute in milliseconds"

294

return self._timedelta_to_milliseconds(self.interval)

295

296

def approval_delay_milliseconds(self):

297

return self._timedelta_to_milliseconds(self.approval_delay)

298

299

def __init__(self, name = None, disable_hook=None, config=None):

300

"""Note: the 'checker' key in 'config' sets the

301

'checker_command' attribute and *not* the 'checker'

302

attribute."""

562

303

self.name = name

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

566

# adding all client settings

567

for setting, value in settings.items():

568

setattr(self, setting, value)

569

570

if self.enabled:

571

if not hasattr(self, "last_enabled"):

572

self.last_enabled = datetime.datetime.utcnow()

573

if not hasattr(self, "expires"):

574

self.expires = (datetime.datetime.utcnow()

575

+ self.timeout)

576

else:

577

self.last_enabled = None

578

self.expires = None

579

304

if config is None:

305

config = {}

580

306

logger.debug("Creating client %r", self.name)

307

# Uppercase and remove spaces from fingerprint for later

308

# comparison purposes with return value from the fingerprint()

309

# function

310

self.fingerprint = (config["fingerprint"].upper()

311

.replace(" ", ""))

581

312

logger.debug(" Fingerprint: %s", self.fingerprint)

582

self.created = settings.get("created",

583

datetime.datetime.utcnow())

584

585

# attributes specific for this server instance

313

if "secret" in config:

314

self.secret = config["secret"].decode("base64")

315

elif "secfile" in config:

316

with open(os.path.expanduser(os.path.expandvars

317

(config["secfile"])),

318

"rb") as secfile:

319

self.secret = secfile.read()

320

else:

321

raise TypeError("No secret or secfile for client %s"

322

% self.name)

323

self.host = config.get("host", "")

324

self.created = datetime.datetime.utcnow()

325

self.enabled = False

326

self.last_approval_request = None

327

self.last_enabled = None

328

self.last_checked_ok = None

329

self.timeout = string_to_delta(config["timeout"])

330

self.interval = string_to_delta(config["interval"])

331

self.disable_hook = disable_hook

586

332

self.checker = None

587

333

self.checker_initiator_tag = None

588

334

self.disable_initiator_tag = None

589

335

self.checker_callback_tag = None

336

self.checker_command = config["checker"]

590

337

self.current_checker_command = None

591

self.approved = None

338

self.last_connect = None

339

self._approved = None

340

self.approved_by_default = config.get("approved_by_default",

341

True)

592

342

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

597

if not attr.startswith("_")]

598

self.client_structure.append("client_structure")

599

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

602

if not name.startswith("_"):

603

self.client_structure.append(name)

343

self.approval_delay = string_to_delta(

344

config["approval_delay"])

345

self.approval_duration = string_to_delta(

346

config["approval_duration"])

347

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

604

348

605

# Send notice to process children that client state has changed

606

349

def send_changedstate(self):

607

with self.changedstate:

608

self.changedstate.notify_all()

609

350

self.changedstate.acquire()

351

self.changedstate.notify_all()

352

self.changedstate.release()

353

610

354

def enable(self):

611

355

"""Start this client's checker and timeout hooks"""

612

356

if getattr(self, "enabled", False):

613

357

# Already enabled

614

358

return

615

self.expires = datetime.datetime.utcnow() + self.timeout

616

self.enabled = True

359

self.send_changedstate()

617

360

self.last_enabled = datetime.datetime.utcnow()

618

self.init_checker()

619

self.send_changedstate()

361

# Schedule a new checker to be started an 'interval' from now,

362

# and every interval from then on.

363

self.checker_initiator_tag = (gobject.timeout_add

364

(self.interval_milliseconds(),

365

self.start_checker))

366

# Schedule a disable() when 'timeout' has passed

367

self.disable_initiator_tag = (gobject.timeout_add

368

(self.timeout_milliseconds(),

369

self.disable))

370

self.enabled = True

371

# Also start a new checker *right now*.

372

self.start_checker()

620

373

621

374

def disable(self, quiet=True):

622

375

"""Disable this client."""

623

376

if not getattr(self, "enabled", False):

624

377

return False

625

378

if not quiet:

379

self.send_changedstate()

380

if not quiet:

626

381

logger.info("Disabling client %s", self.name)

627

if getattr(self, "disable_initiator_tag", None) is not None:

382

if getattr(self, "disable_initiator_tag", False):

628

383

gobject.source_remove(self.disable_initiator_tag)

629

384

self.disable_initiator_tag = None

630

self.expires = None

631

if getattr(self, "checker_initiator_tag", None) is not None:

385

if getattr(self, "checker_initiator_tag", False):

632

386

gobject.source_remove(self.checker_initiator_tag)

633

387

self.checker_initiator_tag = None

634

388

self.stop_checker()

389

if self.disable_hook:

390

self.disable_hook(self)

635

391

self.enabled = False

636

if not quiet:

637

self.send_changedstate()

638

392

# Do not run this again if called by a gobject.timeout_add

639

393

return False

640

394

641

395

def __del__(self):

396

self.disable_hook = None

642

397

self.disable()

643

398

644

def init_checker(self):

645

# Schedule a new checker to be started an 'interval' from now,

646

# and every interval from then on.

647

if self.checker_initiator_tag is not None:

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

652

# Schedule a disable() when 'timeout' has passed

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

657

# Also start a new checker *right now*.

658

self.start_checker()

659

660

def checker_callback(self, source, condition, connection,

661

command):

399

def checker_callback(self, pid, condition, command):

662

400

"""The checker has completed, so take appropriate actions."""

663

401

self.checker_callback_tag = None

664

402

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

672

if self.last_checker_status == 0:

403

if os.WIFEXITED(condition):

404

exitstatus = os.WEXITSTATUS(condition)

405

if exitstatus == 0:

673

406

logger.info("Checker for %(name)s succeeded",

674

407

vars(self))

675

408

self.checked_ok()

676

409

else:

677

logger.info("Checker for %(name)s failed", vars(self))

410

logger.info("Checker for %(name)s failed",

411

vars(self))

678

412

else:

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

413

logger.warning("Checker for %(name)s crashed?",

682

414

vars(self))

683

return False

684

415

685

416

def checked_ok(self):

686

"""Assert that the client has been seen, alive and well."""

417

"""Bump up the timeout for this client.

418

419

This should only be called when the client has been seen,

420

alive and well.

421

"""

687

422

self.last_checked_ok = datetime.datetime.utcnow()

688

self.last_checker_status = 0

689

self.last_checker_signal = None

690

self.bump_timeout()

691

692

def bump_timeout(self, timeout=None):

693

"""Bump up the timeout for this client."""

694

if timeout is None:

695

timeout = self.timeout

696

if self.disable_initiator_tag is not None:

697

gobject.source_remove(self.disable_initiator_tag)

698

self.disable_initiator_tag = None

699

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

702

self.expires = datetime.datetime.utcnow() + timeout

423

gobject.source_remove(self.disable_initiator_tag)

424

self.disable_initiator_tag = (gobject.timeout_add

425

(self.timeout_milliseconds(),

426

self.disable))

703

427

704

428

def need_approval(self):

705

429

self.last_approval_request = datetime.datetime.utcnow()

710

434

If a checker already exists, leave it running and do

711

435

nothing."""

712

436

# The reason for not killing a running checker is that if we

713

# did that, and if a checker (for some reason) started running

714

# slowly and taking more than 'interval' time, then the client

715

# would inevitably timeout, since no checker would get a

716

# chance to run to completion. If we instead leave running

437

# did that, then if a checker (for some reason) started

438

# running slowly and taking more than 'interval' time, the

439

# client would inevitably timeout, since no checker would get

440

# a chance to run to completion. If we instead leave running

717

441

# checkers alone, the checker would have to take more time

718

442

# than 'timeout' for the client to be disabled, which is as it

719

443

# should be.

720

444

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

445

# If a checker exists, make sure it is not a zombie

446

try:

447

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

448

except (AttributeError, OSError), error:

449

if (isinstance(error, OSError)

450

and error.errno != errno.ECHILD):

451

raise error

452

else:

453

if pid:

454

logger.warning("Checker was a zombie")

455

gobject.source_remove(self.checker_callback_tag)

456

self.checker_callback(pid, status,

457

self.current_checker_command)

725

458

# Start a new checker if needed

726

459

if self.checker is None:

727

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

731

460

try:

732

command = self.checker_command % escaped_attrs

733

except TypeError as error:

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

461

# In case checker_command has exactly one % operator

462

command = self.checker_command % self.host

463

except TypeError:

464

# Escape attributes for the shell

465

escaped_attrs = dict(

466

(attr,

467

re.escape(unicode(str(getattr(self, attr, "")),

468

errors=

469

'replace')))

470

for attr in

471

self.runtime_expansions)

472

473

try:

474

command = self.checker_command % escaped_attrs

475

except TypeError, error:

476

logger.error('Could not format string "%s":'

477

' %s', self.checker_command, error)

478

return True # Try again later

738

479

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

480

try:

481

logger.info("Starting checker %r for %s",

482

command, self.name)

483

# We don't need to redirect stdout and stderr, since

484

# in normal mode, that is already done by daemon(),

485

# and in debug mode we don't want to. (Stdin is

486

# always replaced by /dev/null.)

487

self.checker = subprocess.Popen(command,

488

close_fds=True,

489

shell=True, cwd="/")

490

self.checker_callback_tag = (gobject.child_watch_add

491

(self.checker.pid,

492

self.checker_callback,

493

data=command))

494

# The checker may have completed before the gobject

495

# watch was added. Check for this.

496

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

497

if pid:

498

gobject.source_remove(self.checker_callback_tag)

499

self.checker_callback(pid, status, command)

500

except OSError, error:

501

logger.error("Failed to start subprocess: %s",

502

error)

764

503

# Re-run this periodically if run by gobject.timeout_add

765

504

return True

766

505

772

511

if getattr(self, "checker", None) is None:

773

512

return

774

513

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

514

try:

515

os.kill(self.checker.pid, signal.SIGTERM)

516

#time.sleep(0.5)

517

#if self.checker.poll() is None:

518

# os.kill(self.checker.pid, signal.SIGKILL)

519

except OSError, error:

520

if error.errno != errno.ESRCH: # No such process

521

raise

776

522

self.checker = None

777

523

778

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

524

def dbus_service_property(dbus_interface, signature="v",

525

access="readwrite", byte_arrays=False):

783

526

"""Decorators for marking methods of a DBusObjectWithProperties to

784

527

become properties on the D-Bus.

785

528

794

537

# "Set" method, so we fail early here:

795

538

if byte_arrays and signature != "ay":

796

539

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {!r}".format(signature))

798

540

" signature %r" % signature)

799

541

def decorator(func):

800

542

func._dbus_is_property = True

801

543

func._dbus_interface = dbus_interface

806

548

func._dbus_name = func._dbus_name[:-14]

807

549

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

550

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

"""

846

847

def decorator(func):

848

func._dbus_annotations = annotations

849

return func

850

851

551

return decorator

852

552

853

553

854

554

class DBusPropertyException(dbus.exceptions.DBusException):

855

555

"""A base class for D-Bus property-related exceptions

856

556

"""

857

pass

557

def __unicode__(self):

558

return unicode(str(self))

858

559

859

560

860

561

class DBusPropertyAccessException(DBusPropertyException):

871

572

872

573

class DBusObjectWithProperties(dbus.service.Object):

873

574

"""A D-Bus object with properties.

874

575

875

576

Classes inheriting from this can use the dbus_service_property

876

577

decorator to expose methods as D-Bus properties. It exposes the

877

578

standard Get(), Set(), and GetAll() methods on the D-Bus.

878

579

"""

879

580

880

581

@staticmethod

881

def _is_dbus_thing(thing):

882

"""Returns a function testing if an attribute is a D-Bus thing

883

884

If called like _is_dbus_thing("method") it returns a function

885

suitable for use as predicate to inspect.getmembers().

886

"""

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

888

False)

582

def _is_dbus_property(obj):

583

return getattr(obj, "_dbus_is_property", False)

889

584

890

def _get_all_dbus_things(self, thing):

585

def _get_all_dbus_properties(self):

891

586

"""Returns a generator of (name, attribute) pairs

892

587

"""

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

894

athing.__get__(self))

895

for cls in self.__class__.__mro__

896

for name, athing in

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

588

return ((prop._dbus_name, prop)

589

for name, prop in

590

inspect.getmembers(self, self._is_dbus_property))

898

591

899

592

def _get_dbus_property(self, interface_name, property_name):

900

593

"""Returns a bound method if one exists which is a D-Bus

901

594

property with the specified name and interface.

902

595

"""

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

906

if (value._dbus_name == property_name

907

and value._dbus_interface == interface_name):

908

return value.__get__(self)

909

596

for name in (property_name,

597

property_name + "_dbus_property"):

598

prop = getattr(self, name, None)

599

if (prop is None

600

or not self._is_dbus_property(prop)

601

or prop._dbus_name != property_name

602

or (interface_name and prop._dbus_interface

603

and interface_name != prop._dbus_interface)):

604

continue

605

return prop

910

606

# No such property

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

607

raise DBusPropertyNotFound(self.dbus_object_path + ":"

608

+ interface_name + "."

609

+ property_name)

913

610

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

611

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

916

612

out_signature="v")

917

613

def Get(self, interface_name, property_name):

918

614

"""Standard D-Bus property Get() method, see D-Bus standard.

936

632

# The byte_arrays option is not supported yet on

937

633

# signatures other than "ay".

938

634

if prop._dbus_signature != "ay":

939

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {!r}"

941

.format(prop._dbus_signature))

942

value = dbus.ByteArray(b''.join(chr(byte)

943

for byte in value))

635

raise ValueError

636

value = dbus.ByteArray(''.join(unichr(byte)

637

for byte in value))

944

638

prop(value)

945

639

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

640

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

948

641

out_signature="a{sv}")

949

642

def GetAll(self, interface_name):

950

643

"""Standard D-Bus property GetAll() method, see D-Bus

951

644

standard.

952

645

953

646

Note: Will not include properties with access="write".

954

647

"""

955

properties = {}

956

for name, prop in self._get_all_dbus_things("property"):

648

all = {}

649

for name, prop in self._get_all_dbus_properties():

957

650

if (interface_name

958

651

and interface_name != prop._dbus_interface):

959

652

# Interface non-empty but did not match

963

656

continue

964

657

value = prop()

965

658

if not hasattr(value, "variant_level"):

966

properties[name] = value

659

all[name] = value

967

660

continue

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

970

return dbus.Dictionary(properties, signature="sv")

971

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

661

all[name] = type(value)(value, variant_level=

662

value.variant_level+1)

663

return dbus.Dictionary(all, signature="sv")

979

664

980

665

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

981

666

out_signature="s",

982

667

path_keyword='object_path',

983

668

connection_keyword='connection')

984

669

def Introspect(self, object_path, connection):

985

"""Overloading of standard D-Bus method.

986

987

Inserts property tags and interface annotation tags.

670

"""Standard D-Bus method, overloaded to insert property tags.

988

671

"""

989

672

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

673

connection)

991

674

try:

992

675

document = xml.dom.minidom.parseString(xmlstring)

993

994

676

def make_tag(document, name, prop):

995

677

e = document.createElement("property")

996

678

e.setAttribute("name", name)

997

679

e.setAttribute("type", prop._dbus_signature)

998

680

e.setAttribute("access", prop._dbus_access)

999

681

return e

1000

1001

682

for if_tag in document.getElementsByTagName("interface"):

1002

# Add property tags

1003

683

for tag in (make_tag(document, name, prop)

1004

684

for name, prop

1005

in self._get_all_dbus_things("property")

685

in self._get_all_dbus_properties()

1006

686

if prop._dbus_interface

1007

687

== if_tag.getAttribute("name")):

1008

688

if_tag.appendChild(tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1038

689

# Add the names to the return values for the

1039

690

# "org.freedesktop.DBus.Properties" methods

1040

691

if (if_tag.getAttribute("name")

1053

704

xmlstring = document.toxml("utf-8")

1054

705

document.unlink()

1055

706

except (AttributeError, xml.dom.DOMException,

1056

xml.parsers.expat.ExpatError) as error:

707

xml.parsers.expat.ExpatError), error:

1057

708

logger.error("Failed to override Introspection method",

1058

exc_info=error)

709

error)

1059

710

return xmlstring

1060

711

1061

712

1062

def datetime_to_dbus(dt, variant_level=0):

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1064

if dt is None:

1065

return dbus.String("", variant_level = variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1067

1068

1069

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1070

"""A class decorator; applied to a subclass of

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1072

interface names according to the "alt_interface_names" mapping.

1073

Usage:

1074

1075

@alternate_dbus_interfaces({"org.example.Interface":

1076

"net.example.AlternateInterface"})

1077

class SampleDBusObject(dbus.service.Object):

1078

@dbus.service.method("org.example.Interface")

1079

def SampleDBusMethod():

1080

pass

1081

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1083

reachable via two interfaces: "org.example.Interface" and

1084

"net.example.AlternateInterface", the latter of which will have

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1086

"true", unless "deprecate" is passed with a False value.

1087

1088

This works for methods and signals, and also for D-Bus properties

1089

(from DBusObjectWithProperties) and interfaces (from the

1090

dbus_interface_annotations decorator).

1091

"""

1092

1093

def wrapper(cls):

1094

for orig_interface_name, alt_interface_name in (

1095

alt_interface_names.items()):

1096

attr = {}

1097

interface_names = set()

1098

# Go though all attributes of the class

1099

for attrname, attribute in inspect.getmembers(cls):

1100

# Ignore non-D-Bus attributes, and D-Bus attributes

1101

# with the wrong interface name

1102

if (not hasattr(attribute, "_dbus_interface")

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1105

continue

1106

# Create an alternate D-Bus interface name based on

1107

# the current name

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1110

interface_names.add(alt_interface)

1111

# Is this a D-Bus signal?

1112

if getattr(attribute, "_dbus_is_signal", False):

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1120

else:

1121

nonmethod_func = attribute

1122

# Create a new, but exactly alike, function

1123

# object, and decorate it to be a new D-Bus signal

1124

# with the alternate D-Bus interface name

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1139

new_function = (dbus.service.signal(

1140

alt_interface,

1141

attribute._dbus_signature)(new_function))

1142

# Copy annotations, if any

1143

try:

1144

new_function._dbus_annotations = dict(

1145

attribute._dbus_annotations)

1146

except AttributeError:

1147

pass

1148

# Define a creator of a function to call both the

1149

# original and alternate functions, so both the

1150

# original and alternate signals gets sent when

1151

# the function is called

1152

def fixscope(func1, func2):

1153

"""This function is a scope container to pass

1154

func1 and func2 to the "call_both" function

1155

outside of its arguments"""

1156

1157

def call_both(*args, **kwargs):

1158

"""This function will emit two D-Bus

1159

signals by calling func1 and func2"""

1160

func1(*args, **kwargs)

1161

func2(*args, **kwargs)

1162

1163

return call_both

1164

# Create the "call_both" function and add it to

1165

# the class

1166

attr[attrname] = fixscope(attribute, new_function)

1167

# Is this a D-Bus method?

1168

elif getattr(attribute, "_dbus_is_method", False):

1169

# Create a new, but exactly alike, function

1170

# object. Decorate it to be a new D-Bus method

1171

# with the alternate D-Bus interface name. Add it

1172

# to the class.

1173

attr[attrname] = (

1174

dbus.service.method(

1175

alt_interface,

1176

attribute._dbus_in_signature,

1177

attribute._dbus_out_signature)

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1183

# Copy annotations, if any

1184

try:

1185

attr[attrname]._dbus_annotations = dict(

1186

attribute._dbus_annotations)

1187

except AttributeError:

1188

pass

1189

# Is this a D-Bus property?

1190

elif getattr(attribute, "_dbus_is_property", False):

1191

# Create a new, but exactly alike, function

1192

# object, and decorate it to be a new D-Bus

1193

# property with the alternate D-Bus interface

1194

# name. Add it to the class.

1195

attr[attrname] = (dbus_service_property(

1196

alt_interface, attribute._dbus_signature,

1197

attribute._dbus_access,

1198

attribute._dbus_get_args_options

1199

["byte_arrays"])

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1206

# Copy annotations, if any

1207

try:

1208

attr[attrname]._dbus_annotations = dict(

1209

attribute._dbus_annotations)

1210

except AttributeError:

1211

pass

1212

# Is this a D-Bus interface?

1213

elif getattr(attribute, "_dbus_is_interface", False):

1214

# Create a new, but exactly alike, function

1215

# object. Decorate it to be a new D-Bus interface

1216

# with the alternate D-Bus interface name. Add it

1217

# to the class.

1218

attr[attrname] = (

1219

dbus_interface_annotations(alt_interface)

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1225

if deprecate:

1226

# Deprecate all alternate interfaces

1227

iname="_AlternateDBusNames_interface_annotation{}"

1228

for interface_name in interface_names:

1229

1230

@dbus_interface_annotations(interface_name)

1231

def func(self):

1232

return { "org.freedesktop.DBus.Deprecated":

1233

"true" }

1234

# Find an unused name

1235

for aname in (iname.format(i)

1236

for i in itertools.count()):

1237

if aname not in attr:

1238

attr[aname] = func

1239

break

1240

if interface_names:

1241

# Replace the class with a new subclass of it with

1242

# methods, signals, etc. as created above.

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1245

return cls

1246

1247

return wrapper

1248

1249

1250

@alternate_dbus_interfaces({"se.recompile.Mandos":

1251

"se.bsnet.fukt.Mandos"})

1252

713

class ClientDBus(Client, DBusObjectWithProperties):

1253

714

"""A Client class using D-Bus

1254

715

1258

719

"""

1259

720

1260

721

runtime_expansions = (Client.runtime_expansions

1261

+ ("dbus_object_path", ))

1262

1263

_interface = "se.recompile.Mandos.Client"

722

+ ("dbus_object_path",))

1264

723

1265

724

# dbus.service.Object doesn't use super(), so we can't either.

1266

725

1267

726

def __init__(self, bus = None, *args, **kwargs):

727

self._approvals_pending = 0

1268

728

self.bus = bus

1269

729

Client.__init__(self, *args, **kwargs)

1270

730

# Only now, when this client is initialized, can it show up on

1271

731

# the D-Bus

1272

client_object_name = str(self.name).translate(

732

client_object_name = unicode(self.name).translate(

1273

733

{ord("."): ord("_"),

1274

734

ord("-"): ord("_")})

1275

self.dbus_object_path = dbus.ObjectPath(

1276

"/clients/" + client_object_name)

735

self.dbus_object_path = (dbus.ObjectPath

736

("/clients/" + client_object_name))

1277

737

DBusObjectWithProperties.__init__(self, self.bus,

1278

738

self.dbus_object_path)

1279

1280

def notifychangeproperty(transform_func, dbus_name,

1281

type_func=lambda x: x,

1282

variant_level=1,

1283

invalidate_only=False,

1284

_interface=_interface):

1285

""" Modify a variable so that it's a property which announces

1286

its changes to DBus.

1287

1288

transform_fun: Function that takes a value and a variant_level

1289

and transforms it to a D-Bus type.

1290

dbus_name: D-Bus name of the variable

1291

type_func: Function that transform the value before sending it

1292

to the D-Bus. Default: no transform

1293

variant_level: D-Bus variant level. Default: 1

1294

"""

1295

attrname = "_{}".format(dbus_name)

1296

1297

def setter(self, value):

1298

if hasattr(self, "dbus_object_path"):

1299

if (not hasattr(self, attrname) or

1300

type_func(getattr(self, attrname, None))

1301

!= type_func(value)):

1302

if invalidate_only:

1303

self.PropertiesChanged(

1304

_interface, dbus.Dictionary(),

1305

dbus.Array((dbus_name, )))

1306

else:

1307

dbus_value = transform_func(

1308

type_func(value),

1309

variant_level = variant_level)

1310

self.PropertyChanged(dbus.String(dbus_name),

1311

dbus_value)

1312

self.PropertiesChanged(

1313

_interface,

1314

dbus.Dictionary({ dbus.String(dbus_name):

1315

dbus_value }),

1316

dbus.Array())

1317

setattr(self, attrname, value)

1318

1319

return property(lambda self: getattr(self, attrname), setter)

1320

1321

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1322

approvals_pending = notifychangeproperty(dbus.Boolean,

1323

"ApprovalPending",

1324

type_func = bool)

1325

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1326

last_enabled = notifychangeproperty(datetime_to_dbus,

1327

"LastEnabled")

1328

checker = notifychangeproperty(

1329

dbus.Boolean, "CheckerRunning",

1330

type_func = lambda checker: checker is not None)

1331

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1332

"LastCheckedOK")

1333

last_checker_status = notifychangeproperty(dbus.Int16,

1334

"LastCheckerStatus")

1335

last_approval_request = notifychangeproperty(

1336

datetime_to_dbus, "LastApprovalRequest")

1337

approved_by_default = notifychangeproperty(dbus.Boolean,

1338

"ApprovedByDefault")

1339

approval_delay = notifychangeproperty(

1340

dbus.UInt64, "ApprovalDelay",

1341

type_func = lambda td: td.total_seconds() * 1000)

1342

approval_duration = notifychangeproperty(

1343

dbus.UInt64, "ApprovalDuration",

1344

type_func = lambda td: td.total_seconds() * 1000)

1345

host = notifychangeproperty(dbus.String, "Host")

1346

timeout = notifychangeproperty(

1347

dbus.UInt64, "Timeout",

1348

type_func = lambda td: td.total_seconds() * 1000)

1349

extended_timeout = notifychangeproperty(

1350

dbus.UInt64, "ExtendedTimeout",

1351

type_func = lambda td: td.total_seconds() * 1000)

1352

interval = notifychangeproperty(

1353

dbus.UInt64, "Interval",

1354

type_func = lambda td: td.total_seconds() * 1000)

1355

checker_command = notifychangeproperty(dbus.String, "Checker")

1356

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1357

invalidate_only=True)

1358

1359

del notifychangeproperty

739

740

def _get_approvals_pending(self):

741

return self._approvals_pending

742

def _set_approvals_pending(self, value):

743

old_value = self._approvals_pending

744

self._approvals_pending = value

745

bval = bool(value)

746

if (hasattr(self, "dbus_object_path")

747

and bval is not bool(old_value)):

748

dbus_bool = dbus.Boolean(bval, variant_level=1)

749

self.PropertyChanged(dbus.String("ApprovalPending"),

750

dbus_bool)

751

752

approvals_pending = property(_get_approvals_pending,

753

_set_approvals_pending)

754

del _get_approvals_pending, _set_approvals_pending

755

756

@staticmethod

757

def _datetime_to_dbus(dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

return dbus.String(dt.isoformat(),

760

variant_level=variant_level)

761

762

def enable(self):

763

oldstate = getattr(self, "enabled", False)

764

r = Client.enable(self)

765

if oldstate != self.enabled:

766

# Emit D-Bus signals

767

self.PropertyChanged(dbus.String("Enabled"),

768

dbus.Boolean(True, variant_level=1))

769

self.PropertyChanged(

770

dbus.String("LastEnabled"),

771

self._datetime_to_dbus(self.last_enabled,

772

variant_level=1))

773

return r

774

775

def disable(self, quiet = False):

776

oldstate = getattr(self, "enabled", False)

777

r = Client.disable(self, quiet=quiet)

778

if not quiet and oldstate != self.enabled:

779

# Emit D-Bus signal

780

self.PropertyChanged(dbus.String("Enabled"),

781

dbus.Boolean(False, variant_level=1))

782

return r

1360

783

1361

784

def __del__(self, *args, **kwargs):

1362

785

try:

1367

790

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1368

791

Client.__del__(self, *args, **kwargs)

1369

792

1370

def checker_callback(self, source, condition,

1371

connection, command, *args, **kwargs):

1372

ret = Client.checker_callback(self, source, condition,

1373

connection, command, *args,

1374

**kwargs)

1375

exitstatus = self.last_checker_status

1376

if exitstatus >= 0:

793

def checker_callback(self, pid, condition, command,

794

*args, **kwargs):

795

self.checker_callback_tag = None

796

self.checker = None

797

# Emit D-Bus signal

798

self.PropertyChanged(dbus.String("CheckerRunning"),

799

dbus.Boolean(False, variant_level=1))

800

if os.WIFEXITED(condition):

801

exitstatus = os.WEXITSTATUS(condition)

1377

802

# Emit D-Bus signal

1378

803

self.CheckerCompleted(dbus.Int16(exitstatus),

1379

dbus.Int64(0),

804

dbus.Int64(condition),

1380

805

dbus.String(command))

1381

806

else:

1382

807

# Emit D-Bus signal

1383

808

self.CheckerCompleted(dbus.Int16(-1),

1384

dbus.Int64(

1385

self.last_checker_signal),

809

dbus.Int64(condition),

1386

810

dbus.String(command))

1387

return ret

811

812

return Client.checker_callback(self, pid, condition, command,

813

*args, **kwargs)

814

815

def checked_ok(self, *args, **kwargs):

816

r = Client.checked_ok(self, *args, **kwargs)

817

# Emit D-Bus signal

818

self.PropertyChanged(

819

dbus.String("LastCheckedOK"),

820

(self._datetime_to_dbus(self.last_checked_ok,

821

variant_level=1)))

822

return r

823

824

def need_approval(self, *args, **kwargs):

825

r = Client.need_approval(self, *args, **kwargs)

826

# Emit D-Bus signal

827

self.PropertyChanged(

828

dbus.String("LastApprovalRequest"),

829

(self._datetime_to_dbus(self.last_approval_request,

830

variant_level=1)))

831

return r

1388

832

1389

833

def start_checker(self, *args, **kwargs):

1390

old_checker_pid = getattr(self.checker, "pid", None)

834

old_checker = self.checker

835

if self.checker is not None:

836

old_checker_pid = self.checker.pid

837

else:

838

old_checker_pid = None

1391

839

r = Client.start_checker(self, *args, **kwargs)

1392

840

# Only if new checker process was started

1393

841

if (self.checker is not None

1394

842

and old_checker_pid != self.checker.pid):

1395

843

# Emit D-Bus signal

1396

844

self.CheckerStarted(self.current_checker_command)

845

self.PropertyChanged(

846

dbus.String("CheckerRunning"),

847

dbus.Boolean(True, variant_level=1))

1397

848

return r

1398

849

850

def stop_checker(self, *args, **kwargs):

851

old_checker = getattr(self, "checker", None)

852

r = Client.stop_checker(self, *args, **kwargs)

853

if (old_checker is not None

854

and getattr(self, "checker", None) is None):

855

self.PropertyChanged(dbus.String("CheckerRunning"),

856

dbus.Boolean(False, variant_level=1))

857

return r

858

1399

859

def _reset_approved(self):

1400

self.approved = None

860

self._approved = None

1401

861

return False

1402

862

1403

863

def approve(self, value=True):

1404

self.approved = value

1405

gobject.timeout_add(int(self.approval_duration.total_seconds()

1406

* 1000), self._reset_approved)

1407

864

self.send_changedstate()

865

self._approved = value

866

gobject.timeout_add(self._timedelta_to_milliseconds

867

(self.approval_duration),

868

self._reset_approved)

869

1408

870

1409

871

## D-Bus methods, signals & properties

1410

1411

## Interfaces

872

_interface = "se.bsnet.fukt.Mandos.Client"

1412

873

1413

874

## Signals

1414

875

1425

886

pass

1426

887

1427

888

# PropertyChanged - signal

1428

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1429

889

@dbus.service.signal(_interface, signature="sv")

1430

890

def PropertyChanged(self, property, value):

1431

891

"D-Bus signal"

1462

922

# CheckedOK - method

1463

923

@dbus.service.method(_interface)

1464

924

def CheckedOK(self):

1465

self.checked_ok()

925

return self.checked_ok()

1466

926

1467

927

# Enable - method

1468

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1469

928

@dbus.service.method(_interface)

1470

929

def Enable(self):

1471

930

"D-Bus method"

1472

931

self.enable()

1473

932

1474

933

# StartChecker - method

1475

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1476

934

@dbus.service.method(_interface)

1477

935

def StartChecker(self):

1478

936

"D-Bus method"

1479

937

self.start_checker()

1480

938

1481

939

# Disable - method

1482

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1483

940

@dbus.service.method(_interface)

1484

941

def Disable(self):

1485

942

"D-Bus method"

1486

943

self.disable()

1487

944

1488

945

# StopChecker - method

1489

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1490

946

@dbus.service.method(_interface)

1491

947

def StopChecker(self):

1492

948

self.stop_checker()

1499

955

return dbus.Boolean(bool(self.approvals_pending))

1500

956

1501

957

# ApprovedByDefault - property

1502

@dbus_service_property(_interface,

1503

signature="b",

958

@dbus_service_property(_interface, signature="b",

1504

959

access="readwrite")

1505

960

def ApprovedByDefault_dbus_property(self, value=None):

1506

961

if value is None: # get

1507

962

return dbus.Boolean(self.approved_by_default)

1508

963

self.approved_by_default = bool(value)

964

# Emit D-Bus signal

965

self.PropertyChanged(dbus.String("ApprovedByDefault"),

966

dbus.Boolean(value, variant_level=1))

1509

967

1510

968

# ApprovalDelay - property

1511

@dbus_service_property(_interface,

1512

signature="t",

969

@dbus_service_property(_interface, signature="t",

1513

970

access="readwrite")

1514

971

def ApprovalDelay_dbus_property(self, value=None):

1515

972

if value is None: # get

1516

return dbus.UInt64(self.approval_delay.total_seconds()

1517

* 1000)

973

return dbus.UInt64(self.approval_delay_milliseconds())

1518

974

self.approval_delay = datetime.timedelta(0, 0, 0, value)

975

# Emit D-Bus signal

976

self.PropertyChanged(dbus.String("ApprovalDelay"),

977

dbus.UInt64(value, variant_level=1))

1519

978

1520

979

# ApprovalDuration - property

1521

@dbus_service_property(_interface,

1522

signature="t",

980

@dbus_service_property(_interface, signature="t",

1523

981

access="readwrite")

1524

982

def ApprovalDuration_dbus_property(self, value=None):

1525

983

if value is None: # get

1526

return dbus.UInt64(self.approval_duration.total_seconds()

1527

* 1000)

984

return dbus.UInt64(self._timedelta_to_milliseconds(

985

self.approval_duration))

1528

986

self.approval_duration = datetime.timedelta(0, 0, 0, value)

987

# Emit D-Bus signal

988

self.PropertyChanged(dbus.String("ApprovalDuration"),

989

dbus.UInt64(value, variant_level=1))

1529

990

1530

991

# Name - property

1531

@dbus_annotations(

1532

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1533

992

@dbus_service_property(_interface, signature="s", access="read")

1534

993

def Name_dbus_property(self):

1535

994

return dbus.String(self.name)

1536

995

1537

996

# Fingerprint - property

1538

@dbus_annotations(

1539

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1540

997

@dbus_service_property(_interface, signature="s", access="read")

1541

998

def Fingerprint_dbus_property(self):

1542

999

return dbus.String(self.fingerprint)

1543

1000

1544

1001

# Host - property

1545

@dbus_service_property(_interface,

1546

signature="s",

1002

@dbus_service_property(_interface, signature="s",

1547

1003

access="readwrite")

1548

1004

def Host_dbus_property(self, value=None):

1549

1005

if value is None: # get

1550

1006

return dbus.String(self.host)

1551

self.host = str(value)

1007

self.host = value

1008

# Emit D-Bus signal

1009

self.PropertyChanged(dbus.String("Host"),

1010

dbus.String(value, variant_level=1))

1552

1011

1553

1012

# Created - property

1554

@dbus_annotations(

1555

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1556

1013

@dbus_service_property(_interface, signature="s", access="read")

1557

1014

def Created_dbus_property(self):

1558

return datetime_to_dbus(self.created)

1015

return dbus.String(self._datetime_to_dbus(self.created))

1559

1016

1560

1017

# LastEnabled - property

1561

1018

@dbus_service_property(_interface, signature="s", access="read")

1562

1019

def LastEnabled_dbus_property(self):

1563

return datetime_to_dbus(self.last_enabled)

1020

if self.last_enabled is None:

1021

return dbus.String("")

1022

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1564

1023

1565

1024

# Enabled - property

1566

@dbus_service_property(_interface,

1567

signature="b",

1025

@dbus_service_property(_interface, signature="b",

1568

1026

access="readwrite")

1569

1027

def Enabled_dbus_property(self, value=None):

1570

1028

if value is None: # get

1575

1033

self.disable()

1576

1034

1577

1035

# LastCheckedOK - property

1578

@dbus_service_property(_interface,

1579

signature="s",

1036

@dbus_service_property(_interface, signature="s",

1580

1037

access="readwrite")

1581

1038

def LastCheckedOK_dbus_property(self, value=None):

1582

1039

if value is not None:

1583

1040

self.checked_ok()

1584

1041

return

1585

return datetime_to_dbus(self.last_checked_ok)

1586

1587

# LastCheckerStatus - property

1588

@dbus_service_property(_interface, signature="n", access="read")

1589

def LastCheckerStatus_dbus_property(self):

1590

return dbus.Int16(self.last_checker_status)

1591

1592

# Expires - property

1593

@dbus_service_property(_interface, signature="s", access="read")

1594

def Expires_dbus_property(self):

1595

return datetime_to_dbus(self.expires)

1042

if self.last_checked_ok is None:

1043

return dbus.String("")

1044

return dbus.String(self._datetime_to_dbus(self

1045

.last_checked_ok))

1596

1046

1597

1047

# LastApprovalRequest - property

1598

1048

@dbus_service_property(_interface, signature="s", access="read")

1599

1049

def LastApprovalRequest_dbus_property(self):

1600

return datetime_to_dbus(self.last_approval_request)

1050

if self.last_approval_request is None:

1051

return dbus.String("")

1052

return dbus.String(self.

1053

_datetime_to_dbus(self

1054

.last_approval_request))

1601

1055

1602

1056

# Timeout - property

1603

@dbus_service_property(_interface,

1604

signature="t",

1057

@dbus_service_property(_interface, signature="t",

1605

1058

access="readwrite")

1606

1059

def Timeout_dbus_property(self, value=None):

1607

1060

if value is None: # get

1608

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1609

old_timeout = self.timeout

1061

return dbus.UInt64(self.timeout_milliseconds())

1610

1062

self.timeout = datetime.timedelta(0, 0, 0, value)

1611

# Reschedule disabling

1612

if self.enabled:

1613

now = datetime.datetime.utcnow()

1614

self.expires += self.timeout - old_timeout

1615

if self.expires <= now:

1616

# The timeout has passed

1617

self.disable()

1618

else:

1619

if (getattr(self, "disable_initiator_tag", None)

1620

is None):

1621

return

1622

gobject.source_remove(self.disable_initiator_tag)

1623

self.disable_initiator_tag = gobject.timeout_add(

1624

int((self.expires - now).total_seconds() * 1000),

1625

self.disable)

1626

1627

# ExtendedTimeout - property

1628

@dbus_service_property(_interface,

1629

signature="t",

1630

access="readwrite")

1631

def ExtendedTimeout_dbus_property(self, value=None):

1632

if value is None: # get

1633

return dbus.UInt64(self.extended_timeout.total_seconds()

1634

* 1000)

1635

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1063

# Emit D-Bus signal

1064

self.PropertyChanged(dbus.String("Timeout"),

1065

dbus.UInt64(value, variant_level=1))

1066

if getattr(self, "disable_initiator_tag", None) is None:

1067

return

1068

# Reschedule timeout

1069

gobject.source_remove(self.disable_initiator_tag)

1070

self.disable_initiator_tag = None

1071

time_to_die = (self.

1072

_timedelta_to_milliseconds((self

1073

.last_checked_ok

1074

+ self.timeout)

1075

- datetime.datetime

1076

.utcnow()))

1077

if time_to_die <= 0:

1078

# The timeout has passed

1079

self.disable()

1080

else:

1081

self.disable_initiator_tag = (gobject.timeout_add

1082

(time_to_die, self.disable))

1636

1083

1637

1084

# Interval - property

1638

@dbus_service_property(_interface,

1639

signature="t",

1085

@dbus_service_property(_interface, signature="t",

1640

1086

access="readwrite")

1641

1087

def Interval_dbus_property(self, value=None):

1642

1088

if value is None: # get

1643

return dbus.UInt64(self.interval.total_seconds() * 1000)

1089

return dbus.UInt64(self.interval_milliseconds())

1644

1090

self.interval = datetime.timedelta(0, 0, 0, value)

1091

# Emit D-Bus signal

1092

self.PropertyChanged(dbus.String("Interval"),

1093

dbus.UInt64(value, variant_level=1))

1645

1094

if getattr(self, "checker_initiator_tag", None) is None:

1646

1095

return

1647

if self.enabled:

1648

# Reschedule checker run

1649

gobject.source_remove(self.checker_initiator_tag)

1650

self.checker_initiator_tag = gobject.timeout_add(

1651

value, self.start_checker)

1652

self.start_checker() # Start one now, too

1653

1096

# Reschedule checker run

1097

gobject.source_remove(self.checker_initiator_tag)

1098

self.checker_initiator_tag = (gobject.timeout_add

1099

(value, self.start_checker))

1100

self.start_checker() # Start one now, too

1101

1654

1102

# Checker - property

1655

@dbus_service_property(_interface,

1656

signature="s",

1103

@dbus_service_property(_interface, signature="s",

1657

1104

access="readwrite")

1658

1105

def Checker_dbus_property(self, value=None):

1659

1106

if value is None: # get

1660

1107

return dbus.String(self.checker_command)

1661

self.checker_command = str(value)

1108

self.checker_command = value

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Checker"),

1111

dbus.String(self.checker_command,

1112

variant_level=1))

1662

1113

1663

1114

# CheckerRunning - property

1664

@dbus_service_property(_interface,

1665

signature="b",

1115

@dbus_service_property(_interface, signature="b",

1666

1116

access="readwrite")

1667

1117

def CheckerRunning_dbus_property(self, value=None):

1668

1118

if value is None: # get

1673

1123

self.stop_checker()

1674

1124

1675

1125

# ObjectPath - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1678

"org.freedesktop.DBus.Deprecated": "true"})

1679

1126

@dbus_service_property(_interface, signature="o", access="read")

1680

1127

def ObjectPath_dbus_property(self):

1681

1128

return self.dbus_object_path # is already a dbus.ObjectPath

1682

1129

1683

1130

# Secret = property

1684

@dbus_annotations(

1685

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1686

"invalidates"})

1687

@dbus_service_property(_interface,

1688

signature="ay",

1689

access="write",

1690

byte_arrays=True)

1131

@dbus_service_property(_interface, signature="ay",

1132

access="write", byte_arrays=True)

1691

1133

def Secret_dbus_property(self, value):

1692

self.secret = bytes(value)

1134

self.secret = str(value)

1693

1135

1694

1136

del _interface

1695

1137

1699

1141

self._pipe = child_pipe

1700

1142

self._pipe.send(('init', fpr, address))

1701

1143

if not self._pipe.recv():

1702

raise KeyError(fpr)

1703

1144

raise KeyError()

1145

1704

1146

def __getattribute__(self, name):

1705

if name == '_pipe':

1147

if(name == '_pipe'):

1706

1148

return super(ProxyClient, self).__getattribute__(name)

1707

1149

self._pipe.send(('getattr', name))

1708

1150

data = self._pipe.recv()

1709

1151

if data[0] == 'data':

1710

1152

return data[1]

1711

1153

if data[0] == 'function':

1712

1713

1154

def func(*args, **kwargs):

1714

1155

self._pipe.send(('funcall', name, args, kwargs))

1715

1156

return self._pipe.recv()[1]

1716

1717

1157

return func

1718

1158

1719

1159

def __setattr__(self, name, value):

1720

if name == '_pipe':

1160

if(name == '_pipe'):

1721

1161

return super(ProxyClient, self).__setattr__(name, value)

1722

1162

self._pipe.send(('setattr', name, value))

1723

1163

1731

1171

def handle(self):

1732

1172

with contextlib.closing(self.server.child_pipe) as child_pipe:

1733

1173

logger.info("TCP connection from: %s",

1734

str(self.client_address))

1174

unicode(self.client_address))

1735

1175

logger.debug("Pipe FD: %d",

1736

1176

self.server.child_pipe.fileno())

1737

1738

session = gnutls.connection.ClientSession(

1739

self.request, gnutls.connection .X509Credentials())

1740

1177

1178

session = (gnutls.connection

1179

.ClientSession(self.request,

1180

gnutls.connection

1181

.X509Credentials()))

1182

1741

1183

# Note: gnutls.connection.X509Credentials is really a

1742

1184

# generic GnuTLS certificate credentials object so long as

1743

1185

# no X.509 keys are added to it. Therefore, we can use it

1744

1186

# here despite using OpenPGP certificates.

1745

1187

1746

1188

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1747

1189

# "+AES-256-CBC", "+SHA1",

1748

1190

# "+COMP-NULL", "+CTYPE-OPENPGP",

1751

1193

priority = self.server.gnutls_priority

1752

1194

if priority is None:

1753

1195

priority = "NORMAL"

1754

gnutls.library.functions.gnutls_priority_set_direct(

1755

session._c_object, priority, None)

1756

1196

(gnutls.library.functions

1197

.gnutls_priority_set_direct(session._c_object,

1198

priority, None))

1199

1757

1200

# Start communication using the Mandos protocol

1758

1201

# Get protocol number

1759

1202

line = self.request.makefile().readline()

1760

1203

logger.debug("Protocol version: %r", line)

1761

1204

try:

1762

1205

if int(line.strip().split()[0]) > 1:

1763

raise RuntimeError(line)

1764

except (ValueError, IndexError, RuntimeError) as error:

1206

raise RuntimeError

1207

except (ValueError, IndexError, RuntimeError), error:

1765

1208

logger.error("Unknown protocol version: %s", error)

1766

1209

return

1767

1210

1768

1211

# Start GnuTLS connection

1769

1212

try:

1770

1213

session.handshake()

1771

except gnutls.errors.GNUTLSError as error:

1214

except gnutls.errors.GNUTLSError, error:

1772

1215

logger.warning("Handshake failed: %s", error)

1773

1216

# Do not run session.bye() here: the session is not

1774

1217

# established. Just abandon the request.

1775

1218

return

1776

1219

logger.debug("Handshake succeeded")

1777

1220

1778

1221

approval_required = False

1779

1222

try:

1780

1223

try:

1781

fpr = self.fingerprint(

1782

self.peer_certificate(session))

1783

except (TypeError,

1784

gnutls.errors.GNUTLSError) as error:

1224

fpr = self.fingerprint(self.peer_certificate

1225

(session))

1226

except (TypeError, gnutls.errors.GNUTLSError), error:

1785

1227

logger.warning("Bad certificate: %s", error)

1786

1228

return

1787

1229

logger.debug("Fingerprint: %s", fpr)

1788

1230

1789

1231

try:

1790

1232

client = ProxyClient(child_pipe, fpr,

1791

1233

self.client_address)

1799

1241

1800

1242

while True:

1801

1243

if not client.enabled:

1802

logger.info("Client %s is disabled",

1803

client.name)

1244

logger.warning("Client %s is disabled",

1245

client.name)

1804

1246

if self.server.use_dbus:

1805

1247

# Emit D-Bus signal

1806

client.Rejected("Disabled")

1248

client.Rejected("Disabled")

1807

1249

return

1808

1250

1809

if client.approved or not client.approval_delay:

1251

if client._approved or not client.approval_delay:

1810

1252

#We are approved or approval is disabled

1811

1253

break

1812

elif client.approved is None:

1254

elif client._approved is None:

1813

1255

logger.info("Client %s needs approval",

1814

1256

client.name)

1815

1257

if self.server.use_dbus:

1816

1258

# Emit D-Bus signal

1817

1259

client.NeedApproval(

1818

client.approval_delay.total_seconds()

1819

* 1000, client.approved_by_default)

1260

client.approval_delay_milliseconds(),

1261

client.approved_by_default)

1820

1262

else:

1821

1263

logger.warning("Client %s was not approved",

1822

1264

client.name)

1826

1268

return

1827

1269

1828

1270

#wait until timeout or approved

1271

#x = float(client._timedelta_to_milliseconds(delay))

1829

1272

time = datetime.datetime.now()

1830

1273

client.changedstate.acquire()

1831

client.changedstate.wait(delay.total_seconds())

1274

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1832

1275

client.changedstate.release()

1833

1276

time2 = datetime.datetime.now()

1834

1277

if (time2 - time) >= delay:

1849

1292

while sent_size < len(client.secret):

1850

1293

try:

1851

1294

sent = session.send(client.secret[sent_size:])

1852

except gnutls.errors.GNUTLSError as error:

1853

logger.warning("gnutls send failed",

1854

exc_info=error)

1295

except (gnutls.errors.GNUTLSError), error:

1296

logger.warning("gnutls send failed")

1855

1297

return

1856

logger.debug("Sent: %d, remaining: %d", sent,

1857

len(client.secret) - (sent_size

1858

+ sent))

1298

logger.debug("Sent: %d, remaining: %d",

1299

sent, len(client.secret)

1300

- (sent_size + sent))

1859

1301

sent_size += sent

1860

1302

1861

1303

logger.info("Sending secret to %s", client.name)

1862

# bump the timeout using extended_timeout

1863

client.bump_timeout(client.extended_timeout)

1304

# bump the timeout as if seen

1305

client.checked_ok()

1864

1306

if self.server.use_dbus:

1865

1307

# Emit D-Bus signal

1866

1308

client.GotSecret()

1870

1312

client.approvals_pending -= 1

1871

1313

try:

1872

1314

session.bye()

1873

except gnutls.errors.GNUTLSError as error:

1874

logger.warning("GnuTLS bye failed",

1875

exc_info=error)

1315

except (gnutls.errors.GNUTLSError), error:

1316

logger.warning("GnuTLS bye failed")

1876

1317

1877

1318

@staticmethod

1878

1319

def peer_certificate(session):

1879

1320

"Return the peer's OpenPGP certificate as a bytestring"

1880

1321

# If not an OpenPGP certificate...

1881

if (gnutls.library.functions.gnutls_certificate_type_get(

1882

session._c_object)

1322

if (gnutls.library.functions

1323

.gnutls_certificate_type_get(session._c_object)

1883

1324

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1884

1325

# ...do the normal thing

1885

1326

return session.peer_certificate

1899

1340

def fingerprint(openpgp):

1900

1341

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1901

1342

# New GnuTLS "datum" with the OpenPGP public key

1902

datum = gnutls.library.types.gnutls_datum_t(

1903

ctypes.cast(ctypes.c_char_p(openpgp),

1904

ctypes.POINTER(ctypes.c_ubyte)),

1905

ctypes.c_uint(len(openpgp)))

1343

datum = (gnutls.library.types

1344

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1345

ctypes.POINTER

1346

(ctypes.c_ubyte)),

1347

ctypes.c_uint(len(openpgp))))

1906

1348

# New empty GnuTLS certificate

1907

1349

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1908

gnutls.library.functions.gnutls_openpgp_crt_init(

1909

ctypes.byref(crt))

1350

(gnutls.library.functions

1351

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1910

1352

# Import the OpenPGP public key into the certificate

1911

gnutls.library.functions.gnutls_openpgp_crt_import(

1912

crt, ctypes.byref(datum),

1913

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1353

(gnutls.library.functions

1354

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1355

gnutls.library.constants

1356

.GNUTLS_OPENPGP_FMT_RAW))

1914

1357

# Verify the self signature in the key

1915

1358

crtverify = ctypes.c_uint()

1916

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1917

crt, 0, ctypes.byref(crtverify))

1359

(gnutls.library.functions

1360

.gnutls_openpgp_crt_verify_self(crt, 0,

1361

ctypes.byref(crtverify)))

1918

1362

if crtverify.value != 0:

1919

1363

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1920

raise gnutls.errors.CertificateSecurityError(

1921

"Verify failed")

1364

raise (gnutls.errors.CertificateSecurityError

1365

("Verify failed"))

1922

1366

# New buffer for the fingerprint

1923

1367

buf = ctypes.create_string_buffer(20)

1924

1368

buf_len = ctypes.c_size_t()

1925

1369

# Get the fingerprint from the certificate into the buffer

1926

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1927

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1370

(gnutls.library.functions

1371

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1372

ctypes.byref(buf_len)))

1928

1373

# Deinit the certificate

1929

1374

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1930

1375

# Convert the buffer to a Python bytestring

1931

1376

fpr = ctypes.string_at(buf, buf_len.value)

1932

1377

# Convert the bytestring to hexadecimal notation

1933

hex_fpr = binascii.hexlify(fpr).upper()

1378

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1934

1379

return hex_fpr

1935

1380

1936

1381

1937

1382

class MultiprocessingMixIn(object):

1938

1383

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1939

1940

1384

def sub_process_main(self, request, address):

1941

1385

try:

1942

1386

self.finish_request(request, address)

1943

except Exception:

1387

except:

1944

1388

self.handle_error(request, address)

1945

1389

self.close_request(request)

1946

1390

1947

1391

def process_request(self, request, address):

1948

1392

"""Start a new process to process the request."""

1949

proc = multiprocessing.Process(target = self.sub_process_main,

1950

args = (request, address))

1951

proc.start()

1952

return proc

1953

1393

multiprocessing.Process(target = self.sub_process_main,

1394

args = (request, address)).start()

1954

1395

1955

1396

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1956

1397

""" adds a pipe to the MixIn """

1957

1958

1398

def process_request(self, request, client_address):

1959

1399

"""Overrides and wraps the original process_request().

1960

1400

1961

1401

This function creates a new pipe in self.pipe

1962

1402

"""

1963

1403

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1964

1965

proc = MultiprocessingMixIn.process_request(self, request,

1966

client_address)

1404

1405

super(MultiprocessingMixInWithPipe,

1406

self).process_request(request, client_address)

1967

1407

self.child_pipe.close()

1968

self.add_pipe(parent_pipe, proc)

1969

1970

def add_pipe(self, parent_pipe, proc):

1408

self.add_pipe(parent_pipe)

1409

1410

def add_pipe(self, parent_pipe):

1971

1411

"""Dummy function; override as necessary"""

1972

raise NotImplementedError()

1973

1412

raise NotImplementedError

1974

1413

1975

1414

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1976

1415

socketserver.TCPServer, object):

1981

1420

interface: None or a network interface name (string)

1982

1421

use_ipv6: Boolean; to use IPv6 or not

1983

1422

"""

1984

1985

1423

def __init__(self, server_address, RequestHandlerClass,

1986

interface=None,

1987

use_ipv6=True,

1988

socketfd=None):

1989

"""If socketfd is set, use that file descriptor instead of

1990

creating a new one with socket.socket().

1991

"""

1424

interface=None, use_ipv6=True):

1992

1425

self.interface = interface

1993

1426

if use_ipv6:

1994

1427

self.address_family = socket.AF_INET6

1995

if socketfd is not None:

1996

# Save the file descriptor

1997

self.socketfd = socketfd

1998

# Save the original socket.socket() function

1999

self.socket_socket = socket.socket

2000

# To implement --socket, we monkey patch socket.socket.

2001

#

2002

# (When socketserver.TCPServer is a new-style class, we

2003

# could make self.socket into a property instead of monkey

2004

# patching socket.socket.)

2005

#

2006

# Create a one-time-only replacement for socket.socket()

2007

@functools.wraps(socket.socket)

2008

def socket_wrapper(*args, **kwargs):

2009

# Restore original function so subsequent calls are

2010

# not affected.

2011

socket.socket = self.socket_socket

2012

del self.socket_socket

2013

# This time only, return a new socket object from the

2014

# saved file descriptor.

2015

return socket.fromfd(self.socketfd, *args, **kwargs)

2016

# Replace socket.socket() function with wrapper

2017

socket.socket = socket_wrapper

2018

# The socketserver.TCPServer.__init__ will call

2019

# socket.socket(), which might be our replacement,

2020

# socket_wrapper(), if socketfd was set.

2021

1428

socketserver.TCPServer.__init__(self, server_address,

2022

1429

RequestHandlerClass)

2023

2024

1430

def server_bind(self):

2025

1431

"""This overrides the normal server_bind() function

2026

1432

to bind to an interface if one was specified, and also NOT to

2032

1438

self.interface)

2033

1439

else:

2034

1440

try:

2035

self.socket.setsockopt(

2036

socket.SOL_SOCKET, SO_BINDTODEVICE,

2037

(self.interface + "\0").encode("utf-8"))

2038

except socket.error as error:

2039

if error.errno == errno.EPERM:

2040

logger.error("No permission to bind to"

2041

" interface %s", self.interface)

2042

elif error.errno == errno.ENOPROTOOPT:

1441

self.socket.setsockopt(socket.SOL_SOCKET,

1442

SO_BINDTODEVICE,

1443

str(self.interface

1444

+ '\0'))

1445

except socket.error, error:

1446

if error[0] == errno.EPERM:

1447

logger.error("No permission to"

1448

" bind to interface %s",

1449

self.interface)

1450

elif error[0] == errno.ENOPROTOOPT:

2043

1451

logger.error("SO_BINDTODEVICE not available;"

2044

1452

" cannot bind to interface %s",

2045

1453

self.interface)

2046

elif error.errno == errno.ENODEV:

2047

logger.error("Interface %s does not exist,"

2048

" cannot bind", self.interface)

2049

1454

else:

2050

1455

raise

2051

1456

# Only bind(2) the socket if we really need to.

2054

1459

if self.address_family == socket.AF_INET6:

2055

1460

any_address = "::" # in6addr_any

2056

1461

else:

2057

any_address = "0.0.0.0" # INADDR_ANY

1462

any_address = socket.INADDR_ANY

2058

1463

self.server_address = (any_address,

2059

1464

self.server_address[1])

2060

1465

elif not self.server_address[1]:

2061

self.server_address = (self.server_address[0], 0)

1466

self.server_address = (self.server_address[0],

1467

0)

2062

1468

# if self.interface:

2063

1469

# self.server_address = (self.server_address[0],

2064

1470

# 0, # port

2078

1484

2079

1485

Assumes a gobject.MainLoop event loop.

2080

1486

"""

2081

2082

1487

def __init__(self, server_address, RequestHandlerClass,

2083

interface=None,

2084

use_ipv6=True,

2085

clients=None,

2086

gnutls_priority=None,

2087

use_dbus=True,

2088

socketfd=None):

1488

interface=None, use_ipv6=True, clients=None,

1489

gnutls_priority=None, use_dbus=True):

2089

1490

self.enabled = False

2090

1491

self.clients = clients

2091

1492

if self.clients is None:

2092

self.clients = {}

1493

self.clients = set()

2093

1494

self.use_dbus = use_dbus

2094

1495

self.gnutls_priority = gnutls_priority

2095

1496

IPv6_TCPServer.__init__(self, server_address,

2096

1497

RequestHandlerClass,

2097

1498

interface = interface,

2098

use_ipv6 = use_ipv6,

2099

socketfd = socketfd)

2100

1499

use_ipv6 = use_ipv6)

2101

1500

def server_activate(self):

2102

1501

if self.enabled:

2103

1502

return socketserver.TCPServer.server_activate(self)

2104

2105

1503

def enable(self):

2106

1504

self.enabled = True

2107

2108

def add_pipe(self, parent_pipe, proc):

1505

def add_pipe(self, parent_pipe):

2109

1506

# Call "handle_ipc" for both data and EOF events

2110

gobject.io_add_watch(

2111

parent_pipe.fileno(),

2112

gobject.IO_IN | gobject.IO_HUP,

2113

functools.partial(self.handle_ipc,

2114

parent_pipe = parent_pipe,

2115

proc = proc))

2116

2117

def handle_ipc(self, source, condition,

2118

parent_pipe=None,

2119

proc = None,

1507

gobject.io_add_watch(parent_pipe.fileno(),

1508

gobject.IO_IN | gobject.IO_HUP,

1509

functools.partial(self.handle_ipc,

1510

parent_pipe = parent_pipe))

1511

1512

def handle_ipc(self, source, condition, parent_pipe=None,

2120

1513

client_object=None):

2121

# error, or the other end of multiprocessing.Pipe has closed

2122

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2123

# Wait for other process to exit

2124

proc.join()

1514

condition_names = {

1515

gobject.IO_IN: "IN", # There is data to read.

1516

gobject.IO_OUT: "OUT", # Data can be written (without

1517

# blocking).

1518

gobject.IO_PRI: "PRI", # There is urgent data to read.

1519

gobject.IO_ERR: "ERR", # Error condition.

1520

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1521

# broken, usually for pipes and

1522

# sockets).

1523

}

1524

conditions_string = ' | '.join(name

1525

for cond, name in

1526

condition_names.iteritems()

1527

if cond & condition)

1528

# error or the other end of multiprocessing.Pipe has closed

1529

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2125

1530

return False

2126

1531

2127

1532

# Read a request from the child

2132

1537

fpr = request[1]

2133

1538

address = request[2]

2134

1539

2135

for c in self.clients.itervalues():

1540

for c in self.clients:

2136

1541

if c.fingerprint == fpr:

2137

1542

client = c

2138

1543

break

2139

1544

else:

2140

logger.info("Client not found for fingerprint: %s, ad"

2141

"dress: %s", fpr, address)

1545

logger.warning("Client not found for fingerprint: %s, ad"

1546

"dress: %s", fpr, address)

2142

1547

if self.use_dbus:

2143

1548

# Emit D-Bus signal

2144

mandos_dbus_service.ClientNotFound(fpr,

2145

address[0])

1549

mandos_dbus_service.ClientNotFound(fpr, address[0])

2146

1550

parent_pipe.send(False)

2147

1551

return False

2148

1552

2149

gobject.io_add_watch(

2150

parent_pipe.fileno(),

2151

gobject.IO_IN | gobject.IO_HUP,

2152

functools.partial(self.handle_ipc,

2153

parent_pipe = parent_pipe,

2154

proc = proc,

2155

client_object = client))

1553

gobject.io_add_watch(parent_pipe.fileno(),

1554

gobject.IO_IN | gobject.IO_HUP,

1555

functools.partial(self.handle_ipc,

1556

parent_pipe = parent_pipe,

1557

client_object = client))

2156

1558

parent_pipe.send(True)

2157

# remove the old hook in favor of the new above hook on

2158

# same fileno

1559

# remove the old hook in favor of the new above hook on same fileno

2159

1560

return False

2160

1561

if command == 'funcall':

2161

1562

funcname = request[1]

2162

1563

args = request[2]

2163

1564

kwargs = request[3]

2164

1565

2165

parent_pipe.send(('data', getattr(client_object,

2166

funcname)(*args,

2167

**kwargs)))

2168

1566

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1567

2169

1568

if command == 'getattr':

2170

1569

attrname = request[1]

2171

if isinstance(client_object.__getattribute__(attrname),

2172

collections.Callable):

2173

parent_pipe.send(('function', ))

1570

if callable(client_object.__getattribute__(attrname)):

1571

parent_pipe.send(('function',))

2174

1572

else:

2175

parent_pipe.send((

2176

'data', client_object.__getattribute__(attrname)))

1573

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2177

1574

2178

1575

if command == 'setattr':

2179

1576

attrname = request[1]

2180

1577

value = request[2]

2181

1578

setattr(client_object, attrname, value)

2182

1579

2183

1580

return True

2184

1581

2185

1582

2186

def rfc3339_duration_to_delta(duration):

2187

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2188

2189

>>> rfc3339_duration_to_delta("P7D")

2190

datetime.timedelta(7)

2191

>>> rfc3339_duration_to_delta("PT60S")

2192

datetime.timedelta(0, 60)

2193

>>> rfc3339_duration_to_delta("PT60M")

2194

datetime.timedelta(0, 3600)

2195

>>> rfc3339_duration_to_delta("PT24H")

2196

datetime.timedelta(1)

2197

>>> rfc3339_duration_to_delta("P1W")

2198

datetime.timedelta(7)

2199

>>> rfc3339_duration_to_delta("PT5M30S")

2200

datetime.timedelta(0, 330)

2201

>>> rfc3339_duration_to_delta("P1DT3M20S")

2202

datetime.timedelta(1, 200)

2203

"""

2204

2205

# Parsing an RFC 3339 duration with regular expressions is not

2206

# possible - there would have to be multiple places for the same

2207

# values, like seconds. The current code, while more esoteric, is

2208

# cleaner without depending on a parsing library. If Python had a

2209

# built-in library for parsing we would use it, but we'd like to

2210

# avoid excessive use of external libraries.

2211

2212

# New type for defining tokens, syntax, and semantics all-in-one

2213

Token = collections.namedtuple("Token", (

2214

"regexp", # To match token; if "value" is not None, must have

2215

# a "group" containing digits

2216

"value", # datetime.timedelta or None

2217

"followers")) # Tokens valid after this token

2218

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2219

# the "duration" ABNF definition in RFC 3339, Appendix A.

2220

token_end = Token(re.compile(r"$"), None, frozenset())

2221

token_second = Token(re.compile(r"(\d+)S"),

2222

datetime.timedelta(seconds=1),

2223

frozenset((token_end, )))

2224

token_minute = Token(re.compile(r"(\d+)M"),

2225

datetime.timedelta(minutes=1),

2226

frozenset((token_second, token_end)))

2227

token_hour = Token(re.compile(r"(\d+)H"),

2228

datetime.timedelta(hours=1),

2229

frozenset((token_minute, token_end)))

2230

token_time = Token(re.compile(r"T"),

2231

None,

2232

frozenset((token_hour, token_minute,

2233

token_second)))

2234

token_day = Token(re.compile(r"(\d+)D"),

2235

datetime.timedelta(days=1),

2236

frozenset((token_time, token_end)))

2237

token_month = Token(re.compile(r"(\d+)M"),

2238

datetime.timedelta(weeks=4),

2239

frozenset((token_day, token_end)))

2240

token_year = Token(re.compile(r"(\d+)Y"),

2241

datetime.timedelta(weeks=52),

2242

frozenset((token_month, token_end)))

2243

token_week = Token(re.compile(r"(\d+)W"),

2244

datetime.timedelta(weeks=1),

2245

frozenset((token_end, )))

2246

token_duration = Token(re.compile(r"P"), None,

2247

frozenset((token_year, token_month,

2248

token_day, token_time,

2249

token_week)))

2250

# Define starting values

2251

value = datetime.timedelta() # Value so far

2252

found_token = None

2253

followers = frozenset((token_duration, )) # Following valid tokens

2254

s = duration # String left to parse

2255

# Loop until end token is found

2256

while found_token is not token_end:

2257

# Search for any currently valid tokens

2258

for token in followers:

2259

match = token.regexp.match(s)

2260

if match is not None:

2261

# Token found

2262

if token.value is not None:

2263

# Value found, parse digits

2264

factor = int(match.group(1), 10)

2265

# Add to value so far

2266

value += factor * token.value

2267

# Strip token from string

2268

s = token.regexp.sub("", s, 1)

2269

# Go to found token

2270

found_token = token

2271

# Set valid next tokens

2272

followers = found_token.followers

2273

break

2274

else:

2275

# No currently valid tokens were found

2276

raise ValueError("Invalid RFC 3339 duration: {!r}"

2277

.format(duration))

2278

# End token found

2279

return value

2280

2281

2282

1583

def string_to_delta(interval):

2283

1584

"""Parse a string and return a datetime.timedelta

2284

1585

2295

1596

>>> string_to_delta('5m 30s')

2296

1597

datetime.timedelta(0, 330)

2297

1598

"""

2298

2299

try:

2300

return rfc3339_duration_to_delta(interval)

2301

except ValueError:

2302

pass

2303

2304

1599

timevalue = datetime.timedelta(0)

2305

1600

for s in interval.split():

2306

1601

try:

2307

suffix = s[-1]

1602

suffix = unicode(s[-1])

2308

1603

value = int(s[:-1])

2309

1604

if suffix == "d":

2310

1605

delta = datetime.timedelta(value)

2317

1612

elif suffix == "w":

2318

1613

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2319

1614

else:

2320

raise ValueError("Unknown suffix {!r}".format(suffix))

2321

except IndexError as e:

1615

raise ValueError("Unknown suffix %r" % suffix)

1616

except (ValueError, IndexError), e:

2322

1617

raise ValueError(*(e.args))

2323

1618

timevalue += delta

2324

1619

return timevalue

2325

1620

2326

1621

1622

def if_nametoindex(interface):

1623

"""Call the C function if_nametoindex(), or equivalent

1624

1625

Note: This function cannot accept a unicode string."""

1626

global if_nametoindex

1627

try:

1628

if_nametoindex = (ctypes.cdll.LoadLibrary

1629

(ctypes.util.find_library("c"))

1630

.if_nametoindex)

1631

except (OSError, AttributeError):

1632

logger.warning("Doing if_nametoindex the hard way")

1633

def if_nametoindex(interface):

1634

"Get an interface index the hard way, i.e. using fcntl()"

1635

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1636

with contextlib.closing(socket.socket()) as s:

1637

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1638

struct.pack(str("16s16x"),

1639

interface))

1640

interface_index = struct.unpack(str("I"),

1641

ifreq[16:20])[0]

1642

return interface_index

1643

return if_nametoindex(interface)

1644

1645

2327

1646

def daemon(nochdir = False, noclose = False):

2328

1647

"""See daemon(3). Standard BSD Unix function.

2329

1648

2337

1656

sys.exit()

2338

1657

if not noclose:

2339

1658

# Close all standard open file descriptors

2340

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1659

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2341

1660

if not stat.S_ISCHR(os.fstat(null).st_mode):

2342

1661

raise OSError(errno.ENODEV,

2343

"{} not a character device"

2344

.format(os.devnull))

1662

"%s not a character device"

1663

% os.path.devnull)

2345

1664

os.dup2(null, sys.stdin.fileno())

2346

1665

os.dup2(null, sys.stdout.fileno())

2347

1666

os.dup2(null, sys.stderr.fileno())

2354

1673

##################################################################

2355

1674

# Parsing of options, both command line and config file

2356

1675

2357

parser = argparse.ArgumentParser()

2358

parser.add_argument("-v", "--version", action="version",

2359

version = "%(prog)s {}".format(version),

2360

help="show version number and exit")

2361

parser.add_argument("-i", "--interface", metavar="IF",

2362

help="Bind to interface IF")

2363

parser.add_argument("-a", "--address",

2364

help="Address to listen for requests on")

2365

parser.add_argument("-p", "--port", type=int,

2366

help="Port number to receive requests on")

2367

parser.add_argument("--check", action="store_true",

2368

help="Run self-test")

2369

parser.add_argument("--debug", action="store_true",

2370

help="Debug mode; run in foreground and log"

2371

" to terminal", default=None)

2372

parser.add_argument("--debuglevel", metavar="LEVEL",

2373

help="Debug level for stdout output")

2374

parser.add_argument("--priority", help="GnuTLS"

2375

" priority string (see GnuTLS documentation)")

2376

parser.add_argument("--servicename",

2377

metavar="NAME", help="Zeroconf service name")

2378

parser.add_argument("--configdir",

2379

default="/etc/mandos", metavar="DIR",

2380

help="Directory to search for configuration"

2381

" files")

2382

parser.add_argument("--no-dbus", action="store_false",

2383

dest="use_dbus", help="Do not provide D-Bus"

2384

" system bus interface", default=None)

2385

parser.add_argument("--no-ipv6", action="store_false",

2386

dest="use_ipv6", help="Do not use IPv6",

2387

default=None)

2388

parser.add_argument("--no-restore", action="store_false",

2389

dest="restore", help="Do not restore stored"

2390

" state", default=None)

2391

parser.add_argument("--socket", type=int,

2392

help="Specify a file descriptor to a network"

2393

" socket to use instead of creating one")

2394

parser.add_argument("--statedir", metavar="DIR",

2395

help="Directory to save/restore state in")

2396

parser.add_argument("--foreground", action="store_true",

2397

help="Run in foreground", default=None)

2398

parser.add_argument("--no-zeroconf", action="store_false",

2399

dest="zeroconf", help="Do not use Zeroconf",

2400

default=None)

2401

2402

options = parser.parse_args()

1676

parser = optparse.OptionParser(version = "%%prog %s" % version)

1677

parser.add_option("-i", "--interface", type="string",

1678

metavar="IF", help="Bind to interface IF")

1679

parser.add_option("-a", "--address", type="string",

1680

help="Address to listen for requests on")

1681

parser.add_option("-p", "--port", type="int",

1682

help="Port number to receive requests on")

1683

parser.add_option("--check", action="store_true",

1684

help="Run self-test")

1685

parser.add_option("--debug", action="store_true",

1686

help="Debug mode; run in foreground and log to"

1687

" terminal")

1688

parser.add_option("--debuglevel", type="string", metavar="LEVEL",

1689

help="Debug level for stdout output")

1690

parser.add_option("--priority", type="string", help="GnuTLS"

1691

" priority string (see GnuTLS documentation)")

1692

parser.add_option("--servicename", type="string",

1693

metavar="NAME", help="Zeroconf service name")

1694

parser.add_option("--configdir", type="string",

1695

default="/etc/mandos", metavar="DIR",

1696

help="Directory to search for configuration"

1697

" files")

1698

parser.add_option("--no-dbus", action="store_false",

1699

dest="use_dbus", help="Do not provide D-Bus"

1700

" system bus interface")

1701

parser.add_option("--no-ipv6", action="store_false",

1702

dest="use_ipv6", help="Do not use IPv6")

1703

options = parser.parse_args()[0]

2403

1704

2404

1705

if options.check:

2405

1706

import doctest

2406

fail_count, test_count = doctest.testmod()

2407

sys.exit(os.EX_OK if fail_count == 0 else 1)

1707

doctest.testmod()

1708

sys.exit()

2408

1709

2409

1710

# Default values for config file for server-global settings

2410

1711

server_defaults = { "interface": "",

2412

1713

"port": "",

2413

1714

"debug": "False",

2414

1715

"priority":

2415

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2416

":+SIGN-DSA-SHA256",

1716

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2417

1717

"servicename": "Mandos",

2418

1718

"use_dbus": "True",

2419

1719

"use_ipv6": "True",

2420

1720

"debuglevel": "",

2421

"restore": "True",

2422

"socket": "",

2423

"statedir": "/var/lib/mandos",

2424

"foreground": "False",

2425

"zeroconf": "True",

2426

}

1721

}

2427

1722

2428

1723

# Parse config file for server-global settings

2429

1724

server_config = configparser.SafeConfigParser(server_defaults)

2430

1725

del server_defaults

2431

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1726

server_config.read(os.path.join(options.configdir,

1727

"mandos.conf"))

2432

1728

# Convert the SafeConfigParser object to a dict

2433

1729

server_settings = server_config.defaults()

2434

1730

# Use the appropriate methods on the non-string config options

2435

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1731

for option in ("debug", "use_dbus", "use_ipv6"):

2436

1732

server_settings[option] = server_config.getboolean("DEFAULT",

2437

1733

option)

2438

1734

if server_settings["port"]:

2439

1735

server_settings["port"] = server_config.getint("DEFAULT",

2440

1736

"port")

2441

if server_settings["socket"]:

2442

server_settings["socket"] = server_config.getint("DEFAULT",

2443

"socket")

2444

# Later, stdin will, and stdout and stderr might, be dup'ed

2445

# over with an opened os.devnull. But we don't want this to

2446

# happen with a supplied network socket.

2447

if 0 <= server_settings["socket"] <= 2:

2448

server_settings["socket"] = os.dup(server_settings

2449

["socket"])

2450

1737

del server_config

2451

1738

2452

1739

# Override the settings from the config file with command line

2453

1740

# options, if set.

2454

1741

for option in ("interface", "address", "port", "debug",

2455

"priority", "servicename", "configdir", "use_dbus",

2456

"use_ipv6", "debuglevel", "restore", "statedir",

2457

"socket", "foreground", "zeroconf"):

1742

"priority", "servicename", "configdir",

1743

"use_dbus", "use_ipv6", "debuglevel"):

2458

1744

value = getattr(options, option)

2459

1745

if value is not None:

2460

1746

server_settings[option] = value

2461

1747

del options

2462

1748

# Force all strings to be unicode

2463

1749

for option in server_settings.keys():

2464

if isinstance(server_settings[option], bytes):

2465

server_settings[option] = (server_settings[option]

2466

.decode("utf-8"))

2467

# Force all boolean options to be boolean

2468

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2469

"foreground", "zeroconf"):

2470

server_settings[option] = bool(server_settings[option])

2471

# Debug implies foreground

2472

if server_settings["debug"]:

2473

server_settings["foreground"] = True

1750

if type(server_settings[option]) is str:

1751

server_settings[option] = unicode(server_settings[option])

2474

1752

# Now we have our good server settings in "server_settings"

2475

1753

2476

1754

##################################################################

2477

1755

2478

if (not server_settings["zeroconf"]

2479

and not (server_settings["port"]

2480

or server_settings["socket"] != "")):

2481

parser.error("Needs port or socket to work without Zeroconf")

2482

2483

1756

# For convenience

2484

1757

debug = server_settings["debug"]

2485

1758

debuglevel = server_settings["debuglevel"]

2486

1759

use_dbus = server_settings["use_dbus"]

2487

1760

use_ipv6 = server_settings["use_ipv6"]

2488

stored_state_path = os.path.join(server_settings["statedir"],

2489

stored_state_file)

2490

foreground = server_settings["foreground"]

2491

zeroconf = server_settings["zeroconf"]

2492

2493

if debug:

2494

initlogger(debug, logging.DEBUG)

2495

else:

2496

if not debuglevel:

2497

initlogger(debug)

2498

else:

2499

level = getattr(logging, debuglevel.upper())

2500

initlogger(debug, level)

2501

1761

2502

1762

if server_settings["servicename"] != "Mandos":

2503

syslogger.setFormatter(

2504

logging.Formatter('Mandos ({}) [%(process)d]:'

2505

' %(levelname)s: %(message)s'.format(

2506

server_settings["servicename"])))

1763

syslogger.setFormatter(logging.Formatter

1764

('Mandos (%s) [%%(process)d]:'

1765

' %%(levelname)s: %%(message)s'

1766

% server_settings["servicename"]))

2507

1767

2508

1768

# Parse config file with clients

2509

client_config = configparser.SafeConfigParser(Client

2510

.client_defaults)

1769

client_defaults = { "timeout": "1h",

1770

"interval": "5m",

1771

"checker": "fping -q -- %%(host)s",

1772

"host": "",

1773

"approval_delay": "0s",

1774

"approval_duration": "1s",

1775

}

1776

client_config = configparser.SafeConfigParser(client_defaults)

2511

1777

client_config.read(os.path.join(server_settings["configdir"],

2512

1778

"clients.conf"))

2513

1779

2514

1780

global mandos_dbus_service

2515

1781

mandos_dbus_service = None

2516

1782

2517

socketfd = None

2518

if server_settings["socket"] != "":

2519

socketfd = server_settings["socket"]

2520

tcp_server = MandosServer(

2521

(server_settings["address"], server_settings["port"]),

2522

ClientHandler,

2523

interface=(server_settings["interface"] or None),

2524

use_ipv6=use_ipv6,

2525

gnutls_priority=server_settings["priority"],

2526

use_dbus=use_dbus,

2527

socketfd=socketfd)

2528

if not foreground:

2529

pidfilename = "/run/mandos.pid"

2530

if not os.path.isdir("/run/."):

2531

pidfilename = "/var/run/mandos.pid"

2532

pidfile = None

1783

tcp_server = MandosServer((server_settings["address"],

1784

server_settings["port"]),

1785

ClientHandler,

1786

interface=(server_settings["interface"]

1787

or None),

1788

use_ipv6=use_ipv6,

1789

gnutls_priority=

1790

server_settings["priority"],

1791

use_dbus=use_dbus)

1792

if not debug:

1793

pidfilename = "/var/run/mandos.pid"

2533

1794

try:

2534

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2535

except IOError as e:

2536

logger.error("Could not open file %r", pidfilename,

2537

exc_info=e)

1795

pidfile = open(pidfilename, "w")

1796

except IOError:

1797

logger.error("Could not open file %r", pidfilename)

2538

1798

2539

for name in ("_mandos", "mandos", "nobody"):

1799

try:

1800

uid = pwd.getpwnam("_mandos").pw_uid

1801

gid = pwd.getpwnam("_mandos").pw_gid

1802

except KeyError:

2540

1803

try:

2541

uid = pwd.getpwnam(name).pw_uid

2542

gid = pwd.getpwnam(name).pw_gid

2543

break

1804

uid = pwd.getpwnam("mandos").pw_uid

1805

gid = pwd.getpwnam("mandos").pw_gid

2544

1806

except KeyError:

2545

continue

2546

else:

2547

uid = 65534

2548

gid = 65534

1807

try:

1808

uid = pwd.getpwnam("nobody").pw_uid

1809

gid = pwd.getpwnam("nobody").pw_gid

1810

except KeyError:

1811

uid = 65534

1812

gid = 65534

2549

1813

try:

2550

1814

os.setgid(gid)

2551

1815

os.setuid(uid)

2552

except OSError as error:

2553

if error.errno != errno.EPERM:

2554

raise

1816

except OSError, error:

1817

if error[0] != errno.EPERM:

1818

raise error

2555

1819

1820

if not debug and not debuglevel:

1821

syslogger.setLevel(logging.WARNING)

1822

console.setLevel(logging.WARNING)

1823

if debuglevel:

1824

level = getattr(logging, debuglevel.upper())

1825

syslogger.setLevel(level)

1826

console.setLevel(level)

1827

2556

1828

if debug:

2557

1829

# Enable all possible GnuTLS debugging

2558

1830

2564

1836

def debug_gnutls(level, string):

2565

1837

logger.debug("GnuTLS: %s", string[:-1])

2566

1838

2567

gnutls.library.functions.gnutls_global_set_log_function(

2568

debug_gnutls)

1839

(gnutls.library.functions

1840

.gnutls_global_set_log_function(debug_gnutls))

2569

1841

2570

1842

# Redirect stdin so all checkers get /dev/null

2571

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1843

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2572

1844

os.dup2(null, sys.stdin.fileno())

2573

1845

if null > 2:

2574

1846

os.close(null)

1847

else:

1848

# No console logging

1849

logger.removeHandler(console)

2575

1850

2576

1851

# Need to fork before connecting to D-Bus

2577

if not foreground:

1852

if not debug:

2578

1853

# Close all input and output, do double fork, etc.

2579

1854

daemon()

2580

1855

2581

# multiprocessing will use threads, so before we use gobject we

2582

# need to inform gobject that threads will be used.

2583

gobject.threads_init()

2584

2585

1856

global main_loop

2586

1857

# From the Avahi example code

2587

DBusGMainLoop(set_as_default=True)

1858

DBusGMainLoop(set_as_default=True )

2588

1859

main_loop = gobject.MainLoop()

2589

1860

bus = dbus.SystemBus()

2590

1861

# End of Avahi example code

2591

1862

if use_dbus:

2592

1863

try:

2593

bus_name = dbus.service.BusName("se.recompile.Mandos",

2594

bus,

2595

do_not_queue=True)

2596

old_bus_name = dbus.service.BusName(

2597

"se.bsnet.fukt.Mandos", bus,

2598

do_not_queue=True)

2599

except dbus.exceptions.DBusException as e:

2600

logger.error("Disabling D-Bus:", exc_info=e)

1864

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1865

bus, do_not_queue=True)

1866

except dbus.exceptions.NameExistsException, e:

1867

logger.error(unicode(e) + ", disabling D-Bus")

2601

1868

use_dbus = False

2602

1869

server_settings["use_dbus"] = False

2603

1870

tcp_server.use_dbus = False

2604

if zeroconf:

2605

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2606

service = AvahiServiceToSyslog(

2607

name = server_settings["servicename"],

2608

servicetype = "_mandos._tcp",

2609

protocol = protocol,

2610

bus = bus)

2611

if server_settings["interface"]:

2612

service.interface = if_nametoindex(

2613

server_settings["interface"].encode("utf-8"))

1871

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1872

service = AvahiService(name = server_settings["servicename"],

1873

servicetype = "_mandos._tcp",

1874

protocol = protocol, bus = bus)

1875

if server_settings["interface"]:

1876

service.interface = (if_nametoindex

1877

(str(server_settings["interface"])))

2614

1878

2615

1879

global multiprocessing_manager

2616

1880

multiprocessing_manager = multiprocessing.Manager()

2618

1882

client_class = Client

2619

1883

if use_dbus:

2620

1884

client_class = functools.partial(ClientDBus, bus = bus)

2621

2622

client_settings = Client.config_parser(client_config)

2623

old_client_settings = {}

2624

clients_data = {}

2625

2626

# This is used to redirect stdout and stderr for checker processes

2627

global wnull

2628

wnull = open(os.devnull, "w") # A writable /dev/null

2629

# Only used if server is running in foreground but not in debug

2630

# mode

2631

if debug or not foreground:

2632

wnull.close()

2633

2634

# Get client data and settings from last running state.

2635

if server_settings["restore"]:

2636

try:

2637

with open(stored_state_path, "rb") as stored_state:

2638

clients_data, old_client_settings = pickle.load(

2639

stored_state)

2640

os.remove(stored_state_path)

2641

except IOError as e:

2642

if e.errno == errno.ENOENT:

2643

logger.warning("Could not load persistent state:"

2644

" {}".format(os.strerror(e.errno)))

2645

else:

2646

logger.critical("Could not load persistent state:",

2647

exc_info=e)

2648

raise

2649

except EOFError as e:

2650

logger.warning("Could not load persistent state: "

2651

"EOFError:",

2652

exc_info=e)

2653

2654

with PGPEngine() as pgp:

2655

for client_name, client in clients_data.items():

2656

# Skip removed clients

2657

if client_name not in client_settings:

2658

continue

2659

2660

# Decide which value to use after restoring saved state.

2661

# We have three different values: Old config file,

2662

# new config file, and saved state.

2663

# New config value takes precedence if it differs from old

2664

# config value, otherwise use saved state.

2665

for name, value in client_settings[client_name].items():

2666

try:

2667

# For each value in new config, check if it

2668

# differs from the old config value (Except for

2669

# the "secret" attribute)

2670

if (name != "secret"

2671

and (value !=

2672

old_client_settings[client_name][name])):

2673

client[name] = value

2674

except KeyError:

2675

pass

2676

2677

# Clients who has passed its expire date can still be

2678

# enabled if its last checker was successful. A Client

2679

# whose checker succeeded before we stored its state is

2680

# assumed to have successfully run all checkers during

2681

# downtime.

2682

if client["enabled"]:

2683

if datetime.datetime.utcnow() >= client["expires"]:

2684

if not client["last_checked_ok"]:

2685

logger.warning(

2686

"disabling client {} - Client never "

2687

"performed a successful checker".format(

2688

client_name))

2689

client["enabled"] = False

2690

elif client["last_checker_status"] != 0:

2691

logger.warning(

2692

"disabling client {} - Client last"

2693

" checker failed with error code"

2694

" {}".format(

2695

client_name,

2696

client["last_checker_status"]))

2697

client["enabled"] = False

2698

else:

2699

client["expires"] = (

2700

datetime.datetime.utcnow()

2701

+ client["timeout"])

2702

logger.debug("Last checker succeeded,"

2703

" keeping {} enabled".format(

2704

client_name))

1885

def client_config_items(config, section):

1886

special_settings = {

1887

"approved_by_default":

1888

lambda: config.getboolean(section,

1889

"approved_by_default"),

1890

}

1891

for name, value in config.items(section):

2705

1892

try:

2706

client["secret"] = pgp.decrypt(

2707

client["encrypted_secret"],

2708

client_settings[client_name]["secret"])

2709

except PGPError:

2710

# If decryption fails, we use secret from new settings

2711

logger.debug("Failed to decrypt {} old secret".format(

2712

client_name))

2713

client["secret"] = (client_settings[client_name]

2714

["secret"])

2715

2716

# Add/remove clients based on new changes made to config

2717

for client_name in (set(old_client_settings)

2718

- set(client_settings)):

2719

del clients_data[client_name]

2720

for client_name in (set(client_settings)

2721

- set(old_client_settings)):

2722

clients_data[client_name] = client_settings[client_name]

2723

2724

# Create all client objects

2725

for client_name, client in clients_data.items():

2726

tcp_server.clients[client_name] = client_class(

2727

name = client_name,

2728

settings = client,

2729

server_settings = server_settings)

2730

1893

yield (name, special_settings[name]())

1894

except KeyError:

1895

yield (name, value)

1896

1897

tcp_server.clients.update(set(

1898

client_class(name = section,

1899

config= dict(client_config_items(

1900

client_config, section)))

1901

for section in client_config.sections()))

2731

1902

if not tcp_server.clients:

2732

1903

logger.warning("No clients defined")

2733

2734

if not foreground:

2735

if pidfile is not None:

2736

pid = os.getpid()

2737

try:

2738

with pidfile:

2739

print(pid, file=pidfile)

2740

except IOError:

2741

logger.error("Could not write to file %r with PID %d",

2742

pidfilename, pid)

2743

del pidfile

1904

1905

if not debug:

1906

try:

1907

with pidfile:

1908

pid = os.getpid()

1909

pidfile.write(str(pid) + "\n".encode("utf-8"))

1910

del pidfile

1911

except IOError:

1912

logger.error("Could not write to file %r with PID %d",

1913

pidfilename, pid)

1914

except NameError:

1915

# "pidfile" was never created

1916

pass

2744

1917

del pidfilename

2745

1918

1919

signal.signal(signal.SIGINT, signal.SIG_IGN)

1920

2746

1921

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2747

1922

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2748

1923

2749

1924

if use_dbus:

2750

2751

@alternate_dbus_interfaces(

2752

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2753

class MandosDBusService(DBusObjectWithProperties):

1925

class MandosDBusService(dbus.service.Object):

2754

1926

"""A D-Bus proxy object"""

2755

2756

1927

def __init__(self):

2757

1928

dbus.service.Object.__init__(self, bus, "/")

2758

2759

_interface = "se.recompile.Mandos"

2760

2761

@dbus_interface_annotations(_interface)

2762

def _foo(self):

2763

return {

2764

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2765

"false" }

1929

_interface = "se.bsnet.fukt.Mandos"

2766

1930

2767

1931

@dbus.service.signal(_interface, signature="o")

2768

1932

def ClientAdded(self, objpath):

2782

1946

@dbus.service.method(_interface, out_signature="ao")

2783

1947

def GetAllClients(self):

2784

1948

"D-Bus method"

2785

return dbus.Array(c.dbus_object_path for c in

2786

tcp_server.clients.itervalues())

1949

return dbus.Array(c.dbus_object_path

1950

for c in tcp_server.clients)

2787

1951

2788

1952

@dbus.service.method(_interface,

2789

1953

out_signature="a{oa{sv}}")

2790

1954

def GetAllClientsWithProperties(self):

2791

1955

"D-Bus method"

2792

1956

return dbus.Dictionary(

2793

{ c.dbus_object_path: c.GetAll("")

2794

for c in tcp_server.clients.itervalues() },

1957

((c.dbus_object_path, c.GetAll(""))

1958

for c in tcp_server.clients),

2795

1959

signature="oa{sv}")

2796

1960

2797

1961

@dbus.service.method(_interface, in_signature="o")

2798

1962

def RemoveClient(self, object_path):

2799

1963

"D-Bus method"

2800

for c in tcp_server.clients.itervalues():

1964

for c in tcp_server.clients:

2801

1965

if c.dbus_object_path == object_path:

2802

del tcp_server.clients[c.name]

1966

tcp_server.clients.remove(c)

2803

1967

c.remove_from_connection()

2804

1968

# Don't signal anything except ClientRemoved

2805

1969

c.disable(quiet=True)

2814

1978

2815

1979

def cleanup():

2816

1980

"Cleanup function; run on exit"

2817

if zeroconf:

2818

service.cleanup()

2819

2820

multiprocessing.active_children()

2821

wnull.close()

2822

if not (tcp_server.clients or client_settings):

2823

return

2824

2825

# Store client before exiting. Secrets are encrypted with key

2826

# based on what config file has. If config file is

2827

# removed/edited, old secret will thus be unrecovable.

2828

clients = {}

2829

with PGPEngine() as pgp:

2830

for client in tcp_server.clients.itervalues():

2831

key = client_settings[client.name]["secret"]

2832

client.encrypted_secret = pgp.encrypt(client.secret,

2833

key)

2834

client_dict = {}

2835

2836

# A list of attributes that can not be pickled

2837

# + secret.

2838

exclude = { "bus", "changedstate", "secret",

2839

"checker", "server_settings" }

2840

for name, typ in inspect.getmembers(dbus.service

2841

.Object):

2842

exclude.add(name)

2843

2844

client_dict["encrypted_secret"] = (client

2845

.encrypted_secret)

2846

for attr in client.client_structure:

2847

if attr not in exclude:

2848

client_dict[attr] = getattr(client, attr)

2849

2850

clients[client.name] = client_dict

2851

del client_settings[client.name]["secret"]

2852

2853

try:

2854

with tempfile.NamedTemporaryFile(

2855

mode='wb',

2856

suffix=".pickle",

2857

prefix='clients-',

2858

dir=os.path.dirname(stored_state_path),

2859

delete=False) as stored_state:

2860

pickle.dump((clients, client_settings), stored_state)

2861

tempname = stored_state.name

2862

os.rename(tempname, stored_state_path)

2863

except (IOError, OSError) as e:

2864

if not debug:

2865

try:

2866

os.remove(tempname)

2867

except NameError:

2868

pass

2869

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2870

logger.warning("Could not save persistent state: {}"

2871

.format(os.strerror(e.errno)))

2872

else:

2873

logger.warning("Could not save persistent state:",

2874

exc_info=e)

2875

raise

2876

2877

# Delete all clients, and settings from config

1981

service.cleanup()

1982

2878

1983

while tcp_server.clients:

2879

name, client = tcp_server.clients.popitem()

1984

client = tcp_server.clients.pop()

2880

1985

if use_dbus:

2881

1986

client.remove_from_connection()

1987

client.disable_hook = None

2882

1988

# Don't signal anything except ClientRemoved

2883

1989

client.disable(quiet=True)

2884

1990

if use_dbus:

2885

1991

# Emit D-Bus signal

2886

mandos_dbus_service.ClientRemoved(

2887

client.dbus_object_path, client.name)

2888

client_settings.clear()

1992

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1993

client.name)

2889

1994

2890

1995

atexit.register(cleanup)

2891

1996

2892

for client in tcp_server.clients.itervalues():

1997

for client in tcp_server.clients:

2893

1998

if use_dbus:

2894

1999

# Emit D-Bus signal

2895

2000

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2896

# Need to initiate checking of clients

2897

if client.enabled:

2898

client.init_checker()

2001

client.enable()

2899

2002

2900

2003

tcp_server.enable()

2901

2004

tcp_server.server_activate()

2902

2005

2903

2006

# Find out what port we got

2904

if zeroconf:

2905

service.port = tcp_server.socket.getsockname()[1]

2007

service.port = tcp_server.socket.getsockname()[1]

2906

2008

if use_ipv6:

2907

2009

logger.info("Now listening on address %r, port %d,"

2908

" flowinfo %d, scope_id %d",

2909

*tcp_server.socket.getsockname())

2010

" flowinfo %d, scope_id %d"

2011

% tcp_server.socket.getsockname())

2910

2012

else: # IPv4

2911

logger.info("Now listening on address %r, port %d",

2912

*tcp_server.socket.getsockname())

2013

logger.info("Now listening on address %r, port %d"

2014

% tcp_server.socket.getsockname())

2913

2015

2914

2016

#service.interface = tcp_server.socket.getsockname()[3]

2915

2017

2916

2018

try:

2917

if zeroconf:

2918

# From the Avahi example code

2919

try:

2920

service.activate()

2921

except dbus.exceptions.DBusException as error:

2922

logger.critical("D-Bus Exception", exc_info=error)

2923

cleanup()

2924

sys.exit(1)

2925

# End of Avahi example code

2019

# From the Avahi example code

2020

try:

2021

service.activate()

2022

except dbus.exceptions.DBusException, error:

2023

logger.critical("DBusException: %s", error)

2024

cleanup()

2025

sys.exit(1)

2026

# End of Avahi example code

2926

2027

2927

2028

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2928

2029

lambda *args, **kwargs:

2931

2032

2932

2033

logger.debug("Starting main loop")

2933

2034

main_loop.run()

2934

except AvahiError as error:

2935

logger.critical("Avahi Error", exc_info=error)

2035

except AvahiError, error:

2036

logger.critical("AvahiError: %s", error)

2936

2037

cleanup()

2937

2038

sys.exit(1)

2938

2039

except KeyboardInterrupt:

2943

2044

# Must run before the D-Bus bus name gets deregistered

2944

2045

cleanup()

2945

2046

2946

2947

2047

if __name__ == '__main__':

2948

2048

main()