To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 482
- compare with another revision
- download diff
- download tarball
- view history from revision 482
- Committer: Teddy Hogeborn
- Date: 2011-04-02 06:37:18 UTC
- Revision ID: teddy@fukt.bsnet.se-20110402063718-13ldrcuu0t33sdc4
* mandos: Tolerate restarting Avahi servers. Also Changed to new
"except x as y" exception syntax.
(AvahiService.entry_group_state_changed_match): New; contains the
SignalMatch object.
(AvahiService.remove): Really remove the group and the signal
connection, if any.
(AvahiService.add): Always create a new group and signal connection.
(AvahiService.cleanup): Changed to simply call remove().
(AvahiService.server_state_changed): Handle and log more bad states.
(AvahiService.activate): Set "follow_name_owner_changes=True" on the
Avahi Server proxy object.
(ClientDBus.checked_ok): Do not return anything.
(ClientDBus.CheckedOK): Do not return anything, as documented.
* mandos-monitor: Call D-Bus methods asynchronously.
"except x as y" exception syntax.
(AvahiService.entry_group_state_changed_match): New; contains the
SignalMatch object.
(AvahiService.remove): Really remove the group and the signal
connection, if any.
(AvahiService.add): Always create a new group and signal connection.
(AvahiService.cleanup): Changed to simply call remove().
(AvahiService.server_state_changed): Handle and log more bad states.
(AvahiService.activate): Set "follow_name_owner_changes=True" on the
Avahi Server proxy object.
(ClientDBus.checked_ok): Do not return anything.
(ClientDBus.CheckedOK): Do not return anything, as documented.
* mandos-monitor: Call D-Bus methods asynchronously.
- files removed:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
50
45
import gnutls.library.functions
51
46
import gnutls.library.constants
52
47
import gnutls.library.types
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
48
import ConfigParser as configparser
57
49
import sys
58
50
import re
59
51
import os
68
60
import struct
69
61
import fcntl
70
62
import functools
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
63
import cPickle as pickle
75
64
import multiprocessing
76
import types
77
import binascii
78
import tempfile
79
import itertools
80
import collections
81
import codecs
82
65
83
66
import dbus
84
67
import dbus.service
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
68
import gobject
89
69
import avahi
90
70
from dbus.mainloop.glib import DBusGMainLoop
91
71
import ctypes
101
81
except ImportError:
102
82
SO_BINDTODEVICE = None
103
83
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
108
stored_state_file = "clients.pickle"
109
110
logger = logging.getLogger()
111
syslogger = None
112
113
try:
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
116
except (OSError, AttributeError):
117
118
def if_nametoindex(interface):
119
"Get an interface index the hard way, i.e. using fcntl()"
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
with contextlib.closing(socket.socket()) as s:
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
125
return interface_index
126
127
128
def initlogger(debug, level=logging.WARNING):
129
"""init logger and add loglevel"""
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
syslogger.setFormatter(logging.Formatter
136
('Mandos [%(process)d]: %(levelname)s:'
137
' %(message)s'))
138
logger.addHandler(syslogger)
139
140
if debug:
141
console = logging.StreamHandler()
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
143
' [%(process)d]:'
144
' %(levelname)s:'
145
' %(message)s'))
146
logger.addHandler(console)
147
logger.setLevel(level)
148
149
150
class PGPError(Exception):
151
"""Exception if encryption/decryption fails"""
152
pass
153
154
155
class PGPEngine(object):
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
158
def __init__(self):
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
165
166
def __enter__(self):
167
return self
168
169
def __exit__(self, exc_type, exc_value, traceback):
170
self._cleanup()
171
return False
172
173
def __del__(self):
174
self._cleanup()
175
176
def _cleanup(self):
177
if self.tempdir is not None:
178
# Delete contents of tempdir
179
for root, dirs, files in os.walk(self.tempdir,
180
topdown = False):
181
for filename in files:
182
os.remove(os.path.join(root, filename))
183
for dirname in dirs:
184
os.rmdir(os.path.join(root, dirname))
185
# Remove tempdir
186
os.rmdir(self.tempdir)
187
self.tempdir = None
188
189
def password_encode(self, password):
190
# Passphrase can not be empty and can not contain newlines or
191
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
199
200
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
216
return ciphertext
217
218
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
234
return decrypted_plaintext
235
84
85
version = "1.3.0"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
236
102
237
103
class AvahiError(Exception):
238
104
def __init__(self, value, *args, **kwargs):
239
105
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
243
109
244
110
class AvahiServiceError(AvahiError):
245
111
pass
246
112
247
248
113
class AvahiGroupError(AvahiError):
249
114
pass
250
115
257
122
Used to optionally bind to the specified interface.
258
123
name: string; Example: 'Mandos'
259
124
type: string; Example: '_mandos._tcp'.
260
See <https://www.iana.org/assignments/service-names-port-numbers>
125
See <http://www.dns-sd.org/ServiceTypes.html>
261
126
port: integer; what port to announce
262
127
TXT: list of strings; TXT record for the service
263
128
domain: string; Domain to publish on, default to .local if empty.
269
134
server: D-Bus Server
270
135
bus: dbus.SystemBus()
271
136
"""
272
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
284
141
self.interface = interface
285
142
self.name = name
286
143
self.type = servicetype
295
152
self.server = None
296
153
self.bus = bus
297
154
self.entry_group_state_changed_match = None
298
299
def rename(self, remove=True):
155
def rename(self):
300
156
"""Derived from the Avahi example code"""
301
157
if self.rename_count >= self.max_renames:
302
158
logger.critical("No suitable Zeroconf service name found"
303
159
" after %i retries, exiting.",
304
160
self.rename_count)
305
161
raise AvahiServiceError("Too many renames")
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
309
163
logger.info("Changing Zeroconf service name to %r ...",
310
164
self.name)
311
if remove:
312
self.remove()
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
169
self.remove()
313
170
try:
314
171
self.add()
315
172
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
324
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
176
self.rename_count += 1
325
177
def remove(self):
326
178
"""Derived from the Avahi example code"""
179
if self.group is not None:
180
try:
181
self.group.Free()
182
except (dbus.exceptions.UnknownMethodException,
183
dbus.exceptions.DBusException) as e:
184
pass
185
self.group = None
327
186
if self.entry_group_state_changed_match is not None:
328
187
self.entry_group_state_changed_match.remove()
329
188
self.entry_group_state_changed_match = None
330
if self.group is not None:
331
self.group.Reset()
332
333
189
def add(self):
334
190
"""Derived from the Avahi example code"""
335
191
self.remove()
336
if self.group is None:
337
self.group = dbus.Interface(
338
self.bus.get_object(avahi.DBUS_NAME,
339
self.server.EntryGroupNew()),
340
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.group = dbus.Interface(
193
self.bus.get_object(avahi.DBUS_NAME,
194
self.server.EntryGroupNew(),
195
follow_name_owner_changes=True),
196
avahi.DBUS_INTERFACE_ENTRY_GROUP)
341
197
self.entry_group_state_changed_match = (
342
198
self.group.connect_to_signal(
343
'StateChanged', self.entry_group_state_changed))
199
'StateChanged', self .entry_group_state_changed))
344
200
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
345
201
self.name, self.type)
346
202
self.group.AddService(
352
208
dbus.UInt16(self.port),
353
209
avahi.string_array_to_txt_array(self.TXT))
354
210
self.group.Commit()
355
356
211
def entry_group_state_changed(self, state, error):
357
212
"""Derived from the Avahi example code"""
358
213
logger.debug("Avahi entry group state change: %i", state)
364
219
self.rename()
365
220
elif state == avahi.ENTRY_GROUP_FAILURE:
366
221
logger.critical("Avahi: Error in group state changed %s",
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
369
222
unicode(error))
223
raise AvahiGroupError("State changed: %s"
224
% unicode(error))
370
225
def cleanup(self):
371
226
"""Derived from the Avahi example code"""
372
if self.group is not None:
373
try:
374
self.group.Free()
375
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
377
pass
378
self.group = None
379
227
self.remove()
380
381
228
def server_state_changed(self, state, error=None):
382
229
"""Derived from the Avahi example code"""
383
230
logger.debug("Avahi server state change: %i", state)
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
231
bad_states = { avahi.SERVER_INVALID:
232
"Zeroconf server invalid",
233
avahi.SERVER_REGISTERING: None,
234
avahi.SERVER_COLLISION:
235
"Zeroconf server name collision",
236
avahi.SERVER_FAILURE:
237
"Zeroconf server failure" }
390
238
if state in bad_states:
391
if bad_states[state] is not None:
392
if error is None:
393
logger.error(bad_states[state])
394
else:
395
logger.error(bad_states[state] + ": %r", error)
396
self.cleanup()
239
if bad_states[state]:
240
logger.error(bad_states[state])
241
self.remove()
397
242
elif state == avahi.SERVER_RUNNING:
398
243
self.add()
399
244
else:
400
if error is None:
401
logger.debug("Unknown state: %r", state)
402
else:
403
logger.debug("Unknown state: %r: %r", state, error)
404
245
logger.debug("Unknown state: %r", state)
405
246
def activate(self):
406
247
"""Derived from the Avahi example code"""
407
248
if self.server is None:
411
252
follow_name_owner_changes=True),
412
253
avahi.DBUS_INTERFACE_SERVER)
413
254
self.server.connect_to_signal("StateChanged",
414
self.server_state_changed)
255
self.server_state_changed)
415
256
self.server_state_changed(self.server.GetState())
416
257
417
258
418
class AvahiServiceToSyslog(AvahiService):
419
def rename(self, *args, **kwargs):
420
"""Add the new name to the syslog messages"""
421
ret = AvahiService.rename(self, *args, **kwargs)
422
syslogger.setFormatter(logging.Formatter(
423
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
.format(self.name)))
425
return ret
426
427
def call_pipe(connection, # : multiprocessing.Connection
428
func, *args, **kwargs):
429
"""This function is meant to be called by multiprocessing.Process
430
431
This function runs func(*args, **kwargs), and writes the resulting
432
return value on the provided multiprocessing.Connection.
433
"""
434
connection.send(func(*args, **kwargs))
435
connection.close()
436
437
259
class Client(object):
438
260
"""A representation of a client host served by this server.
439
261
440
262
Attributes:
441
approved: bool(); 'None' if not yet approved/disapproved
263
_approved: bool(); 'None' if not yet approved/disapproved
442
264
approval_delay: datetime.timedelta(); Time to wait for approval
443
265
approval_duration: datetime.timedelta(); Duration of one approval
444
266
checker: subprocess.Popen(); a running checker process used
451
273
instance %(name)s can be used in the command.
452
274
checker_initiator_tag: a gobject event source tag, or None
453
275
created: datetime.datetime(); (UTC) object creation
454
client_structure: Object describing what attributes a client has
455
and is used for storing the client at exit
456
276
current_checker_command: string; current running checker_command
277
disable_hook: If set, called by disable() as disable_hook(self)
457
278
disable_initiator_tag: a gobject event source tag, or None
458
279
enabled: bool()
459
280
fingerprint: string (40 or 32 hexadecimal digits); used to
462
283
interval: datetime.timedelta(); How often to start a new checker
463
284
last_approval_request: datetime.datetime(); (UTC) or None
464
285
last_checked_ok: datetime.datetime(); (UTC) or None
465
last_checker_status: integer between 0 and 255 reflecting exit
466
status of last checker. -1 reflects crashed
467
checker, -2 means no checker completed yet.
468
last_checker_signal: The signal which killed the last checker, if
469
last_checker_status is -1
470
last_enabled: datetime.datetime(); (UTC) or None
286
last_enabled: datetime.datetime(); (UTC)
471
287
name: string; from the config file, used in log messages and
472
288
D-Bus identifiers
473
289
secret: bytestring; sent verbatim (over TLS) to client
474
290
timeout: datetime.timedelta(); How long from last_checked_ok
475
291
until this client is disabled
476
extended_timeout: extra long timeout when secret has been sent
477
292
runtime_expansions: Allowed attributes for runtime expansion.
478
expires: datetime.datetime(); time (UTC) when a client will be
479
disabled, or None
480
server_settings: The server_settings dict from main()
481
293
"""
482
294
483
295
runtime_expansions = ("approval_delay", "approval_duration",
484
"created", "enabled", "expires",
485
"fingerprint", "host", "interval",
486
"last_approval_request", "last_checked_ok",
296
"created", "enabled", "fingerprint",
297
"host", "interval", "last_checked_ok",
487
298
"last_enabled", "name", "timeout")
488
client_defaults = {
489
"timeout": "PT5M",
490
"extended_timeout": "PT15M",
491
"interval": "PT2M",
492
"checker": "fping -q -- %%(host)s",
493
"host": "",
494
"approval_delay": "PT0S",
495
"approval_duration": "PT1S",
496
"approved_by_default": "True",
497
"enabled": "True",
498
}
499
299
500
300
@staticmethod
501
def config_parser(config):
502
"""Construct a new dict of client settings of this form:
503
{ client_name: {setting_name: value, ...}, ...}
504
with exceptions for any special settings as defined above.
505
NOTE: Must be a pure function. Must return the same result
506
value given the same arguments.
507
"""
508
settings = {}
509
for client_name in config.sections():
510
section = dict(config.items(client_name))
511
client = settings[client_name] = {}
512
513
client["host"] = section["host"]
514
# Reformat values from string types to Python types
515
client["approved_by_default"] = config.getboolean(
516
client_name, "approved_by_default")
517
client["enabled"] = config.getboolean(client_name,
518
"enabled")
519
520
# Uppercase and remove spaces from fingerprint for later
521
# comparison purposes with return value from the
522
# fingerprint() function
523
client["fingerprint"] = (section["fingerprint"].upper()
524
.replace(" ", ""))
525
if "secret" in section:
526
client["secret"] = section["secret"].decode("base64")
527
elif "secfile" in section:
528
with open(os.path.expanduser(os.path.expandvars
529
(section["secfile"])),
530
"rb") as secfile:
531
client["secret"] = secfile.read()
532
else:
533
raise TypeError("No secret or secfile for section {}"
534
.format(section))
535
client["timeout"] = string_to_delta(section["timeout"])
536
client["extended_timeout"] = string_to_delta(
537
section["extended_timeout"])
538
client["interval"] = string_to_delta(section["interval"])
539
client["approval_delay"] = string_to_delta(
540
section["approval_delay"])
541
client["approval_duration"] = string_to_delta(
542
section["approval_duration"])
543
client["checker_command"] = section["checker"]
544
client["last_approval_request"] = None
545
client["last_checked_ok"] = None
546
client["last_checker_status"] = -2
547
548
return settings
549
550
def __init__(self, settings, name = None, server_settings=None):
301
def _timedelta_to_milliseconds(td):
302
"Convert a datetime.timedelta() to milliseconds"
303
return ((td.days * 24 * 60 * 60 * 1000)
304
+ (td.seconds * 1000)
305
+ (td.microseconds // 1000))
306
307
def timeout_milliseconds(self):
308
"Return the 'timeout' attribute in milliseconds"
309
return self._timedelta_to_milliseconds(self.timeout)
310
311
def interval_milliseconds(self):
312
"Return the 'interval' attribute in milliseconds"
313
return self._timedelta_to_milliseconds(self.interval)
314
315
def approval_delay_milliseconds(self):
316
return self._timedelta_to_milliseconds(self.approval_delay)
317
318
def __init__(self, name = None, disable_hook=None, config=None):
319
"""Note: the 'checker' key in 'config' sets the
320
'checker_command' attribute and *not* the 'checker'
321
attribute."""
551
322
self.name = name
552
if server_settings is None:
553
server_settings = {}
554
self.server_settings = server_settings
555
# adding all client settings
556
for setting, value in settings.items():
557
setattr(self, setting, value)
558
559
if self.enabled:
560
if not hasattr(self, "last_enabled"):
561
self.last_enabled = datetime.datetime.utcnow()
562
if not hasattr(self, "expires"):
563
self.expires = (datetime.datetime.utcnow()
564
+ self.timeout)
565
else:
566
self.last_enabled = None
567
self.expires = None
568
323
if config is None:
324
config = {}
569
325
logger.debug("Creating client %r", self.name)
326
# Uppercase and remove spaces from fingerprint for later
327
# comparison purposes with return value from the fingerprint()
328
# function
329
self.fingerprint = (config["fingerprint"].upper()
330
.replace(" ", ""))
570
331
logger.debug(" Fingerprint: %s", self.fingerprint)
571
self.created = settings.get("created",
572
datetime.datetime.utcnow())
573
574
# attributes specific for this server instance
332
if "secret" in config:
333
self.secret = config["secret"].decode("base64")
334
elif "secfile" in config:
335
with open(os.path.expanduser(os.path.expandvars
336
(config["secfile"])),
337
"rb") as secfile:
338
self.secret = secfile.read()
339
else:
340
raise TypeError("No secret or secfile for client %s"
341
% self.name)
342
self.host = config.get("host", "")
343
self.created = datetime.datetime.utcnow()
344
self.enabled = False
345
self.last_approval_request = None
346
self.last_enabled = None
347
self.last_checked_ok = None
348
self.timeout = string_to_delta(config["timeout"])
349
self.interval = string_to_delta(config["interval"])
350
self.disable_hook = disable_hook
575
351
self.checker = None
576
352
self.checker_initiator_tag = None
577
353
self.disable_initiator_tag = None
578
354
self.checker_callback_tag = None
355
self.checker_command = config["checker"]
579
356
self.current_checker_command = None
580
self.approved = None
357
self.last_connect = None
358
self._approved = None
359
self.approved_by_default = config.get("approved_by_default",
360
True)
581
361
self.approvals_pending = 0
582
self.changedstate = multiprocessing_manager.Condition(
583
multiprocessing_manager.Lock())
584
self.client_structure = [attr
585
for attr in self.__dict__.iterkeys()
586
if not attr.startswith("_")]
587
self.client_structure.append("client_structure")
588
589
for name, t in inspect.getmembers(
590
type(self), lambda obj: isinstance(obj, property)):
591
if not name.startswith("_"):
592
self.client_structure.append(name)
362
self.approval_delay = string_to_delta(
363
config["approval_delay"])
364
self.approval_duration = string_to_delta(
365
config["approval_duration"])
366
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
593
367
594
# Send notice to process children that client state has changed
595
368
def send_changedstate(self):
596
with self.changedstate:
597
self.changedstate.notify_all()
598
369
self.changedstate.acquire()
370
self.changedstate.notify_all()
371
self.changedstate.release()
372
599
373
def enable(self):
600
374
"""Start this client's checker and timeout hooks"""
601
375
if getattr(self, "enabled", False):
602
376
# Already enabled
603
377
return
604
self.expires = datetime.datetime.utcnow() + self.timeout
605
self.enabled = True
378
self.send_changedstate()
606
379
self.last_enabled = datetime.datetime.utcnow()
607
self.init_checker()
608
self.send_changedstate()
380
# Schedule a new checker to be started an 'interval' from now,
381
# and every interval from then on.
382
self.checker_initiator_tag = (gobject.timeout_add
383
(self.interval_milliseconds(),
384
self.start_checker))
385
# Schedule a disable() when 'timeout' has passed
386
self.disable_initiator_tag = (gobject.timeout_add
387
(self.timeout_milliseconds(),
388
self.disable))
389
self.enabled = True
390
# Also start a new checker *right now*.
391
self.start_checker()
609
392
610
393
def disable(self, quiet=True):
611
394
"""Disable this client."""
612
395
if not getattr(self, "enabled", False):
613
396
return False
614
397
if not quiet:
398
self.send_changedstate()
399
if not quiet:
615
400
logger.info("Disabling client %s", self.name)
616
if getattr(self, "disable_initiator_tag", None) is not None:
401
if getattr(self, "disable_initiator_tag", False):
617
402
gobject.source_remove(self.disable_initiator_tag)
618
403
self.disable_initiator_tag = None
619
self.expires = None
620
if getattr(self, "checker_initiator_tag", None) is not None:
404
if getattr(self, "checker_initiator_tag", False):
621
405
gobject.source_remove(self.checker_initiator_tag)
622
406
self.checker_initiator_tag = None
623
407
self.stop_checker()
408
if self.disable_hook:
409
self.disable_hook(self)
624
410
self.enabled = False
625
if not quiet:
626
self.send_changedstate()
627
411
# Do not run this again if called by a gobject.timeout_add
628
412
return False
629
413
630
414
def __del__(self):
415
self.disable_hook = None
631
416
self.disable()
632
417
633
def init_checker(self):
634
# Schedule a new checker to be started an 'interval' from now,
635
# and every interval from then on.
636
if self.checker_initiator_tag is not None:
637
gobject.source_remove(self.checker_initiator_tag)
638
self.checker_initiator_tag = gobject.timeout_add(
639
int(self.interval.total_seconds() * 1000),
640
self.start_checker)
641
# Schedule a disable() when 'timeout' has passed
642
if self.disable_initiator_tag is not None:
643
gobject.source_remove(self.disable_initiator_tag)
644
self.disable_initiator_tag = gobject.timeout_add(
645
int(self.timeout.total_seconds() * 1000), self.disable)
646
# Also start a new checker *right now*.
647
self.start_checker()
648
649
def checker_callback(self, source, condition, connection,
650
command):
418
def checker_callback(self, pid, condition, command):
651
419
"""The checker has completed, so take appropriate actions."""
652
420
self.checker_callback_tag = None
653
421
self.checker = None
654
# Read return code from connection (see call_pipe)
655
returncode = connection.recv()
656
connection.close()
657
658
if returncode >= 0:
659
self.last_checker_status = returncode
660
self.last_checker_signal = None
661
if self.last_checker_status == 0:
422
if os.WIFEXITED(condition):
423
exitstatus = os.WEXITSTATUS(condition)
424
if exitstatus == 0:
662
425
logger.info("Checker for %(name)s succeeded",
663
426
vars(self))
664
427
self.checked_ok()
665
428
else:
666
logger.info("Checker for %(name)s failed", vars(self))
429
logger.info("Checker for %(name)s failed",
430
vars(self))
667
431
else:
668
self.last_checker_status = -1
669
self.last_checker_signal = -returncode
670
432
logger.warning("Checker for %(name)s crashed?",
671
433
vars(self))
672
return False
673
434
674
435
def checked_ok(self):
675
"""Assert that the client has been seen, alive and well."""
436
"""Bump up the timeout for this client.
437
438
This should only be called when the client has been seen,
439
alive and well.
440
"""
676
441
self.last_checked_ok = datetime.datetime.utcnow()
677
self.last_checker_status = 0
678
self.last_checker_signal = None
679
self.bump_timeout()
680
681
def bump_timeout(self, timeout=None):
682
"""Bump up the timeout for this client."""
683
if timeout is None:
684
timeout = self.timeout
685
if self.disable_initiator_tag is not None:
686
gobject.source_remove(self.disable_initiator_tag)
687
self.disable_initiator_tag = None
688
if getattr(self, "enabled", False):
689
self.disable_initiator_tag = gobject.timeout_add(
690
int(timeout.total_seconds() * 1000), self.disable)
691
self.expires = datetime.datetime.utcnow() + timeout
442
gobject.source_remove(self.disable_initiator_tag)
443
self.disable_initiator_tag = (gobject.timeout_add
444
(self.timeout_milliseconds(),
445
self.disable))
692
446
693
447
def need_approval(self):
694
448
self.last_approval_request = datetime.datetime.utcnow()
699
453
If a checker already exists, leave it running and do
700
454
nothing."""
701
455
# The reason for not killing a running checker is that if we
702
# did that, and if a checker (for some reason) started running
703
# slowly and taking more than 'interval' time, then the client
704
# would inevitably timeout, since no checker would get a
705
# chance to run to completion. If we instead leave running
456
# did that, then if a checker (for some reason) started
457
# running slowly and taking more than 'interval' time, the
458
# client would inevitably timeout, since no checker would get
459
# a chance to run to completion. If we instead leave running
706
460
# checkers alone, the checker would have to take more time
707
461
# than 'timeout' for the client to be disabled, which is as it
708
462
# should be.
709
463
710
if self.checker is not None and not self.checker.is_alive():
711
logger.warning("Checker was not alive; joining")
712
self.checker.join()
713
self.checker = None
464
# If a checker exists, make sure it is not a zombie
465
try:
466
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
467
except (AttributeError, OSError) as error:
468
if (isinstance(error, OSError)
469
and error.errno != errno.ECHILD):
470
raise error
471
else:
472
if pid:
473
logger.warning("Checker was a zombie")
474
gobject.source_remove(self.checker_callback_tag)
475
self.checker_callback(pid, status,
476
self.current_checker_command)
714
477
# Start a new checker if needed
715
478
if self.checker is None:
716
# Escape attributes for the shell
717
escaped_attrs = {
718
attr: re.escape(str(getattr(self, attr)))
719
for attr in self.runtime_expansions }
720
479
try:
721
command = self.checker_command % escaped_attrs
722
except TypeError as error:
723
logger.error('Could not format string "%s"',
724
self.checker_command,
725
exc_info=error)
726
return True # Try again later
480
# In case checker_command has exactly one % operator
481
command = self.checker_command % self.host
482
except TypeError:
483
# Escape attributes for the shell
484
escaped_attrs = dict(
485
(attr,
486
re.escape(unicode(str(getattr(self, attr, "")),
487
errors=
488
'replace')))
489
for attr in
490
self.runtime_expansions)
491
492
try:
493
command = self.checker_command % escaped_attrs
494
except TypeError as error:
495
logger.error('Could not format string "%s":'
496
' %s', self.checker_command, error)
497
return True # Try again later
727
498
self.current_checker_command = command
728
logger.info("Starting checker %r for %s", command,
729
self.name)
730
# We don't need to redirect stdout and stderr, since
731
# in normal mode, that is already done by daemon(),
732
# and in debug mode we don't want to. (Stdin is
733
# always replaced by /dev/null.)
734
# The exception is when not debugging but nevertheless
735
# running in the foreground; use the previously
736
# created wnull.
737
popen_args = { "close_fds": True,
738
"shell": True,
739
"cwd": "/" }
740
if (not self.server_settings["debug"]
741
and self.server_settings["foreground"]):
742
popen_args.update({"stdout": wnull,
743
"stderr": wnull })
744
pipe = multiprocessing.Pipe(duplex = False)
745
self.checker = multiprocessing.Process(
746
target = call_pipe,
747
args = (pipe[1], subprocess.call, command),
748
kwargs = popen_args)
749
self.checker.start()
750
self.checker_callback_tag = gobject.io_add_watch(
751
pipe[0].fileno(), gobject.IO_IN,
752
self.checker_callback, pipe[0], command)
499
try:
500
logger.info("Starting checker %r for %s",
501
command, self.name)
502
# We don't need to redirect stdout and stderr, since
503
# in normal mode, that is already done by daemon(),
504
# and in debug mode we don't want to. (Stdin is
505
# always replaced by /dev/null.)
506
self.checker = subprocess.Popen(command,
507
close_fds=True,
508
shell=True, cwd="/")
509
self.checker_callback_tag = (gobject.child_watch_add
510
(self.checker.pid,
511
self.checker_callback,
512
data=command))
513
# The checker may have completed before the gobject
514
# watch was added. Check for this.
515
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
516
if pid:
517
gobject.source_remove(self.checker_callback_tag)
518
self.checker_callback(pid, status, command)
519
except OSError as error:
520
logger.error("Failed to start subprocess: %s",
521
error)
753
522
# Re-run this periodically if run by gobject.timeout_add
754
523
return True
755
524
761
530
if getattr(self, "checker", None) is None:
762
531
return
763
532
logger.debug("Stopping checker for %(name)s", vars(self))
764
self.checker.terminate()
533
try:
534
os.kill(self.checker.pid, signal.SIGTERM)
535
#time.sleep(0.5)
536
#if self.checker.poll() is None:
537
# os.kill(self.checker.pid, signal.SIGKILL)
538
except OSError as error:
539
if error.errno != errno.ESRCH: # No such process
540
raise
765
541
self.checker = None
766
542
767
768
def dbus_service_property(dbus_interface,
769
signature="v",
770
access="readwrite",
771
byte_arrays=False):
543
def dbus_service_property(dbus_interface, signature="v",
544
access="readwrite", byte_arrays=False):
772
545
"""Decorators for marking methods of a DBusObjectWithProperties to
773
546
become properties on the D-Bus.
774
547
783
556
# "Set" method, so we fail early here:
784
557
if byte_arrays and signature != "ay":
785
558
raise ValueError("Byte arrays not supported for non-'ay'"
786
" signature {!r}".format(signature))
787
559
" signature %r" % signature)
788
560
def decorator(func):
789
561
func._dbus_is_property = True
790
562
func._dbus_interface = dbus_interface
795
567
func._dbus_name = func._dbus_name[:-14]
796
568
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
797
569
return func
798
799
return decorator
800
801
802
def dbus_interface_annotations(dbus_interface):
803
"""Decorator for marking functions returning interface annotations
804
805
Usage:
806
807
@dbus_interface_annotations("org.example.Interface")
808
def _foo(self): # Function name does not matter
809
return {"org.freedesktop.DBus.Deprecated": "true",
810
"org.freedesktop.DBus.Property.EmitsChangedSignal":
811
"false"}
812
"""
813
814
def decorator(func):
815
func._dbus_is_interface = True
816
func._dbus_interface = dbus_interface
817
func._dbus_name = dbus_interface
818
return func
819
820
return decorator
821
822
823
def dbus_annotations(annotations):
824
"""Decorator to annotate D-Bus methods, signals or properties
825
Usage:
826
827
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
828
"org.freedesktop.DBus.Property."
829
"EmitsChangedSignal": "false"})
830
@dbus_service_property("org.example.Interface", signature="b",
831
access="r")
832
def Property_dbus_property(self):
833
return dbus.Boolean(False)
834
"""
835
836
def decorator(func):
837
func._dbus_annotations = annotations
838
return func
839
840
570
return decorator
841
571
842
572
843
573
class DBusPropertyException(dbus.exceptions.DBusException):
844
574
"""A base class for D-Bus property-related exceptions
845
575
"""
846
pass
576
def __unicode__(self):
577
return unicode(str(self))
847
578
848
579
849
580
class DBusPropertyAccessException(DBusPropertyException):
860
591
861
592
class DBusObjectWithProperties(dbus.service.Object):
862
593
"""A D-Bus object with properties.
863
594
864
595
Classes inheriting from this can use the dbus_service_property
865
596
decorator to expose methods as D-Bus properties. It exposes the
866
597
standard Get(), Set(), and GetAll() methods on the D-Bus.
867
598
"""
868
599
869
600
@staticmethod
870
def _is_dbus_thing(thing):
871
"""Returns a function testing if an attribute is a D-Bus thing
872
873
If called like _is_dbus_thing("method") it returns a function
874
suitable for use as predicate to inspect.getmembers().
875
"""
876
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
877
False)
601
def _is_dbus_property(obj):
602
return getattr(obj, "_dbus_is_property", False)
878
603
879
def _get_all_dbus_things(self, thing):
604
def _get_all_dbus_properties(self):
880
605
"""Returns a generator of (name, attribute) pairs
881
606
"""
882
return ((getattr(athing.__get__(self), "_dbus_name", name),
883
athing.__get__(self))
884
for cls in self.__class__.__mro__
885
for name, athing in
886
inspect.getmembers(cls, self._is_dbus_thing(thing)))
607
return ((prop._dbus_name, prop)
608
for name, prop in
609
inspect.getmembers(self, self._is_dbus_property))
887
610
888
611
def _get_dbus_property(self, interface_name, property_name):
889
612
"""Returns a bound method if one exists which is a D-Bus
890
613
property with the specified name and interface.
891
614
"""
892
for cls in self.__class__.__mro__:
893
for name, value in inspect.getmembers(
894
cls, self._is_dbus_thing("property")):
895
if (value._dbus_name == property_name
896
and value._dbus_interface == interface_name):
897
return value.__get__(self)
898
615
for name in (property_name,
616
property_name + "_dbus_property"):
617
prop = getattr(self, name, None)
618
if (prop is None
619
or not self._is_dbus_property(prop)
620
or prop._dbus_name != property_name
621
or (interface_name and prop._dbus_interface
622
and interface_name != prop._dbus_interface)):
623
continue
624
return prop
899
625
# No such property
900
raise DBusPropertyNotFound("{}:{}.{}".format(
901
self.dbus_object_path, interface_name, property_name))
626
raise DBusPropertyNotFound(self.dbus_object_path + ":"
627
+ interface_name + "."
628
+ property_name)
902
629
903
@dbus.service.method(dbus.PROPERTIES_IFACE,
904
in_signature="ss",
630
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
905
631
out_signature="v")
906
632
def Get(self, interface_name, property_name):
907
633
"""Standard D-Bus property Get() method, see D-Bus standard.
925
651
# The byte_arrays option is not supported yet on
926
652
# signatures other than "ay".
927
653
if prop._dbus_signature != "ay":
928
raise ValueError("Byte arrays not supported for non-"
929
"'ay' signature {!r}"
930
.format(prop._dbus_signature))
931
value = dbus.ByteArray(b''.join(chr(byte)
932
for byte in value))
654
raise ValueError
655
value = dbus.ByteArray(''.join(unichr(byte)
656
for byte in value))
933
657
prop(value)
934
658
935
@dbus.service.method(dbus.PROPERTIES_IFACE,
936
in_signature="s",
659
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
937
660
out_signature="a{sv}")
938
661
def GetAll(self, interface_name):
939
662
"""Standard D-Bus property GetAll() method, see D-Bus
940
663
standard.
941
664
942
665
Note: Will not include properties with access="write".
943
666
"""
944
properties = {}
945
for name, prop in self._get_all_dbus_things("property"):
667
all = {}
668
for name, prop in self._get_all_dbus_properties():
946
669
if (interface_name
947
670
and interface_name != prop._dbus_interface):
948
671
# Interface non-empty but did not match
952
675
continue
953
676
value = prop()
954
677
if not hasattr(value, "variant_level"):
955
properties[name] = value
678
all[name] = value
956
679
continue
957
properties[name] = type(value)(
958
value, variant_level = value.variant_level + 1)
959
return dbus.Dictionary(properties, signature="sv")
960
961
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
962
def PropertiesChanged(self, interface_name, changed_properties,
963
invalidated_properties):
964
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
965
standard.
966
"""
967
pass
680
all[name] = type(value)(value, variant_level=
681
value.variant_level+1)
682
return dbus.Dictionary(all, signature="sv")
968
683
969
684
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
970
685
out_signature="s",
971
686
path_keyword='object_path',
972
687
connection_keyword='connection')
973
688
def Introspect(self, object_path, connection):
974
"""Overloading of standard D-Bus method.
975
976
Inserts property tags and interface annotation tags.
689
"""Standard D-Bus method, overloaded to insert property tags.
977
690
"""
978
691
xmlstring = dbus.service.Object.Introspect(self, object_path,
979
692
connection)
980
693
try:
981
694
document = xml.dom.minidom.parseString(xmlstring)
982
983
695
def make_tag(document, name, prop):
984
696
e = document.createElement("property")
985
697
e.setAttribute("name", name)
986
698
e.setAttribute("type", prop._dbus_signature)
987
699
e.setAttribute("access", prop._dbus_access)
988
700
return e
989
990
701
for if_tag in document.getElementsByTagName("interface"):
991
# Add property tags
992
702
for tag in (make_tag(document, name, prop)
993
703
for name, prop
994
in self._get_all_dbus_things("property")
704
in self._get_all_dbus_properties()
995
705
if prop._dbus_interface
996
706
== if_tag.getAttribute("name")):
997
707
if_tag.appendChild(tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr(
1008
prop, "_dbus_annotations", {}))
1009
for name, value in annots.items():
1010
ann_tag = document.createElement(
1011
"annotation")
1012
ann_tag.setAttribute("name", name)
1013
ann_tag.setAttribute("value", value)
1014
tag.appendChild(ann_tag)
1015
# Add interface annotation tags
1016
for annotation, value in dict(
1017
itertools.chain.from_iterable(
1018
annotations().items()
1019
for name, annotations
1020
in self._get_all_dbus_things("interface")
1021
if name == if_tag.getAttribute("name")
1022
)).items():
1023
ann_tag = document.createElement("annotation")
1024
ann_tag.setAttribute("name", annotation)
1025
ann_tag.setAttribute("value", value)
1026
if_tag.appendChild(ann_tag)
1027
708
# Add the names to the return values for the
1028
709
# "org.freedesktop.DBus.Properties" methods
1029
710
if (if_tag.getAttribute("name")
1044
725
except (AttributeError, xml.dom.DOMException,
1045
726
xml.parsers.expat.ExpatError) as error:
1046
727
logger.error("Failed to override Introspection method",
1047
exc_info=error)
728
error)
1048
729
return xmlstring
1049
730
1050
731
1051
def datetime_to_dbus(dt, variant_level=0):
1052
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1053
if dt is None:
1054
return dbus.String("", variant_level = variant_level)
1055
return dbus.String(dt.isoformat(), variant_level=variant_level)
1056
1057
1058
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1059
"""A class decorator; applied to a subclass of
1060
dbus.service.Object, it will add alternate D-Bus attributes with
1061
interface names according to the "alt_interface_names" mapping.
1062
Usage:
1063
1064
@alternate_dbus_interfaces({"org.example.Interface":
1065
"net.example.AlternateInterface"})
1066
class SampleDBusObject(dbus.service.Object):
1067
@dbus.service.method("org.example.Interface")
1068
def SampleDBusMethod():
1069
pass
1070
1071
The above "SampleDBusMethod" on "SampleDBusObject" will be
1072
reachable via two interfaces: "org.example.Interface" and
1073
"net.example.AlternateInterface", the latter of which will have
1074
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1075
"true", unless "deprecate" is passed with a False value.
1076
1077
This works for methods and signals, and also for D-Bus properties
1078
(from DBusObjectWithProperties) and interfaces (from the
1079
dbus_interface_annotations decorator).
1080
"""
1081
1082
def wrapper(cls):
1083
for orig_interface_name, alt_interface_name in (
1084
alt_interface_names.items()):
1085
attr = {}
1086
interface_names = set()
1087
# Go though all attributes of the class
1088
for attrname, attribute in inspect.getmembers(cls):
1089
# Ignore non-D-Bus attributes, and D-Bus attributes
1090
# with the wrong interface name
1091
if (not hasattr(attribute, "_dbus_interface")
1092
or not attribute._dbus_interface.startswith(
1093
orig_interface_name)):
1094
continue
1095
# Create an alternate D-Bus interface name based on
1096
# the current name
1097
alt_interface = attribute._dbus_interface.replace(
1098
orig_interface_name, alt_interface_name)
1099
interface_names.add(alt_interface)
1100
# Is this a D-Bus signal?
1101
if getattr(attribute, "_dbus_is_signal", False):
1102
if sys.version_info.major == 2:
1103
# Extract the original non-method undecorated
1104
# function by black magic
1105
nonmethod_func = (dict(
1106
zip(attribute.func_code.co_freevars,
1107
attribute.__closure__))
1108
["func"].cell_contents)
1109
else:
1110
nonmethod_func = attribute
1111
# Create a new, but exactly alike, function
1112
# object, and decorate it to be a new D-Bus signal
1113
# with the alternate D-Bus interface name
1114
if sys.version_info.major == 2:
1115
new_function = types.FunctionType(
1116
nonmethod_func.func_code,
1117
nonmethod_func.func_globals,
1118
nonmethod_func.func_name,
1119
nonmethod_func.func_defaults,
1120
nonmethod_func.func_closure)
1121
else:
1122
new_function = types.FunctionType(
1123
nonmethod_func.__code__,
1124
nonmethod_func.__globals__,
1125
nonmethod_func.__name__,
1126
nonmethod_func.__defaults__,
1127
nonmethod_func.__closure__)
1128
new_function = (dbus.service.signal(
1129
alt_interface,
1130
attribute._dbus_signature)(new_function))
1131
# Copy annotations, if any
1132
try:
1133
new_function._dbus_annotations = dict(
1134
attribute._dbus_annotations)
1135
except AttributeError:
1136
pass
1137
# Define a creator of a function to call both the
1138
# original and alternate functions, so both the
1139
# original and alternate signals gets sent when
1140
# the function is called
1141
def fixscope(func1, func2):
1142
"""This function is a scope container to pass
1143
func1 and func2 to the "call_both" function
1144
outside of its arguments"""
1145
1146
def call_both(*args, **kwargs):
1147
"""This function will emit two D-Bus
1148
signals by calling func1 and func2"""
1149
func1(*args, **kwargs)
1150
func2(*args, **kwargs)
1151
1152
return call_both
1153
# Create the "call_both" function and add it to
1154
# the class
1155
attr[attrname] = fixscope(attribute, new_function)
1156
# Is this a D-Bus method?
1157
elif getattr(attribute, "_dbus_is_method", False):
1158
# Create a new, but exactly alike, function
1159
# object. Decorate it to be a new D-Bus method
1160
# with the alternate D-Bus interface name. Add it
1161
# to the class.
1162
attr[attrname] = (
1163
dbus.service.method(
1164
alt_interface,
1165
attribute._dbus_in_signature,
1166
attribute._dbus_out_signature)
1167
(types.FunctionType(attribute.func_code,
1168
attribute.func_globals,
1169
attribute.func_name,
1170
attribute.func_defaults,
1171
attribute.func_closure)))
1172
# Copy annotations, if any
1173
try:
1174
attr[attrname]._dbus_annotations = dict(
1175
attribute._dbus_annotations)
1176
except AttributeError:
1177
pass
1178
# Is this a D-Bus property?
1179
elif getattr(attribute, "_dbus_is_property", False):
1180
# Create a new, but exactly alike, function
1181
# object, and decorate it to be a new D-Bus
1182
# property with the alternate D-Bus interface
1183
# name. Add it to the class.
1184
attr[attrname] = (dbus_service_property(
1185
alt_interface, attribute._dbus_signature,
1186
attribute._dbus_access,
1187
attribute._dbus_get_args_options
1188
["byte_arrays"])
1189
(types.FunctionType(
1190
attribute.func_code,
1191
attribute.func_globals,
1192
attribute.func_name,
1193
attribute.func_defaults,
1194
attribute.func_closure)))
1195
# Copy annotations, if any
1196
try:
1197
attr[attrname]._dbus_annotations = dict(
1198
attribute._dbus_annotations)
1199
except AttributeError:
1200
pass
1201
# Is this a D-Bus interface?
1202
elif getattr(attribute, "_dbus_is_interface", False):
1203
# Create a new, but exactly alike, function
1204
# object. Decorate it to be a new D-Bus interface
1205
# with the alternate D-Bus interface name. Add it
1206
# to the class.
1207
attr[attrname] = (
1208
dbus_interface_annotations(alt_interface)
1209
(types.FunctionType(attribute.func_code,
1210
attribute.func_globals,
1211
attribute.func_name,
1212
attribute.func_defaults,
1213
attribute.func_closure)))
1214
if deprecate:
1215
# Deprecate all alternate interfaces
1216
iname="_AlternateDBusNames_interface_annotation{}"
1217
for interface_name in interface_names:
1218
1219
@dbus_interface_annotations(interface_name)
1220
def func(self):
1221
return { "org.freedesktop.DBus.Deprecated":
1222
"true" }
1223
# Find an unused name
1224
for aname in (iname.format(i)
1225
for i in itertools.count()):
1226
if aname not in attr:
1227
attr[aname] = func
1228
break
1229
if interface_names:
1230
# Replace the class with a new subclass of it with
1231
# methods, signals, etc. as created above.
1232
cls = type(b"{}Alternate".format(cls.__name__),
1233
(cls, ), attr)
1234
return cls
1235
1236
return wrapper
1237
1238
1239
@alternate_dbus_interfaces({"se.recompile.Mandos":
1240
"se.bsnet.fukt.Mandos"})
1241
732
class ClientDBus(Client, DBusObjectWithProperties):
1242
733
"""A Client class using D-Bus
1243
734
1247
738
"""
1248
739
1249
740
runtime_expansions = (Client.runtime_expansions
1250
+ ("dbus_object_path", ))
1251
1252
_interface = "se.recompile.Mandos.Client"
741
+ ("dbus_object_path",))
1253
742
1254
743
# dbus.service.Object doesn't use super(), so we can't either.
1255
744
1256
745
def __init__(self, bus = None, *args, **kwargs):
746
self._approvals_pending = 0
1257
747
self.bus = bus
1258
748
Client.__init__(self, *args, **kwargs)
1259
749
# Only now, when this client is initialized, can it show up on
1260
750
# the D-Bus
1261
client_object_name = str(self.name).translate(
751
client_object_name = unicode(self.name).translate(
1262
752
{ord("."): ord("_"),
1263
753
ord("-"): ord("_")})
1264
self.dbus_object_path = dbus.ObjectPath(
1265
"/clients/" + client_object_name)
754
self.dbus_object_path = (dbus.ObjectPath
755
("/clients/" + client_object_name))
1266
756
DBusObjectWithProperties.__init__(self, self.bus,
1267
757
self.dbus_object_path)
1268
1269
def notifychangeproperty(transform_func, dbus_name,
1270
type_func=lambda x: x,
1271
variant_level=1,
1272
invalidate_only=False,
1273
_interface=_interface):
1274
""" Modify a variable so that it's a property which announces
1275
its changes to DBus.
1276
1277
transform_fun: Function that takes a value and a variant_level
1278
and transforms it to a D-Bus type.
1279
dbus_name: D-Bus name of the variable
1280
type_func: Function that transform the value before sending it
1281
to the D-Bus. Default: no transform
1282
variant_level: D-Bus variant level. Default: 1
1283
"""
1284
attrname = "_{}".format(dbus_name)
1285
1286
def setter(self, value):
1287
if hasattr(self, "dbus_object_path"):
1288
if (not hasattr(self, attrname) or
1289
type_func(getattr(self, attrname, None))
1290
!= type_func(value)):
1291
if invalidate_only:
1292
self.PropertiesChanged(
1293
_interface, dbus.Dictionary(),
1294
dbus.Array((dbus_name, )))
1295
else:
1296
dbus_value = transform_func(
1297
type_func(value),
1298
variant_level = variant_level)
1299
self.PropertyChanged(dbus.String(dbus_name),
1300
dbus_value)
1301
self.PropertiesChanged(
1302
_interface,
1303
dbus.Dictionary({ dbus.String(dbus_name):
1304
dbus_value }),
1305
dbus.Array())
1306
setattr(self, attrname, value)
1307
1308
return property(lambda self: getattr(self, attrname), setter)
1309
1310
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1311
approvals_pending = notifychangeproperty(dbus.Boolean,
1312
"ApprovalPending",
1313
type_func = bool)
1314
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1315
last_enabled = notifychangeproperty(datetime_to_dbus,
1316
"LastEnabled")
1317
checker = notifychangeproperty(
1318
dbus.Boolean, "CheckerRunning",
1319
type_func = lambda checker: checker is not None)
1320
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1321
"LastCheckedOK")
1322
last_checker_status = notifychangeproperty(dbus.Int16,
1323
"LastCheckerStatus")
1324
last_approval_request = notifychangeproperty(
1325
datetime_to_dbus, "LastApprovalRequest")
1326
approved_by_default = notifychangeproperty(dbus.Boolean,
1327
"ApprovedByDefault")
1328
approval_delay = notifychangeproperty(
1329
dbus.UInt64, "ApprovalDelay",
1330
type_func = lambda td: td.total_seconds() * 1000)
1331
approval_duration = notifychangeproperty(
1332
dbus.UInt64, "ApprovalDuration",
1333
type_func = lambda td: td.total_seconds() * 1000)
1334
host = notifychangeproperty(dbus.String, "Host")
1335
timeout = notifychangeproperty(
1336
dbus.UInt64, "Timeout",
1337
type_func = lambda td: td.total_seconds() * 1000)
1338
extended_timeout = notifychangeproperty(
1339
dbus.UInt64, "ExtendedTimeout",
1340
type_func = lambda td: td.total_seconds() * 1000)
1341
interval = notifychangeproperty(
1342
dbus.UInt64, "Interval",
1343
type_func = lambda td: td.total_seconds() * 1000)
1344
checker_command = notifychangeproperty(dbus.String, "Checker")
1345
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1346
invalidate_only=True)
1347
1348
del notifychangeproperty
758
759
def _get_approvals_pending(self):
760
return self._approvals_pending
761
def _set_approvals_pending(self, value):
762
old_value = self._approvals_pending
763
self._approvals_pending = value
764
bval = bool(value)
765
if (hasattr(self, "dbus_object_path")
766
and bval is not bool(old_value)):
767
dbus_bool = dbus.Boolean(bval, variant_level=1)
768
self.PropertyChanged(dbus.String("ApprovalPending"),
769
dbus_bool)
770
771
approvals_pending = property(_get_approvals_pending,
772
_set_approvals_pending)
773
del _get_approvals_pending, _set_approvals_pending
774
775
@staticmethod
776
def _datetime_to_dbus(dt, variant_level=0):
777
"""Convert a UTC datetime.datetime() to a D-Bus type."""
778
return dbus.String(dt.isoformat(),
779
variant_level=variant_level)
780
781
def enable(self):
782
oldstate = getattr(self, "enabled", False)
783
r = Client.enable(self)
784
if oldstate != self.enabled:
785
# Emit D-Bus signals
786
self.PropertyChanged(dbus.String("Enabled"),
787
dbus.Boolean(True, variant_level=1))
788
self.PropertyChanged(
789
dbus.String("LastEnabled"),
790
self._datetime_to_dbus(self.last_enabled,
791
variant_level=1))
792
return r
793
794
def disable(self, quiet = False):
795
oldstate = getattr(self, "enabled", False)
796
r = Client.disable(self, quiet=quiet)
797
if not quiet and oldstate != self.enabled:
798
# Emit D-Bus signal
799
self.PropertyChanged(dbus.String("Enabled"),
800
dbus.Boolean(False, variant_level=1))
801
return r
1349
802
1350
803
def __del__(self, *args, **kwargs):
1351
804
try:
1356
809
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1357
810
Client.__del__(self, *args, **kwargs)
1358
811
1359
def checker_callback(self, source, condition,
1360
connection, command, *args, **kwargs):
1361
ret = Client.checker_callback(self, source, condition,
1362
connection, command, *args,
1363
**kwargs)
1364
exitstatus = self.last_checker_status
1365
if exitstatus >= 0:
812
def checker_callback(self, pid, condition, command,
813
*args, **kwargs):
814
self.checker_callback_tag = None
815
self.checker = None
816
# Emit D-Bus signal
817
self.PropertyChanged(dbus.String("CheckerRunning"),
818
dbus.Boolean(False, variant_level=1))
819
if os.WIFEXITED(condition):
820
exitstatus = os.WEXITSTATUS(condition)
1366
821
# Emit D-Bus signal
1367
822
self.CheckerCompleted(dbus.Int16(exitstatus),
1368
dbus.Int64(0),
823
dbus.Int64(condition),
1369
824
dbus.String(command))
1370
825
else:
1371
826
# Emit D-Bus signal
1372
827
self.CheckerCompleted(dbus.Int16(-1),
1373
dbus.Int64(
1374
self.last_checker_signal),
828
dbus.Int64(condition),
1375
829
dbus.String(command))
1376
return ret
830
831
return Client.checker_callback(self, pid, condition, command,
832
*args, **kwargs)
833
834
def checked_ok(self, *args, **kwargs):
835
Client.checked_ok(self, *args, **kwargs)
836
# Emit D-Bus signal
837
self.PropertyChanged(
838
dbus.String("LastCheckedOK"),
839
(self._datetime_to_dbus(self.last_checked_ok,
840
variant_level=1)))
841
842
def need_approval(self, *args, **kwargs):
843
r = Client.need_approval(self, *args, **kwargs)
844
# Emit D-Bus signal
845
self.PropertyChanged(
846
dbus.String("LastApprovalRequest"),
847
(self._datetime_to_dbus(self.last_approval_request,
848
variant_level=1)))
849
return r
1377
850
1378
851
def start_checker(self, *args, **kwargs):
1379
old_checker_pid = getattr(self.checker, "pid", None)
852
old_checker = self.checker
853
if self.checker is not None:
854
old_checker_pid = self.checker.pid
855
else:
856
old_checker_pid = None
1380
857
r = Client.start_checker(self, *args, **kwargs)
1381
858
# Only if new checker process was started
1382
859
if (self.checker is not None
1383
860
and old_checker_pid != self.checker.pid):
1384
861
# Emit D-Bus signal
1385
862
self.CheckerStarted(self.current_checker_command)
863
self.PropertyChanged(
864
dbus.String("CheckerRunning"),
865
dbus.Boolean(True, variant_level=1))
1386
866
return r
1387
867
868
def stop_checker(self, *args, **kwargs):
869
old_checker = getattr(self, "checker", None)
870
r = Client.stop_checker(self, *args, **kwargs)
871
if (old_checker is not None
872
and getattr(self, "checker", None) is None):
873
self.PropertyChanged(dbus.String("CheckerRunning"),
874
dbus.Boolean(False, variant_level=1))
875
return r
876
1388
877
def _reset_approved(self):
1389
self.approved = None
878
self._approved = None
1390
879
return False
1391
880
1392
881
def approve(self, value=True):
1393
self.approved = value
1394
gobject.timeout_add(int(self.approval_duration.total_seconds()
1395
* 1000), self._reset_approved)
1396
882
self.send_changedstate()
883
self._approved = value
884
gobject.timeout_add(self._timedelta_to_milliseconds
885
(self.approval_duration),
886
self._reset_approved)
887
1397
888
1398
889
## D-Bus methods, signals & properties
1399
1400
## Interfaces
890
_interface = "se.bsnet.fukt.Mandos.Client"
1401
891
1402
892
## Signals
1403
893
1414
904
pass
1415
905
1416
906
# PropertyChanged - signal
1417
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1418
907
@dbus.service.signal(_interface, signature="sv")
1419
908
def PropertyChanged(self, property, value):
1420
909
"D-Bus signal"
1484
973
return dbus.Boolean(bool(self.approvals_pending))
1485
974
1486
975
# ApprovedByDefault - property
1487
@dbus_service_property(_interface,
1488
signature="b",
976
@dbus_service_property(_interface, signature="b",
1489
977
access="readwrite")
1490
978
def ApprovedByDefault_dbus_property(self, value=None):
1491
979
if value is None: # get
1492
980
return dbus.Boolean(self.approved_by_default)
1493
981
self.approved_by_default = bool(value)
982
# Emit D-Bus signal
983
self.PropertyChanged(dbus.String("ApprovedByDefault"),
984
dbus.Boolean(value, variant_level=1))
1494
985
1495
986
# ApprovalDelay - property
1496
@dbus_service_property(_interface,
1497
signature="t",
987
@dbus_service_property(_interface, signature="t",
1498
988
access="readwrite")
1499
989
def ApprovalDelay_dbus_property(self, value=None):
1500
990
if value is None: # get
1501
return dbus.UInt64(self.approval_delay.total_seconds()
1502
* 1000)
991
return dbus.UInt64(self.approval_delay_milliseconds())
1503
992
self.approval_delay = datetime.timedelta(0, 0, 0, value)
993
# Emit D-Bus signal
994
self.PropertyChanged(dbus.String("ApprovalDelay"),
995
dbus.UInt64(value, variant_level=1))
1504
996
1505
997
# ApprovalDuration - property
1506
@dbus_service_property(_interface,
1507
signature="t",
998
@dbus_service_property(_interface, signature="t",
1508
999
access="readwrite")
1509
1000
def ApprovalDuration_dbus_property(self, value=None):
1510
1001
if value is None: # get
1511
return dbus.UInt64(self.approval_duration.total_seconds()
1512
* 1000)
1002
return dbus.UInt64(self._timedelta_to_milliseconds(
1003
self.approval_duration))
1513
1004
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1005
# Emit D-Bus signal
1006
self.PropertyChanged(dbus.String("ApprovalDuration"),
1007
dbus.UInt64(value, variant_level=1))
1514
1008
1515
1009
# Name - property
1516
1010
@dbus_service_property(_interface, signature="s", access="read")
1523
1017
return dbus.String(self.fingerprint)
1524
1018
1525
1019
# Host - property
1526
@dbus_service_property(_interface,
1527
signature="s",
1020
@dbus_service_property(_interface, signature="s",
1528
1021
access="readwrite")
1529
1022
def Host_dbus_property(self, value=None):
1530
1023
if value is None: # get
1531
1024
return dbus.String(self.host)
1532
self.host = str(value)
1025
self.host = value
1026
# Emit D-Bus signal
1027
self.PropertyChanged(dbus.String("Host"),
1028
dbus.String(value, variant_level=1))
1533
1029
1534
1030
# Created - property
1535
1031
@dbus_service_property(_interface, signature="s", access="read")
1536
1032
def Created_dbus_property(self):
1537
return datetime_to_dbus(self.created)
1033
return dbus.String(self._datetime_to_dbus(self.created))
1538
1034
1539
1035
# LastEnabled - property
1540
1036
@dbus_service_property(_interface, signature="s", access="read")
1541
1037
def LastEnabled_dbus_property(self):
1542
return datetime_to_dbus(self.last_enabled)
1038
if self.last_enabled is None:
1039
return dbus.String("")
1040
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1543
1041
1544
1042
# Enabled - property
1545
@dbus_service_property(_interface,
1546
signature="b",
1043
@dbus_service_property(_interface, signature="b",
1547
1044
access="readwrite")
1548
1045
def Enabled_dbus_property(self, value=None):
1549
1046
if value is None: # get
1554
1051
self.disable()
1555
1052
1556
1053
# LastCheckedOK - property
1557
@dbus_service_property(_interface,
1558
signature="s",
1054
@dbus_service_property(_interface, signature="s",
1559
1055
access="readwrite")
1560
1056
def LastCheckedOK_dbus_property(self, value=None):
1561
1057
if value is not None:
1562
1058
self.checked_ok()
1563
1059
return
1564
return datetime_to_dbus(self.last_checked_ok)
1565
1566
# LastCheckerStatus - property
1567
@dbus_service_property(_interface, signature="n", access="read")
1568
def LastCheckerStatus_dbus_property(self):
1569
return dbus.Int16(self.last_checker_status)
1570
1571
# Expires - property
1572
@dbus_service_property(_interface, signature="s", access="read")
1573
def Expires_dbus_property(self):
1574
return datetime_to_dbus(self.expires)
1060
if self.last_checked_ok is None:
1061
return dbus.String("")
1062
return dbus.String(self._datetime_to_dbus(self
1063
.last_checked_ok))
1575
1064
1576
1065
# LastApprovalRequest - property
1577
1066
@dbus_service_property(_interface, signature="s", access="read")
1578
1067
def LastApprovalRequest_dbus_property(self):
1579
return datetime_to_dbus(self.last_approval_request)
1068
if self.last_approval_request is None:
1069
return dbus.String("")
1070
return dbus.String(self.
1071
_datetime_to_dbus(self
1072
.last_approval_request))
1580
1073
1581
1074
# Timeout - property
1582
@dbus_service_property(_interface,
1583
signature="t",
1075
@dbus_service_property(_interface, signature="t",
1584
1076
access="readwrite")
1585
1077
def Timeout_dbus_property(self, value=None):
1586
1078
if value is None: # get
1587
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1588
old_timeout = self.timeout
1079
return dbus.UInt64(self.timeout_milliseconds())
1589
1080
self.timeout = datetime.timedelta(0, 0, 0, value)
1590
# Reschedule disabling
1591
if self.enabled:
1592
now = datetime.datetime.utcnow()
1593
self.expires += self.timeout - old_timeout
1594
if self.expires <= now:
1595
# The timeout has passed
1596
self.disable()
1597
else:
1598
if (getattr(self, "disable_initiator_tag", None)
1599
is None):
1600
return
1601
gobject.source_remove(self.disable_initiator_tag)
1602
self.disable_initiator_tag = gobject.timeout_add(
1603
int((self.expires - now).total_seconds() * 1000),
1604
self.disable)
1605
1606
# ExtendedTimeout - property
1607
@dbus_service_property(_interface,
1608
signature="t",
1609
access="readwrite")
1610
def ExtendedTimeout_dbus_property(self, value=None):
1611
if value is None: # get
1612
return dbus.UInt64(self.extended_timeout.total_seconds()
1613
* 1000)
1614
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1081
# Emit D-Bus signal
1082
self.PropertyChanged(dbus.String("Timeout"),
1083
dbus.UInt64(value, variant_level=1))
1084
if getattr(self, "disable_initiator_tag", None) is None:
1085
return
1086
# Reschedule timeout
1087
gobject.source_remove(self.disable_initiator_tag)
1088
self.disable_initiator_tag = None
1089
time_to_die = (self.
1090
_timedelta_to_milliseconds((self
1091
.last_checked_ok
1092
+ self.timeout)
1093
- datetime.datetime
1094
.utcnow()))
1095
if time_to_die <= 0:
1096
# The timeout has passed
1097
self.disable()
1098
else:
1099
self.disable_initiator_tag = (gobject.timeout_add
1100
(time_to_die, self.disable))
1615
1101
1616
1102
# Interval - property
1617
@dbus_service_property(_interface,
1618
signature="t",
1103
@dbus_service_property(_interface, signature="t",
1619
1104
access="readwrite")
1620
1105
def Interval_dbus_property(self, value=None):
1621
1106
if value is None: # get
1622
return dbus.UInt64(self.interval.total_seconds() * 1000)
1107
return dbus.UInt64(self.interval_milliseconds())
1623
1108
self.interval = datetime.timedelta(0, 0, 0, value)
1109
# Emit D-Bus signal
1110
self.PropertyChanged(dbus.String("Interval"),
1111
dbus.UInt64(value, variant_level=1))
1624
1112
if getattr(self, "checker_initiator_tag", None) is None:
1625
1113
return
1626
if self.enabled:
1627
# Reschedule checker run
1628
gobject.source_remove(self.checker_initiator_tag)
1629
self.checker_initiator_tag = gobject.timeout_add(
1630
value, self.start_checker)
1631
self.start_checker() # Start one now, too
1632
1114
# Reschedule checker run
1115
gobject.source_remove(self.checker_initiator_tag)
1116
self.checker_initiator_tag = (gobject.timeout_add
1117
(value, self.start_checker))
1118
self.start_checker() # Start one now, too
1119
1633
1120
# Checker - property
1634
@dbus_service_property(_interface,
1635
signature="s",
1121
@dbus_service_property(_interface, signature="s",
1636
1122
access="readwrite")
1637
1123
def Checker_dbus_property(self, value=None):
1638
1124
if value is None: # get
1639
1125
return dbus.String(self.checker_command)
1640
self.checker_command = str(value)
1126
self.checker_command = value
1127
# Emit D-Bus signal
1128
self.PropertyChanged(dbus.String("Checker"),
1129
dbus.String(self.checker_command,
1130
variant_level=1))
1641
1131
1642
1132
# CheckerRunning - property
1643
@dbus_service_property(_interface,
1644
signature="b",
1133
@dbus_service_property(_interface, signature="b",
1645
1134
access="readwrite")
1646
1135
def CheckerRunning_dbus_property(self, value=None):
1647
1136
if value is None: # get
1657
1146
return self.dbus_object_path # is already a dbus.ObjectPath
1658
1147
1659
1148
# Secret = property
1660
@dbus_service_property(_interface,
1661
signature="ay",
1662
access="write",
1663
byte_arrays=True)
1149
@dbus_service_property(_interface, signature="ay",
1150
access="write", byte_arrays=True)
1664
1151
def Secret_dbus_property(self, value):
1665
self.secret = bytes(value)
1152
self.secret = str(value)
1666
1153
1667
1154
del _interface
1668
1155
1672
1159
self._pipe = child_pipe
1673
1160
self._pipe.send(('init', fpr, address))
1674
1161
if not self._pipe.recv():
1675
raise KeyError(fpr)
1676
1162
raise KeyError()
1163
1677
1164
def __getattribute__(self, name):
1678
if name == '_pipe':
1165
if(name == '_pipe'):
1679
1166
return super(ProxyClient, self).__getattribute__(name)
1680
1167
self._pipe.send(('getattr', name))
1681
1168
data = self._pipe.recv()
1682
1169
if data[0] == 'data':
1683
1170
return data[1]
1684
1171
if data[0] == 'function':
1685
1686
1172
def func(*args, **kwargs):
1687
1173
self._pipe.send(('funcall', name, args, kwargs))
1688
1174
return self._pipe.recv()[1]
1689
1690
1175
return func
1691
1176
1692
1177
def __setattr__(self, name, value):
1693
if name == '_pipe':
1178
if(name == '_pipe'):
1694
1179
return super(ProxyClient, self).__setattr__(name, value)
1695
1180
self._pipe.send(('setattr', name, value))
1696
1181
1704
1189
def handle(self):
1705
1190
with contextlib.closing(self.server.child_pipe) as child_pipe:
1706
1191
logger.info("TCP connection from: %s",
1707
str(self.client_address))
1192
unicode(self.client_address))
1708
1193
logger.debug("Pipe FD: %d",
1709
1194
self.server.child_pipe.fileno())
1710
1711
session = gnutls.connection.ClientSession(
1712
self.request, gnutls.connection .X509Credentials())
1713
1195
1196
session = (gnutls.connection
1197
.ClientSession(self.request,
1198
gnutls.connection
1199
.X509Credentials()))
1200
1714
1201
# Note: gnutls.connection.X509Credentials is really a
1715
1202
# generic GnuTLS certificate credentials object so long as
1716
1203
# no X.509 keys are added to it. Therefore, we can use it
1717
1204
# here despite using OpenPGP certificates.
1718
1205
1719
1206
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1720
1207
# "+AES-256-CBC", "+SHA1",
1721
1208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1724
1211
priority = self.server.gnutls_priority
1725
1212
if priority is None:
1726
1213
priority = "NORMAL"
1727
gnutls.library.functions.gnutls_priority_set_direct(
1728
session._c_object, priority, None)
1729
1214
(gnutls.library.functions
1215
.gnutls_priority_set_direct(session._c_object,
1216
priority, None))
1217
1730
1218
# Start communication using the Mandos protocol
1731
1219
# Get protocol number
1732
1220
line = self.request.makefile().readline()
1733
1221
logger.debug("Protocol version: %r", line)
1734
1222
try:
1735
1223
if int(line.strip().split()[0]) > 1:
1736
raise RuntimeError(line)
1224
raise RuntimeError
1737
1225
except (ValueError, IndexError, RuntimeError) as error:
1738
1226
logger.error("Unknown protocol version: %s", error)
1739
1227
return
1740
1228
1741
1229
# Start GnuTLS connection
1742
1230
try:
1743
1231
session.handshake()
1747
1235
# established. Just abandon the request.
1748
1236
return
1749
1237
logger.debug("Handshake succeeded")
1750
1238
1751
1239
approval_required = False
1752
1240
try:
1753
1241
try:
1754
fpr = self.fingerprint(
1755
self.peer_certificate(session))
1242
fpr = self.fingerprint(self.peer_certificate
1243
(session))
1756
1244
except (TypeError,
1757
1245
gnutls.errors.GNUTLSError) as error:
1758
1246
logger.warning("Bad certificate: %s", error)
1759
1247
return
1760
1248
logger.debug("Fingerprint: %s", fpr)
1761
1249
1762
1250
try:
1763
1251
client = ProxyClient(child_pipe, fpr,
1764
1252
self.client_address)
1772
1260
1773
1261
while True:
1774
1262
if not client.enabled:
1775
logger.info("Client %s is disabled",
1776
client.name)
1263
logger.warning("Client %s is disabled",
1264
client.name)
1777
1265
if self.server.use_dbus:
1778
1266
# Emit D-Bus signal
1779
client.Rejected("Disabled")
1267
client.Rejected("Disabled")
1780
1268
return
1781
1269
1782
if client.approved or not client.approval_delay:
1270
if client._approved or not client.approval_delay:
1783
1271
#We are approved or approval is disabled
1784
1272
break
1785
elif client.approved is None:
1273
elif client._approved is None:
1786
1274
logger.info("Client %s needs approval",
1787
1275
client.name)
1788
1276
if self.server.use_dbus:
1789
1277
# Emit D-Bus signal
1790
1278
client.NeedApproval(
1791
client.approval_delay.total_seconds()
1792
* 1000, client.approved_by_default)
1279
client.approval_delay_milliseconds(),
1280
client.approved_by_default)
1793
1281
else:
1794
1282
logger.warning("Client %s was not approved",
1795
1283
client.name)
1799
1287
return
1800
1288
1801
1289
#wait until timeout or approved
1290
#x = float(client._timedelta_to_milliseconds(delay))
1802
1291
time = datetime.datetime.now()
1803
1292
client.changedstate.acquire()
1804
client.changedstate.wait(delay.total_seconds())
1293
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1805
1294
client.changedstate.release()
1806
1295
time2 = datetime.datetime.now()
1807
1296
if (time2 - time) >= delay:
1823
1312
try:
1824
1313
sent = session.send(client.secret[sent_size:])
1825
1314
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1827
exc_info=error)
1315
logger.warning("gnutls send failed")
1828
1316
return
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
1831
+ sent))
1317
logger.debug("Sent: %d, remaining: %d",
1318
sent, len(client.secret)
1319
- (sent_size + sent))
1832
1320
sent_size += sent
1833
1321
1834
1322
logger.info("Sending secret to %s", client.name)
1835
# bump the timeout using extended_timeout
1836
client.bump_timeout(client.extended_timeout)
1323
# bump the timeout as if seen
1324
client.checked_ok()
1837
1325
if self.server.use_dbus:
1838
1326
# Emit D-Bus signal
1839
1327
client.GotSecret()
1844
1332
try:
1845
1333
session.bye()
1846
1334
except gnutls.errors.GNUTLSError as error:
1847
logger.warning("GnuTLS bye failed",
1848
exc_info=error)
1335
logger.warning("GnuTLS bye failed")
1849
1336
1850
1337
@staticmethod
1851
1338
def peer_certificate(session):
1852
1339
"Return the peer's OpenPGP certificate as a bytestring"
1853
1340
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
session._c_object)
1341
if (gnutls.library.functions
1342
.gnutls_certificate_type_get(session._c_object)
1856
1343
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
1344
# ...do the normal thing
1858
1345
return session.peer_certificate
1872
1359
def fingerprint(openpgp):
1873
1360
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1874
1361
# New GnuTLS "datum" with the OpenPGP public key
1875
datum = gnutls.library.types.gnutls_datum_t(
1876
ctypes.cast(ctypes.c_char_p(openpgp),
1877
ctypes.POINTER(ctypes.c_ubyte)),
1878
ctypes.c_uint(len(openpgp)))
1362
datum = (gnutls.library.types
1363
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1364
ctypes.POINTER
1365
(ctypes.c_ubyte)),
1366
ctypes.c_uint(len(openpgp))))
1879
1367
# New empty GnuTLS certificate
1880
1368
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
1882
ctypes.byref(crt))
1369
(gnutls.library.functions
1370
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1883
1371
# Import the OpenPGP public key into the certificate
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1372
(gnutls.library.functions
1373
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1374
gnutls.library.constants
1375
.GNUTLS_OPENPGP_FMT_RAW))
1887
1376
# Verify the self signature in the key
1888
1377
crtverify = ctypes.c_uint()
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
1378
(gnutls.library.functions
1379
.gnutls_openpgp_crt_verify_self(crt, 0,
1380
ctypes.byref(crtverify)))
1891
1381
if crtverify.value != 0:
1892
1382
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
1894
"Verify failed")
1383
raise (gnutls.errors.CertificateSecurityError
1384
("Verify failed"))
1895
1385
# New buffer for the fingerprint
1896
1386
buf = ctypes.create_string_buffer(20)
1897
1387
buf_len = ctypes.c_size_t()
1898
1388
# Get the fingerprint from the certificate into the buffer
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1389
(gnutls.library.functions
1390
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1391
ctypes.byref(buf_len)))
1901
1392
# Deinit the certificate
1902
1393
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1903
1394
# Convert the buffer to a Python bytestring
1904
1395
fpr = ctypes.string_at(buf, buf_len.value)
1905
1396
# Convert the bytestring to hexadecimal notation
1906
hex_fpr = binascii.hexlify(fpr).upper()
1397
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1907
1398
return hex_fpr
1908
1399
1909
1400
1910
1401
class MultiprocessingMixIn(object):
1911
1402
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1912
1913
1403
def sub_process_main(self, request, address):
1914
1404
try:
1915
1405
self.finish_request(request, address)
1916
except Exception:
1406
except:
1917
1407
self.handle_error(request, address)
1918
1408
self.close_request(request)
1919
1409
1920
1410
def process_request(self, request, address):
1921
1411
"""Start a new process to process the request."""
1922
proc = multiprocessing.Process(target = self.sub_process_main,
1923
args = (request, address))
1924
proc.start()
1925
return proc
1926
1412
multiprocessing.Process(target = self.sub_process_main,
1413
args = (request, address)).start()
1927
1414
1928
1415
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1929
1416
""" adds a pipe to the MixIn """
1930
1931
1417
def process_request(self, request, client_address):
1932
1418
"""Overrides and wraps the original process_request().
1933
1419
1934
1420
This function creates a new pipe in self.pipe
1935
1421
"""
1936
1422
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1937
1938
proc = MultiprocessingMixIn.process_request(self, request,
1939
client_address)
1423
1424
super(MultiprocessingMixInWithPipe,
1425
self).process_request(request, client_address)
1940
1426
self.child_pipe.close()
1941
self.add_pipe(parent_pipe, proc)
1942
1943
def add_pipe(self, parent_pipe, proc):
1427
self.add_pipe(parent_pipe)
1428
1429
def add_pipe(self, parent_pipe):
1944
1430
"""Dummy function; override as necessary"""
1945
raise NotImplementedError()
1946
1431
raise NotImplementedError
1947
1432
1948
1433
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1949
1434
socketserver.TCPServer, object):
1954
1439
interface: None or a network interface name (string)
1955
1440
use_ipv6: Boolean; to use IPv6 or not
1956
1441
"""
1957
1958
1442
def __init__(self, server_address, RequestHandlerClass,
1959
interface=None,
1960
use_ipv6=True,
1961
socketfd=None):
1962
"""If socketfd is set, use that file descriptor instead of
1963
creating a new one with socket.socket().
1964
"""
1443
interface=None, use_ipv6=True):
1965
1444
self.interface = interface
1966
1445
if use_ipv6:
1967
1446
self.address_family = socket.AF_INET6
1968
if socketfd is not None:
1969
# Save the file descriptor
1970
self.socketfd = socketfd
1971
# Save the original socket.socket() function
1972
self.socket_socket = socket.socket
1973
# To implement --socket, we monkey patch socket.socket.
1974
#
1975
# (When socketserver.TCPServer is a new-style class, we
1976
# could make self.socket into a property instead of monkey
1977
# patching socket.socket.)
1978
#
1979
# Create a one-time-only replacement for socket.socket()
1980
@functools.wraps(socket.socket)
1981
def socket_wrapper(*args, **kwargs):
1982
# Restore original function so subsequent calls are
1983
# not affected.
1984
socket.socket = self.socket_socket
1985
del self.socket_socket
1986
# This time only, return a new socket object from the
1987
# saved file descriptor.
1988
return socket.fromfd(self.socketfd, *args, **kwargs)
1989
# Replace socket.socket() function with wrapper
1990
socket.socket = socket_wrapper
1991
# The socketserver.TCPServer.__init__ will call
1992
# socket.socket(), which might be our replacement,
1993
# socket_wrapper(), if socketfd was set.
1994
1447
socketserver.TCPServer.__init__(self, server_address,
1995
1448
RequestHandlerClass)
1996
1997
1449
def server_bind(self):
1998
1450
"""This overrides the normal server_bind() function
1999
1451
to bind to an interface if one was specified, and also NOT to
2005
1457
self.interface)
2006
1458
else:
2007
1459
try:
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
1460
self.socket.setsockopt(socket.SOL_SOCKET,
1461
SO_BINDTODEVICE,
1462
str(self.interface
1463
+ '\0'))
2011
1464
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
1465
if error[0] == errno.EPERM:
1466
logger.error("No permission to"
1467
" bind to interface %s",
1468
self.interface)
1469
elif error[0] == errno.ENOPROTOOPT:
2016
1470
logger.error("SO_BINDTODEVICE not available;"
2017
1471
" cannot bind to interface %s",
2018
1472
self.interface)
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2022
1473
else:
2023
1474
raise
2024
1475
# Only bind(2) the socket if we really need to.
2027
1478
if self.address_family == socket.AF_INET6:
2028
1479
any_address = "::" # in6addr_any
2029
1480
else:
2030
any_address = "0.0.0.0" # INADDR_ANY
1481
any_address = socket.INADDR_ANY
2031
1482
self.server_address = (any_address,
2032
1483
self.server_address[1])
2033
1484
elif not self.server_address[1]:
2034
self.server_address = (self.server_address[0], 0)
1485
self.server_address = (self.server_address[0],
1486
0)
2035
1487
# if self.interface:
2036
1488
# self.server_address = (self.server_address[0],
2037
1489
# 0, # port
2051
1503
2052
1504
Assumes a gobject.MainLoop event loop.
2053
1505
"""
2054
2055
1506
def __init__(self, server_address, RequestHandlerClass,
2056
interface=None,
2057
use_ipv6=True,
2058
clients=None,
2059
gnutls_priority=None,
2060
use_dbus=True,
2061
socketfd=None):
1507
interface=None, use_ipv6=True, clients=None,
1508
gnutls_priority=None, use_dbus=True):
2062
1509
self.enabled = False
2063
1510
self.clients = clients
2064
1511
if self.clients is None:
2065
self.clients = {}
1512
self.clients = set()
2066
1513
self.use_dbus = use_dbus
2067
1514
self.gnutls_priority = gnutls_priority
2068
1515
IPv6_TCPServer.__init__(self, server_address,
2069
1516
RequestHandlerClass,
2070
1517
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2073
1518
use_ipv6 = use_ipv6)
2074
1519
def server_activate(self):
2075
1520
if self.enabled:
2076
1521
return socketserver.TCPServer.server_activate(self)
2077
2078
1522
def enable(self):
2079
1523
self.enabled = True
2080
2081
def add_pipe(self, parent_pipe, proc):
1524
def add_pipe(self, parent_pipe):
2082
1525
# Call "handle_ipc" for both data and EOF events
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2086
functools.partial(self.handle_ipc,
2087
parent_pipe = parent_pipe,
2088
proc = proc))
2089
2090
def handle_ipc(self, source, condition,
2091
parent_pipe=None,
2092
proc = None,
1526
gobject.io_add_watch(parent_pipe.fileno(),
1527
gobject.IO_IN | gobject.IO_HUP,
1528
functools.partial(self.handle_ipc,
1529
parent_pipe = parent_pipe))
1530
1531
def handle_ipc(self, source, condition, parent_pipe=None,
2093
1532
client_object=None):
2094
# error, or the other end of multiprocessing.Pipe has closed
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2096
# Wait for other process to exit
2097
proc.join()
1533
condition_names = {
1534
gobject.IO_IN: "IN", # There is data to read.
1535
gobject.IO_OUT: "OUT", # Data can be written (without
1536
# blocking).
1537
gobject.IO_PRI: "PRI", # There is urgent data to read.
1538
gobject.IO_ERR: "ERR", # Error condition.
1539
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1540
# broken, usually for pipes and
1541
# sockets).
1542
}
1543
conditions_string = ' | '.join(name
1544
for cond, name in
1545
condition_names.iteritems()
1546
if cond & condition)
1547
# error or the other end of multiprocessing.Pipe has closed
1548
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2098
1549
return False
2099
1550
2100
1551
# Read a request from the child
2105
1556
fpr = request[1]
2106
1557
address = request[2]
2107
1558
2108
for c in self.clients.itervalues():
1559
for c in self.clients:
2109
1560
if c.fingerprint == fpr:
2110
1561
client = c
2111
1562
break
2112
1563
else:
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
1564
logger.warning("Client not found for fingerprint: %s, ad"
1565
"dress: %s", fpr, address)
2115
1566
if self.use_dbus:
2116
1567
# Emit D-Bus signal
2117
mandos_dbus_service.ClientNotFound(fpr,
2118
address[0])
1568
mandos_dbus_service.ClientNotFound(fpr, address[0])
2119
1569
parent_pipe.send(False)
2120
1570
return False
2121
1571
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2125
functools.partial(self.handle_ipc,
2126
parent_pipe = parent_pipe,
2127
proc = proc,
2128
client_object = client))
1572
gobject.io_add_watch(parent_pipe.fileno(),
1573
gobject.IO_IN | gobject.IO_HUP,
1574
functools.partial(self.handle_ipc,
1575
parent_pipe = parent_pipe,
1576
client_object = client))
2129
1577
parent_pipe.send(True)
2130
# remove the old hook in favor of the new above hook on
2131
# same fileno
1578
# remove the old hook in favor of the new above hook on same fileno
2132
1579
return False
2133
1580
if command == 'funcall':
2134
1581
funcname = request[1]
2135
1582
args = request[2]
2136
1583
kwargs = request[3]
2137
1584
2138
parent_pipe.send(('data', getattr(client_object,
2139
funcname)(*args,
2140
**kwargs)))
2141
1585
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1586
2142
1587
if command == 'getattr':
2143
1588
attrname = request[1]
2144
if isinstance(client_object.__getattribute__(attrname),
2145
collections.Callable):
2146
parent_pipe.send(('function', ))
1589
if callable(client_object.__getattribute__(attrname)):
1590
parent_pipe.send(('function',))
2147
1591
else:
2148
parent_pipe.send((
2149
'data', client_object.__getattribute__(attrname)))
1592
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2150
1593
2151
1594
if command == 'setattr':
2152
1595
attrname = request[1]
2153
1596
value = request[2]
2154
1597
setattr(client_object, attrname, value)
2155
1598
2156
1599
return True
2157
1600
2158
1601
2159
def rfc3339_duration_to_delta(duration):
2160
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2161
2162
>>> rfc3339_duration_to_delta("P7D")
2163
datetime.timedelta(7)
2164
>>> rfc3339_duration_to_delta("PT60S")
2165
datetime.timedelta(0, 60)
2166
>>> rfc3339_duration_to_delta("PT60M")
2167
datetime.timedelta(0, 3600)
2168
>>> rfc3339_duration_to_delta("PT24H")
2169
datetime.timedelta(1)
2170
>>> rfc3339_duration_to_delta("P1W")
2171
datetime.timedelta(7)
2172
>>> rfc3339_duration_to_delta("PT5M30S")
2173
datetime.timedelta(0, 330)
2174
>>> rfc3339_duration_to_delta("P1DT3M20S")
2175
datetime.timedelta(1, 200)
2176
"""
2177
2178
# Parsing an RFC 3339 duration with regular expressions is not
2179
# possible - there would have to be multiple places for the same
2180
# values, like seconds. The current code, while more esoteric, is
2181
# cleaner without depending on a parsing library. If Python had a
2182
# built-in library for parsing we would use it, but we'd like to
2183
# avoid excessive use of external libraries.
2184
2185
# New type for defining tokens, syntax, and semantics all-in-one
2186
Token = collections.namedtuple("Token", (
2187
"regexp", # To match token; if "value" is not None, must have
2188
# a "group" containing digits
2189
"value", # datetime.timedelta or None
2190
"followers")) # Tokens valid after this token
2191
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2192
# the "duration" ABNF definition in RFC 3339, Appendix A.
2193
token_end = Token(re.compile(r"$"), None, frozenset())
2194
token_second = Token(re.compile(r"(\d+)S"),
2195
datetime.timedelta(seconds=1),
2196
frozenset((token_end, )))
2197
token_minute = Token(re.compile(r"(\d+)M"),
2198
datetime.timedelta(minutes=1),
2199
frozenset((token_second, token_end)))
2200
token_hour = Token(re.compile(r"(\d+)H"),
2201
datetime.timedelta(hours=1),
2202
frozenset((token_minute, token_end)))
2203
token_time = Token(re.compile(r"T"),
2204
None,
2205
frozenset((token_hour, token_minute,
2206
token_second)))
2207
token_day = Token(re.compile(r"(\d+)D"),
2208
datetime.timedelta(days=1),
2209
frozenset((token_time, token_end)))
2210
token_month = Token(re.compile(r"(\d+)M"),
2211
datetime.timedelta(weeks=4),
2212
frozenset((token_day, token_end)))
2213
token_year = Token(re.compile(r"(\d+)Y"),
2214
datetime.timedelta(weeks=52),
2215
frozenset((token_month, token_end)))
2216
token_week = Token(re.compile(r"(\d+)W"),
2217
datetime.timedelta(weeks=1),
2218
frozenset((token_end, )))
2219
token_duration = Token(re.compile(r"P"), None,
2220
frozenset((token_year, token_month,
2221
token_day, token_time,
2222
token_week)))
2223
# Define starting values
2224
value = datetime.timedelta() # Value so far
2225
found_token = None
2226
followers = frozenset((token_duration, )) # Following valid tokens
2227
s = duration # String left to parse
2228
# Loop until end token is found
2229
while found_token is not token_end:
2230
# Search for any currently valid tokens
2231
for token in followers:
2232
match = token.regexp.match(s)
2233
if match is not None:
2234
# Token found
2235
if token.value is not None:
2236
# Value found, parse digits
2237
factor = int(match.group(1), 10)
2238
# Add to value so far
2239
value += factor * token.value
2240
# Strip token from string
2241
s = token.regexp.sub("", s, 1)
2242
# Go to found token
2243
found_token = token
2244
# Set valid next tokens
2245
followers = found_token.followers
2246
break
2247
else:
2248
# No currently valid tokens were found
2249
raise ValueError("Invalid RFC 3339 duration: {!r}"
2250
.format(duration))
2251
# End token found
2252
return value
2253
2254
2255
1602
def string_to_delta(interval):
2256
1603
"""Parse a string and return a datetime.timedelta
2257
1604
2268
1615
>>> string_to_delta('5m 30s')
2269
1616
datetime.timedelta(0, 330)
2270
1617
"""
2271
2272
try:
2273
return rfc3339_duration_to_delta(interval)
2274
except ValueError:
2275
pass
2276
2277
1618
timevalue = datetime.timedelta(0)
2278
1619
for s in interval.split():
2279
1620
try:
2280
suffix = s[-1]
1621
suffix = unicode(s[-1])
2281
1622
value = int(s[:-1])
2282
1623
if suffix == "d":
2283
1624
delta = datetime.timedelta(value)
2290
1631
elif suffix == "w":
2291
1632
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2292
1633
else:
2293
raise ValueError("Unknown suffix {!r}".format(suffix))
2294
except IndexError as e:
1634
raise ValueError("Unknown suffix %r" % suffix)
1635
except (ValueError, IndexError) as e:
2295
1636
raise ValueError(*(e.args))
2296
1637
timevalue += delta
2297
1638
return timevalue
2298
1639
2299
1640
1641
def if_nametoindex(interface):
1642
"""Call the C function if_nametoindex(), or equivalent
1643
1644
Note: This function cannot accept a unicode string."""
1645
global if_nametoindex
1646
try:
1647
if_nametoindex = (ctypes.cdll.LoadLibrary
1648
(ctypes.util.find_library("c"))
1649
.if_nametoindex)
1650
except (OSError, AttributeError):
1651
logger.warning("Doing if_nametoindex the hard way")
1652
def if_nametoindex(interface):
1653
"Get an interface index the hard way, i.e. using fcntl()"
1654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1655
with contextlib.closing(socket.socket()) as s:
1656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1657
struct.pack(str("16s16x"),
1658
interface))
1659
interface_index = struct.unpack(str("I"),
1660
ifreq[16:20])[0]
1661
return interface_index
1662
return if_nametoindex(interface)
1663
1664
2300
1665
def daemon(nochdir = False, noclose = False):
2301
1666
"""See daemon(3). Standard BSD Unix function.
2302
1667
2310
1675
sys.exit()
2311
1676
if not noclose:
2312
1677
# Close all standard open file descriptors
2313
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1678
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2314
1679
if not stat.S_ISCHR(os.fstat(null).st_mode):
2315
1680
raise OSError(errno.ENODEV,
2316
"{} not a character device"
2317
.format(os.devnull))
1681
"%s not a character device"
1682
% os.path.devnull)
2318
1683
os.dup2(null, sys.stdin.fileno())
2319
1684
os.dup2(null, sys.stdout.fileno())
2320
1685
os.dup2(null, sys.stderr.fileno())
2329
1694
2330
1695
parser = argparse.ArgumentParser()
2331
1696
parser.add_argument("-v", "--version", action="version",
2332
version = "%(prog)s {}".format(version),
1697
version = "%%(prog)s %s" % version,
2333
1698
help="show version number and exit")
2334
1699
parser.add_argument("-i", "--interface", metavar="IF",
2335
1700
help="Bind to interface IF")
2341
1706
help="Run self-test")
2342
1707
parser.add_argument("--debug", action="store_true",
2343
1708
help="Debug mode; run in foreground and log"
2344
" to terminal", default=None)
1709
" to terminal")
2345
1710
parser.add_argument("--debuglevel", metavar="LEVEL",
2346
1711
help="Debug level for stdout output")
2347
1712
parser.add_argument("--priority", help="GnuTLS"
2354
1719
" files")
2355
1720
parser.add_argument("--no-dbus", action="store_false",
2356
1721
dest="use_dbus", help="Do not provide D-Bus"
2357
" system bus interface", default=None)
1722
" system bus interface")
2358
1723
parser.add_argument("--no-ipv6", action="store_false",
2359
dest="use_ipv6", help="Do not use IPv6",
2360
default=None)
2361
parser.add_argument("--no-restore", action="store_false",
2362
dest="restore", help="Do not restore stored"
2363
" state", default=None)
2364
parser.add_argument("--socket", type=int,
2365
help="Specify a file descriptor to a network"
2366
" socket to use instead of creating one")
2367
parser.add_argument("--statedir", metavar="DIR",
2368
help="Directory to save/restore state in")
2369
parser.add_argument("--foreground", action="store_true",
2370
help="Run in foreground", default=None)
2371
parser.add_argument("--no-zeroconf", action="store_false",
2372
dest="zeroconf", help="Do not use Zeroconf",
2373
default=None)
2374
1724
dest="use_ipv6", help="Do not use IPv6")
2375
1725
options = parser.parse_args()
2376
1726
2377
1727
if options.check:
2378
1728
import doctest
2379
fail_count, test_count = doctest.testmod()
2380
sys.exit(os.EX_OK if fail_count == 0 else 1)
1729
doctest.testmod()
1730
sys.exit()
2381
1731
2382
1732
# Default values for config file for server-global settings
2383
1733
server_defaults = { "interface": "",
2385
1735
"port": "",
2386
1736
"debug": "False",
2387
1737
"priority":
2388
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2389
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
1738
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2390
1739
"servicename": "Mandos",
2391
1740
"use_dbus": "True",
2392
1741
"use_ipv6": "True",
2393
1742
"debuglevel": "",
2394
"restore": "True",
2395
"socket": "",
2396
"statedir": "/var/lib/mandos",
2397
"foreground": "False",
2398
"zeroconf": "True",
2399
}
1743
}
2400
1744
2401
1745
# Parse config file for server-global settings
2402
1746
server_config = configparser.SafeConfigParser(server_defaults)
2403
1747
del server_defaults
2404
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1748
server_config.read(os.path.join(options.configdir,
1749
"mandos.conf"))
2405
1750
# Convert the SafeConfigParser object to a dict
2406
1751
server_settings = server_config.defaults()
2407
1752
# Use the appropriate methods on the non-string config options
2408
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1753
for option in ("debug", "use_dbus", "use_ipv6"):
2409
1754
server_settings[option] = server_config.getboolean("DEFAULT",
2410
1755
option)
2411
1756
if server_settings["port"]:
2412
1757
server_settings["port"] = server_config.getint("DEFAULT",
2413
1758
"port")
2414
if server_settings["socket"]:
2415
server_settings["socket"] = server_config.getint("DEFAULT",
2416
"socket")
2417
# Later, stdin will, and stdout and stderr might, be dup'ed
2418
# over with an opened os.devnull. But we don't want this to
2419
# happen with a supplied network socket.
2420
if 0 <= server_settings["socket"] <= 2:
2421
server_settings["socket"] = os.dup(server_settings
2422
["socket"])
2423
1759
del server_config
2424
1760
2425
1761
# Override the settings from the config file with command line
2426
1762
# options, if set.
2427
1763
for option in ("interface", "address", "port", "debug",
2428
"priority", "servicename", "configdir", "use_dbus",
2429
"use_ipv6", "debuglevel", "restore", "statedir",
2430
"socket", "foreground", "zeroconf"):
1764
"priority", "servicename", "configdir",
1765
"use_dbus", "use_ipv6", "debuglevel"):
2431
1766
value = getattr(options, option)
2432
1767
if value is not None:
2433
1768
server_settings[option] = value
2434
1769
del options
2435
1770
# Force all strings to be unicode
2436
1771
for option in server_settings.keys():
2437
if isinstance(server_settings[option], bytes):
2438
server_settings[option] = (server_settings[option]
2439
.decode("utf-8"))
2440
# Force all boolean options to be boolean
2441
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2442
"foreground", "zeroconf"):
2443
server_settings[option] = bool(server_settings[option])
2444
# Debug implies foreground
2445
if server_settings["debug"]:
2446
server_settings["foreground"] = True
1772
if type(server_settings[option]) is str:
1773
server_settings[option] = unicode(server_settings[option])
2447
1774
# Now we have our good server settings in "server_settings"
2448
1775
2449
1776
##################################################################
2450
1777
2451
if (not server_settings["zeroconf"]
2452
and not (server_settings["port"]
2453
or server_settings["socket"] != "")):
2454
parser.error("Needs port or socket to work without Zeroconf")
2455
2456
1778
# For convenience
2457
1779
debug = server_settings["debug"]
2458
1780
debuglevel = server_settings["debuglevel"]
2459
1781
use_dbus = server_settings["use_dbus"]
2460
1782
use_ipv6 = server_settings["use_ipv6"]
2461
stored_state_path = os.path.join(server_settings["statedir"],
2462
stored_state_file)
2463
foreground = server_settings["foreground"]
2464
zeroconf = server_settings["zeroconf"]
2465
2466
if debug:
2467
initlogger(debug, logging.DEBUG)
2468
else:
2469
if not debuglevel:
2470
initlogger(debug)
2471
else:
2472
level = getattr(logging, debuglevel.upper())
2473
initlogger(debug, level)
2474
1783
2475
1784
if server_settings["servicename"] != "Mandos":
2476
syslogger.setFormatter(
2477
logging.Formatter('Mandos ({}) [%(process)d]:'
2478
' %(levelname)s: %(message)s'.format(
2479
server_settings["servicename"])))
1785
syslogger.setFormatter(logging.Formatter
1786
('Mandos (%s) [%%(process)d]:'
1787
' %%(levelname)s: %%(message)s'
1788
% server_settings["servicename"]))
2480
1789
2481
1790
# Parse config file with clients
2482
client_config = configparser.SafeConfigParser(Client
2483
.client_defaults)
1791
client_defaults = { "timeout": "1h",
1792
"interval": "5m",
1793
"checker": "fping -q -- %%(host)s",
1794
"host": "",
1795
"approval_delay": "0s",
1796
"approval_duration": "1s",
1797
}
1798
client_config = configparser.SafeConfigParser(client_defaults)
2484
1799
client_config.read(os.path.join(server_settings["configdir"],
2485
1800
"clients.conf"))
2486
1801
2487
1802
global mandos_dbus_service
2488
1803
mandos_dbus_service = None
2489
1804
2490
socketfd = None
2491
if server_settings["socket"] != "":
2492
socketfd = server_settings["socket"]
2493
tcp_server = MandosServer(
2494
(server_settings["address"], server_settings["port"]),
2495
ClientHandler,
2496
interface=(server_settings["interface"] or None),
2497
use_ipv6=use_ipv6,
2498
gnutls_priority=server_settings["priority"],
2499
use_dbus=use_dbus,
2500
socketfd=socketfd)
2501
if not foreground:
2502
pidfilename = "/run/mandos.pid"
2503
if not os.path.isdir("/run/."):
2504
pidfilename = "/var/run/mandos.pid"
2505
pidfile = None
1805
tcp_server = MandosServer((server_settings["address"],
1806
server_settings["port"]),
1807
ClientHandler,
1808
interface=(server_settings["interface"]
1809
or None),
1810
use_ipv6=use_ipv6,
1811
gnutls_priority=
1812
server_settings["priority"],
1813
use_dbus=use_dbus)
1814
if not debug:
1815
pidfilename = "/var/run/mandos.pid"
2506
1816
try:
2507
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2508
except IOError as e:
2509
logger.error("Could not open file %r", pidfilename,
2510
exc_info=e)
1817
pidfile = open(pidfilename, "w")
1818
except IOError:
1819
logger.error("Could not open file %r", pidfilename)
2511
1820
2512
for name in ("_mandos", "mandos", "nobody"):
1821
try:
1822
uid = pwd.getpwnam("_mandos").pw_uid
1823
gid = pwd.getpwnam("_mandos").pw_gid
1824
except KeyError:
2513
1825
try:
2514
uid = pwd.getpwnam(name).pw_uid
2515
gid = pwd.getpwnam(name).pw_gid
2516
break
1826
uid = pwd.getpwnam("mandos").pw_uid
1827
gid = pwd.getpwnam("mandos").pw_gid
2517
1828
except KeyError:
2518
continue
2519
else:
2520
uid = 65534
2521
gid = 65534
1829
try:
1830
uid = pwd.getpwnam("nobody").pw_uid
1831
gid = pwd.getpwnam("nobody").pw_gid
1832
except KeyError:
1833
uid = 65534
1834
gid = 65534
2522
1835
try:
2523
1836
os.setgid(gid)
2524
1837
os.setuid(uid)
2525
1838
except OSError as error:
2526
if error.errno != errno.EPERM:
2527
raise
1839
if error[0] != errno.EPERM:
1840
raise error
2528
1841
1842
if not debug and not debuglevel:
1843
syslogger.setLevel(logging.WARNING)
1844
console.setLevel(logging.WARNING)
1845
if debuglevel:
1846
level = getattr(logging, debuglevel.upper())
1847
syslogger.setLevel(level)
1848
console.setLevel(level)
1849
2529
1850
if debug:
2530
1851
# Enable all possible GnuTLS debugging
2531
1852
2537
1858
def debug_gnutls(level, string):
2538
1859
logger.debug("GnuTLS: %s", string[:-1])
2539
1860
2540
gnutls.library.functions.gnutls_global_set_log_function(
2541
debug_gnutls)
1861
(gnutls.library.functions
1862
.gnutls_global_set_log_function(debug_gnutls))
2542
1863
2543
1864
# Redirect stdin so all checkers get /dev/null
2544
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1865
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2545
1866
os.dup2(null, sys.stdin.fileno())
2546
1867
if null > 2:
2547
1868
os.close(null)
1869
else:
1870
# No console logging
1871
logger.removeHandler(console)
2548
1872
2549
1873
# Need to fork before connecting to D-Bus
2550
if not foreground:
1874
if not debug:
2551
1875
# Close all input and output, do double fork, etc.
2552
1876
daemon()
2553
1877
2554
# multiprocessing will use threads, so before we use gobject we
2555
# need to inform gobject that threads will be used.
2556
gobject.threads_init()
2557
2558
1878
global main_loop
2559
1879
# From the Avahi example code
2560
DBusGMainLoop(set_as_default=True)
1880
DBusGMainLoop(set_as_default=True )
2561
1881
main_loop = gobject.MainLoop()
2562
1882
bus = dbus.SystemBus()
2563
1883
# End of Avahi example code
2564
1884
if use_dbus:
2565
1885
try:
2566
bus_name = dbus.service.BusName("se.recompile.Mandos",
2567
bus,
2568
do_not_queue=True)
2569
old_bus_name = dbus.service.BusName(
2570
"se.bsnet.fukt.Mandos", bus,
2571
do_not_queue=True)
2572
except dbus.exceptions.DBusException as e:
2573
logger.error("Disabling D-Bus:", exc_info=e)
1886
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1887
bus, do_not_queue=True)
1888
except dbus.exceptions.NameExistsException as e:
1889
logger.error(unicode(e) + ", disabling D-Bus")
2574
1890
use_dbus = False
2575
1891
server_settings["use_dbus"] = False
2576
1892
tcp_server.use_dbus = False
2577
if zeroconf:
2578
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2579
service = AvahiServiceToSyslog(
2580
name = server_settings["servicename"],
2581
servicetype = "_mandos._tcp",
2582
protocol = protocol,
2583
bus = bus)
2584
if server_settings["interface"]:
2585
service.interface = if_nametoindex(
2586
server_settings["interface"].encode("utf-8"))
1893
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1894
service = AvahiService(name = server_settings["servicename"],
1895
servicetype = "_mandos._tcp",
1896
protocol = protocol, bus = bus)
1897
if server_settings["interface"]:
1898
service.interface = (if_nametoindex
1899
(str(server_settings["interface"])))
2587
1900
2588
1901
global multiprocessing_manager
2589
1902
multiprocessing_manager = multiprocessing.Manager()
2591
1904
client_class = Client
2592
1905
if use_dbus:
2593
1906
client_class = functools.partial(ClientDBus, bus = bus)
2594
2595
client_settings = Client.config_parser(client_config)
2596
old_client_settings = {}
2597
clients_data = {}
2598
2599
# This is used to redirect stdout and stderr for checker processes
2600
global wnull
2601
wnull = open(os.devnull, "w") # A writable /dev/null
2602
# Only used if server is running in foreground but not in debug
2603
# mode
2604
if debug or not foreground:
2605
wnull.close()
2606
2607
# Get client data and settings from last running state.
2608
if server_settings["restore"]:
2609
try:
2610
with open(stored_state_path, "rb") as stored_state:
2611
clients_data, old_client_settings = pickle.load(
2612
stored_state)
2613
os.remove(stored_state_path)
2614
except IOError as e:
2615
if e.errno == errno.ENOENT:
2616
logger.warning("Could not load persistent state:"
2617
" {}".format(os.strerror(e.errno)))
2618
else:
2619
logger.critical("Could not load persistent state:",
2620
exc_info=e)
2621
raise
2622
except EOFError as e:
2623
logger.warning("Could not load persistent state: "
2624
"EOFError:",
2625
exc_info=e)
2626
2627
with PGPEngine() as pgp:
2628
for client_name, client in clients_data.items():
2629
# Skip removed clients
2630
if client_name not in client_settings:
2631
continue
2632
2633
# Decide which value to use after restoring saved state.
2634
# We have three different values: Old config file,
2635
# new config file, and saved state.
2636
# New config value takes precedence if it differs from old
2637
# config value, otherwise use saved state.
2638
for name, value in client_settings[client_name].items():
2639
try:
2640
# For each value in new config, check if it
2641
# differs from the old config value (Except for
2642
# the "secret" attribute)
2643
if (name != "secret"
2644
and (value !=
2645
old_client_settings[client_name][name])):
2646
client[name] = value
2647
except KeyError:
2648
pass
2649
2650
# Clients who has passed its expire date can still be
2651
# enabled if its last checker was successful. A Client
2652
# whose checker succeeded before we stored its state is
2653
# assumed to have successfully run all checkers during
2654
# downtime.
2655
if client["enabled"]:
2656
if datetime.datetime.utcnow() >= client["expires"]:
2657
if not client["last_checked_ok"]:
2658
logger.warning(
2659
"disabling client {} - Client never "
2660
"performed a successful checker".format(
2661
client_name))
2662
client["enabled"] = False
2663
elif client["last_checker_status"] != 0:
2664
logger.warning(
2665
"disabling client {} - Client last"
2666
" checker failed with error code"
2667
" {}".format(
2668
client_name,
2669
client["last_checker_status"]))
2670
client["enabled"] = False
2671
else:
2672
client["expires"] = (
2673
datetime.datetime.utcnow()
2674
+ client["timeout"])
2675
logger.debug("Last checker succeeded,"
2676
" keeping {} enabled".format(
2677
client_name))
1907
def client_config_items(config, section):
1908
special_settings = {
1909
"approved_by_default":
1910
lambda: config.getboolean(section,
1911
"approved_by_default"),
1912
}
1913
for name, value in config.items(section):
2678
1914
try:
2679
client["secret"] = pgp.decrypt(
2680
client["encrypted_secret"],
2681
client_settings[client_name]["secret"])
2682
except PGPError:
2683
# If decryption fails, we use secret from new settings
2684
logger.debug("Failed to decrypt {} old secret".format(
2685
client_name))
2686
client["secret"] = (client_settings[client_name]
2687
["secret"])
2688
2689
# Add/remove clients based on new changes made to config
2690
for client_name in (set(old_client_settings)
2691
- set(client_settings)):
2692
del clients_data[client_name]
2693
for client_name in (set(client_settings)
2694
- set(old_client_settings)):
2695
clients_data[client_name] = client_settings[client_name]
2696
2697
# Create all client objects
2698
for client_name, client in clients_data.items():
2699
tcp_server.clients[client_name] = client_class(
2700
name = client_name,
2701
settings = client,
2702
server_settings = server_settings)
2703
1915
yield (name, special_settings[name]())
1916
except KeyError:
1917
yield (name, value)
1918
1919
tcp_server.clients.update(set(
1920
client_class(name = section,
1921
config= dict(client_config_items(
1922
client_config, section)))
1923
for section in client_config.sections()))
2704
1924
if not tcp_server.clients:
2705
1925
logger.warning("No clients defined")
2706
2707
if not foreground:
2708
if pidfile is not None:
2709
pid = os.getpid()
2710
try:
2711
with pidfile:
2712
print(pid, file=pidfile)
2713
except IOError:
2714
logger.error("Could not write to file %r with PID %d",
2715
pidfilename, pid)
2716
del pidfile
1926
1927
if not debug:
1928
try:
1929
with pidfile:
1930
pid = os.getpid()
1931
pidfile.write(str(pid) + "\n".encode("utf-8"))
1932
del pidfile
1933
except IOError:
1934
logger.error("Could not write to file %r with PID %d",
1935
pidfilename, pid)
1936
except NameError:
1937
# "pidfile" was never created
1938
pass
2717
1939
del pidfilename
2718
1940
1941
signal.signal(signal.SIGINT, signal.SIG_IGN)
1942
2719
1943
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2720
1944
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2721
1945
2722
1946
if use_dbus:
2723
2724
@alternate_dbus_interfaces(
2725
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2726
class MandosDBusService(DBusObjectWithProperties):
1947
class MandosDBusService(dbus.service.Object):
2727
1948
"""A D-Bus proxy object"""
2728
2729
1949
def __init__(self):
2730
1950
dbus.service.Object.__init__(self, bus, "/")
2731
2732
_interface = "se.recompile.Mandos"
2733
2734
@dbus_interface_annotations(_interface)
2735
def _foo(self):
2736
return {
2737
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2738
"false" }
1951
_interface = "se.bsnet.fukt.Mandos"
2739
1952
2740
1953
@dbus.service.signal(_interface, signature="o")
2741
1954
def ClientAdded(self, objpath):
2755
1968
@dbus.service.method(_interface, out_signature="ao")
2756
1969
def GetAllClients(self):
2757
1970
"D-Bus method"
2758
return dbus.Array(c.dbus_object_path for c in
2759
tcp_server.clients.itervalues())
1971
return dbus.Array(c.dbus_object_path
1972
for c in tcp_server.clients)
2760
1973
2761
1974
@dbus.service.method(_interface,
2762
1975
out_signature="a{oa{sv}}")
2763
1976
def GetAllClientsWithProperties(self):
2764
1977
"D-Bus method"
2765
1978
return dbus.Dictionary(
2766
{ c.dbus_object_path: c.GetAll("")
2767
for c in tcp_server.clients.itervalues() },
1979
((c.dbus_object_path, c.GetAll(""))
1980
for c in tcp_server.clients),
2768
1981
signature="oa{sv}")
2769
1982
2770
1983
@dbus.service.method(_interface, in_signature="o")
2771
1984
def RemoveClient(self, object_path):
2772
1985
"D-Bus method"
2773
for c in tcp_server.clients.itervalues():
1986
for c in tcp_server.clients:
2774
1987
if c.dbus_object_path == object_path:
2775
del tcp_server.clients[c.name]
1988
tcp_server.clients.remove(c)
2776
1989
c.remove_from_connection()
2777
1990
# Don't signal anything except ClientRemoved
2778
1991
c.disable(quiet=True)
2787
2000
2788
2001
def cleanup():
2789
2002
"Cleanup function; run on exit"
2790
if zeroconf:
2791
service.cleanup()
2792
2793
multiprocessing.active_children()
2794
wnull.close()
2795
if not (tcp_server.clients or client_settings):
2796
return
2797
2798
# Store client before exiting. Secrets are encrypted with key
2799
# based on what config file has. If config file is
2800
# removed/edited, old secret will thus be unrecovable.
2801
clients = {}
2802
with PGPEngine() as pgp:
2803
for client in tcp_server.clients.itervalues():
2804
key = client_settings[client.name]["secret"]
2805
client.encrypted_secret = pgp.encrypt(client.secret,
2806
key)
2807
client_dict = {}
2808
2809
# A list of attributes that can not be pickled
2810
# + secret.
2811
exclude = { "bus", "changedstate", "secret",
2812
"checker", "server_settings" }
2813
for name, typ in inspect.getmembers(dbus.service
2814
.Object):
2815
exclude.add(name)
2816
2817
client_dict["encrypted_secret"] = (client
2818
.encrypted_secret)
2819
for attr in client.client_structure:
2820
if attr not in exclude:
2821
client_dict[attr] = getattr(client, attr)
2822
2823
clients[client.name] = client_dict
2824
del client_settings[client.name]["secret"]
2825
2826
try:
2827
with tempfile.NamedTemporaryFile(
2828
mode='wb',
2829
suffix=".pickle",
2830
prefix='clients-',
2831
dir=os.path.dirname(stored_state_path),
2832
delete=False) as stored_state:
2833
pickle.dump((clients, client_settings), stored_state)
2834
tempname = stored_state.name
2835
os.rename(tempname, stored_state_path)
2836
except (IOError, OSError) as e:
2837
if not debug:
2838
try:
2839
os.remove(tempname)
2840
except NameError:
2841
pass
2842
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2843
logger.warning("Could not save persistent state: {}"
2844
.format(os.strerror(e.errno)))
2845
else:
2846
logger.warning("Could not save persistent state:",
2847
exc_info=e)
2848
raise
2849
2850
# Delete all clients, and settings from config
2003
service.cleanup()
2004
2851
2005
while tcp_server.clients:
2852
name, client = tcp_server.clients.popitem()
2006
client = tcp_server.clients.pop()
2853
2007
if use_dbus:
2854
2008
client.remove_from_connection()
2009
client.disable_hook = None
2855
2010
# Don't signal anything except ClientRemoved
2856
2011
client.disable(quiet=True)
2857
2012
if use_dbus:
2858
2013
# Emit D-Bus signal
2859
mandos_dbus_service.ClientRemoved(
2860
client.dbus_object_path, client.name)
2861
client_settings.clear()
2014
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2015
client.name)
2862
2016
2863
2017
atexit.register(cleanup)
2864
2018
2865
for client in tcp_server.clients.itervalues():
2019
for client in tcp_server.clients:
2866
2020
if use_dbus:
2867
2021
# Emit D-Bus signal
2868
2022
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2869
# Need to initiate checking of clients
2870
if client.enabled:
2871
client.init_checker()
2023
client.enable()
2872
2024
2873
2025
tcp_server.enable()
2874
2026
tcp_server.server_activate()
2875
2027
2876
2028
# Find out what port we got
2877
if zeroconf:
2878
service.port = tcp_server.socket.getsockname()[1]
2029
service.port = tcp_server.socket.getsockname()[1]
2879
2030
if use_ipv6:
2880
2031
logger.info("Now listening on address %r, port %d,"
2881
" flowinfo %d, scope_id %d",
2882
*tcp_server.socket.getsockname())
2032
" flowinfo %d, scope_id %d"
2033
% tcp_server.socket.getsockname())
2883
2034
else: # IPv4
2884
logger.info("Now listening on address %r, port %d",
2885
*tcp_server.socket.getsockname())
2035
logger.info("Now listening on address %r, port %d"
2036
% tcp_server.socket.getsockname())
2886
2037
2887
2038
#service.interface = tcp_server.socket.getsockname()[3]
2888
2039
2889
2040
try:
2890
if zeroconf:
2891
# From the Avahi example code
2892
try:
2893
service.activate()
2894
except dbus.exceptions.DBusException as error:
2895
logger.critical("D-Bus Exception", exc_info=error)
2896
cleanup()
2897
sys.exit(1)
2898
# End of Avahi example code
2041
# From the Avahi example code
2042
try:
2043
service.activate()
2044
except dbus.exceptions.DBusException as error:
2045
logger.critical("DBusException: %s", error)
2046
cleanup()
2047
sys.exit(1)
2048
# End of Avahi example code
2899
2049
2900
2050
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2901
2051
lambda *args, **kwargs:
2905
2055
logger.debug("Starting main loop")
2906
2056
main_loop.run()
2907
2057
except AvahiError as error:
2908
logger.critical("Avahi Error", exc_info=error)
2058
logger.critical("AvahiError: %s", error)
2909
2059
cleanup()
2910
2060
sys.exit(1)
2911
2061
except KeyboardInterrupt:
2916
2066
# Must run before the D-Bus bus name gets deregistered
2917
2067
cleanup()
2918
2068
2919
2920
2069
if __name__ == '__main__':
2921
2070
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0