/mandos/trunk : revision 482

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

37

import SocketServer as socketserver

43

38

import socket

44

39

import argparse

45

40

import datetime

50

45

import gnutls.library.functions

51

46

import gnutls.library.constants

52

47

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

48

import ConfigParser as configparser

57

49

import sys

58

50

import re

59

51

import os

68

60

import struct

69

61

import fcntl

70

62

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

63

import cPickle as pickle

75

64

import multiprocessing

76

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

81

import codecs

82

65

83

66

import dbus

84

67

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

68

import gobject

89

69

import avahi

90

70

from dbus.mainloop.glib import DBusGMainLoop

91

71

import ctypes

101

81

except ImportError:

102

82

SO_BINDTODEVICE = None

103

83

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

108

stored_state_file = "clients.pickle"

109

110

logger = logging.getLogger()

111

syslogger = None

112

113

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

116

except (OSError, AttributeError):

117

118

def if_nametoindex(interface):

119

"Get an interface index the hard way, i.e. using fcntl()"

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

with contextlib.closing(socket.socket()) as s:

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

125

return interface_index

126

127

128

def initlogger(debug, level=logging.WARNING):

129

"""init logger and add loglevel"""

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

syslogger.setFormatter(logging.Formatter

136

('Mandos [%(process)d]: %(levelname)s:'

137

' %(message)s'))

138

logger.addHandler(syslogger)

139

140

if debug:

141

console = logging.StreamHandler()

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

147

logger.setLevel(level)

148

149

150

class PGPError(Exception):

151

"""Exception if encryption/decryption fails"""

152

pass

153

154

155

class PGPEngine(object):

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

def __init__(self):

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

165

166

def __enter__(self):

167

return self

168

169

def __exit__(self, exc_type, exc_value, traceback):

170

self._cleanup()

171

return False

172

173

def __del__(self):

174

self._cleanup()

175

176

def _cleanup(self):

177

if self.tempdir is not None:

178

# Delete contents of tempdir

179

for root, dirs, files in os.walk(self.tempdir,

180

topdown = False):

181

for filename in files:

182

os.remove(os.path.join(root, filename))

183

for dirname in dirs:

184

os.rmdir(os.path.join(root, dirname))

185

# Remove tempdir

186

os.rmdir(self.tempdir)

187

self.tempdir = None

188

189

def password_encode(self, password):

190

# Passphrase can not be empty and can not contain newlines or

191

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

199

200

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

216

return ciphertext

217

218

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

234

return decrypted_plaintext

235

84

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

89

syslogger = (logging.handlers.SysLogHandler

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

236

102

237

103

class AvahiError(Exception):

238

104

def __init__(self, value, *args, **kwargs):

239

105

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

106

super(AvahiError, self).__init__(value, *args, **kwargs)

107

def __unicode__(self):

108

return unicode(repr(self.value))

243

109

244

110

class AvahiServiceError(AvahiError):

245

111

pass

246

112

247

248

113

class AvahiGroupError(AvahiError):

249

114

pass

250

115

257

122

Used to optionally bind to the specified interface.

258

123

name: string; Example: 'Mandos'

259

124

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

125

See <http://www.dns-sd.org/ServiceTypes.html>

261

126

port: integer; what port to announce

262

127

TXT: list of strings; TXT record for the service

263

128

domain: string; Domain to publish on, default to .local if empty.

269

134

server: D-Bus Server

270

135

bus: dbus.SystemBus()

271

136

"""

272

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

284

141

self.interface = interface

285

142

self.name = name

286

143

self.type = servicetype

295

152

self.server = None

296

153

self.bus = bus

297

154

self.entry_group_state_changed_match = None

298

299

def rename(self, remove=True):

155

def rename(self):

300

156

"""Derived from the Avahi example code"""

301

157

if self.rename_count >= self.max_renames:

302

158

logger.critical("No suitable Zeroconf service name found"

303

159

" after %i retries, exiting.",

304

160

self.rename_count)

305

161

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

309

163

logger.info("Changing Zeroconf service name to %r ...",

310

164

self.name)

311

if remove:

312

self.remove()

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

self.remove()

313

170

try:

314

171

self.add()

315

172

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

324

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

176

self.rename_count += 1

325

177

def remove(self):

326

178

"""Derived from the Avahi example code"""

179

if self.group is not None:

180

try:

181

self.group.Free()

182

except (dbus.exceptions.UnknownMethodException,

183

dbus.exceptions.DBusException) as e:

184

pass

185

self.group = None

327

186

if self.entry_group_state_changed_match is not None:

328

187

self.entry_group_state_changed_match.remove()

329

188

self.entry_group_state_changed_match = None

330

if self.group is not None:

331

self.group.Reset()

332

333

189

def add(self):

334

190

"""Derived from the Avahi example code"""

335

191

self.remove()

336

if self.group is None:

337

self.group = dbus.Interface(

338

self.bus.get_object(avahi.DBUS_NAME,

339

self.server.EntryGroupNew()),

340

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

self.group = dbus.Interface(

193

self.bus.get_object(avahi.DBUS_NAME,

194

self.server.EntryGroupNew(),

195

follow_name_owner_changes=True),

196

avahi.DBUS_INTERFACE_ENTRY_GROUP)

341

197

self.entry_group_state_changed_match = (

342

198

self.group.connect_to_signal(

343

'StateChanged', self.entry_group_state_changed))

199

'StateChanged', self .entry_group_state_changed))

344

200

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

345

201

self.name, self.type)

346

202

self.group.AddService(

352

208

dbus.UInt16(self.port),

353

209

avahi.string_array_to_txt_array(self.TXT))

354

210

self.group.Commit()

355

356

211

def entry_group_state_changed(self, state, error):

357

212

"""Derived from the Avahi example code"""

358

213

logger.debug("Avahi entry group state change: %i", state)

364

219

self.rename()

365

220

elif state == avahi.ENTRY_GROUP_FAILURE:

366

221

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

369

222

unicode(error))

223

raise AvahiGroupError("State changed: %s"

224

% unicode(error))

370

225

def cleanup(self):

371

226

"""Derived from the Avahi example code"""

372

if self.group is not None:

373

try:

374

self.group.Free()

375

except (dbus.exceptions.UnknownMethodException,

376

dbus.exceptions.DBusException):

377

pass

378

self.group = None

379

227

self.remove()

380

381

228

def server_state_changed(self, state, error=None):

382

229

"""Derived from the Avahi example code"""

383

230

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

231

bad_states = { avahi.SERVER_INVALID:

232

"Zeroconf server invalid",

233

avahi.SERVER_REGISTERING: None,

234

avahi.SERVER_COLLISION:

235

"Zeroconf server name collision",

236

avahi.SERVER_FAILURE:

237

"Zeroconf server failure" }

390

238

if state in bad_states:

391

if bad_states[state] is not None:

392

if error is None:

393

logger.error(bad_states[state])

394

else:

395

logger.error(bad_states[state] + ": %r", error)

396

self.cleanup()

239

if bad_states[state]:

240

logger.error(bad_states[state])

241

self.remove()

397

242

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

243

self.add()

410

244

else:

411

if error is None:

412

logger.debug("Unknown state: %r", state)

413

else:

414

logger.debug("Unknown state: %r: %r", state, error)

415

245

logger.debug("Unknown state: %r", state)

416

246

def activate(self):

417

247

"""Derived from the Avahi example code"""

418

248

if self.server is None:

422

252

follow_name_owner_changes=True),

423

253

avahi.DBUS_INTERFACE_SERVER)

424

254

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

255

self.server_state_changed)

426

256

self.server_state_changed(self.server.GetState())

427

257

428

258

429

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

431

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

436

return ret

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

448

259

class Client(object):

449

260

"""A representation of a client host served by this server.

450

261

451

262

Attributes:

452

approved: bool(); 'None' if not yet approved/disapproved

263

_approved: bool(); 'None' if not yet approved/disapproved

453

264

approval_delay: datetime.timedelta(); Time to wait for approval

454

265

approval_duration: datetime.timedelta(); Duration of one approval

455

266

checker: subprocess.Popen(); a running checker process used

462

273

instance %(name)s can be used in the command.

463

274

checker_initiator_tag: a gobject event source tag, or None

464

275

created: datetime.datetime(); (UTC) object creation

465

client_structure: Object describing what attributes a client has

466

and is used for storing the client at exit

467

276

current_checker_command: string; current running checker_command

277

disable_hook: If set, called by disable() as disable_hook(self)

468

278

disable_initiator_tag: a gobject event source tag, or None

469

279

enabled: bool()

470

280

fingerprint: string (40 or 32 hexadecimal digits); used to

473

283

interval: datetime.timedelta(); How often to start a new checker

474

284

last_approval_request: datetime.datetime(); (UTC) or None

475

285

last_checked_ok: datetime.datetime(); (UTC) or None

476

last_checker_status: integer between 0 and 255 reflecting exit

477

status of last checker. -1 reflects crashed

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

last_enabled: datetime.datetime(); (UTC) or None

286

last_enabled: datetime.datetime(); (UTC)

482

287

name: string; from the config file, used in log messages and

483

288

D-Bus identifiers

484

289

secret: bytestring; sent verbatim (over TLS) to client

485

290

timeout: datetime.timedelta(); How long from last_checked_ok

486

291

until this client is disabled

487

extended_timeout: extra long timeout when secret has been sent

488

292

runtime_expansions: Allowed attributes for runtime expansion.

489

expires: datetime.datetime(); time (UTC) when a client will be

490

disabled, or None

491

server_settings: The server_settings dict from main()

492

293

"""

493

294

494

295

runtime_expansions = ("approval_delay", "approval_duration",

495

"created", "enabled", "expires",

496

"fingerprint", "host", "interval",

497

"last_approval_request", "last_checked_ok",

296

"created", "enabled", "fingerprint",

297

"host", "interval", "last_checked_ok",

498

298

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

510

299

511

300

@staticmethod

512

def config_parser(config):

513

"""Construct a new dict of client settings of this form:

514

{ client_name: {setting_name: value, ...}, ...}

515

with exceptions for any special settings as defined above.

516

NOTE: Must be a pure function. Must return the same result

517

value given the same arguments.

518

"""

519

settings = {}

520

for client_name in config.sections():

521

section = dict(config.items(client_name))

522

client = settings[client_name] = {}

523

524

client["host"] = section["host"]

525

# Reformat values from string types to Python types

526

client["approved_by_default"] = config.getboolean(

527

client_name, "approved_by_default")

528

client["enabled"] = config.getboolean(client_name,

529

"enabled")

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

535

.replace(" ", ""))

536

if "secret" in section:

537

client["secret"] = section["secret"].decode("base64")

538

elif "secfile" in section:

539

with open(os.path.expanduser(os.path.expandvars

540

(section["secfile"])),

541

"rb") as secfile:

542

client["secret"] = secfile.read()

543

else:

544

raise TypeError("No secret or secfile for section {}"

545

.format(section))

546

client["timeout"] = string_to_delta(section["timeout"])

547

client["extended_timeout"] = string_to_delta(

548

section["extended_timeout"])

549

client["interval"] = string_to_delta(section["interval"])

550

client["approval_delay"] = string_to_delta(

551

section["approval_delay"])

552

client["approval_duration"] = string_to_delta(

553

section["approval_duration"])

554

client["checker_command"] = section["checker"]

555

client["last_approval_request"] = None

556

client["last_checked_ok"] = None

557

client["last_checker_status"] = -2

558

559

return settings

560

561

def __init__(self, settings, name = None, server_settings=None):

301

def _timedelta_to_milliseconds(td):

302

"Convert a datetime.timedelta() to milliseconds"

303

return ((td.days * 24 * 60 * 60 * 1000)

304

+ (td.seconds * 1000)

305

+ (td.microseconds // 1000))

306

307

def timeout_milliseconds(self):

308

"Return the 'timeout' attribute in milliseconds"

309

return self._timedelta_to_milliseconds(self.timeout)

310

311

def interval_milliseconds(self):

312

"Return the 'interval' attribute in milliseconds"

313

return self._timedelta_to_milliseconds(self.interval)

314

315

def approval_delay_milliseconds(self):

316

return self._timedelta_to_milliseconds(self.approval_delay)

317

318

def __init__(self, name = None, disable_hook=None, config=None):

319

"""Note: the 'checker' key in 'config' sets the

320

'checker_command' attribute and *not* the 'checker'

321

attribute."""

562

322

self.name = name

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

566

# adding all client settings

567

for setting, value in settings.items():

568

setattr(self, setting, value)

569

570

if self.enabled:

571

if not hasattr(self, "last_enabled"):

572

self.last_enabled = datetime.datetime.utcnow()

573

if not hasattr(self, "expires"):

574

self.expires = (datetime.datetime.utcnow()

575

+ self.timeout)

576

else:

577

self.last_enabled = None

578

self.expires = None

579

323

if config is None:

324

config = {}

580

325

logger.debug("Creating client %r", self.name)

326

# Uppercase and remove spaces from fingerprint for later

327

# comparison purposes with return value from the fingerprint()

328

# function

329

self.fingerprint = (config["fingerprint"].upper()

330

.replace(" ", ""))

581

331

logger.debug(" Fingerprint: %s", self.fingerprint)

582

self.created = settings.get("created",

583

datetime.datetime.utcnow())

584

585

# attributes specific for this server instance

332

if "secret" in config:

333

self.secret = config["secret"].decode("base64")

334

elif "secfile" in config:

335

with open(os.path.expanduser(os.path.expandvars

336

(config["secfile"])),

337

"rb") as secfile:

338

self.secret = secfile.read()

339

else:

340

raise TypeError("No secret or secfile for client %s"

341

% self.name)

342

self.host = config.get("host", "")

343

self.created = datetime.datetime.utcnow()

344

self.enabled = False

345

self.last_approval_request = None

346

self.last_enabled = None

347

self.last_checked_ok = None

348

self.timeout = string_to_delta(config["timeout"])

349

self.interval = string_to_delta(config["interval"])

350

self.disable_hook = disable_hook

586

351

self.checker = None

587

352

self.checker_initiator_tag = None

588

353

self.disable_initiator_tag = None

589

354

self.checker_callback_tag = None

355

self.checker_command = config["checker"]

590

356

self.current_checker_command = None

591

self.approved = None

357

self.last_connect = None

358

self._approved = None

359

self.approved_by_default = config.get("approved_by_default",

360

True)

592

361

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

597

if not attr.startswith("_")]

598

self.client_structure.append("client_structure")

599

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

602

if not name.startswith("_"):

603

self.client_structure.append(name)

362

self.approval_delay = string_to_delta(

363

config["approval_delay"])

364

self.approval_duration = string_to_delta(

365

config["approval_duration"])

366

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

604

367

605

# Send notice to process children that client state has changed

606

368

def send_changedstate(self):

607

with self.changedstate:

608

self.changedstate.notify_all()

609

369

self.changedstate.acquire()

370

self.changedstate.notify_all()

371

self.changedstate.release()

372

610

373

def enable(self):

611

374

"""Start this client's checker and timeout hooks"""

612

375

if getattr(self, "enabled", False):

613

376

# Already enabled

614

377

return

615

self.expires = datetime.datetime.utcnow() + self.timeout

616

self.enabled = True

378

self.send_changedstate()

617

379

self.last_enabled = datetime.datetime.utcnow()

618

self.init_checker()

619

self.send_changedstate()

380

# Schedule a new checker to be started an 'interval' from now,

381

# and every interval from then on.

382

self.checker_initiator_tag = (gobject.timeout_add

383

(self.interval_milliseconds(),

384

self.start_checker))

385

# Schedule a disable() when 'timeout' has passed

386

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

388

self.disable))

389

self.enabled = True

390

# Also start a new checker *right now*.

391

self.start_checker()

620

392

621

393

def disable(self, quiet=True):

622

394

"""Disable this client."""

623

395

if not getattr(self, "enabled", False):

624

396

return False

625

397

if not quiet:

398

self.send_changedstate()

399

if not quiet:

626

400

logger.info("Disabling client %s", self.name)

627

if getattr(self, "disable_initiator_tag", None) is not None:

401

if getattr(self, "disable_initiator_tag", False):

628

402

gobject.source_remove(self.disable_initiator_tag)

629

403

self.disable_initiator_tag = None

630

self.expires = None

631

if getattr(self, "checker_initiator_tag", None) is not None:

404

if getattr(self, "checker_initiator_tag", False):

632

405

gobject.source_remove(self.checker_initiator_tag)

633

406

self.checker_initiator_tag = None

634

407

self.stop_checker()

408

if self.disable_hook:

409

self.disable_hook(self)

635

410

self.enabled = False

636

if not quiet:

637

self.send_changedstate()

638

411

# Do not run this again if called by a gobject.timeout_add

639

412

return False

640

413

641

414

def __del__(self):

415

self.disable_hook = None

642

416

self.disable()

643

417

644

def init_checker(self):

645

# Schedule a new checker to be started an 'interval' from now,

646

# and every interval from then on.

647

if self.checker_initiator_tag is not None:

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

652

# Schedule a disable() when 'timeout' has passed

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

657

# Also start a new checker *right now*.

658

self.start_checker()

659

660

def checker_callback(self, source, condition, connection,

661

command):

418

def checker_callback(self, pid, condition, command):

662

419

"""The checker has completed, so take appropriate actions."""

663

420

self.checker_callback_tag = None

664

421

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

672

if self.last_checker_status == 0:

422

if os.WIFEXITED(condition):

423

exitstatus = os.WEXITSTATUS(condition)

424

if exitstatus == 0:

673

425

logger.info("Checker for %(name)s succeeded",

674

426

vars(self))

675

427

self.checked_ok()

676

428

else:

677

logger.info("Checker for %(name)s failed", vars(self))

429

logger.info("Checker for %(name)s failed",

430

vars(self))

678

431

else:

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

432

logger.warning("Checker for %(name)s crashed?",

682

433

vars(self))

683

return False

684

434

685

435

def checked_ok(self):

686

"""Assert that the client has been seen, alive and well."""

436

"""Bump up the timeout for this client.

437

438

This should only be called when the client has been seen,

439

alive and well.

440

"""

687

441

self.last_checked_ok = datetime.datetime.utcnow()

688

self.last_checker_status = 0

689

self.last_checker_signal = None

690

self.bump_timeout()

691

692

def bump_timeout(self, timeout=None):

693

"""Bump up the timeout for this client."""

694

if timeout is None:

695

timeout = self.timeout

696

if self.disable_initiator_tag is not None:

697

gobject.source_remove(self.disable_initiator_tag)

698

self.disable_initiator_tag = None

699

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

702

self.expires = datetime.datetime.utcnow() + timeout

442

gobject.source_remove(self.disable_initiator_tag)

443

self.disable_initiator_tag = (gobject.timeout_add

444

(self.timeout_milliseconds(),

445

self.disable))

703

446

704

447

def need_approval(self):

705

448

self.last_approval_request = datetime.datetime.utcnow()

710

453

If a checker already exists, leave it running and do

711

454

nothing."""

712

455

# The reason for not killing a running checker is that if we

713

# did that, and if a checker (for some reason) started running

714

# slowly and taking more than 'interval' time, then the client

715

# would inevitably timeout, since no checker would get a

716

# chance to run to completion. If we instead leave running

456

# did that, then if a checker (for some reason) started

457

# running slowly and taking more than 'interval' time, the

458

# client would inevitably timeout, since no checker would get

459

# a chance to run to completion. If we instead leave running

717

460

# checkers alone, the checker would have to take more time

718

461

# than 'timeout' for the client to be disabled, which is as it

719

462

# should be.

720

463

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

464

# If a checker exists, make sure it is not a zombie

465

try:

466

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

467

except (AttributeError, OSError) as error:

468

if (isinstance(error, OSError)

469

and error.errno != errno.ECHILD):

470

raise error

471

else:

472

if pid:

473

logger.warning("Checker was a zombie")

474

gobject.source_remove(self.checker_callback_tag)

475

self.checker_callback(pid, status,

476

self.current_checker_command)

725

477

# Start a new checker if needed

726

478

if self.checker is None:

727

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

731

479

try:

732

command = self.checker_command % escaped_attrs

733

except TypeError as error:

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

480

# In case checker_command has exactly one % operator

481

command = self.checker_command % self.host

482

except TypeError:

483

# Escape attributes for the shell

484

escaped_attrs = dict(

485

(attr,

486

re.escape(unicode(str(getattr(self, attr, "")),

487

errors=

488

'replace')))

489

for attr in

490

self.runtime_expansions)

491

492

try:

493

command = self.checker_command % escaped_attrs

494

except TypeError as error:

495

logger.error('Could not format string "%s":'

496

' %s', self.checker_command, error)

497

return True # Try again later

738

498

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

499

try:

500

logger.info("Starting checker %r for %s",

501

command, self.name)

502

# We don't need to redirect stdout and stderr, since

503

# in normal mode, that is already done by daemon(),

504

# and in debug mode we don't want to. (Stdin is

505

# always replaced by /dev/null.)

506

self.checker = subprocess.Popen(command,

507

close_fds=True,

508

shell=True, cwd="/")

509

self.checker_callback_tag = (gobject.child_watch_add

510

(self.checker.pid,

511

self.checker_callback,

512

data=command))

513

# The checker may have completed before the gobject

514

# watch was added. Check for this.

515

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

516

if pid:

517

gobject.source_remove(self.checker_callback_tag)

518

self.checker_callback(pid, status, command)

519

except OSError as error:

520

logger.error("Failed to start subprocess: %s",

521

error)

764

522

# Re-run this periodically if run by gobject.timeout_add

765

523

return True

766

524

772

530

if getattr(self, "checker", None) is None:

773

531

return

774

532

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

533

try:

534

os.kill(self.checker.pid, signal.SIGTERM)

535

#time.sleep(0.5)

536

#if self.checker.poll() is None:

537

# os.kill(self.checker.pid, signal.SIGKILL)

538

except OSError as error:

539

if error.errno != errno.ESRCH: # No such process

540

raise

776

541

self.checker = None

777

542

778

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

543

def dbus_service_property(dbus_interface, signature="v",

544

access="readwrite", byte_arrays=False):

783

545

"""Decorators for marking methods of a DBusObjectWithProperties to

784

546

become properties on the D-Bus.

785

547

794

556

# "Set" method, so we fail early here:

795

557

if byte_arrays and signature != "ay":

796

558

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {!r}".format(signature))

798

559

" signature %r" % signature)

799

560

def decorator(func):

800

561

func._dbus_is_property = True

801

562

func._dbus_interface = dbus_interface

806

567

func._dbus_name = func._dbus_name[:-14]

807

568

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

569

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

"""

846

847

def decorator(func):

848

func._dbus_annotations = annotations

849

return func

850

851

570

return decorator

852

571

853

572

854

573

class DBusPropertyException(dbus.exceptions.DBusException):

855

574

"""A base class for D-Bus property-related exceptions

856

575

"""

857

pass

576

def __unicode__(self):

577

return unicode(str(self))

858

578

859

579

860

580

class DBusPropertyAccessException(DBusPropertyException):

871

591

872

592

class DBusObjectWithProperties(dbus.service.Object):

873

593

"""A D-Bus object with properties.

874

594

875

595

Classes inheriting from this can use the dbus_service_property

876

596

decorator to expose methods as D-Bus properties. It exposes the

877

597

standard Get(), Set(), and GetAll() methods on the D-Bus.

878

598

"""

879

599

880

600

@staticmethod

881

def _is_dbus_thing(thing):

882

"""Returns a function testing if an attribute is a D-Bus thing

883

884

If called like _is_dbus_thing("method") it returns a function

885

suitable for use as predicate to inspect.getmembers().

886

"""

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

888

False)

601

def _is_dbus_property(obj):

602

return getattr(obj, "_dbus_is_property", False)

889

603

890

def _get_all_dbus_things(self, thing):

604

def _get_all_dbus_properties(self):

891

605

"""Returns a generator of (name, attribute) pairs

892

606

"""

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

894

athing.__get__(self))

895

for cls in self.__class__.__mro__

896

for name, athing in

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

607

return ((prop._dbus_name, prop)

608

for name, prop in

609

inspect.getmembers(self, self._is_dbus_property))

898

610

899

611

def _get_dbus_property(self, interface_name, property_name):

900

612

"""Returns a bound method if one exists which is a D-Bus

901

613

property with the specified name and interface.

902

614

"""

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

906

if (value._dbus_name == property_name

907

and value._dbus_interface == interface_name):

908

return value.__get__(self)

909

615

for name in (property_name,

616

property_name + "_dbus_property"):

617

prop = getattr(self, name, None)

618

if (prop is None

619

or not self._is_dbus_property(prop)

620

or prop._dbus_name != property_name

621

or (interface_name and prop._dbus_interface

622

and interface_name != prop._dbus_interface)):

623

continue

624

return prop

910

625

# No such property

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

626

raise DBusPropertyNotFound(self.dbus_object_path + ":"

627

+ interface_name + "."

628

+ property_name)

913

629

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

630

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

916

631

out_signature="v")

917

632

def Get(self, interface_name, property_name):

918

633

"""Standard D-Bus property Get() method, see D-Bus standard.

936

651

# The byte_arrays option is not supported yet on

937

652

# signatures other than "ay".

938

653

if prop._dbus_signature != "ay":

939

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {!r}"

941

.format(prop._dbus_signature))

942

value = dbus.ByteArray(b''.join(chr(byte)

943

for byte in value))

654

raise ValueError

655

value = dbus.ByteArray(''.join(unichr(byte)

656

for byte in value))

944

657

prop(value)

945

658

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

659

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

948

660

out_signature="a{sv}")

949

661

def GetAll(self, interface_name):

950

662

"""Standard D-Bus property GetAll() method, see D-Bus

951

663

standard.

952

664

953

665

Note: Will not include properties with access="write".

954

666

"""

955

properties = {}

956

for name, prop in self._get_all_dbus_things("property"):

667

all = {}

668

for name, prop in self._get_all_dbus_properties():

957

669

if (interface_name

958

670

and interface_name != prop._dbus_interface):

959

671

# Interface non-empty but did not match

963

675

continue

964

676

value = prop()

965

677

if not hasattr(value, "variant_level"):

966

properties[name] = value

678

all[name] = value

967

679

continue

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

970

return dbus.Dictionary(properties, signature="sv")

971

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

680

all[name] = type(value)(value, variant_level=

681

value.variant_level+1)

682

return dbus.Dictionary(all, signature="sv")

979

683

980

684

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

981

685

out_signature="s",

982

686

path_keyword='object_path',

983

687

connection_keyword='connection')

984

688

def Introspect(self, object_path, connection):

985

"""Overloading of standard D-Bus method.

986

987

Inserts property tags and interface annotation tags.

689

"""Standard D-Bus method, overloaded to insert property tags.

988

690

"""

989

691

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

692

connection)

991

693

try:

992

694

document = xml.dom.minidom.parseString(xmlstring)

993

994

695

def make_tag(document, name, prop):

995

696

e = document.createElement("property")

996

697

e.setAttribute("name", name)

997

698

e.setAttribute("type", prop._dbus_signature)

998

699

e.setAttribute("access", prop._dbus_access)

999

700

return e

1000

1001

701

for if_tag in document.getElementsByTagName("interface"):

1002

# Add property tags

1003

702

for tag in (make_tag(document, name, prop)

1004

703

for name, prop

1005

in self._get_all_dbus_things("property")

704

in self._get_all_dbus_properties()

1006

705

if prop._dbus_interface

1007

706

== if_tag.getAttribute("name")):

1008

707

if_tag.appendChild(tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1038

708

# Add the names to the return values for the

1039

709

# "org.freedesktop.DBus.Properties" methods

1040

710

if (if_tag.getAttribute("name")

1055

725

except (AttributeError, xml.dom.DOMException,

1056

726

xml.parsers.expat.ExpatError) as error:

1057

727

logger.error("Failed to override Introspection method",

1058

exc_info=error)

728

error)

1059

729

return xmlstring

1060

730

1061

731

1062

def datetime_to_dbus(dt, variant_level=0):

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1064

if dt is None:

1065

return dbus.String("", variant_level = variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1067

1068

1069

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1070

"""A class decorator; applied to a subclass of

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1072

interface names according to the "alt_interface_names" mapping.

1073

Usage:

1074

1075

@alternate_dbus_interfaces({"org.example.Interface":

1076

"net.example.AlternateInterface"})

1077

class SampleDBusObject(dbus.service.Object):

1078

@dbus.service.method("org.example.Interface")

1079

def SampleDBusMethod():

1080

pass

1081

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1083

reachable via two interfaces: "org.example.Interface" and

1084

"net.example.AlternateInterface", the latter of which will have

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1086

"true", unless "deprecate" is passed with a False value.

1087

1088

This works for methods and signals, and also for D-Bus properties

1089

(from DBusObjectWithProperties) and interfaces (from the

1090

dbus_interface_annotations decorator).

1091

"""

1092

1093

def wrapper(cls):

1094

for orig_interface_name, alt_interface_name in (

1095

alt_interface_names.items()):

1096

attr = {}

1097

interface_names = set()

1098

# Go though all attributes of the class

1099

for attrname, attribute in inspect.getmembers(cls):

1100

# Ignore non-D-Bus attributes, and D-Bus attributes

1101

# with the wrong interface name

1102

if (not hasattr(attribute, "_dbus_interface")

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1105

continue

1106

# Create an alternate D-Bus interface name based on

1107

# the current name

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1110

interface_names.add(alt_interface)

1111

# Is this a D-Bus signal?

1112

if getattr(attribute, "_dbus_is_signal", False):

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1120

else:

1121

nonmethod_func = attribute

1122

# Create a new, but exactly alike, function

1123

# object, and decorate it to be a new D-Bus signal

1124

# with the alternate D-Bus interface name

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1139

new_function = (dbus.service.signal(

1140

alt_interface,

1141

attribute._dbus_signature)(new_function))

1142

# Copy annotations, if any

1143

try:

1144

new_function._dbus_annotations = dict(

1145

attribute._dbus_annotations)

1146

except AttributeError:

1147

pass

1148

# Define a creator of a function to call both the

1149

# original and alternate functions, so both the

1150

# original and alternate signals gets sent when

1151

# the function is called

1152

def fixscope(func1, func2):

1153

"""This function is a scope container to pass

1154

func1 and func2 to the "call_both" function

1155

outside of its arguments"""

1156

1157

def call_both(*args, **kwargs):

1158

"""This function will emit two D-Bus

1159

signals by calling func1 and func2"""

1160

func1(*args, **kwargs)

1161

func2(*args, **kwargs)

1162

1163

return call_both

1164

# Create the "call_both" function and add it to

1165

# the class

1166

attr[attrname] = fixscope(attribute, new_function)

1167

# Is this a D-Bus method?

1168

elif getattr(attribute, "_dbus_is_method", False):

1169

# Create a new, but exactly alike, function

1170

# object. Decorate it to be a new D-Bus method

1171

# with the alternate D-Bus interface name. Add it

1172

# to the class.

1173

attr[attrname] = (

1174

dbus.service.method(

1175

alt_interface,

1176

attribute._dbus_in_signature,

1177

attribute._dbus_out_signature)

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1183

# Copy annotations, if any

1184

try:

1185

attr[attrname]._dbus_annotations = dict(

1186

attribute._dbus_annotations)

1187

except AttributeError:

1188

pass

1189

# Is this a D-Bus property?

1190

elif getattr(attribute, "_dbus_is_property", False):

1191

# Create a new, but exactly alike, function

1192

# object, and decorate it to be a new D-Bus

1193

# property with the alternate D-Bus interface

1194

# name. Add it to the class.

1195

attr[attrname] = (dbus_service_property(

1196

alt_interface, attribute._dbus_signature,

1197

attribute._dbus_access,

1198

attribute._dbus_get_args_options

1199

["byte_arrays"])

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1206

# Copy annotations, if any

1207

try:

1208

attr[attrname]._dbus_annotations = dict(

1209

attribute._dbus_annotations)

1210

except AttributeError:

1211

pass

1212

# Is this a D-Bus interface?

1213

elif getattr(attribute, "_dbus_is_interface", False):

1214

# Create a new, but exactly alike, function

1215

# object. Decorate it to be a new D-Bus interface

1216

# with the alternate D-Bus interface name. Add it

1217

# to the class.

1218

attr[attrname] = (

1219

dbus_interface_annotations(alt_interface)

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1225

if deprecate:

1226

# Deprecate all alternate interfaces

1227

iname="_AlternateDBusNames_interface_annotation{}"

1228

for interface_name in interface_names:

1229

1230

@dbus_interface_annotations(interface_name)

1231

def func(self):

1232

return { "org.freedesktop.DBus.Deprecated":

1233

"true" }

1234

# Find an unused name

1235

for aname in (iname.format(i)

1236

for i in itertools.count()):

1237

if aname not in attr:

1238

attr[aname] = func

1239

break

1240

if interface_names:

1241

# Replace the class with a new subclass of it with

1242

# methods, signals, etc. as created above.

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1245

return cls

1246

1247

return wrapper

1248

1249

1250

@alternate_dbus_interfaces({"se.recompile.Mandos":

1251

"se.bsnet.fukt.Mandos"})

1252

732

class ClientDBus(Client, DBusObjectWithProperties):

1253

733

"""A Client class using D-Bus

1254

734

1258

738

"""

1259

739

1260

740

runtime_expansions = (Client.runtime_expansions

1261

+ ("dbus_object_path", ))

1262

1263

_interface = "se.recompile.Mandos.Client"

741

+ ("dbus_object_path",))

1264

742

1265

743

# dbus.service.Object doesn't use super(), so we can't either.

1266

744

1267

745

def __init__(self, bus = None, *args, **kwargs):

746

self._approvals_pending = 0

1268

747

self.bus = bus

1269

748

Client.__init__(self, *args, **kwargs)

1270

749

# Only now, when this client is initialized, can it show up on

1271

750

# the D-Bus

1272

client_object_name = str(self.name).translate(

751

client_object_name = unicode(self.name).translate(

1273

752

{ord("."): ord("_"),

1274

753

ord("-"): ord("_")})

1275

self.dbus_object_path = dbus.ObjectPath(

1276

"/clients/" + client_object_name)

754

self.dbus_object_path = (dbus.ObjectPath

755

("/clients/" + client_object_name))

1277

756

DBusObjectWithProperties.__init__(self, self.bus,

1278

757

self.dbus_object_path)

1279

1280

def notifychangeproperty(transform_func, dbus_name,

1281

type_func=lambda x: x,

1282

variant_level=1,

1283

invalidate_only=False,

1284

_interface=_interface):

1285

""" Modify a variable so that it's a property which announces

1286

its changes to DBus.

1287

1288

transform_fun: Function that takes a value and a variant_level

1289

and transforms it to a D-Bus type.

1290

dbus_name: D-Bus name of the variable

1291

type_func: Function that transform the value before sending it

1292

to the D-Bus. Default: no transform

1293

variant_level: D-Bus variant level. Default: 1

1294

"""

1295

attrname = "_{}".format(dbus_name)

1296

1297

def setter(self, value):

1298

if hasattr(self, "dbus_object_path"):

1299

if (not hasattr(self, attrname) or

1300

type_func(getattr(self, attrname, None))

1301

!= type_func(value)):

1302

if invalidate_only:

1303

self.PropertiesChanged(

1304

_interface, dbus.Dictionary(),

1305

dbus.Array((dbus_name, )))

1306

else:

1307

dbus_value = transform_func(

1308

type_func(value),

1309

variant_level = variant_level)

1310

self.PropertyChanged(dbus.String(dbus_name),

1311

dbus_value)

1312

self.PropertiesChanged(

1313

_interface,

1314

dbus.Dictionary({ dbus.String(dbus_name):

1315

dbus_value }),

1316

dbus.Array())

1317

setattr(self, attrname, value)

1318

1319

return property(lambda self: getattr(self, attrname), setter)

1320

1321

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1322

approvals_pending = notifychangeproperty(dbus.Boolean,

1323

"ApprovalPending",

1324

type_func = bool)

1325

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1326

last_enabled = notifychangeproperty(datetime_to_dbus,

1327

"LastEnabled")

1328

checker = notifychangeproperty(

1329

dbus.Boolean, "CheckerRunning",

1330

type_func = lambda checker: checker is not None)

1331

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1332

"LastCheckedOK")

1333

last_checker_status = notifychangeproperty(dbus.Int16,

1334

"LastCheckerStatus")

1335

last_approval_request = notifychangeproperty(

1336

datetime_to_dbus, "LastApprovalRequest")

1337

approved_by_default = notifychangeproperty(dbus.Boolean,

1338

"ApprovedByDefault")

1339

approval_delay = notifychangeproperty(

1340

dbus.UInt64, "ApprovalDelay",

1341

type_func = lambda td: td.total_seconds() * 1000)

1342

approval_duration = notifychangeproperty(

1343

dbus.UInt64, "ApprovalDuration",

1344

type_func = lambda td: td.total_seconds() * 1000)

1345

host = notifychangeproperty(dbus.String, "Host")

1346

timeout = notifychangeproperty(

1347

dbus.UInt64, "Timeout",

1348

type_func = lambda td: td.total_seconds() * 1000)

1349

extended_timeout = notifychangeproperty(

1350

dbus.UInt64, "ExtendedTimeout",

1351

type_func = lambda td: td.total_seconds() * 1000)

1352

interval = notifychangeproperty(

1353

dbus.UInt64, "Interval",

1354

type_func = lambda td: td.total_seconds() * 1000)

1355

checker_command = notifychangeproperty(dbus.String, "Checker")

1356

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1357

invalidate_only=True)

1358

1359

del notifychangeproperty

758

759

def _get_approvals_pending(self):

760

return self._approvals_pending

761

def _set_approvals_pending(self, value):

762

old_value = self._approvals_pending

763

self._approvals_pending = value

764

bval = bool(value)

765

if (hasattr(self, "dbus_object_path")

766

and bval is not bool(old_value)):

767

dbus_bool = dbus.Boolean(bval, variant_level=1)

768

self.PropertyChanged(dbus.String("ApprovalPending"),

769

dbus_bool)

770

771

approvals_pending = property(_get_approvals_pending,

772

_set_approvals_pending)

773

del _get_approvals_pending, _set_approvals_pending

774

775

@staticmethod

776

def _datetime_to_dbus(dt, variant_level=0):

777

"""Convert a UTC datetime.datetime() to a D-Bus type."""

778

return dbus.String(dt.isoformat(),

779

variant_level=variant_level)

780

781

def enable(self):

782

oldstate = getattr(self, "enabled", False)

783

r = Client.enable(self)

784

if oldstate != self.enabled:

785

# Emit D-Bus signals

786

self.PropertyChanged(dbus.String("Enabled"),

787

dbus.Boolean(True, variant_level=1))

788

self.PropertyChanged(

789

dbus.String("LastEnabled"),

790

self._datetime_to_dbus(self.last_enabled,

791

variant_level=1))

792

return r

793

794

def disable(self, quiet = False):

795

oldstate = getattr(self, "enabled", False)

796

r = Client.disable(self, quiet=quiet)

797

if not quiet and oldstate != self.enabled:

798

# Emit D-Bus signal

799

self.PropertyChanged(dbus.String("Enabled"),

800

dbus.Boolean(False, variant_level=1))

801

return r

1360

802

1361

803

def __del__(self, *args, **kwargs):

1362

804

try:

1367

809

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1368

810

Client.__del__(self, *args, **kwargs)

1369

811

1370

def checker_callback(self, source, condition,

1371

connection, command, *args, **kwargs):

1372

ret = Client.checker_callback(self, source, condition,

1373

connection, command, *args,

1374

**kwargs)

1375

exitstatus = self.last_checker_status

1376

if exitstatus >= 0:

812

def checker_callback(self, pid, condition, command,

813

*args, **kwargs):

814

self.checker_callback_tag = None

815

self.checker = None

816

# Emit D-Bus signal

817

self.PropertyChanged(dbus.String("CheckerRunning"),

818

dbus.Boolean(False, variant_level=1))

819

if os.WIFEXITED(condition):

820

exitstatus = os.WEXITSTATUS(condition)

1377

821

# Emit D-Bus signal

1378

822

self.CheckerCompleted(dbus.Int16(exitstatus),

1379

# This is specific to GNU libC

1380

dbus.Int64(exitstatus << 8),

823

dbus.Int64(condition),

1381

824

dbus.String(command))

1382

825

else:

1383

826

# Emit D-Bus signal

1384

827

self.CheckerCompleted(dbus.Int16(-1),

1385

dbus.Int64(

1386

# This is specific to GNU libC

1387

(exitstatus << 8)

1388

| self.last_checker_signal),

828

dbus.Int64(condition),

1389

829

dbus.String(command))

1390

return ret

830

831

return Client.checker_callback(self, pid, condition, command,

832

*args, **kwargs)

833

834

def checked_ok(self, *args, **kwargs):

835

Client.checked_ok(self, *args, **kwargs)

836

# Emit D-Bus signal

837

self.PropertyChanged(

838

dbus.String("LastCheckedOK"),

839

(self._datetime_to_dbus(self.last_checked_ok,

840

variant_level=1)))

841

842

def need_approval(self, *args, **kwargs):

843

r = Client.need_approval(self, *args, **kwargs)

844

# Emit D-Bus signal

845

self.PropertyChanged(

846

dbus.String("LastApprovalRequest"),

847

(self._datetime_to_dbus(self.last_approval_request,

848

variant_level=1)))

849

return r

1391

850

1392

851

def start_checker(self, *args, **kwargs):

1393

old_checker_pid = getattr(self.checker, "pid", None)

852

old_checker = self.checker

853

if self.checker is not None:

854

old_checker_pid = self.checker.pid

855

else:

856

old_checker_pid = None

1394

857

r = Client.start_checker(self, *args, **kwargs)

1395

858

# Only if new checker process was started

1396

859

if (self.checker is not None

1397

860

and old_checker_pid != self.checker.pid):

1398

861

# Emit D-Bus signal

1399

862

self.CheckerStarted(self.current_checker_command)

863

self.PropertyChanged(

864

dbus.String("CheckerRunning"),

865

dbus.Boolean(True, variant_level=1))

1400

866

return r

1401

867

868

def stop_checker(self, *args, **kwargs):

869

old_checker = getattr(self, "checker", None)

870

r = Client.stop_checker(self, *args, **kwargs)

871

if (old_checker is not None

872

and getattr(self, "checker", None) is None):

873

self.PropertyChanged(dbus.String("CheckerRunning"),

874

dbus.Boolean(False, variant_level=1))

875

return r

876

1402

877

def _reset_approved(self):

1403

self.approved = None

878

self._approved = None

1404

879

return False

1405

880

1406

881

def approve(self, value=True):

1407

self.approved = value

1408

gobject.timeout_add(int(self.approval_duration.total_seconds()

1409

* 1000), self._reset_approved)

1410

882

self.send_changedstate()

883

self._approved = value

884

gobject.timeout_add(self._timedelta_to_milliseconds

885

(self.approval_duration),

886

self._reset_approved)

887

1411

888

1412

889

## D-Bus methods, signals & properties

1413

1414

## Interfaces

890

_interface = "se.bsnet.fukt.Mandos.Client"

1415

891

1416

892

## Signals

1417

893

1428

904

pass

1429

905

1430

906

# PropertyChanged - signal

1431

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1432

907

@dbus.service.signal(_interface, signature="sv")

1433

908

def PropertyChanged(self, property, value):

1434

909

"D-Bus signal"

1468

943

self.checked_ok()

1469

944

1470

945

# Enable - method

1471

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1472

946

@dbus.service.method(_interface)

1473

947

def Enable(self):

1474

948

"D-Bus method"

1475

949

self.enable()

1476

950

1477

951

# StartChecker - method

1478

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1479

952

@dbus.service.method(_interface)

1480

953

def StartChecker(self):

1481

954

"D-Bus method"

1482

955

self.start_checker()

1483

956

1484

957

# Disable - method

1485

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1486

958

@dbus.service.method(_interface)

1487

959

def Disable(self):

1488

960

"D-Bus method"

1489

961

self.disable()

1490

962

1491

963

# StopChecker - method

1492

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1493

964

@dbus.service.method(_interface)

1494

965

def StopChecker(self):

1495

966

self.stop_checker()

1502

973

return dbus.Boolean(bool(self.approvals_pending))

1503

974

1504

975

# ApprovedByDefault - property

1505

@dbus_service_property(_interface,

1506

signature="b",

976

@dbus_service_property(_interface, signature="b",

1507

977

access="readwrite")

1508

978

def ApprovedByDefault_dbus_property(self, value=None):

1509

979

if value is None: # get

1510

980

return dbus.Boolean(self.approved_by_default)

1511

981

self.approved_by_default = bool(value)

982

# Emit D-Bus signal

983

self.PropertyChanged(dbus.String("ApprovedByDefault"),

984

dbus.Boolean(value, variant_level=1))

1512

985

1513

986

# ApprovalDelay - property

1514

@dbus_service_property(_interface,

1515

signature="t",

987

@dbus_service_property(_interface, signature="t",

1516

988

access="readwrite")

1517

989

def ApprovalDelay_dbus_property(self, value=None):

1518

990

if value is None: # get

1519

return dbus.UInt64(self.approval_delay.total_seconds()

1520

* 1000)

991

return dbus.UInt64(self.approval_delay_milliseconds())

1521

992

self.approval_delay = datetime.timedelta(0, 0, 0, value)

993

# Emit D-Bus signal

994

self.PropertyChanged(dbus.String("ApprovalDelay"),

995

dbus.UInt64(value, variant_level=1))

1522

996

1523

997

# ApprovalDuration - property

1524

@dbus_service_property(_interface,

1525

signature="t",

998

@dbus_service_property(_interface, signature="t",

1526

999

access="readwrite")

1527

1000

def ApprovalDuration_dbus_property(self, value=None):

1528

1001

if value is None: # get

1529

return dbus.UInt64(self.approval_duration.total_seconds()

1530

* 1000)

1002

return dbus.UInt64(self._timedelta_to_milliseconds(

1003

self.approval_duration))

1531

1004

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1005

# Emit D-Bus signal

1006

self.PropertyChanged(dbus.String("ApprovalDuration"),

1007

dbus.UInt64(value, variant_level=1))

1532

1008

1533

1009

# Name - property

1534

@dbus_annotations(

1535

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1536

1010

@dbus_service_property(_interface, signature="s", access="read")

1537

1011

def Name_dbus_property(self):

1538

1012

return dbus.String(self.name)

1539

1013

1540

1014

# Fingerprint - property

1541

@dbus_annotations(

1542

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1543

1015

@dbus_service_property(_interface, signature="s", access="read")

1544

1016

def Fingerprint_dbus_property(self):

1545

1017

return dbus.String(self.fingerprint)

1546

1018

1547

1019

# Host - property

1548

@dbus_service_property(_interface,

1549

signature="s",

1020

@dbus_service_property(_interface, signature="s",

1550

1021

access="readwrite")

1551

1022

def Host_dbus_property(self, value=None):

1552

1023

if value is None: # get

1553

1024

return dbus.String(self.host)

1554

self.host = str(value)

1025

self.host = value

1026

# Emit D-Bus signal

1027

self.PropertyChanged(dbus.String("Host"),

1028

dbus.String(value, variant_level=1))

1555

1029

1556

1030

# Created - property

1557

@dbus_annotations(

1558

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1559

1031

@dbus_service_property(_interface, signature="s", access="read")

1560

1032

def Created_dbus_property(self):

1561

return datetime_to_dbus(self.created)

1033

return dbus.String(self._datetime_to_dbus(self.created))

1562

1034

1563

1035

# LastEnabled - property

1564

1036

@dbus_service_property(_interface, signature="s", access="read")

1565

1037

def LastEnabled_dbus_property(self):

1566

return datetime_to_dbus(self.last_enabled)

1038

if self.last_enabled is None:

1039

return dbus.String("")

1040

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1567

1041

1568

1042

# Enabled - property

1569

@dbus_service_property(_interface,

1570

signature="b",

1043

@dbus_service_property(_interface, signature="b",

1571

1044

access="readwrite")

1572

1045

def Enabled_dbus_property(self, value=None):

1573

1046

if value is None: # get

1578

1051

self.disable()

1579

1052

1580

1053

# LastCheckedOK - property

1581

@dbus_service_property(_interface,

1582

signature="s",

1054

@dbus_service_property(_interface, signature="s",

1583

1055

access="readwrite")

1584

1056

def LastCheckedOK_dbus_property(self, value=None):

1585

1057

if value is not None:

1586

1058

self.checked_ok()

1587

1059

return

1588

return datetime_to_dbus(self.last_checked_ok)

1589

1590

# LastCheckerStatus - property

1591

@dbus_service_property(_interface, signature="n", access="read")

1592

def LastCheckerStatus_dbus_property(self):

1593

return dbus.Int16(self.last_checker_status)

1594

1595

# Expires - property

1596

@dbus_service_property(_interface, signature="s", access="read")

1597

def Expires_dbus_property(self):

1598

return datetime_to_dbus(self.expires)

1060

if self.last_checked_ok is None:

1061

return dbus.String("")

1062

return dbus.String(self._datetime_to_dbus(self

1063

.last_checked_ok))

1599

1064

1600

1065

# LastApprovalRequest - property

1601

1066

@dbus_service_property(_interface, signature="s", access="read")

1602

1067

def LastApprovalRequest_dbus_property(self):

1603

return datetime_to_dbus(self.last_approval_request)

1068

if self.last_approval_request is None:

1069

return dbus.String("")

1070

return dbus.String(self.

1071

_datetime_to_dbus(self

1072

.last_approval_request))

1604

1073

1605

1074

# Timeout - property

1606

@dbus_service_property(_interface,

1607

signature="t",

1075

@dbus_service_property(_interface, signature="t",

1608

1076

access="readwrite")

1609

1077

def Timeout_dbus_property(self, value=None):

1610

1078

if value is None: # get

1611

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1612

old_timeout = self.timeout

1079

return dbus.UInt64(self.timeout_milliseconds())

1613

1080

self.timeout = datetime.timedelta(0, 0, 0, value)

1614

# Reschedule disabling

1615

if self.enabled:

1616

now = datetime.datetime.utcnow()

1617

self.expires += self.timeout - old_timeout

1618

if self.expires <= now:

1619

# The timeout has passed

1620

self.disable()

1621

else:

1622

if (getattr(self, "disable_initiator_tag", None)

1623

is None):

1624

return

1625

gobject.source_remove(self.disable_initiator_tag)

1626

self.disable_initiator_tag = gobject.timeout_add(

1627

int((self.expires - now).total_seconds() * 1000),

1628

self.disable)

1629

1630

# ExtendedTimeout - property

1631

@dbus_service_property(_interface,

1632

signature="t",

1633

access="readwrite")

1634

def ExtendedTimeout_dbus_property(self, value=None):

1635

if value is None: # get

1636

return dbus.UInt64(self.extended_timeout.total_seconds()

1637

* 1000)

1638

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1081

# Emit D-Bus signal

1082

self.PropertyChanged(dbus.String("Timeout"),

1083

dbus.UInt64(value, variant_level=1))

1084

if getattr(self, "disable_initiator_tag", None) is None:

1085

return

1086

# Reschedule timeout

1087

gobject.source_remove(self.disable_initiator_tag)

1088

self.disable_initiator_tag = None

1089

time_to_die = (self.

1090

_timedelta_to_milliseconds((self

1091

.last_checked_ok

1092

+ self.timeout)

1093

- datetime.datetime

1094

.utcnow()))

1095

if time_to_die <= 0:

1096

# The timeout has passed

1097

self.disable()

1098

else:

1099

self.disable_initiator_tag = (gobject.timeout_add

1100

(time_to_die, self.disable))

1639

1101

1640

1102

# Interval - property

1641

@dbus_service_property(_interface,

1642

signature="t",

1103

@dbus_service_property(_interface, signature="t",

1643

1104

access="readwrite")

1644

1105

def Interval_dbus_property(self, value=None):

1645

1106

if value is None: # get

1646

return dbus.UInt64(self.interval.total_seconds() * 1000)

1107

return dbus.UInt64(self.interval_milliseconds())

1647

1108

self.interval = datetime.timedelta(0, 0, 0, value)

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Interval"),

1111

dbus.UInt64(value, variant_level=1))

1648

1112

if getattr(self, "checker_initiator_tag", None) is None:

1649

1113

return

1650

if self.enabled:

1651

# Reschedule checker run

1652

gobject.source_remove(self.checker_initiator_tag)

1653

self.checker_initiator_tag = gobject.timeout_add(

1654

value, self.start_checker)

1655

self.start_checker() # Start one now, too

1656

1114

# Reschedule checker run

1115

gobject.source_remove(self.checker_initiator_tag)

1116

self.checker_initiator_tag = (gobject.timeout_add

1117

(value, self.start_checker))

1118

self.start_checker() # Start one now, too

1119

1657

1120

# Checker - property

1658

@dbus_service_property(_interface,

1659

signature="s",

1121

@dbus_service_property(_interface, signature="s",

1660

1122

access="readwrite")

1661

1123

def Checker_dbus_property(self, value=None):

1662

1124

if value is None: # get

1663

1125

return dbus.String(self.checker_command)

1664

self.checker_command = str(value)

1126

self.checker_command = value

1127

# Emit D-Bus signal

1128

self.PropertyChanged(dbus.String("Checker"),

1129

dbus.String(self.checker_command,

1130

variant_level=1))

1665

1131

1666

1132

# CheckerRunning - property

1667

@dbus_service_property(_interface,

1668

signature="b",

1133

@dbus_service_property(_interface, signature="b",

1669

1134

access="readwrite")

1670

1135

def CheckerRunning_dbus_property(self, value=None):

1671

1136

if value is None: # get

1676

1141

self.stop_checker()

1677

1142

1678

1143

# ObjectPath - property

1679

@dbus_annotations(

1680

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1681

"org.freedesktop.DBus.Deprecated": "true"})

1682

1144

@dbus_service_property(_interface, signature="o", access="read")

1683

1145

def ObjectPath_dbus_property(self):

1684

1146

return self.dbus_object_path # is already a dbus.ObjectPath

1685

1147

1686

1148

# Secret = property

1687

@dbus_annotations(

1688

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1689

"invalidates"})

1690

@dbus_service_property(_interface,

1691

signature="ay",

1692

access="write",

1693

byte_arrays=True)

1149

@dbus_service_property(_interface, signature="ay",

1150

access="write", byte_arrays=True)

1694

1151

def Secret_dbus_property(self, value):

1695

self.secret = bytes(value)

1152

self.secret = str(value)

1696

1153

1697

1154

del _interface

1698

1155

1702

1159

self._pipe = child_pipe

1703

1160

self._pipe.send(('init', fpr, address))

1704

1161

if not self._pipe.recv():

1705

raise KeyError(fpr)

1706

1162

raise KeyError()

1163

1707

1164

def __getattribute__(self, name):

1708

if name == '_pipe':

1165

if(name == '_pipe'):

1709

1166

return super(ProxyClient, self).__getattribute__(name)

1710

1167

self._pipe.send(('getattr', name))

1711

1168

data = self._pipe.recv()

1712

1169

if data[0] == 'data':

1713

1170

return data[1]

1714

1171

if data[0] == 'function':

1715

1716

1172

def func(*args, **kwargs):

1717

1173

self._pipe.send(('funcall', name, args, kwargs))

1718

1174

return self._pipe.recv()[1]

1719

1720

1175

return func

1721

1176

1722

1177

def __setattr__(self, name, value):

1723

if name == '_pipe':

1178

if(name == '_pipe'):

1724

1179

return super(ProxyClient, self).__setattr__(name, value)

1725

1180

self._pipe.send(('setattr', name, value))

1726

1181

1734

1189

def handle(self):

1735

1190

with contextlib.closing(self.server.child_pipe) as child_pipe:

1736

1191

logger.info("TCP connection from: %s",

1737

str(self.client_address))

1192

unicode(self.client_address))

1738

1193

logger.debug("Pipe FD: %d",

1739

1194

self.server.child_pipe.fileno())

1740

1741

session = gnutls.connection.ClientSession(

1742

self.request, gnutls.connection .X509Credentials())

1743

1195

1196

session = (gnutls.connection

1197

.ClientSession(self.request,

1198

gnutls.connection

1199

.X509Credentials()))

1200

1744

1201

# Note: gnutls.connection.X509Credentials is really a

1745

1202

# generic GnuTLS certificate credentials object so long as

1746

1203

# no X.509 keys are added to it. Therefore, we can use it

1747

1204

# here despite using OpenPGP certificates.

1748

1205

1749

1206

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1750

1207

# "+AES-256-CBC", "+SHA1",

1751

1208

# "+COMP-NULL", "+CTYPE-OPENPGP",

1754

1211

priority = self.server.gnutls_priority

1755

1212

if priority is None:

1756

1213

priority = "NORMAL"

1757

gnutls.library.functions.gnutls_priority_set_direct(

1758

session._c_object, priority, None)

1759

1214

(gnutls.library.functions

1215

.gnutls_priority_set_direct(session._c_object,

1216

priority, None))

1217

1760

1218

# Start communication using the Mandos protocol

1761

1219

# Get protocol number

1762

1220

line = self.request.makefile().readline()

1763

1221

logger.debug("Protocol version: %r", line)

1764

1222

try:

1765

1223

if int(line.strip().split()[0]) > 1:

1766

raise RuntimeError(line)

1224

raise RuntimeError

1767

1225

except (ValueError, IndexError, RuntimeError) as error:

1768

1226

logger.error("Unknown protocol version: %s", error)

1769

1227

return

1770

1228

1771

1229

# Start GnuTLS connection

1772

1230

try:

1773

1231

session.handshake()

1777

1235

# established. Just abandon the request.

1778

1236

return

1779

1237

logger.debug("Handshake succeeded")

1780

1238

1781

1239

approval_required = False

1782

1240

try:

1783

1241

try:

1784

fpr = self.fingerprint(

1785

self.peer_certificate(session))

1242

fpr = self.fingerprint(self.peer_certificate

1243

(session))

1786

1244

except (TypeError,

1787

1245

gnutls.errors.GNUTLSError) as error:

1788

1246

logger.warning("Bad certificate: %s", error)

1789

1247

return

1790

1248

logger.debug("Fingerprint: %s", fpr)

1791

1249

1792

1250

try:

1793

1251

client = ProxyClient(child_pipe, fpr,

1794

1252

self.client_address)

1802

1260

1803

1261

while True:

1804

1262

if not client.enabled:

1805

logger.info("Client %s is disabled",

1806

client.name)

1263

logger.warning("Client %s is disabled",

1264

client.name)

1807

1265

if self.server.use_dbus:

1808

1266

# Emit D-Bus signal

1809

client.Rejected("Disabled")

1267

client.Rejected("Disabled")

1810

1268

return

1811

1269

1812

if client.approved or not client.approval_delay:

1270

if client._approved or not client.approval_delay:

1813

1271

#We are approved or approval is disabled

1814

1272

break

1815

elif client.approved is None:

1273

elif client._approved is None:

1816

1274

logger.info("Client %s needs approval",

1817

1275

client.name)

1818

1276

if self.server.use_dbus:

1819

1277

# Emit D-Bus signal

1820

1278

client.NeedApproval(

1821

client.approval_delay.total_seconds()

1822

* 1000, client.approved_by_default)

1279

client.approval_delay_milliseconds(),

1280

client.approved_by_default)

1823

1281

else:

1824

1282

logger.warning("Client %s was not approved",

1825

1283

client.name)

1829

1287

return

1830

1288

1831

1289

#wait until timeout or approved

1290

#x = float(client._timedelta_to_milliseconds(delay))

1832

1291

time = datetime.datetime.now()

1833

1292

client.changedstate.acquire()

1834

client.changedstate.wait(delay.total_seconds())

1293

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1835

1294

client.changedstate.release()

1836

1295

time2 = datetime.datetime.now()

1837

1296

if (time2 - time) >= delay:

1853

1312

try:

1854

1313

sent = session.send(client.secret[sent_size:])

1855

1314

except gnutls.errors.GNUTLSError as error:

1856

logger.warning("gnutls send failed",

1857

exc_info=error)

1315

logger.warning("gnutls send failed")

1858

1316

return

1859

logger.debug("Sent: %d, remaining: %d", sent,

1860

len(client.secret) - (sent_size

1861

+ sent))

1317

logger.debug("Sent: %d, remaining: %d",

1318

sent, len(client.secret)

1319

- (sent_size + sent))

1862

1320

sent_size += sent

1863

1321

1864

1322

logger.info("Sending secret to %s", client.name)

1865

# bump the timeout using extended_timeout

1866

client.bump_timeout(client.extended_timeout)

1323

# bump the timeout as if seen

1324

client.checked_ok()

1867

1325

if self.server.use_dbus:

1868

1326

# Emit D-Bus signal

1869

1327

client.GotSecret()

1874

1332

try:

1875

1333

session.bye()

1876

1334

except gnutls.errors.GNUTLSError as error:

1877

logger.warning("GnuTLS bye failed",

1878

exc_info=error)

1335

logger.warning("GnuTLS bye failed")

1879

1336

1880

1337

@staticmethod

1881

1338

def peer_certificate(session):

1882

1339

"Return the peer's OpenPGP certificate as a bytestring"

1883

1340

# If not an OpenPGP certificate...

1884

if (gnutls.library.functions.gnutls_certificate_type_get(

1885

session._c_object)

1341

if (gnutls.library.functions

1342

.gnutls_certificate_type_get(session._c_object)

1886

1343

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1887

1344

# ...do the normal thing

1888

1345

return session.peer_certificate

1902

1359

def fingerprint(openpgp):

1903

1360

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1904

1361

# New GnuTLS "datum" with the OpenPGP public key

1905

datum = gnutls.library.types.gnutls_datum_t(

1906

ctypes.cast(ctypes.c_char_p(openpgp),

1907

ctypes.POINTER(ctypes.c_ubyte)),

1908

ctypes.c_uint(len(openpgp)))

1362

datum = (gnutls.library.types

1363

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1364

ctypes.POINTER

1365

(ctypes.c_ubyte)),

1366

ctypes.c_uint(len(openpgp))))

1909

1367

# New empty GnuTLS certificate

1910

1368

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1911

gnutls.library.functions.gnutls_openpgp_crt_init(

1912

ctypes.byref(crt))

1369

(gnutls.library.functions

1370

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1913

1371

# Import the OpenPGP public key into the certificate

1914

gnutls.library.functions.gnutls_openpgp_crt_import(

1915

crt, ctypes.byref(datum),

1916

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1372

(gnutls.library.functions

1373

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1374

gnutls.library.constants

1375

.GNUTLS_OPENPGP_FMT_RAW))

1917

1376

# Verify the self signature in the key

1918

1377

crtverify = ctypes.c_uint()

1919

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1920

crt, 0, ctypes.byref(crtverify))

1378

(gnutls.library.functions

1379

.gnutls_openpgp_crt_verify_self(crt, 0,

1380

ctypes.byref(crtverify)))

1921

1381

if crtverify.value != 0:

1922

1382

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1923

raise gnutls.errors.CertificateSecurityError(

1924

"Verify failed")

1383

raise (gnutls.errors.CertificateSecurityError

1384

("Verify failed"))

1925

1385

# New buffer for the fingerprint

1926

1386

buf = ctypes.create_string_buffer(20)

1927

1387

buf_len = ctypes.c_size_t()

1928

1388

# Get the fingerprint from the certificate into the buffer

1929

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1930

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1389

(gnutls.library.functions

1390

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1391

ctypes.byref(buf_len)))

1931

1392

# Deinit the certificate

1932

1393

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1933

1394

# Convert the buffer to a Python bytestring

1934

1395

fpr = ctypes.string_at(buf, buf_len.value)

1935

1396

# Convert the bytestring to hexadecimal notation

1936

hex_fpr = binascii.hexlify(fpr).upper()

1397

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1937

1398

return hex_fpr

1938

1399

1939

1400

1940

1401

class MultiprocessingMixIn(object):

1941

1402

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1942

1943

1403

def sub_process_main(self, request, address):

1944

1404

try:

1945

1405

self.finish_request(request, address)

1946

except Exception:

1406

except:

1947

1407

self.handle_error(request, address)

1948

1408

self.close_request(request)

1949

1409

1950

1410

def process_request(self, request, address):

1951

1411

"""Start a new process to process the request."""

1952

proc = multiprocessing.Process(target = self.sub_process_main,

1953

args = (request, address))

1954

proc.start()

1955

return proc

1956

1412

multiprocessing.Process(target = self.sub_process_main,

1413

args = (request, address)).start()

1957

1414

1958

1415

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1959

1416

""" adds a pipe to the MixIn """

1960

1961

1417

def process_request(self, request, client_address):

1962

1418

"""Overrides and wraps the original process_request().

1963

1419

1964

1420

This function creates a new pipe in self.pipe

1965

1421

"""

1966

1422

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1967

1968

proc = MultiprocessingMixIn.process_request(self, request,

1969

client_address)

1423

1424

super(MultiprocessingMixInWithPipe,

1425

self).process_request(request, client_address)

1970

1426

self.child_pipe.close()

1971

self.add_pipe(parent_pipe, proc)

1972

1973

def add_pipe(self, parent_pipe, proc):

1427

self.add_pipe(parent_pipe)

1428

1429

def add_pipe(self, parent_pipe):

1974

1430

"""Dummy function; override as necessary"""

1975

raise NotImplementedError()

1976

1431

raise NotImplementedError

1977

1432

1978

1433

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1979

1434

socketserver.TCPServer, object):

1984

1439

interface: None or a network interface name (string)

1985

1440

use_ipv6: Boolean; to use IPv6 or not

1986

1441

"""

1987

1988

1442

def __init__(self, server_address, RequestHandlerClass,

1989

interface=None,

1990

use_ipv6=True,

1991

socketfd=None):

1992

"""If socketfd is set, use that file descriptor instead of

1993

creating a new one with socket.socket().

1994

"""

1443

interface=None, use_ipv6=True):

1995

1444

self.interface = interface

1996

1445

if use_ipv6:

1997

1446

self.address_family = socket.AF_INET6

1998

if socketfd is not None:

1999

# Save the file descriptor

2000

self.socketfd = socketfd

2001

# Save the original socket.socket() function

2002

self.socket_socket = socket.socket

2003

# To implement --socket, we monkey patch socket.socket.

2004

#

2005

# (When socketserver.TCPServer is a new-style class, we

2006

# could make self.socket into a property instead of monkey

2007

# patching socket.socket.)

2008

#

2009

# Create a one-time-only replacement for socket.socket()

2010

@functools.wraps(socket.socket)

2011

def socket_wrapper(*args, **kwargs):

2012

# Restore original function so subsequent calls are

2013

# not affected.

2014

socket.socket = self.socket_socket

2015

del self.socket_socket

2016

# This time only, return a new socket object from the

2017

# saved file descriptor.

2018

return socket.fromfd(self.socketfd, *args, **kwargs)

2019

# Replace socket.socket() function with wrapper

2020

socket.socket = socket_wrapper

2021

# The socketserver.TCPServer.__init__ will call

2022

# socket.socket(), which might be our replacement,

2023

# socket_wrapper(), if socketfd was set.

2024

1447

socketserver.TCPServer.__init__(self, server_address,

2025

1448

RequestHandlerClass)

2026

2027

1449

def server_bind(self):

2028

1450

"""This overrides the normal server_bind() function

2029

1451

to bind to an interface if one was specified, and also NOT to

2035

1457

self.interface)

2036

1458

else:

2037

1459

try:

2038

self.socket.setsockopt(

2039

socket.SOL_SOCKET, SO_BINDTODEVICE,

2040

(self.interface + "\0").encode("utf-8"))

1460

self.socket.setsockopt(socket.SOL_SOCKET,

1461

SO_BINDTODEVICE,

1462

str(self.interface

1463

+ '\0'))

2041

1464

except socket.error as error:

2042

if error.errno == errno.EPERM:

2043

logger.error("No permission to bind to"

2044

" interface %s", self.interface)

2045

elif error.errno == errno.ENOPROTOOPT:

1465

if error[0] == errno.EPERM:

1466

logger.error("No permission to"

1467

" bind to interface %s",

1468

self.interface)

1469

elif error[0] == errno.ENOPROTOOPT:

2046

1470

logger.error("SO_BINDTODEVICE not available;"

2047

1471

" cannot bind to interface %s",

2048

1472

self.interface)

2049

elif error.errno == errno.ENODEV:

2050

logger.error("Interface %s does not exist,"

2051

" cannot bind", self.interface)

2052

1473

else:

2053

1474

raise

2054

1475

# Only bind(2) the socket if we really need to.

2057

1478

if self.address_family == socket.AF_INET6:

2058

1479

any_address = "::" # in6addr_any

2059

1480

else:

2060

any_address = "0.0.0.0" # INADDR_ANY

1481

any_address = socket.INADDR_ANY

2061

1482

self.server_address = (any_address,

2062

1483

self.server_address[1])

2063

1484

elif not self.server_address[1]:

2064

self.server_address = (self.server_address[0], 0)

1485

self.server_address = (self.server_address[0],

1486

0)

2065

1487

# if self.interface:

2066

1488

# self.server_address = (self.server_address[0],

2067

1489

# 0, # port

2081

1503

2082

1504

Assumes a gobject.MainLoop event loop.

2083

1505

"""

2084

2085

1506

def __init__(self, server_address, RequestHandlerClass,

2086

interface=None,

2087

use_ipv6=True,

2088

clients=None,

2089

gnutls_priority=None,

2090

use_dbus=True,

2091

socketfd=None):

1507

interface=None, use_ipv6=True, clients=None,

1508

gnutls_priority=None, use_dbus=True):

2092

1509

self.enabled = False

2093

1510

self.clients = clients

2094

1511

if self.clients is None:

2095

self.clients = {}

1512

self.clients = set()

2096

1513

self.use_dbus = use_dbus

2097

1514

self.gnutls_priority = gnutls_priority

2098

1515

IPv6_TCPServer.__init__(self, server_address,

2099

1516

RequestHandlerClass,

2100

1517

interface = interface,

2101

use_ipv6 = use_ipv6,

2102

socketfd = socketfd)

2103

1518

use_ipv6 = use_ipv6)

2104

1519

def server_activate(self):

2105

1520

if self.enabled:

2106

1521

return socketserver.TCPServer.server_activate(self)

2107

2108

1522

def enable(self):

2109

1523

self.enabled = True

2110

2111

def add_pipe(self, parent_pipe, proc):

1524

def add_pipe(self, parent_pipe):

2112

1525

# Call "handle_ipc" for both data and EOF events

2113

gobject.io_add_watch(

2114

parent_pipe.fileno(),

2115

gobject.IO_IN | gobject.IO_HUP,

2116

functools.partial(self.handle_ipc,

2117

parent_pipe = parent_pipe,

2118

proc = proc))

2119

2120

def handle_ipc(self, source, condition,

2121

parent_pipe=None,

2122

proc = None,

1526

gobject.io_add_watch(parent_pipe.fileno(),

1527

gobject.IO_IN | gobject.IO_HUP,

1528

functools.partial(self.handle_ipc,

1529

parent_pipe = parent_pipe))

1530

1531

def handle_ipc(self, source, condition, parent_pipe=None,

2123

1532

client_object=None):

2124

# error, or the other end of multiprocessing.Pipe has closed

2125

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2126

# Wait for other process to exit

2127

proc.join()

1533

condition_names = {

1534

gobject.IO_IN: "IN", # There is data to read.

1535

gobject.IO_OUT: "OUT", # Data can be written (without

1536

# blocking).

1537

gobject.IO_PRI: "PRI", # There is urgent data to read.

1538

gobject.IO_ERR: "ERR", # Error condition.

1539

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1540

# broken, usually for pipes and

1541

# sockets).

1542

}

1543

conditions_string = ' | '.join(name

1544

for cond, name in

1545

condition_names.iteritems()

1546

if cond & condition)

1547

# error or the other end of multiprocessing.Pipe has closed

1548

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2128

1549

return False

2129

1550

2130

1551

# Read a request from the child

2135

1556

fpr = request[1]

2136

1557

address = request[2]

2137

1558

2138

for c in self.clients.itervalues():

1559

for c in self.clients:

2139

1560

if c.fingerprint == fpr:

2140

1561

client = c

2141

1562

break

2142

1563

else:

2143

logger.info("Client not found for fingerprint: %s, ad"

2144

"dress: %s", fpr, address)

1564

logger.warning("Client not found for fingerprint: %s, ad"

1565

"dress: %s", fpr, address)

2145

1566

if self.use_dbus:

2146

1567

# Emit D-Bus signal

2147

mandos_dbus_service.ClientNotFound(fpr,

2148

address[0])

1568

mandos_dbus_service.ClientNotFound(fpr, address[0])

2149

1569

parent_pipe.send(False)

2150

1570

return False

2151

1571

2152

gobject.io_add_watch(

2153

parent_pipe.fileno(),

2154

gobject.IO_IN | gobject.IO_HUP,

2155

functools.partial(self.handle_ipc,

2156

parent_pipe = parent_pipe,

2157

proc = proc,

2158

client_object = client))

1572

gobject.io_add_watch(parent_pipe.fileno(),

1573

gobject.IO_IN | gobject.IO_HUP,

1574

functools.partial(self.handle_ipc,

1575

parent_pipe = parent_pipe,

1576

client_object = client))

2159

1577

parent_pipe.send(True)

2160

# remove the old hook in favor of the new above hook on

2161

# same fileno

1578

# remove the old hook in favor of the new above hook on same fileno

2162

1579

return False

2163

1580

if command == 'funcall':

2164

1581

funcname = request[1]

2165

1582

args = request[2]

2166

1583

kwargs = request[3]

2167

1584

2168

parent_pipe.send(('data', getattr(client_object,

2169

funcname)(*args,

2170

**kwargs)))

2171

1585

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1586

2172

1587

if command == 'getattr':

2173

1588

attrname = request[1]

2174

if isinstance(client_object.__getattribute__(attrname),

2175

collections.Callable):

2176

parent_pipe.send(('function', ))

1589

if callable(client_object.__getattribute__(attrname)):

1590

parent_pipe.send(('function',))

2177

1591

else:

2178

parent_pipe.send((

2179

'data', client_object.__getattribute__(attrname)))

1592

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2180

1593

2181

1594

if command == 'setattr':

2182

1595

attrname = request[1]

2183

1596

value = request[2]

2184

1597

setattr(client_object, attrname, value)

2185

1598

2186

1599

return True

2187

1600

2188

1601

2189

def rfc3339_duration_to_delta(duration):

2190

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2191

2192

>>> rfc3339_duration_to_delta("P7D")

2193

datetime.timedelta(7)

2194

>>> rfc3339_duration_to_delta("PT60S")

2195

datetime.timedelta(0, 60)

2196

>>> rfc3339_duration_to_delta("PT60M")

2197

datetime.timedelta(0, 3600)

2198

>>> rfc3339_duration_to_delta("PT24H")

2199

datetime.timedelta(1)

2200

>>> rfc3339_duration_to_delta("P1W")

2201

datetime.timedelta(7)

2202

>>> rfc3339_duration_to_delta("PT5M30S")

2203

datetime.timedelta(0, 330)

2204

>>> rfc3339_duration_to_delta("P1DT3M20S")

2205

datetime.timedelta(1, 200)

2206

"""

2207

2208

# Parsing an RFC 3339 duration with regular expressions is not

2209

# possible - there would have to be multiple places for the same

2210

# values, like seconds. The current code, while more esoteric, is

2211

# cleaner without depending on a parsing library. If Python had a

2212

# built-in library for parsing we would use it, but we'd like to

2213

# avoid excessive use of external libraries.

2214

2215

# New type for defining tokens, syntax, and semantics all-in-one

2216

Token = collections.namedtuple("Token", (

2217

"regexp", # To match token; if "value" is not None, must have

2218

# a "group" containing digits

2219

"value", # datetime.timedelta or None

2220

"followers")) # Tokens valid after this token

2221

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2222

# the "duration" ABNF definition in RFC 3339, Appendix A.

2223

token_end = Token(re.compile(r"$"), None, frozenset())

2224

token_second = Token(re.compile(r"(\d+)S"),

2225

datetime.timedelta(seconds=1),

2226

frozenset((token_end, )))

2227

token_minute = Token(re.compile(r"(\d+)M"),

2228

datetime.timedelta(minutes=1),

2229

frozenset((token_second, token_end)))

2230

token_hour = Token(re.compile(r"(\d+)H"),

2231

datetime.timedelta(hours=1),

2232

frozenset((token_minute, token_end)))

2233

token_time = Token(re.compile(r"T"),

2234

None,

2235

frozenset((token_hour, token_minute,

2236

token_second)))

2237

token_day = Token(re.compile(r"(\d+)D"),

2238

datetime.timedelta(days=1),

2239

frozenset((token_time, token_end)))

2240

token_month = Token(re.compile(r"(\d+)M"),

2241

datetime.timedelta(weeks=4),

2242

frozenset((token_day, token_end)))

2243

token_year = Token(re.compile(r"(\d+)Y"),

2244

datetime.timedelta(weeks=52),

2245

frozenset((token_month, token_end)))

2246

token_week = Token(re.compile(r"(\d+)W"),

2247

datetime.timedelta(weeks=1),

2248

frozenset((token_end, )))

2249

token_duration = Token(re.compile(r"P"), None,

2250

frozenset((token_year, token_month,

2251

token_day, token_time,

2252

token_week)))

2253

# Define starting values

2254

value = datetime.timedelta() # Value so far

2255

found_token = None

2256

followers = frozenset((token_duration, )) # Following valid tokens

2257

s = duration # String left to parse

2258

# Loop until end token is found

2259

while found_token is not token_end:

2260

# Search for any currently valid tokens

2261

for token in followers:

2262

match = token.regexp.match(s)

2263

if match is not None:

2264

# Token found

2265

if token.value is not None:

2266

# Value found, parse digits

2267

factor = int(match.group(1), 10)

2268

# Add to value so far

2269

value += factor * token.value

2270

# Strip token from string

2271

s = token.regexp.sub("", s, 1)

2272

# Go to found token

2273

found_token = token

2274

# Set valid next tokens

2275

followers = found_token.followers

2276

break

2277

else:

2278

# No currently valid tokens were found

2279

raise ValueError("Invalid RFC 3339 duration: {!r}"

2280

.format(duration))

2281

# End token found

2282

return value

2283

2284

2285

1602

def string_to_delta(interval):

2286

1603

"""Parse a string and return a datetime.timedelta

2287

1604

2298

1615

>>> string_to_delta('5m 30s')

2299

1616

datetime.timedelta(0, 330)

2300

1617

"""

2301

2302

try:

2303

return rfc3339_duration_to_delta(interval)

2304

except ValueError:

2305

pass

2306

2307

1618

timevalue = datetime.timedelta(0)

2308

1619

for s in interval.split():

2309

1620

try:

2310

suffix = s[-1]

1621

suffix = unicode(s[-1])

2311

1622

value = int(s[:-1])

2312

1623

if suffix == "d":

2313

1624

delta = datetime.timedelta(value)

2320

1631

elif suffix == "w":

2321

1632

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2322

1633

else:

2323

raise ValueError("Unknown suffix {!r}".format(suffix))

2324

except IndexError as e:

1634

raise ValueError("Unknown suffix %r" % suffix)

1635

except (ValueError, IndexError) as e:

2325

1636

raise ValueError(*(e.args))

2326

1637

timevalue += delta

2327

1638

return timevalue

2328

1639

2329

1640

1641

def if_nametoindex(interface):

1642

"""Call the C function if_nametoindex(), or equivalent

1643

1644

Note: This function cannot accept a unicode string."""

1645

global if_nametoindex

1646

try:

1647

if_nametoindex = (ctypes.cdll.LoadLibrary

1648

(ctypes.util.find_library("c"))

1649

.if_nametoindex)

1650

except (OSError, AttributeError):

1651

logger.warning("Doing if_nametoindex the hard way")

1652

def if_nametoindex(interface):

1653

"Get an interface index the hard way, i.e. using fcntl()"

1654

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1655

with contextlib.closing(socket.socket()) as s:

1656

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1657

struct.pack(str("16s16x"),

1658

interface))

1659

interface_index = struct.unpack(str("I"),

1660

ifreq[16:20])[0]

1661

return interface_index

1662

return if_nametoindex(interface)

1663

1664

2330

1665

def daemon(nochdir = False, noclose = False):

2331

1666

"""See daemon(3). Standard BSD Unix function.

2332

1667

2340

1675

sys.exit()

2341

1676

if not noclose:

2342

1677

# Close all standard open file descriptors

2343

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1678

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2344

1679

if not stat.S_ISCHR(os.fstat(null).st_mode):

2345

1680

raise OSError(errno.ENODEV,

2346

"{} not a character device"

2347

.format(os.devnull))

1681

"%s not a character device"

1682

% os.path.devnull)

2348

1683

os.dup2(null, sys.stdin.fileno())

2349

1684

os.dup2(null, sys.stdout.fileno())

2350

1685

os.dup2(null, sys.stderr.fileno())

2359

1694

2360

1695

parser = argparse.ArgumentParser()

2361

1696

parser.add_argument("-v", "--version", action="version",

2362

version = "%(prog)s {}".format(version),

1697

version = "%%(prog)s %s" % version,

2363

1698

help="show version number and exit")

2364

1699

parser.add_argument("-i", "--interface", metavar="IF",

2365

1700

help="Bind to interface IF")

2371

1706

help="Run self-test")

2372

1707

parser.add_argument("--debug", action="store_true",

2373

1708

help="Debug mode; run in foreground and log"

2374

" to terminal", default=None)

1709

" to terminal")

2375

1710

parser.add_argument("--debuglevel", metavar="LEVEL",

2376

1711

help="Debug level for stdout output")

2377

1712

parser.add_argument("--priority", help="GnuTLS"

2384

1719

" files")

2385

1720

parser.add_argument("--no-dbus", action="store_false",

2386

1721

dest="use_dbus", help="Do not provide D-Bus"

2387

" system bus interface", default=None)

1722

" system bus interface")

2388

1723

parser.add_argument("--no-ipv6", action="store_false",

2389

dest="use_ipv6", help="Do not use IPv6",

2390

default=None)

2391

parser.add_argument("--no-restore", action="store_false",

2392

dest="restore", help="Do not restore stored"

2393

" state", default=None)

2394

parser.add_argument("--socket", type=int,

2395

help="Specify a file descriptor to a network"

2396

" socket to use instead of creating one")

2397

parser.add_argument("--statedir", metavar="DIR",

2398

help="Directory to save/restore state in")

2399

parser.add_argument("--foreground", action="store_true",

2400

help="Run in foreground", default=None)

2401

parser.add_argument("--no-zeroconf", action="store_false",

2402

dest="zeroconf", help="Do not use Zeroconf",

2403

default=None)

2404

1724

dest="use_ipv6", help="Do not use IPv6")

2405

1725

options = parser.parse_args()

2406

1726

2407

1727

if options.check:

2408

1728

import doctest

2409

fail_count, test_count = doctest.testmod()

2410

sys.exit(os.EX_OK if fail_count == 0 else 1)

1729

doctest.testmod()

1730

sys.exit()

2411

1731

2412

1732

# Default values for config file for server-global settings

2413

1733

server_defaults = { "interface": "",

2415

1735

"port": "",

2416

1736

"debug": "False",

2417

1737

"priority":

2418

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2419

":+SIGN-DSA-SHA256",

1738

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2420

1739

"servicename": "Mandos",

2421

1740

"use_dbus": "True",

2422

1741

"use_ipv6": "True",

2423

1742

"debuglevel": "",

2424

"restore": "True",

2425

"socket": "",

2426

"statedir": "/var/lib/mandos",

2427

"foreground": "False",

2428

"zeroconf": "True",

2429

}

1743

}

2430

1744

2431

1745

# Parse config file for server-global settings

2432

1746

server_config = configparser.SafeConfigParser(server_defaults)

2433

1747

del server_defaults

2434

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1748

server_config.read(os.path.join(options.configdir,

1749

"mandos.conf"))

2435

1750

# Convert the SafeConfigParser object to a dict

2436

1751

server_settings = server_config.defaults()

2437

1752

# Use the appropriate methods on the non-string config options

2438

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1753

for option in ("debug", "use_dbus", "use_ipv6"):

2439

1754

server_settings[option] = server_config.getboolean("DEFAULT",

2440

1755

option)

2441

1756

if server_settings["port"]:

2442

1757

server_settings["port"] = server_config.getint("DEFAULT",

2443

1758

"port")

2444

if server_settings["socket"]:

2445

server_settings["socket"] = server_config.getint("DEFAULT",

2446

"socket")

2447

# Later, stdin will, and stdout and stderr might, be dup'ed

2448

# over with an opened os.devnull. But we don't want this to

2449

# happen with a supplied network socket.

2450

if 0 <= server_settings["socket"] <= 2:

2451

server_settings["socket"] = os.dup(server_settings

2452

["socket"])

2453

1759

del server_config

2454

1760

2455

1761

# Override the settings from the config file with command line

2456

1762

# options, if set.

2457

1763

for option in ("interface", "address", "port", "debug",

2458

"priority", "servicename", "configdir", "use_dbus",

2459

"use_ipv6", "debuglevel", "restore", "statedir",

2460

"socket", "foreground", "zeroconf"):

1764

"priority", "servicename", "configdir",

1765

"use_dbus", "use_ipv6", "debuglevel"):

2461

1766

value = getattr(options, option)

2462

1767

if value is not None:

2463

1768

server_settings[option] = value

2464

1769

del options

2465

1770

# Force all strings to be unicode

2466

1771

for option in server_settings.keys():

2467

if isinstance(server_settings[option], bytes):

2468

server_settings[option] = (server_settings[option]

2469

.decode("utf-8"))

2470

# Force all boolean options to be boolean

2471

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2472

"foreground", "zeroconf"):

2473

server_settings[option] = bool(server_settings[option])

2474

# Debug implies foreground

2475

if server_settings["debug"]:

2476

server_settings["foreground"] = True

1772

if type(server_settings[option]) is str:

1773

server_settings[option] = unicode(server_settings[option])

2477

1774

# Now we have our good server settings in "server_settings"

2478

1775

2479

1776

##################################################################

2480

1777

2481

if (not server_settings["zeroconf"]

2482

and not (server_settings["port"]

2483

or server_settings["socket"] != "")):

2484

parser.error("Needs port or socket to work without Zeroconf")

2485

2486

1778

# For convenience

2487

1779

debug = server_settings["debug"]

2488

1780

debuglevel = server_settings["debuglevel"]

2489

1781

use_dbus = server_settings["use_dbus"]

2490

1782

use_ipv6 = server_settings["use_ipv6"]

2491

stored_state_path = os.path.join(server_settings["statedir"],

2492

stored_state_file)

2493

foreground = server_settings["foreground"]

2494

zeroconf = server_settings["zeroconf"]

2495

2496

if debug:

2497

initlogger(debug, logging.DEBUG)

2498

else:

2499

if not debuglevel:

2500

initlogger(debug)

2501

else:

2502

level = getattr(logging, debuglevel.upper())

2503

initlogger(debug, level)

2504

1783

2505

1784

if server_settings["servicename"] != "Mandos":

2506

syslogger.setFormatter(

2507

logging.Formatter('Mandos ({}) [%(process)d]:'

2508

' %(levelname)s: %(message)s'.format(

2509

server_settings["servicename"])))

1785

syslogger.setFormatter(logging.Formatter

1786

('Mandos (%s) [%%(process)d]:'

1787

' %%(levelname)s: %%(message)s'

1788

% server_settings["servicename"]))

2510

1789

2511

1790

# Parse config file with clients

2512

client_config = configparser.SafeConfigParser(Client

2513

.client_defaults)

1791

client_defaults = { "timeout": "1h",

1792

"interval": "5m",

1793

"checker": "fping -q -- %%(host)s",

1794

"host": "",

1795

"approval_delay": "0s",

1796

"approval_duration": "1s",

1797

}

1798

client_config = configparser.SafeConfigParser(client_defaults)

2514

1799

client_config.read(os.path.join(server_settings["configdir"],

2515

1800

"clients.conf"))

2516

1801

2517

1802

global mandos_dbus_service

2518

1803

mandos_dbus_service = None

2519

1804

2520

socketfd = None

2521

if server_settings["socket"] != "":

2522

socketfd = server_settings["socket"]

2523

tcp_server = MandosServer(

2524

(server_settings["address"], server_settings["port"]),

2525

ClientHandler,

2526

interface=(server_settings["interface"] or None),

2527

use_ipv6=use_ipv6,

2528

gnutls_priority=server_settings["priority"],

2529

use_dbus=use_dbus,

2530

socketfd=socketfd)

2531

if not foreground:

2532

pidfilename = "/run/mandos.pid"

2533

if not os.path.isdir("/run/."):

2534

pidfilename = "/var/run/mandos.pid"

2535

pidfile = None

1805

tcp_server = MandosServer((server_settings["address"],

1806

server_settings["port"]),

1807

ClientHandler,

1808

interface=(server_settings["interface"]

1809

or None),

1810

use_ipv6=use_ipv6,

1811

gnutls_priority=

1812

server_settings["priority"],

1813

use_dbus=use_dbus)

1814

if not debug:

1815

pidfilename = "/var/run/mandos.pid"

2536

1816

try:

2537

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2538

except IOError as e:

2539

logger.error("Could not open file %r", pidfilename,

2540

exc_info=e)

1817

pidfile = open(pidfilename, "w")

1818

except IOError:

1819

logger.error("Could not open file %r", pidfilename)

2541

1820

2542

for name in ("_mandos", "mandos", "nobody"):

1821

try:

1822

uid = pwd.getpwnam("_mandos").pw_uid

1823

gid = pwd.getpwnam("_mandos").pw_gid

1824

except KeyError:

2543

1825

try:

2544

uid = pwd.getpwnam(name).pw_uid

2545

gid = pwd.getpwnam(name).pw_gid

2546

break

1826

uid = pwd.getpwnam("mandos").pw_uid

1827

gid = pwd.getpwnam("mandos").pw_gid

2547

1828

except KeyError:

2548

continue

2549

else:

2550

uid = 65534

2551

gid = 65534

1829

try:

1830

uid = pwd.getpwnam("nobody").pw_uid

1831

gid = pwd.getpwnam("nobody").pw_gid

1832

except KeyError:

1833

uid = 65534

1834

gid = 65534

2552

1835

try:

2553

1836

os.setgid(gid)

2554

1837

os.setuid(uid)

2555

1838

except OSError as error:

2556

if error.errno != errno.EPERM:

2557

raise

1839

if error[0] != errno.EPERM:

1840

raise error

2558

1841

1842

if not debug and not debuglevel:

1843

syslogger.setLevel(logging.WARNING)

1844

console.setLevel(logging.WARNING)

1845

if debuglevel:

1846

level = getattr(logging, debuglevel.upper())

1847

syslogger.setLevel(level)

1848

console.setLevel(level)

1849

2559

1850

if debug:

2560

1851

# Enable all possible GnuTLS debugging

2561

1852

2567

1858

def debug_gnutls(level, string):

2568

1859

logger.debug("GnuTLS: %s", string[:-1])

2569

1860

2570

gnutls.library.functions.gnutls_global_set_log_function(

2571

debug_gnutls)

1861

(gnutls.library.functions

1862

.gnutls_global_set_log_function(debug_gnutls))

2572

1863

2573

1864

# Redirect stdin so all checkers get /dev/null

2574

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1865

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2575

1866

os.dup2(null, sys.stdin.fileno())

2576

1867

if null > 2:

2577

1868

os.close(null)

1869

else:

1870

# No console logging

1871

logger.removeHandler(console)

2578

1872

2579

1873

# Need to fork before connecting to D-Bus

2580

if not foreground:

1874

if not debug:

2581

1875

# Close all input and output, do double fork, etc.

2582

1876

daemon()

2583

1877

2584

# multiprocessing will use threads, so before we use gobject we

2585

# need to inform gobject that threads will be used.

2586

gobject.threads_init()

2587

2588

1878

global main_loop

2589

1879

# From the Avahi example code

2590

DBusGMainLoop(set_as_default=True)

1880

DBusGMainLoop(set_as_default=True )

2591

1881

main_loop = gobject.MainLoop()

2592

1882

bus = dbus.SystemBus()

2593

1883

# End of Avahi example code

2594

1884

if use_dbus:

2595

1885

try:

2596

bus_name = dbus.service.BusName("se.recompile.Mandos",

2597

bus,

2598

do_not_queue=True)

2599

old_bus_name = dbus.service.BusName(

2600

"se.bsnet.fukt.Mandos", bus,

2601

do_not_queue=True)

2602

except dbus.exceptions.DBusException as e:

2603

logger.error("Disabling D-Bus:", exc_info=e)

1886

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1887

bus, do_not_queue=True)

1888

except dbus.exceptions.NameExistsException as e:

1889

logger.error(unicode(e) + ", disabling D-Bus")

2604

1890

use_dbus = False

2605

1891

server_settings["use_dbus"] = False

2606

1892

tcp_server.use_dbus = False

2607

if zeroconf:

2608

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2609

service = AvahiServiceToSyslog(

2610

name = server_settings["servicename"],

2611

servicetype = "_mandos._tcp",

2612

protocol = protocol,

2613

bus = bus)

2614

if server_settings["interface"]:

2615

service.interface = if_nametoindex(

2616

server_settings["interface"].encode("utf-8"))

1893

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1894

service = AvahiService(name = server_settings["servicename"],

1895

servicetype = "_mandos._tcp",

1896

protocol = protocol, bus = bus)

1897

if server_settings["interface"]:

1898

service.interface = (if_nametoindex

1899

(str(server_settings["interface"])))

2617

1900

2618

1901

global multiprocessing_manager

2619

1902

multiprocessing_manager = multiprocessing.Manager()

2621

1904

client_class = Client

2622

1905

if use_dbus:

2623

1906

client_class = functools.partial(ClientDBus, bus = bus)

2624

2625

client_settings = Client.config_parser(client_config)

2626

old_client_settings = {}

2627

clients_data = {}

2628

2629

# This is used to redirect stdout and stderr for checker processes

2630

global wnull

2631

wnull = open(os.devnull, "w") # A writable /dev/null

2632

# Only used if server is running in foreground but not in debug

2633

# mode

2634

if debug or not foreground:

2635

wnull.close()

2636

2637

# Get client data and settings from last running state.

2638

if server_settings["restore"]:

2639

try:

2640

with open(stored_state_path, "rb") as stored_state:

2641

clients_data, old_client_settings = pickle.load(

2642

stored_state)

2643

os.remove(stored_state_path)

2644

except IOError as e:

2645

if e.errno == errno.ENOENT:

2646

logger.warning("Could not load persistent state:"

2647

" {}".format(os.strerror(e.errno)))

2648

else:

2649

logger.critical("Could not load persistent state:",

2650

exc_info=e)

2651

raise

2652

except EOFError as e:

2653

logger.warning("Could not load persistent state: "

2654

"EOFError:",

2655

exc_info=e)

2656

2657

with PGPEngine() as pgp:

2658

for client_name, client in clients_data.items():

2659

# Skip removed clients

2660

if client_name not in client_settings:

2661

continue

2662

2663

# Decide which value to use after restoring saved state.

2664

# We have three different values: Old config file,

2665

# new config file, and saved state.

2666

# New config value takes precedence if it differs from old

2667

# config value, otherwise use saved state.

2668

for name, value in client_settings[client_name].items():

2669

try:

2670

# For each value in new config, check if it

2671

# differs from the old config value (Except for

2672

# the "secret" attribute)

2673

if (name != "secret"

2674

and (value !=

2675

old_client_settings[client_name][name])):

2676

client[name] = value

2677

except KeyError:

2678

pass

2679

2680

# Clients who has passed its expire date can still be

2681

# enabled if its last checker was successful. A Client

2682

# whose checker succeeded before we stored its state is

2683

# assumed to have successfully run all checkers during

2684

# downtime.

2685

if client["enabled"]:

2686

if datetime.datetime.utcnow() >= client["expires"]:

2687

if not client["last_checked_ok"]:

2688

logger.warning(

2689

"disabling client {} - Client never "

2690

"performed a successful checker".format(

2691

client_name))

2692

client["enabled"] = False

2693

elif client["last_checker_status"] != 0:

2694

logger.warning(

2695

"disabling client {} - Client last"

2696

" checker failed with error code"

2697

" {}".format(

2698

client_name,

2699

client["last_checker_status"]))

2700

client["enabled"] = False

2701

else:

2702

client["expires"] = (

2703

datetime.datetime.utcnow()

2704

+ client["timeout"])

2705

logger.debug("Last checker succeeded,"

2706

" keeping {} enabled".format(

2707

client_name))

1907

def client_config_items(config, section):

1908

special_settings = {

1909

"approved_by_default":

1910

lambda: config.getboolean(section,

1911

"approved_by_default"),

1912

}

1913

for name, value in config.items(section):

2708

1914

try:

2709

client["secret"] = pgp.decrypt(

2710

client["encrypted_secret"],

2711

client_settings[client_name]["secret"])

2712

except PGPError:

2713

# If decryption fails, we use secret from new settings

2714

logger.debug("Failed to decrypt {} old secret".format(

2715

client_name))

2716

client["secret"] = (client_settings[client_name]

2717

["secret"])

2718

2719

# Add/remove clients based on new changes made to config

2720

for client_name in (set(old_client_settings)

2721

- set(client_settings)):

2722

del clients_data[client_name]

2723

for client_name in (set(client_settings)

2724

- set(old_client_settings)):

2725

clients_data[client_name] = client_settings[client_name]

2726

2727

# Create all client objects

2728

for client_name, client in clients_data.items():

2729

tcp_server.clients[client_name] = client_class(

2730

name = client_name,

2731

settings = client,

2732

server_settings = server_settings)

2733

1915

yield (name, special_settings[name]())

1916

except KeyError:

1917

yield (name, value)

1918

1919

tcp_server.clients.update(set(

1920

client_class(name = section,

1921

config= dict(client_config_items(

1922

client_config, section)))

1923

for section in client_config.sections()))

2734

1924

if not tcp_server.clients:

2735

1925

logger.warning("No clients defined")

2736

2737

if not foreground:

2738

if pidfile is not None:

2739

pid = os.getpid()

2740

try:

2741

with pidfile:

2742

print(pid, file=pidfile)

2743

except IOError:

2744

logger.error("Could not write to file %r with PID %d",

2745

pidfilename, pid)

2746

del pidfile

1926

1927

if not debug:

1928

try:

1929

with pidfile:

1930

pid = os.getpid()

1931

pidfile.write(str(pid) + "\n".encode("utf-8"))

1932

del pidfile

1933

except IOError:

1934

logger.error("Could not write to file %r with PID %d",

1935

pidfilename, pid)

1936

except NameError:

1937

# "pidfile" was never created

1938

pass

2747

1939

del pidfilename

2748

1940

1941

signal.signal(signal.SIGINT, signal.SIG_IGN)

1942

2749

1943

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2750

1944

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2751

1945

2752

1946

if use_dbus:

2753

2754

@alternate_dbus_interfaces(

2755

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2756

class MandosDBusService(DBusObjectWithProperties):

1947

class MandosDBusService(dbus.service.Object):

2757

1948

"""A D-Bus proxy object"""

2758

2759

1949

def __init__(self):

2760

1950

dbus.service.Object.__init__(self, bus, "/")

2761

2762

_interface = "se.recompile.Mandos"

2763

2764

@dbus_interface_annotations(_interface)

2765

def _foo(self):

2766

return {

2767

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2768

"false" }

1951

_interface = "se.bsnet.fukt.Mandos"

2769

1952

2770

1953

@dbus.service.signal(_interface, signature="o")

2771

1954

def ClientAdded(self, objpath):

2785

1968

@dbus.service.method(_interface, out_signature="ao")

2786

1969

def GetAllClients(self):

2787

1970

"D-Bus method"

2788

return dbus.Array(c.dbus_object_path for c in

2789

tcp_server.clients.itervalues())

1971

return dbus.Array(c.dbus_object_path

1972

for c in tcp_server.clients)

2790

1973

2791

1974

@dbus.service.method(_interface,

2792

1975

out_signature="a{oa{sv}}")

2793

1976

def GetAllClientsWithProperties(self):

2794

1977

"D-Bus method"

2795

1978

return dbus.Dictionary(

2796

{ c.dbus_object_path: c.GetAll("")

2797

for c in tcp_server.clients.itervalues() },

1979

((c.dbus_object_path, c.GetAll(""))

1980

for c in tcp_server.clients),

2798

1981

signature="oa{sv}")

2799

1982

2800

1983

@dbus.service.method(_interface, in_signature="o")

2801

1984

def RemoveClient(self, object_path):

2802

1985

"D-Bus method"

2803

for c in tcp_server.clients.itervalues():

1986

for c in tcp_server.clients:

2804

1987

if c.dbus_object_path == object_path:

2805

del tcp_server.clients[c.name]

1988

tcp_server.clients.remove(c)

2806

1989

c.remove_from_connection()

2807

1990

# Don't signal anything except ClientRemoved

2808

1991

c.disable(quiet=True)

2817

2000

2818

2001

def cleanup():

2819

2002

"Cleanup function; run on exit"

2820

if zeroconf:

2821

service.cleanup()

2822

2823

multiprocessing.active_children()

2824

wnull.close()

2825

if not (tcp_server.clients or client_settings):

2826

return

2827

2828

# Store client before exiting. Secrets are encrypted with key

2829

# based on what config file has. If config file is

2830

# removed/edited, old secret will thus be unrecovable.

2831

clients = {}

2832

with PGPEngine() as pgp:

2833

for client in tcp_server.clients.itervalues():

2834

key = client_settings[client.name]["secret"]

2835

client.encrypted_secret = pgp.encrypt(client.secret,

2836

key)

2837

client_dict = {}

2838

2839

# A list of attributes that can not be pickled

2840

# + secret.

2841

exclude = { "bus", "changedstate", "secret",

2842

"checker", "server_settings" }

2843

for name, typ in inspect.getmembers(dbus.service

2844

.Object):

2845

exclude.add(name)

2846

2847

client_dict["encrypted_secret"] = (client

2848

.encrypted_secret)

2849

for attr in client.client_structure:

2850

if attr not in exclude:

2851

client_dict[attr] = getattr(client, attr)

2852

2853

clients[client.name] = client_dict

2854

del client_settings[client.name]["secret"]

2855

2856

try:

2857

with tempfile.NamedTemporaryFile(

2858

mode='wb',

2859

suffix=".pickle",

2860

prefix='clients-',

2861

dir=os.path.dirname(stored_state_path),

2862

delete=False) as stored_state:

2863

pickle.dump((clients, client_settings), stored_state)

2864

tempname = stored_state.name

2865

os.rename(tempname, stored_state_path)

2866

except (IOError, OSError) as e:

2867

if not debug:

2868

try:

2869

os.remove(tempname)

2870

except NameError:

2871

pass

2872

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2873

logger.warning("Could not save persistent state: {}"

2874

.format(os.strerror(e.errno)))

2875

else:

2876

logger.warning("Could not save persistent state:",

2877

exc_info=e)

2878

raise

2879

2880

# Delete all clients, and settings from config

2003

service.cleanup()

2004

2881

2005

while tcp_server.clients:

2882

name, client = tcp_server.clients.popitem()

2006

client = tcp_server.clients.pop()

2883

2007

if use_dbus:

2884

2008

client.remove_from_connection()

2009

client.disable_hook = None

2885

2010

# Don't signal anything except ClientRemoved

2886

2011

client.disable(quiet=True)

2887

2012

if use_dbus:

2888

2013

# Emit D-Bus signal

2889

mandos_dbus_service.ClientRemoved(

2890

client.dbus_object_path, client.name)

2891

client_settings.clear()

2014

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2015

client.name)

2892

2016

2893

2017

atexit.register(cleanup)

2894

2018

2895

for client in tcp_server.clients.itervalues():

2019

for client in tcp_server.clients:

2896

2020

if use_dbus:

2897

2021

# Emit D-Bus signal

2898

2022

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2899

# Need to initiate checking of clients

2900

if client.enabled:

2901

client.init_checker()

2023

client.enable()

2902

2024

2903

2025

tcp_server.enable()

2904

2026

tcp_server.server_activate()

2905

2027

2906

2028

# Find out what port we got

2907

if zeroconf:

2908

service.port = tcp_server.socket.getsockname()[1]

2029

service.port = tcp_server.socket.getsockname()[1]

2909

2030

if use_ipv6:

2910

2031

logger.info("Now listening on address %r, port %d,"

2911

" flowinfo %d, scope_id %d",

2912

*tcp_server.socket.getsockname())

2032

" flowinfo %d, scope_id %d"

2033

% tcp_server.socket.getsockname())

2913

2034

else: # IPv4

2914

logger.info("Now listening on address %r, port %d",

2915

*tcp_server.socket.getsockname())

2035

logger.info("Now listening on address %r, port %d"

2036

% tcp_server.socket.getsockname())

2916

2037

2917

2038

#service.interface = tcp_server.socket.getsockname()[3]

2918

2039

2919

2040

try:

2920

if zeroconf:

2921

# From the Avahi example code

2922

try:

2923

service.activate()

2924

except dbus.exceptions.DBusException as error:

2925

logger.critical("D-Bus Exception", exc_info=error)

2926

cleanup()

2927

sys.exit(1)

2928

# End of Avahi example code

2041

# From the Avahi example code

2042

try:

2043

service.activate()

2044

except dbus.exceptions.DBusException as error:

2045

logger.critical("DBusException: %s", error)

2046

cleanup()

2047

sys.exit(1)

2048

# End of Avahi example code

2929

2049

2930

2050

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2931

2051

lambda *args, **kwargs:

2935

2055

logger.debug("Starting main loop")

2936

2056

main_loop.run()

2937

2057

except AvahiError as error:

2938

logger.critical("Avahi Error", exc_info=error)

2058

logger.critical("AvahiError: %s", error)

2939

2059

cleanup()

2940

2060

sys.exit(1)

2941

2061

except KeyboardInterrupt:

2946

2066

# Must run before the D-Bus bus name gets deregistered

2947

2067

cleanup()

2948

2068

2949

2950

2069

if __name__ == '__main__':

2951

2070

main()