To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 505.1.13
- compare with another revision
- download diff
- download tarball
- view history from revision 505.1.13
- Committer: Teddy Hogeborn
- Date: 2011-10-10 20:29:58 UTC
- mto: (505.2.5 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 515.
- Revision ID: teddy@recompile.se-20111010202958-4nasdbwsxbennrwj
Miscellaneous fixes prompted by lintian:
* debian/control (Conflicts): Changed to "Breaks:".
* debian/copyright: Updated format.
* debian/mandos-client.postinst: Use "set -e" instead of "#!/bin/sh -e".
* debian/mandos-client.postrm: - '' -
* debian/mandos.postinst: - '' -
* debian/mandos.prerm: Consistent magic.
* mandos: Small comment change.
* mandos-clients.conf.xml (OPTIONS/extended_timeout): Fix spelling.
* debian/control (Conflicts): Changed to "Breaks:".
* debian/copyright: Updated format.
* debian/mandos-client.postinst: Use "set -e" instead of "#!/bin/sh -e".
* debian/mandos-client.postrm: - '' -
* debian/mandos.postinst: - '' -
* debian/mandos.prerm: Consistent magic.
* mandos: Small comment change.
* mandos-clients.conf.xml (OPTIONS/extended_timeout): Fix spelling.
- files removed:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
50
45
import gnutls.library.functions
51
46
import gnutls.library.constants
52
47
import gnutls.library.types
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
48
import ConfigParser as configparser
57
49
import sys
58
50
import re
59
51
import os
68
60
import struct
69
61
import fcntl
70
62
import functools
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
63
import cPickle as pickle
75
64
import multiprocessing
76
65
import types
77
import binascii
78
import tempfile
79
import itertools
80
import collections
81
import codecs
82
66
83
67
import dbus
84
68
import dbus.service
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
69
import gobject
89
70
import avahi
90
71
from dbus.mainloop.glib import DBusGMainLoop
91
72
import ctypes
101
82
except ImportError:
102
83
SO_BINDTODEVICE = None
103
84
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
108
stored_state_file = "clients.pickle"
109
110
logger = logging.getLogger()
111
syslogger = None
112
113
try:
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
116
except (OSError, AttributeError):
117
118
def if_nametoindex(interface):
119
"Get an interface index the hard way, i.e. using fcntl()"
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
with contextlib.closing(socket.socket()) as s:
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
125
return interface_index
126
127
128
def initlogger(debug, level=logging.WARNING):
129
"""init logger and add loglevel"""
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
syslogger.setFormatter(logging.Formatter
136
('Mandos [%(process)d]: %(levelname)s:'
137
' %(message)s'))
138
logger.addHandler(syslogger)
139
140
if debug:
141
console = logging.StreamHandler()
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
143
' [%(process)d]:'
144
' %(levelname)s:'
145
' %(message)s'))
146
logger.addHandler(console)
147
logger.setLevel(level)
148
149
150
class PGPError(Exception):
151
"""Exception if encryption/decryption fails"""
152
pass
153
154
155
class PGPEngine(object):
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
158
def __init__(self):
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
165
166
def __enter__(self):
167
return self
168
169
def __exit__(self, exc_type, exc_value, traceback):
170
self._cleanup()
171
return False
172
173
def __del__(self):
174
self._cleanup()
175
176
def _cleanup(self):
177
if self.tempdir is not None:
178
# Delete contents of tempdir
179
for root, dirs, files in os.walk(self.tempdir,
180
topdown = False):
181
for filename in files:
182
os.remove(os.path.join(root, filename))
183
for dirname in dirs:
184
os.rmdir(os.path.join(root, dirname))
185
# Remove tempdir
186
os.rmdir(self.tempdir)
187
self.tempdir = None
188
189
def password_encode(self, password):
190
# Passphrase can not be empty and can not contain newlines or
191
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
199
200
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
216
return ciphertext
217
218
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
234
return decrypted_plaintext
235
85
86
version = "1.4.0"
87
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
90
syslogger = (logging.handlers.SysLogHandler
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
93
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
96
logger.addHandler(syslogger)
97
98
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
102
logger.addHandler(console)
236
103
237
104
class AvahiError(Exception):
238
105
def __init__(self, value, *args, **kwargs):
239
106
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
107
super(AvahiError, self).__init__(value, *args, **kwargs)
108
def __unicode__(self):
109
return unicode(repr(self.value))
243
110
244
111
class AvahiServiceError(AvahiError):
245
112
pass
246
113
247
248
114
class AvahiGroupError(AvahiError):
249
115
pass
250
116
257
123
Used to optionally bind to the specified interface.
258
124
name: string; Example: 'Mandos'
259
125
type: string; Example: '_mandos._tcp'.
260
See <https://www.iana.org/assignments/service-names-port-numbers>
126
See <http://www.dns-sd.org/ServiceTypes.html>
261
127
port: integer; what port to announce
262
128
TXT: list of strings; TXT record for the service
263
129
domain: string; Domain to publish on, default to .local if empty.
269
135
server: D-Bus Server
270
136
bus: dbus.SystemBus()
271
137
"""
272
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
138
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
141
protocol = avahi.PROTO_UNSPEC, bus = None):
284
142
self.interface = interface
285
143
self.name = name
286
144
self.type = servicetype
295
153
self.server = None
296
154
self.bus = bus
297
155
self.entry_group_state_changed_match = None
298
299
def rename(self, remove=True):
156
def rename(self):
300
157
"""Derived from the Avahi example code"""
301
158
if self.rename_count >= self.max_renames:
302
159
logger.critical("No suitable Zeroconf service name found"
303
160
" after %i retries, exiting.",
304
161
self.rename_count)
305
162
raise AvahiServiceError("Too many renames")
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
163
self.name = unicode(self.server
164
.GetAlternativeServiceName(self.name))
309
165
logger.info("Changing Zeroconf service name to %r ...",
310
166
self.name)
311
if remove:
312
self.remove()
167
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
170
% self.name))
171
self.remove()
313
172
try:
314
173
self.add()
315
174
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
324
175
logger.critical("DBusException: %s", error)
176
self.cleanup()
177
os._exit(1)
178
self.rename_count += 1
325
179
def remove(self):
326
180
"""Derived from the Avahi example code"""
327
181
if self.entry_group_state_changed_match is not None:
329
183
self.entry_group_state_changed_match = None
330
184
if self.group is not None:
331
185
self.group.Reset()
332
333
186
def add(self):
334
187
"""Derived from the Avahi example code"""
335
188
self.remove()
340
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
341
194
self.entry_group_state_changed_match = (
342
195
self.group.connect_to_signal(
343
'StateChanged', self.entry_group_state_changed))
196
'StateChanged', self .entry_group_state_changed))
344
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
345
198
self.name, self.type)
346
199
self.group.AddService(
352
205
dbus.UInt16(self.port),
353
206
avahi.string_array_to_txt_array(self.TXT))
354
207
self.group.Commit()
355
356
208
def entry_group_state_changed(self, state, error):
357
209
"""Derived from the Avahi example code"""
358
210
logger.debug("Avahi entry group state change: %i", state)
364
216
self.rename()
365
217
elif state == avahi.ENTRY_GROUP_FAILURE:
366
218
logger.critical("Avahi: Error in group state changed %s",
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
369
219
unicode(error))
220
raise AvahiGroupError("State changed: %s"
221
% unicode(error))
370
222
def cleanup(self):
371
223
"""Derived from the Avahi example code"""
372
224
if self.group is not None:
373
225
try:
374
226
self.group.Free()
375
227
except (dbus.exceptions.UnknownMethodException,
376
dbus.exceptions.DBusException):
228
dbus.exceptions.DBusException) as e:
377
229
pass
378
230
self.group = None
379
231
self.remove()
380
381
232
def server_state_changed(self, state, error=None):
382
233
"""Derived from the Avahi example code"""
383
234
logger.debug("Avahi server state change: %i", state)
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
235
bad_states = { avahi.SERVER_INVALID:
236
"Zeroconf server invalid",
237
avahi.SERVER_REGISTERING: None,
238
avahi.SERVER_COLLISION:
239
"Zeroconf server name collision",
240
avahi.SERVER_FAILURE:
241
"Zeroconf server failure" }
390
242
if state in bad_states:
391
243
if bad_states[state] is not None:
392
244
if error is None:
395
247
logger.error(bad_states[state] + ": %r", error)
396
248
self.cleanup()
397
249
elif state == avahi.SERVER_RUNNING:
398
try:
399
self.add()
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
404
" collision.")
405
return self.rename(remove=False)
406
else:
407
logger.critical("D-Bus Exception", exc_info=error)
408
self.cleanup()
409
os._exit(1)
250
self.add()
410
251
else:
411
252
if error is None:
412
253
logger.debug("Unknown state: %r", state)
413
254
else:
414
255
logger.debug("Unknown state: %r: %r", state, error)
415
416
256
def activate(self):
417
257
"""Derived from the Avahi example code"""
418
258
if self.server is None:
422
262
follow_name_owner_changes=True),
423
263
avahi.DBUS_INTERFACE_SERVER)
424
264
self.server.connect_to_signal("StateChanged",
425
self.server_state_changed)
265
self.server_state_changed)
426
266
self.server_state_changed(self.server.GetState())
427
267
428
268
429
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
.format(self.name)))
436
return ret
437
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
441
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
444
"""
445
connection.send(func(*args, **kwargs))
446
connection.close()
447
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
274
448
275
class Client(object):
449
276
"""A representation of a client host served by this server.
450
277
451
278
Attributes:
452
approved: bool(); 'None' if not yet approved/disapproved
279
_approved: bool(); 'None' if not yet approved/disapproved
453
280
approval_delay: datetime.timedelta(); Time to wait for approval
454
281
approval_duration: datetime.timedelta(); Duration of one approval
455
282
checker: subprocess.Popen(); a running checker process used
462
289
instance %(name)s can be used in the command.
463
290
checker_initiator_tag: a gobject event source tag, or None
464
291
created: datetime.datetime(); (UTC) object creation
465
client_structure: Object describing what attributes a client has
466
and is used for storing the client at exit
467
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
468
294
disable_initiator_tag: a gobject event source tag, or None
469
295
enabled: bool()
470
296
fingerprint: string (40 or 32 hexadecimal digits); used to
473
299
interval: datetime.timedelta(); How often to start a new checker
474
300
last_approval_request: datetime.datetime(); (UTC) or None
475
301
last_checked_ok: datetime.datetime(); (UTC) or None
476
last_checker_status: integer between 0 and 255 reflecting exit
477
status of last checker. -1 reflects crashed
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
481
last_enabled: datetime.datetime(); (UTC) or None
302
last_enabled: datetime.datetime(); (UTC)
482
303
name: string; from the config file, used in log messages and
483
304
D-Bus identifiers
484
305
secret: bytestring; sent verbatim (over TLS) to client
485
306
timeout: datetime.timedelta(); How long from last_checked_ok
486
307
until this client is disabled
487
extended_timeout: extra long timeout when secret has been sent
308
extended_timeout: extra long timeout when password has been sent
488
309
runtime_expansions: Allowed attributes for runtime expansion.
489
310
expires: datetime.datetime(); time (UTC) when a client will be
490
311
disabled, or None
491
server_settings: The server_settings dict from main()
492
312
"""
493
313
494
314
runtime_expansions = ("approval_delay", "approval_duration",
495
"created", "enabled", "expires",
496
"fingerprint", "host", "interval",
497
"last_approval_request", "last_checked_ok",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
498
317
"last_enabled", "name", "timeout")
499
client_defaults = {
500
"timeout": "PT5M",
501
"extended_timeout": "PT15M",
502
"interval": "PT2M",
503
"checker": "fping -q -- %%(host)s",
504
"host": "",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
508
"enabled": "True",
509
}
510
511
@staticmethod
512
def config_parser(config):
513
"""Construct a new dict of client settings of this form:
514
{ client_name: {setting_name: value, ...}, ...}
515
with exceptions for any special settings as defined above.
516
NOTE: Must be a pure function. Must return the same result
517
value given the same arguments.
518
"""
519
settings = {}
520
for client_name in config.sections():
521
section = dict(config.items(client_name))
522
client = settings[client_name] = {}
523
524
client["host"] = section["host"]
525
# Reformat values from string types to Python types
526
client["approved_by_default"] = config.getboolean(
527
client_name, "approved_by_default")
528
client["enabled"] = config.getboolean(client_name,
529
"enabled")
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
534
client["fingerprint"] = (section["fingerprint"].upper()
535
.replace(" ", ""))
536
if "secret" in section:
537
client["secret"] = section["secret"].decode("base64")
538
elif "secfile" in section:
539
with open(os.path.expanduser(os.path.expandvars
540
(section["secfile"])),
541
"rb") as secfile:
542
client["secret"] = secfile.read()
543
else:
544
raise TypeError("No secret or secfile for section {}"
545
.format(section))
546
client["timeout"] = string_to_delta(section["timeout"])
547
client["extended_timeout"] = string_to_delta(
548
section["extended_timeout"])
549
client["interval"] = string_to_delta(section["interval"])
550
client["approval_delay"] = string_to_delta(
551
section["approval_delay"])
552
client["approval_duration"] = string_to_delta(
553
section["approval_duration"])
554
client["checker_command"] = section["checker"]
555
client["last_approval_request"] = None
556
client["last_checked_ok"] = None
557
client["last_checker_status"] = -2
558
559
return settings
560
561
def __init__(self, settings, name = None, server_settings=None):
318
319
def timeout_milliseconds(self):
320
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
322
323
def extended_timeout_milliseconds(self):
324
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
326
327
def interval_milliseconds(self):
328
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
330
331
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
333
334
def __init__(self, name = None, disable_hook=None, config=None):
335
"""Note: the 'checker' key in 'config' sets the
336
'checker_command' attribute and *not* the 'checker'
337
attribute."""
562
338
self.name = name
563
if server_settings is None:
564
server_settings = {}
565
self.server_settings = server_settings
566
# adding all client settings
567
for setting, value in settings.items():
568
setattr(self, setting, value)
569
570
if self.enabled:
571
if not hasattr(self, "last_enabled"):
572
self.last_enabled = datetime.datetime.utcnow()
573
if not hasattr(self, "expires"):
574
self.expires = (datetime.datetime.utcnow()
575
+ self.timeout)
576
else:
577
self.last_enabled = None
578
self.expires = None
579
339
if config is None:
340
config = {}
580
341
logger.debug("Creating client %r", self.name)
342
# Uppercase and remove spaces from fingerprint for later
343
# comparison purposes with return value from the fingerprint()
344
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
581
347
logger.debug(" Fingerprint: %s", self.fingerprint)
582
self.created = settings.get("created",
583
datetime.datetime.utcnow())
584
585
# attributes specific for this server instance
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
351
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
353
"rb") as secfile:
354
self.secret = secfile.read()
355
else:
356
raise TypeError("No secret or secfile for client %s"
357
% self.name)
358
self.host = config.get("host", "")
359
self.created = datetime.datetime.utcnow()
360
self.enabled = False
361
self.last_approval_request = None
362
self.last_enabled = None
363
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
368
self.disable_hook = disable_hook
586
369
self.checker = None
587
370
self.checker_initiator_tag = None
588
371
self.disable_initiator_tag = None
372
self.expires = None
589
373
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
590
375
self.current_checker_command = None
591
self.approved = None
376
self.last_connect = None
377
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
379
True)
592
380
self.approvals_pending = 0
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
597
if not attr.startswith("_")]
598
self.client_structure.append("client_structure")
599
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
602
if not name.startswith("_"):
603
self.client_structure.append(name)
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
self.changedstate = (multiprocessing_manager
386
.Condition(multiprocessing_manager
387
.Lock()))
604
388
605
# Send notice to process children that client state has changed
606
389
def send_changedstate(self):
607
with self.changedstate:
608
self.changedstate.notify_all()
390
self.changedstate.acquire()
391
self.changedstate.notify_all()
392
self.changedstate.release()
609
393
610
394
def enable(self):
611
395
"""Start this client's checker and timeout hooks"""
612
396
if getattr(self, "enabled", False):
613
397
# Already enabled
614
398
return
399
self.send_changedstate()
400
# Schedule a new checker to be started an 'interval' from now,
401
# and every interval from then on.
402
self.checker_initiator_tag = (gobject.timeout_add
403
(self.interval_milliseconds(),
404
self.start_checker))
405
# Schedule a disable() when 'timeout' has passed
615
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
self.disable_initiator_tag = (gobject.timeout_add
408
(self.timeout_milliseconds(),
409
self.disable))
616
410
self.enabled = True
617
411
self.last_enabled = datetime.datetime.utcnow()
618
self.init_checker()
619
self.send_changedstate()
412
# Also start a new checker *right now*.
413
self.start_checker()
620
414
621
415
def disable(self, quiet=True):
622
416
"""Disable this client."""
623
417
if not getattr(self, "enabled", False):
624
418
return False
625
419
if not quiet:
420
self.send_changedstate()
421
if not quiet:
626
422
logger.info("Disabling client %s", self.name)
627
if getattr(self, "disable_initiator_tag", None) is not None:
423
if getattr(self, "disable_initiator_tag", False):
628
424
gobject.source_remove(self.disable_initiator_tag)
629
425
self.disable_initiator_tag = None
630
426
self.expires = None
631
if getattr(self, "checker_initiator_tag", None) is not None:
427
if getattr(self, "checker_initiator_tag", False):
632
428
gobject.source_remove(self.checker_initiator_tag)
633
429
self.checker_initiator_tag = None
634
430
self.stop_checker()
431
if self.disable_hook:
432
self.disable_hook(self)
635
433
self.enabled = False
636
if not quiet:
637
self.send_changedstate()
638
434
# Do not run this again if called by a gobject.timeout_add
639
435
return False
640
436
641
437
def __del__(self):
438
self.disable_hook = None
642
439
self.disable()
643
440
644
def init_checker(self):
645
# Schedule a new checker to be started an 'interval' from now,
646
# and every interval from then on.
647
if self.checker_initiator_tag is not None:
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
652
# Schedule a disable() when 'timeout' has passed
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
657
# Also start a new checker *right now*.
658
self.start_checker()
659
660
def checker_callback(self, source, condition, connection,
661
command):
441
def checker_callback(self, pid, condition, command):
662
442
"""The checker has completed, so take appropriate actions."""
663
443
self.checker_callback_tag = None
664
444
self.checker = None
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
667
connection.close()
668
669
if returncode >= 0:
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
672
if self.last_checker_status == 0:
445
if os.WIFEXITED(condition):
446
exitstatus = os.WEXITSTATUS(condition)
447
if exitstatus == 0:
673
448
logger.info("Checker for %(name)s succeeded",
674
449
vars(self))
675
450
self.checked_ok()
676
451
else:
677
logger.info("Checker for %(name)s failed", vars(self))
452
logger.info("Checker for %(name)s failed",
453
vars(self))
678
454
else:
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
681
455
logger.warning("Checker for %(name)s crashed?",
682
456
vars(self))
683
return False
684
685
def checked_ok(self):
686
"""Assert that the client has been seen, alive and well."""
687
self.last_checked_ok = datetime.datetime.utcnow()
688
self.last_checker_status = 0
689
self.last_checker_signal = None
690
self.bump_timeout()
691
692
def bump_timeout(self, timeout=None):
693
"""Bump up the timeout for this client."""
457
458
def checked_ok(self, timeout=None):
459
"""Bump up the timeout for this client.
460
461
This should only be called when the client has been seen,
462
alive and well.
463
"""
694
464
if timeout is None:
695
465
timeout = self.timeout
696
if self.disable_initiator_tag is not None:
697
gobject.source_remove(self.disable_initiator_tag)
698
self.disable_initiator_tag = None
699
if getattr(self, "enabled", False):
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
702
self.expires = datetime.datetime.utcnow() + timeout
466
self.last_checked_ok = datetime.datetime.utcnow()
467
gobject.source_remove(self.disable_initiator_tag)
468
self.disable_initiator_tag = (gobject.timeout_add
469
(_timedelta_to_milliseconds
470
(timeout), self.disable))
471
self.expires = datetime.datetime.utcnow() + timeout
703
472
704
473
def need_approval(self):
705
474
self.last_approval_request = datetime.datetime.utcnow()
710
479
If a checker already exists, leave it running and do
711
480
nothing."""
712
481
# The reason for not killing a running checker is that if we
713
# did that, and if a checker (for some reason) started running
714
# slowly and taking more than 'interval' time, then the client
715
# would inevitably timeout, since no checker would get a
716
# chance to run to completion. If we instead leave running
482
# did that, then if a checker (for some reason) started
483
# running slowly and taking more than 'interval' time, the
484
# client would inevitably timeout, since no checker would get
485
# a chance to run to completion. If we instead leave running
717
486
# checkers alone, the checker would have to take more time
718
487
# than 'timeout' for the client to be disabled, which is as it
719
488
# should be.
720
489
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
723
self.checker.join()
724
self.checker = None
490
# If a checker exists, make sure it is not a zombie
491
try:
492
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
493
except (AttributeError, OSError) as error:
494
if (isinstance(error, OSError)
495
and error.errno != errno.ECHILD):
496
raise error
497
else:
498
if pid:
499
logger.warning("Checker was a zombie")
500
gobject.source_remove(self.checker_callback_tag)
501
self.checker_callback(pid, status,
502
self.current_checker_command)
725
503
# Start a new checker if needed
726
504
if self.checker is None:
727
# Escape attributes for the shell
728
escaped_attrs = {
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
731
505
try:
732
command = self.checker_command % escaped_attrs
733
except TypeError as error:
734
logger.error('Could not format string "%s"',
735
self.checker_command,
736
exc_info=error)
737
return True # Try again later
506
# In case checker_command has exactly one % operator
507
command = self.checker_command % self.host
508
except TypeError:
509
# Escape attributes for the shell
510
escaped_attrs = dict(
511
(attr,
512
re.escape(unicode(str(getattr(self, attr, "")),
513
errors=
514
'replace')))
515
for attr in
516
self.runtime_expansions)
517
518
try:
519
command = self.checker_command % escaped_attrs
520
except TypeError as error:
521
logger.error('Could not format string "%s":'
522
' %s', self.checker_command, error)
523
return True # Try again later
738
524
self.current_checker_command = command
739
logger.info("Starting checker %r for %s", command,
740
self.name)
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
747
# created wnull.
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
760
self.checker.start()
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
525
try:
526
logger.info("Starting checker %r for %s",
527
command, self.name)
528
# We don't need to redirect stdout and stderr, since
529
# in normal mode, that is already done by daemon(),
530
# and in debug mode we don't want to. (Stdin is
531
# always replaced by /dev/null.)
532
self.checker = subprocess.Popen(command,
533
close_fds=True,
534
shell=True, cwd="/")
535
self.checker_callback_tag = (gobject.child_watch_add
536
(self.checker.pid,
537
self.checker_callback,
538
data=command))
539
# The checker may have completed before the gobject
540
# watch was added. Check for this.
541
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
542
if pid:
543
gobject.source_remove(self.checker_callback_tag)
544
self.checker_callback(pid, status, command)
545
except OSError as error:
546
logger.error("Failed to start subprocess: %s",
547
error)
764
548
# Re-run this periodically if run by gobject.timeout_add
765
549
return True
766
550
772
556
if getattr(self, "checker", None) is None:
773
557
return
774
558
logger.debug("Stopping checker for %(name)s", vars(self))
775
self.checker.terminate()
559
try:
560
os.kill(self.checker.pid, signal.SIGTERM)
561
#time.sleep(0.5)
562
#if self.checker.poll() is None:
563
# os.kill(self.checker.pid, signal.SIGKILL)
564
except OSError as error:
565
if error.errno != errno.ESRCH: # No such process
566
raise
776
567
self.checker = None
777
568
778
569
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
570
def dbus_service_property(dbus_interface, signature="v",
571
access="readwrite", byte_arrays=False):
783
572
"""Decorators for marking methods of a DBusObjectWithProperties to
784
573
become properties on the D-Bus.
785
574
794
583
# "Set" method, so we fail early here:
795
584
if byte_arrays and signature != "ay":
796
585
raise ValueError("Byte arrays not supported for non-'ay'"
797
" signature {!r}".format(signature))
798
586
" signature %r" % signature)
799
587
def decorator(func):
800
588
func._dbus_is_property = True
801
589
func._dbus_interface = dbus_interface
806
594
func._dbus_name = func._dbus_name[:-14]
807
595
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
808
596
return func
809
810
return decorator
811
812
813
def dbus_interface_annotations(dbus_interface):
814
"""Decorator for marking functions returning interface annotations
815
816
Usage:
817
818
@dbus_interface_annotations("org.example.Interface")
819
def _foo(self): # Function name does not matter
820
return {"org.freedesktop.DBus.Deprecated": "true",
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
822
"false"}
823
"""
824
825
def decorator(func):
826
func._dbus_is_interface = True
827
func._dbus_interface = dbus_interface
828
func._dbus_name = dbus_interface
829
return func
830
831
return decorator
832
833
834
def dbus_annotations(annotations):
835
"""Decorator to annotate D-Bus methods, signals or properties
836
Usage:
837
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
@dbus_service_property("org.example.Interface", signature="b",
842
access="r")
843
def Property_dbus_property(self):
844
return dbus.Boolean(False)
845
"""
846
847
def decorator(func):
848
func._dbus_annotations = annotations
849
return func
850
851
597
return decorator
852
598
853
599
854
600
class DBusPropertyException(dbus.exceptions.DBusException):
855
601
"""A base class for D-Bus property-related exceptions
856
602
"""
857
pass
603
def __unicode__(self):
604
return unicode(str(self))
858
605
859
606
860
607
class DBusPropertyAccessException(DBusPropertyException):
878
625
"""
879
626
880
627
@staticmethod
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
883
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
886
"""
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
False)
628
def _is_dbus_property(obj):
629
return getattr(obj, "_dbus_is_property", False)
889
630
890
def _get_all_dbus_things(self, thing):
631
def _get_all_dbus_properties(self):
891
632
"""Returns a generator of (name, attribute) pairs
892
633
"""
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
634
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
895
635
for cls in self.__class__.__mro__
896
for name, athing in
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
636
for name, prop in
637
inspect.getmembers(cls, self._is_dbus_property))
898
638
899
639
def _get_dbus_property(self, interface_name, property_name):
900
640
"""Returns a bound method if one exists which is a D-Bus
901
641
property with the specified name and interface.
902
642
"""
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
643
for cls in self.__class__.__mro__:
644
for name, value in (inspect.getmembers
645
(cls, self._is_dbus_property)):
906
646
if (value._dbus_name == property_name
907
647
and value._dbus_interface == interface_name):
908
648
return value.__get__(self)
909
649
910
650
# No such property
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
651
raise DBusPropertyNotFound(self.dbus_object_path + ":"
652
+ interface_name + "."
653
+ property_name)
913
654
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
915
in_signature="ss",
655
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
656
out_signature="v")
917
657
def Get(self, interface_name, property_name):
918
658
"""Standard D-Bus property Get() method, see D-Bus standard.
936
676
# The byte_arrays option is not supported yet on
937
677
# signatures other than "ay".
938
678
if prop._dbus_signature != "ay":
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {!r}"
941
.format(prop._dbus_signature))
942
value = dbus.ByteArray(b''.join(chr(byte)
943
for byte in value))
679
raise ValueError
680
value = dbus.ByteArray(''.join(unichr(byte)
681
for byte in value))
944
682
prop(value)
945
683
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
in_signature="s",
684
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
948
685
out_signature="a{sv}")
949
686
def GetAll(self, interface_name):
950
687
"""Standard D-Bus property GetAll() method, see D-Bus
952
689
953
690
Note: Will not include properties with access="write".
954
691
"""
955
properties = {}
956
for name, prop in self._get_all_dbus_things("property"):
692
all = {}
693
for name, prop in self._get_all_dbus_properties():
957
694
if (interface_name
958
695
and interface_name != prop._dbus_interface):
959
696
# Interface non-empty but did not match
963
700
continue
964
701
value = prop()
965
702
if not hasattr(value, "variant_level"):
966
properties[name] = value
703
all[name] = value
967
704
continue
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
970
return dbus.Dictionary(properties, signature="sv")
971
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
976
standard.
977
"""
978
pass
705
all[name] = type(value)(value, variant_level=
706
value.variant_level+1)
707
return dbus.Dictionary(all, signature="sv")
979
708
980
709
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
981
710
out_signature="s",
982
711
path_keyword='object_path',
983
712
connection_keyword='connection')
984
713
def Introspect(self, object_path, connection):
985
"""Overloading of standard D-Bus method.
986
987
Inserts property tags and interface annotation tags.
714
"""Standard D-Bus method, overloaded to insert property tags.
988
715
"""
989
716
xmlstring = dbus.service.Object.Introspect(self, object_path,
990
717
connection)
991
718
try:
992
719
document = xml.dom.minidom.parseString(xmlstring)
993
994
720
def make_tag(document, name, prop):
995
721
e = document.createElement("property")
996
722
e.setAttribute("name", name)
997
723
e.setAttribute("type", prop._dbus_signature)
998
724
e.setAttribute("access", prop._dbus_access)
999
725
return e
1000
1001
726
for if_tag in document.getElementsByTagName("interface"):
1002
# Add property tags
1003
727
for tag in (make_tag(document, name, prop)
1004
728
for name, prop
1005
in self._get_all_dbus_things("property")
729
in self._get_all_dbus_properties()
1006
730
if prop._dbus_interface
1007
731
== if_tag.getAttribute("name")):
1008
732
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1038
733
# Add the names to the return values for the
1039
734
# "org.freedesktop.DBus.Properties" methods
1040
735
if (if_tag.getAttribute("name")
1055
750
except (AttributeError, xml.dom.DOMException,
1056
751
xml.parsers.expat.ExpatError) as error:
1057
752
logger.error("Failed to override Introspection method",
1058
exc_info=error)
753
error)
1059
754
return xmlstring
1060
755
1061
756
1062
def datetime_to_dbus(dt, variant_level=0):
757
def datetime_to_dbus (dt, variant_level=0):
1063
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1064
759
if dt is None:
1065
760
return dbus.String("", variant_level = variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1067
1068
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1073
Usage:
1074
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1080
pass
1081
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1087
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
761
return dbus.String(dt.isoformat(),
762
variant_level=variant_level)
763
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
765
.__metaclass__):
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
767
will add additional D-Bus attributes matching a certain pattern.
1091
768
"""
1092
1093
def wrapper(cls):
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1096
attr = {}
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
769
def __new__(mcs, name, bases, attr):
770
# Go through all the base classes which could have D-Bus
771
# methods, signals, or properties in them
772
for base in (b for b in bases
773
if issubclass(b, dbus.service.Object)):
774
# Go though all attributes of the base class
775
for attrname, attribute in inspect.getmembers(base):
1100
776
# Ignore non-D-Bus attributes, and D-Bus attributes
1101
777
# with the wrong interface name
1102
778
if (not hasattr(attribute, "_dbus_interface")
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
779
or not attribute._dbus_interface
780
.startswith("se.recompile.Mandos")):
1105
781
continue
1106
782
# Create an alternate D-Bus interface name based on
1107
783
# the current name
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
784
alt_interface = (attribute._dbus_interface
785
.replace("se.recompile.Mandos",
786
"se.bsnet.fukt.Mandos"))
1111
787
# Is this a D-Bus signal?
1112
788
if getattr(attribute, "_dbus_is_signal", False):
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1116
nonmethod_func = (dict(
789
# Extract the original non-method function by
790
# black magic
791
nonmethod_func = (dict(
1117
792
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1120
else:
1121
nonmethod_func = attribute
793
attribute.__closure__))["func"]
794
.cell_contents)
1122
795
# Create a new, but exactly alike, function
1123
796
# object, and decorate it to be a new D-Bus signal
1124
797
# with the alternate D-Bus interface name
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1132
else:
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1139
new_function = (dbus.service.signal(
1140
alt_interface,
1141
attribute._dbus_signature)(new_function))
1142
# Copy annotations, if any
1143
try:
1144
new_function._dbus_annotations = dict(
1145
attribute._dbus_annotations)
1146
except AttributeError:
1147
pass
798
new_function = (dbus.service.signal
799
(alt_interface,
800
attribute._dbus_signature)
801
(types.FunctionType(
802
nonmethod_func.func_code,
803
nonmethod_func.func_globals,
804
nonmethod_func.func_name,
805
nonmethod_func.func_defaults,
806
nonmethod_func.func_closure)))
1148
807
# Define a creator of a function to call both the
1149
# original and alternate functions, so both the
1150
# original and alternate signals gets sent when
1151
# the function is called
808
# old and new functions, so both the old and new
809
# signals gets sent when the function is called
1152
810
def fixscope(func1, func2):
1153
811
"""This function is a scope container to pass
1154
812
func1 and func2 to the "call_both" function
1155
813
outside of its arguments"""
1156
1157
814
def call_both(*args, **kwargs):
1158
815
"""This function will emit two D-Bus
1159
816
signals by calling func1 and func2"""
1160
817
func1(*args, **kwargs)
1161
818
func2(*args, **kwargs)
1162
1163
819
return call_both
1164
820
# Create the "call_both" function and add it to
1165
821
# the class
1166
attr[attrname] = fixscope(attribute, new_function)
822
attr[attrname] = fixscope(attribute,
823
new_function)
1167
824
# Is this a D-Bus method?
1168
825
elif getattr(attribute, "_dbus_is_method", False):
1169
826
# Create a new, but exactly alike, function
1170
827
# object. Decorate it to be a new D-Bus method
1171
828
# with the alternate D-Bus interface name. Add it
1172
829
# to the class.
1173
attr[attrname] = (
1174
dbus.service.method(
1175
alt_interface,
1176
attribute._dbus_in_signature,
1177
attribute._dbus_out_signature)
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
# Copy annotations, if any
1184
try:
1185
attr[attrname]._dbus_annotations = dict(
1186
attribute._dbus_annotations)
1187
except AttributeError:
1188
pass
830
attr[attrname] = (dbus.service.method
831
(alt_interface,
832
attribute._dbus_in_signature,
833
attribute._dbus_out_signature)
834
(types.FunctionType
835
(attribute.func_code,
836
attribute.func_globals,
837
attribute.func_name,
838
attribute.func_defaults,
839
attribute.func_closure)))
1189
840
# Is this a D-Bus property?
1190
841
elif getattr(attribute, "_dbus_is_property", False):
1191
842
# Create a new, but exactly alike, function
1192
843
# object, and decorate it to be a new D-Bus
1193
844
# property with the alternate D-Bus interface
1194
845
# name. Add it to the class.
1195
attr[attrname] = (dbus_service_property(
1196
alt_interface, attribute._dbus_signature,
1197
attribute._dbus_access,
1198
attribute._dbus_get_args_options
1199
["byte_arrays"])
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1206
# Copy annotations, if any
1207
try:
1208
attr[attrname]._dbus_annotations = dict(
1209
attribute._dbus_annotations)
1210
except AttributeError:
1211
pass
1212
# Is this a D-Bus interface?
1213
elif getattr(attribute, "_dbus_is_interface", False):
1214
# Create a new, but exactly alike, function
1215
# object. Decorate it to be a new D-Bus interface
1216
# with the alternate D-Bus interface name. Add it
1217
# to the class.
1218
attr[attrname] = (
1219
dbus_interface_annotations(alt_interface)
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1225
if deprecate:
1226
# Deprecate all alternate interfaces
1227
iname="_AlternateDBusNames_interface_annotation{}"
1228
for interface_name in interface_names:
1229
1230
@dbus_interface_annotations(interface_name)
1231
def func(self):
1232
return { "org.freedesktop.DBus.Deprecated":
1233
"true" }
1234
# Find an unused name
1235
for aname in (iname.format(i)
1236
for i in itertools.count()):
1237
if aname not in attr:
1238
attr[aname] = func
1239
break
1240
if interface_names:
1241
# Replace the class with a new subclass of it with
1242
# methods, signals, etc. as created above.
1243
cls = type(b"{}Alternate".format(cls.__name__),
1244
(cls, ), attr)
1245
return cls
1246
1247
return wrapper
1248
1249
1250
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
"se.bsnet.fukt.Mandos"})
846
attr[attrname] = (dbus_service_property
847
(alt_interface,
848
attribute._dbus_signature,
849
attribute._dbus_access,
850
attribute
851
._dbus_get_args_options
852
["byte_arrays"])
853
(types.FunctionType
854
(attribute.func_code,
855
attribute.func_globals,
856
attribute.func_name,
857
attribute.func_defaults,
858
attribute.func_closure)))
859
return type.__new__(mcs, name, bases, attr)
860
1252
861
class ClientDBus(Client, DBusObjectWithProperties):
1253
862
"""A Client class using D-Bus
1254
863
1258
867
"""
1259
868
1260
869
runtime_expansions = (Client.runtime_expansions
1261
+ ("dbus_object_path", ))
1262
1263
_interface = "se.recompile.Mandos.Client"
870
+ ("dbus_object_path",))
1264
871
1265
872
# dbus.service.Object doesn't use super(), so we can't either.
1266
873
1267
874
def __init__(self, bus = None, *args, **kwargs):
875
self._approvals_pending = 0
1268
876
self.bus = bus
1269
877
Client.__init__(self, *args, **kwargs)
1270
878
# Only now, when this client is initialized, can it show up on
1271
879
# the D-Bus
1272
client_object_name = str(self.name).translate(
880
client_object_name = unicode(self.name).translate(
1273
881
{ord("."): ord("_"),
1274
882
ord("-"): ord("_")})
1275
self.dbus_object_path = dbus.ObjectPath(
1276
"/clients/" + client_object_name)
883
self.dbus_object_path = (dbus.ObjectPath
884
("/clients/" + client_object_name))
1277
885
DBusObjectWithProperties.__init__(self, self.bus,
1278
886
self.dbus_object_path)
1279
1280
def notifychangeproperty(transform_func, dbus_name,
1281
type_func=lambda x: x,
1282
variant_level=1,
1283
invalidate_only=False,
1284
_interface=_interface):
887
888
def notifychangeproperty(transform_func,
889
dbus_name, type_func=lambda x: x,
890
variant_level=1):
1285
891
""" Modify a variable so that it's a property which announces
1286
892
its changes to DBus.
1287
1288
transform_fun: Function that takes a value and a variant_level
1289
and transforms it to a D-Bus type.
893
894
transform_fun: Function that takes a value and transforms it
895
to a D-Bus type.
1290
896
dbus_name: D-Bus name of the variable
1291
897
type_func: Function that transform the value before sending it
1292
898
to the D-Bus. Default: no transform
1293
899
variant_level: D-Bus variant level. Default: 1
1294
900
"""
1295
attrname = "_{}".format(dbus_name)
1296
901
attrname = "_{0}".format(dbus_name)
1297
902
def setter(self, value):
1298
903
if hasattr(self, "dbus_object_path"):
1299
904
if (not hasattr(self, attrname) or
1300
905
type_func(getattr(self, attrname, None))
1301
906
!= type_func(value)):
1302
if invalidate_only:
1303
self.PropertiesChanged(
1304
_interface, dbus.Dictionary(),
1305
dbus.Array((dbus_name, )))
1306
else:
1307
dbus_value = transform_func(
1308
type_func(value),
1309
variant_level = variant_level)
1310
self.PropertyChanged(dbus.String(dbus_name),
1311
dbus_value)
1312
self.PropertiesChanged(
1313
_interface,
1314
dbus.Dictionary({ dbus.String(dbus_name):
1315
dbus_value }),
1316
dbus.Array())
907
dbus_value = transform_func(type_func(value),
908
variant_level)
909
self.PropertyChanged(dbus.String(dbus_name),
910
dbus_value)
1317
911
setattr(self, attrname, value)
1318
912
1319
913
return property(lambda self: getattr(self, attrname), setter)
1320
914
915
1321
916
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1322
917
approvals_pending = notifychangeproperty(dbus.Boolean,
1323
918
"ApprovalPending",
1325
920
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
921
last_enabled = notifychangeproperty(datetime_to_dbus,
1327
922
"LastEnabled")
1328
checker = notifychangeproperty(
1329
dbus.Boolean, "CheckerRunning",
1330
type_func = lambda checker: checker is not None)
923
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
924
type_func = lambda checker:
925
checker is not None)
1331
926
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1332
927
"LastCheckedOK")
1333
last_checker_status = notifychangeproperty(dbus.Int16,
1334
"LastCheckerStatus")
1335
928
last_approval_request = notifychangeproperty(
1336
929
datetime_to_dbus, "LastApprovalRequest")
1337
930
approved_by_default = notifychangeproperty(dbus.Boolean,
1338
931
"ApprovedByDefault")
1339
approval_delay = notifychangeproperty(
1340
dbus.UInt64, "ApprovalDelay",
1341
type_func = lambda td: td.total_seconds() * 1000)
932
approval_delay = notifychangeproperty(dbus.UInt16,
933
"ApprovalDelay",
934
type_func =
935
_timedelta_to_milliseconds)
1342
936
approval_duration = notifychangeproperty(
1343
dbus.UInt64, "ApprovalDuration",
1344
type_func = lambda td: td.total_seconds() * 1000)
937
dbus.UInt16, "ApprovalDuration",
938
type_func = _timedelta_to_milliseconds)
1345
939
host = notifychangeproperty(dbus.String, "Host")
1346
timeout = notifychangeproperty(
1347
dbus.UInt64, "Timeout",
1348
type_func = lambda td: td.total_seconds() * 1000)
940
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
941
type_func =
942
_timedelta_to_milliseconds)
1349
943
extended_timeout = notifychangeproperty(
1350
dbus.UInt64, "ExtendedTimeout",
1351
type_func = lambda td: td.total_seconds() * 1000)
1352
interval = notifychangeproperty(
1353
dbus.UInt64, "Interval",
1354
type_func = lambda td: td.total_seconds() * 1000)
944
dbus.UInt16, "ExtendedTimeout",
945
type_func = _timedelta_to_milliseconds)
946
interval = notifychangeproperty(dbus.UInt16,
947
"Interval",
948
type_func =
949
_timedelta_to_milliseconds)
1355
950
checker_command = notifychangeproperty(dbus.String, "Checker")
1356
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
invalidate_only=True)
1358
951
1359
952
del notifychangeproperty
1360
953
1367
960
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
961
Client.__del__(self, *args, **kwargs)
1369
962
1370
def checker_callback(self, source, condition,
1371
connection, command, *args, **kwargs):
1372
ret = Client.checker_callback(self, source, condition,
1373
connection, command, *args,
1374
**kwargs)
1375
exitstatus = self.last_checker_status
1376
if exitstatus >= 0:
963
def checker_callback(self, pid, condition, command,
964
*args, **kwargs):
965
self.checker_callback_tag = None
966
self.checker = None
967
if os.WIFEXITED(condition):
968
exitstatus = os.WEXITSTATUS(condition)
1377
969
# Emit D-Bus signal
1378
970
self.CheckerCompleted(dbus.Int16(exitstatus),
1379
dbus.Int64(0),
971
dbus.Int64(condition),
1380
972
dbus.String(command))
1381
973
else:
1382
974
# Emit D-Bus signal
1383
975
self.CheckerCompleted(dbus.Int16(-1),
1384
dbus.Int64(
1385
self.last_checker_signal),
976
dbus.Int64(condition),
1386
977
dbus.String(command))
1387
return ret
978
979
return Client.checker_callback(self, pid, condition, command,
980
*args, **kwargs)
1388
981
1389
982
def start_checker(self, *args, **kwargs):
1390
old_checker_pid = getattr(self.checker, "pid", None)
983
old_checker = self.checker
984
if self.checker is not None:
985
old_checker_pid = self.checker.pid
986
else:
987
old_checker_pid = None
1391
988
r = Client.start_checker(self, *args, **kwargs)
1392
989
# Only if new checker process was started
1393
990
if (self.checker is not None
1397
994
return r
1398
995
1399
996
def _reset_approved(self):
1400
self.approved = None
997
self._approved = None
1401
998
return False
1402
999
1403
1000
def approve(self, value=True):
1404
self.approved = value
1405
gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
* 1000), self._reset_approved)
1407
1001
self.send_changedstate()
1002
self._approved = value
1003
gobject.timeout_add(_timedelta_to_milliseconds
1004
(self.approval_duration),
1005
self._reset_approved)
1006
1408
1007
1409
1008
## D-Bus methods, signals & properties
1410
1411
## Interfaces
1009
_interface = "se.recompile.Mandos.Client"
1412
1010
1413
1011
## Signals
1414
1012
1425
1023
pass
1426
1024
1427
1025
# PropertyChanged - signal
1428
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1429
1026
@dbus.service.signal(_interface, signature="sv")
1430
1027
def PropertyChanged(self, property, value):
1431
1028
"D-Bus signal"
1465
1062
self.checked_ok()
1466
1063
1467
1064
# Enable - method
1468
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1469
1065
@dbus.service.method(_interface)
1470
1066
def Enable(self):
1471
1067
"D-Bus method"
1472
1068
self.enable()
1473
1069
1474
1070
# StartChecker - method
1475
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1476
1071
@dbus.service.method(_interface)
1477
1072
def StartChecker(self):
1478
1073
"D-Bus method"
1479
1074
self.start_checker()
1480
1075
1481
1076
# Disable - method
1482
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1483
1077
@dbus.service.method(_interface)
1484
1078
def Disable(self):
1485
1079
"D-Bus method"
1486
1080
self.disable()
1487
1081
1488
1082
# StopChecker - method
1489
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1490
1083
@dbus.service.method(_interface)
1491
1084
def StopChecker(self):
1492
1085
self.stop_checker()
1499
1092
return dbus.Boolean(bool(self.approvals_pending))
1500
1093
1501
1094
# ApprovedByDefault - property
1502
@dbus_service_property(_interface,
1503
signature="b",
1095
@dbus_service_property(_interface, signature="b",
1504
1096
access="readwrite")
1505
1097
def ApprovedByDefault_dbus_property(self, value=None):
1506
1098
if value is None: # get
1508
1100
self.approved_by_default = bool(value)
1509
1101
1510
1102
# ApprovalDelay - property
1511
@dbus_service_property(_interface,
1512
signature="t",
1103
@dbus_service_property(_interface, signature="t",
1513
1104
access="readwrite")
1514
1105
def ApprovalDelay_dbus_property(self, value=None):
1515
1106
if value is None: # get
1516
return dbus.UInt64(self.approval_delay.total_seconds()
1517
* 1000)
1107
return dbus.UInt64(self.approval_delay_milliseconds())
1518
1108
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1519
1109
1520
1110
# ApprovalDuration - property
1521
@dbus_service_property(_interface,
1522
signature="t",
1111
@dbus_service_property(_interface, signature="t",
1523
1112
access="readwrite")
1524
1113
def ApprovalDuration_dbus_property(self, value=None):
1525
1114
if value is None: # get
1526
return dbus.UInt64(self.approval_duration.total_seconds()
1527
* 1000)
1115
return dbus.UInt64(_timedelta_to_milliseconds(
1116
self.approval_duration))
1528
1117
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1529
1118
1530
1119
# Name - property
1531
@dbus_annotations(
1532
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1533
1120
@dbus_service_property(_interface, signature="s", access="read")
1534
1121
def Name_dbus_property(self):
1535
1122
return dbus.String(self.name)
1536
1123
1537
1124
# Fingerprint - property
1538
@dbus_annotations(
1539
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1540
1125
@dbus_service_property(_interface, signature="s", access="read")
1541
1126
def Fingerprint_dbus_property(self):
1542
1127
return dbus.String(self.fingerprint)
1543
1128
1544
1129
# Host - property
1545
@dbus_service_property(_interface,
1546
signature="s",
1130
@dbus_service_property(_interface, signature="s",
1547
1131
access="readwrite")
1548
1132
def Host_dbus_property(self, value=None):
1549
1133
if value is None: # get
1550
1134
return dbus.String(self.host)
1551
self.host = str(value)
1135
self.host = value
1552
1136
1553
1137
# Created - property
1554
@dbus_annotations(
1555
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1556
1138
@dbus_service_property(_interface, signature="s", access="read")
1557
1139
def Created_dbus_property(self):
1558
return datetime_to_dbus(self.created)
1140
return dbus.String(datetime_to_dbus(self.created))
1559
1141
1560
1142
# LastEnabled - property
1561
1143
@dbus_service_property(_interface, signature="s", access="read")
1563
1145
return datetime_to_dbus(self.last_enabled)
1564
1146
1565
1147
# Enabled - property
1566
@dbus_service_property(_interface,
1567
signature="b",
1148
@dbus_service_property(_interface, signature="b",
1568
1149
access="readwrite")
1569
1150
def Enabled_dbus_property(self, value=None):
1570
1151
if value is None: # get
1575
1156
self.disable()
1576
1157
1577
1158
# LastCheckedOK - property
1578
@dbus_service_property(_interface,
1579
signature="s",
1159
@dbus_service_property(_interface, signature="s",
1580
1160
access="readwrite")
1581
1161
def LastCheckedOK_dbus_property(self, value=None):
1582
1162
if value is not None:
1584
1164
return
1585
1165
return datetime_to_dbus(self.last_checked_ok)
1586
1166
1587
# LastCheckerStatus - property
1588
@dbus_service_property(_interface, signature="n", access="read")
1589
def LastCheckerStatus_dbus_property(self):
1590
return dbus.Int16(self.last_checker_status)
1591
1592
1167
# Expires - property
1593
1168
@dbus_service_property(_interface, signature="s", access="read")
1594
1169
def Expires_dbus_property(self):
1600
1175
return datetime_to_dbus(self.last_approval_request)
1601
1176
1602
1177
# Timeout - property
1603
@dbus_service_property(_interface,
1604
signature="t",
1178
@dbus_service_property(_interface, signature="t",
1605
1179
access="readwrite")
1606
1180
def Timeout_dbus_property(self, value=None):
1607
1181
if value is None: # get
1608
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1609
old_timeout = self.timeout
1182
return dbus.UInt64(self.timeout_milliseconds())
1610
1183
self.timeout = datetime.timedelta(0, 0, 0, value)
1611
# Reschedule disabling
1612
if self.enabled:
1613
now = datetime.datetime.utcnow()
1614
self.expires += self.timeout - old_timeout
1615
if self.expires <= now:
1616
# The timeout has passed
1617
self.disable()
1618
else:
1619
if (getattr(self, "disable_initiator_tag", None)
1620
is None):
1621
return
1622
gobject.source_remove(self.disable_initiator_tag)
1623
self.disable_initiator_tag = gobject.timeout_add(
1624
int((self.expires - now).total_seconds() * 1000),
1625
self.disable)
1184
if getattr(self, "disable_initiator_tag", None) is None:
1185
return
1186
# Reschedule timeout
1187
gobject.source_remove(self.disable_initiator_tag)
1188
self.disable_initiator_tag = None
1189
self.expires = None
1190
time_to_die = (self.
1191
_timedelta_to_milliseconds((self
1192
.last_checked_ok
1193
+ self.timeout)
1194
- datetime.datetime
1195
.utcnow()))
1196
if time_to_die <= 0:
1197
# The timeout has passed
1198
self.disable()
1199
else:
1200
self.expires = (datetime.datetime.utcnow()
1201
+ datetime.timedelta(milliseconds =
1202
time_to_die))
1203
self.disable_initiator_tag = (gobject.timeout_add
1204
(time_to_die, self.disable))
1626
1205
1627
1206
# ExtendedTimeout - property
1628
@dbus_service_property(_interface,
1629
signature="t",
1207
@dbus_service_property(_interface, signature="t",
1630
1208
access="readwrite")
1631
1209
def ExtendedTimeout_dbus_property(self, value=None):
1632
1210
if value is None: # get
1633
return dbus.UInt64(self.extended_timeout.total_seconds()
1634
* 1000)
1211
return dbus.UInt64(self.extended_timeout_milliseconds())
1635
1212
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1636
1213
1637
1214
# Interval - property
1638
@dbus_service_property(_interface,
1639
signature="t",
1215
@dbus_service_property(_interface, signature="t",
1640
1216
access="readwrite")
1641
1217
def Interval_dbus_property(self, value=None):
1642
1218
if value is None: # get
1643
return dbus.UInt64(self.interval.total_seconds() * 1000)
1219
return dbus.UInt64(self.interval_milliseconds())
1644
1220
self.interval = datetime.timedelta(0, 0, 0, value)
1645
1221
if getattr(self, "checker_initiator_tag", None) is None:
1646
1222
return
1647
if self.enabled:
1648
# Reschedule checker run
1649
gobject.source_remove(self.checker_initiator_tag)
1650
self.checker_initiator_tag = gobject.timeout_add(
1651
value, self.start_checker)
1652
self.start_checker() # Start one now, too
1223
# Reschedule checker run
1224
gobject.source_remove(self.checker_initiator_tag)
1225
self.checker_initiator_tag = (gobject.timeout_add
1226
(value, self.start_checker))
1227
self.start_checker() # Start one now, too
1653
1228
1654
1229
# Checker - property
1655
@dbus_service_property(_interface,
1656
signature="s",
1230
@dbus_service_property(_interface, signature="s",
1657
1231
access="readwrite")
1658
1232
def Checker_dbus_property(self, value=None):
1659
1233
if value is None: # get
1660
1234
return dbus.String(self.checker_command)
1661
self.checker_command = str(value)
1235
self.checker_command = value
1662
1236
1663
1237
# CheckerRunning - property
1664
@dbus_service_property(_interface,
1665
signature="b",
1238
@dbus_service_property(_interface, signature="b",
1666
1239
access="readwrite")
1667
1240
def CheckerRunning_dbus_property(self, value=None):
1668
1241
if value is None: # get
1673
1246
self.stop_checker()
1674
1247
1675
1248
# ObjectPath - property
1676
@dbus_annotations(
1677
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1678
1249
@dbus_service_property(_interface, signature="o", access="read")
1679
1250
def ObjectPath_dbus_property(self):
1680
1251
return self.dbus_object_path # is already a dbus.ObjectPath
1681
1252
1682
1253
# Secret = property
1683
@dbus_annotations(
1684
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1685
"invalidates"})
1686
@dbus_service_property(_interface,
1687
signature="ay",
1688
access="write",
1689
byte_arrays=True)
1254
@dbus_service_property(_interface, signature="ay",
1255
access="write", byte_arrays=True)
1690
1256
def Secret_dbus_property(self, value):
1691
self.secret = bytes(value)
1257
self.secret = str(value)
1692
1258
1693
1259
del _interface
1694
1260
1698
1264
self._pipe = child_pipe
1699
1265
self._pipe.send(('init', fpr, address))
1700
1266
if not self._pipe.recv():
1701
raise KeyError(fpr)
1267
raise KeyError()
1702
1268
1703
1269
def __getattribute__(self, name):
1704
if name == '_pipe':
1270
if(name == '_pipe'):
1705
1271
return super(ProxyClient, self).__getattribute__(name)
1706
1272
self._pipe.send(('getattr', name))
1707
1273
data = self._pipe.recv()
1708
1274
if data[0] == 'data':
1709
1275
return data[1]
1710
1276
if data[0] == 'function':
1711
1712
1277
def func(*args, **kwargs):
1713
1278
self._pipe.send(('funcall', name, args, kwargs))
1714
1279
return self._pipe.recv()[1]
1715
1716
1280
return func
1717
1281
1718
1282
def __setattr__(self, name, value):
1719
if name == '_pipe':
1283
if(name == '_pipe'):
1720
1284
return super(ProxyClient, self).__setattr__(name, value)
1721
1285
self._pipe.send(('setattr', name, value))
1722
1286
1287
class ClientDBusTransitional(ClientDBus):
1288
__metaclass__ = AlternateDBusNamesMetaclass
1723
1289
1724
1290
class ClientHandler(socketserver.BaseRequestHandler, object):
1725
1291
"""A class to handle client connections.
1730
1296
def handle(self):
1731
1297
with contextlib.closing(self.server.child_pipe) as child_pipe:
1732
1298
logger.info("TCP connection from: %s",
1733
str(self.client_address))
1299
unicode(self.client_address))
1734
1300
logger.debug("Pipe FD: %d",
1735
1301
self.server.child_pipe.fileno())
1736
1302
1737
session = gnutls.connection.ClientSession(
1738
self.request, gnutls.connection .X509Credentials())
1303
session = (gnutls.connection
1304
.ClientSession(self.request,
1305
gnutls.connection
1306
.X509Credentials()))
1739
1307
1740
1308
# Note: gnutls.connection.X509Credentials is really a
1741
1309
# generic GnuTLS certificate credentials object so long as
1750
1318
priority = self.server.gnutls_priority
1751
1319
if priority is None:
1752
1320
priority = "NORMAL"
1753
gnutls.library.functions.gnutls_priority_set_direct(
1754
session._c_object, priority, None)
1321
(gnutls.library.functions
1322
.gnutls_priority_set_direct(session._c_object,
1323
priority, None))
1755
1324
1756
1325
# Start communication using the Mandos protocol
1757
1326
# Get protocol number
1759
1328
logger.debug("Protocol version: %r", line)
1760
1329
try:
1761
1330
if int(line.strip().split()[0]) > 1:
1762
raise RuntimeError(line)
1331
raise RuntimeError
1763
1332
except (ValueError, IndexError, RuntimeError) as error:
1764
1333
logger.error("Unknown protocol version: %s", error)
1765
1334
return
1777
1346
approval_required = False
1778
1347
try:
1779
1348
try:
1780
fpr = self.fingerprint(
1781
self.peer_certificate(session))
1349
fpr = self.fingerprint(self.peer_certificate
1350
(session))
1782
1351
except (TypeError,
1783
1352
gnutls.errors.GNUTLSError) as error:
1784
1353
logger.warning("Bad certificate: %s", error)
1799
1368
while True:
1800
1369
if not client.enabled:
1801
1370
logger.info("Client %s is disabled",
1802
client.name)
1371
client.name)
1803
1372
if self.server.use_dbus:
1804
1373
# Emit D-Bus signal
1805
1374
client.Rejected("Disabled")
1806
1375
return
1807
1376
1808
if client.approved or not client.approval_delay:
1377
if client._approved or not client.approval_delay:
1809
1378
#We are approved or approval is disabled
1810
1379
break
1811
elif client.approved is None:
1380
elif client._approved is None:
1812
1381
logger.info("Client %s needs approval",
1813
1382
client.name)
1814
1383
if self.server.use_dbus:
1815
1384
# Emit D-Bus signal
1816
1385
client.NeedApproval(
1817
client.approval_delay.total_seconds()
1818
* 1000, client.approved_by_default)
1386
client.approval_delay_milliseconds(),
1387
client.approved_by_default)
1819
1388
else:
1820
1389
logger.warning("Client %s was not approved",
1821
1390
client.name)
1827
1396
#wait until timeout or approved
1828
1397
time = datetime.datetime.now()
1829
1398
client.changedstate.acquire()
1830
client.changedstate.wait(delay.total_seconds())
1399
(client.changedstate.wait
1400
(float(client._timedelta_to_milliseconds(delay)
1401
/ 1000)))
1831
1402
client.changedstate.release()
1832
1403
time2 = datetime.datetime.now()
1833
1404
if (time2 - time) >= delay:
1849
1420
try:
1850
1421
sent = session.send(client.secret[sent_size:])
1851
1422
except gnutls.errors.GNUTLSError as error:
1852
logger.warning("gnutls send failed",
1853
exc_info=error)
1423
logger.warning("gnutls send failed")
1854
1424
return
1855
logger.debug("Sent: %d, remaining: %d", sent,
1856
len(client.secret) - (sent_size
1857
+ sent))
1425
logger.debug("Sent: %d, remaining: %d",
1426
sent, len(client.secret)
1427
- (sent_size + sent))
1858
1428
sent_size += sent
1859
1429
1860
1430
logger.info("Sending secret to %s", client.name)
1861
1431
# bump the timeout using extended_timeout
1862
client.bump_timeout(client.extended_timeout)
1432
client.checked_ok(client.extended_timeout)
1863
1433
if self.server.use_dbus:
1864
1434
# Emit D-Bus signal
1865
1435
client.GotSecret()
1870
1440
try:
1871
1441
session.bye()
1872
1442
except gnutls.errors.GNUTLSError as error:
1873
logger.warning("GnuTLS bye failed",
1874
exc_info=error)
1443
logger.warning("GnuTLS bye failed")
1875
1444
1876
1445
@staticmethod
1877
1446
def peer_certificate(session):
1878
1447
"Return the peer's OpenPGP certificate as a bytestring"
1879
1448
# If not an OpenPGP certificate...
1880
if (gnutls.library.functions.gnutls_certificate_type_get(
1881
session._c_object)
1449
if (gnutls.library.functions
1450
.gnutls_certificate_type_get(session._c_object)
1882
1451
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1883
1452
# ...do the normal thing
1884
1453
return session.peer_certificate
1898
1467
def fingerprint(openpgp):
1899
1468
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1900
1469
# New GnuTLS "datum" with the OpenPGP public key
1901
datum = gnutls.library.types.gnutls_datum_t(
1902
ctypes.cast(ctypes.c_char_p(openpgp),
1903
ctypes.POINTER(ctypes.c_ubyte)),
1904
ctypes.c_uint(len(openpgp)))
1470
datum = (gnutls.library.types
1471
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1472
ctypes.POINTER
1473
(ctypes.c_ubyte)),
1474
ctypes.c_uint(len(openpgp))))
1905
1475
# New empty GnuTLS certificate
1906
1476
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1907
gnutls.library.functions.gnutls_openpgp_crt_init(
1908
ctypes.byref(crt))
1477
(gnutls.library.functions
1478
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1909
1479
# Import the OpenPGP public key into the certificate
1910
gnutls.library.functions.gnutls_openpgp_crt_import(
1911
crt, ctypes.byref(datum),
1912
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1480
(gnutls.library.functions
1481
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1482
gnutls.library.constants
1483
.GNUTLS_OPENPGP_FMT_RAW))
1913
1484
# Verify the self signature in the key
1914
1485
crtverify = ctypes.c_uint()
1915
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1916
crt, 0, ctypes.byref(crtverify))
1486
(gnutls.library.functions
1487
.gnutls_openpgp_crt_verify_self(crt, 0,
1488
ctypes.byref(crtverify)))
1917
1489
if crtverify.value != 0:
1918
1490
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1919
raise gnutls.errors.CertificateSecurityError(
1920
"Verify failed")
1491
raise (gnutls.errors.CertificateSecurityError
1492
("Verify failed"))
1921
1493
# New buffer for the fingerprint
1922
1494
buf = ctypes.create_string_buffer(20)
1923
1495
buf_len = ctypes.c_size_t()
1924
1496
# Get the fingerprint from the certificate into the buffer
1925
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1926
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1497
(gnutls.library.functions
1498
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1499
ctypes.byref(buf_len)))
1927
1500
# Deinit the certificate
1928
1501
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1929
1502
# Convert the buffer to a Python bytestring
1930
1503
fpr = ctypes.string_at(buf, buf_len.value)
1931
1504
# Convert the bytestring to hexadecimal notation
1932
hex_fpr = binascii.hexlify(fpr).upper()
1505
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1933
1506
return hex_fpr
1934
1507
1935
1508
1936
1509
class MultiprocessingMixIn(object):
1937
1510
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1938
1939
1511
def sub_process_main(self, request, address):
1940
1512
try:
1941
1513
self.finish_request(request, address)
1942
except Exception:
1514
except:
1943
1515
self.handle_error(request, address)
1944
1516
self.close_request(request)
1945
1517
1946
1518
def process_request(self, request, address):
1947
1519
"""Start a new process to process the request."""
1948
1520
proc = multiprocessing.Process(target = self.sub_process_main,
1949
args = (request, address))
1521
args = (request,
1522
address))
1950
1523
proc.start()
1951
1524
return proc
1952
1525
1953
1526
1954
1527
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1955
1528
""" adds a pipe to the MixIn """
1956
1957
1529
def process_request(self, request, client_address):
1958
1530
"""Overrides and wraps the original process_request().
1959
1531
1968
1540
1969
1541
def add_pipe(self, parent_pipe, proc):
1970
1542
"""Dummy function; override as necessary"""
1971
raise NotImplementedError()
1543
raise NotImplementedError
1972
1544
1973
1545
1974
1546
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1980
1552
interface: None or a network interface name (string)
1981
1553
use_ipv6: Boolean; to use IPv6 or not
1982
1554
"""
1983
1984
1555
def __init__(self, server_address, RequestHandlerClass,
1985
interface=None,
1986
use_ipv6=True,
1987
socketfd=None):
1988
"""If socketfd is set, use that file descriptor instead of
1989
creating a new one with socket.socket().
1990
"""
1556
interface=None, use_ipv6=True):
1991
1557
self.interface = interface
1992
1558
if use_ipv6:
1993
1559
self.address_family = socket.AF_INET6
1994
if socketfd is not None:
1995
# Save the file descriptor
1996
self.socketfd = socketfd
1997
# Save the original socket.socket() function
1998
self.socket_socket = socket.socket
1999
# To implement --socket, we monkey patch socket.socket.
2000
#
2001
# (When socketserver.TCPServer is a new-style class, we
2002
# could make self.socket into a property instead of monkey
2003
# patching socket.socket.)
2004
#
2005
# Create a one-time-only replacement for socket.socket()
2006
@functools.wraps(socket.socket)
2007
def socket_wrapper(*args, **kwargs):
2008
# Restore original function so subsequent calls are
2009
# not affected.
2010
socket.socket = self.socket_socket
2011
del self.socket_socket
2012
# This time only, return a new socket object from the
2013
# saved file descriptor.
2014
return socket.fromfd(self.socketfd, *args, **kwargs)
2015
# Replace socket.socket() function with wrapper
2016
socket.socket = socket_wrapper
2017
# The socketserver.TCPServer.__init__ will call
2018
# socket.socket(), which might be our replacement,
2019
# socket_wrapper(), if socketfd was set.
2020
1560
socketserver.TCPServer.__init__(self, server_address,
2021
1561
RequestHandlerClass)
2022
2023
1562
def server_bind(self):
2024
1563
"""This overrides the normal server_bind() function
2025
1564
to bind to an interface if one was specified, and also NOT to
2031
1570
self.interface)
2032
1571
else:
2033
1572
try:
2034
self.socket.setsockopt(
2035
socket.SOL_SOCKET, SO_BINDTODEVICE,
2036
(self.interface + "\0").encode("utf-8"))
1573
self.socket.setsockopt(socket.SOL_SOCKET,
1574
SO_BINDTODEVICE,
1575
str(self.interface
1576
+ '\0'))
2037
1577
except socket.error as error:
2038
if error.errno == errno.EPERM:
2039
logger.error("No permission to bind to"
2040
" interface %s", self.interface)
2041
elif error.errno == errno.ENOPROTOOPT:
1578
if error[0] == errno.EPERM:
1579
logger.error("No permission to"
1580
" bind to interface %s",
1581
self.interface)
1582
elif error[0] == errno.ENOPROTOOPT:
2042
1583
logger.error("SO_BINDTODEVICE not available;"
2043
1584
" cannot bind to interface %s",
2044
1585
self.interface)
2045
elif error.errno == errno.ENODEV:
2046
logger.error("Interface %s does not exist,"
2047
" cannot bind", self.interface)
2048
1586
else:
2049
1587
raise
2050
1588
# Only bind(2) the socket if we really need to.
2053
1591
if self.address_family == socket.AF_INET6:
2054
1592
any_address = "::" # in6addr_any
2055
1593
else:
2056
any_address = "0.0.0.0" # INADDR_ANY
1594
any_address = socket.INADDR_ANY
2057
1595
self.server_address = (any_address,
2058
1596
self.server_address[1])
2059
1597
elif not self.server_address[1]:
2060
self.server_address = (self.server_address[0], 0)
1598
self.server_address = (self.server_address[0],
1599
0)
2061
1600
# if self.interface:
2062
1601
# self.server_address = (self.server_address[0],
2063
1602
# 0, # port
2077
1616
2078
1617
Assumes a gobject.MainLoop event loop.
2079
1618
"""
2080
2081
1619
def __init__(self, server_address, RequestHandlerClass,
2082
interface=None,
2083
use_ipv6=True,
2084
clients=None,
2085
gnutls_priority=None,
2086
use_dbus=True,
2087
socketfd=None):
1620
interface=None, use_ipv6=True, clients=None,
1621
gnutls_priority=None, use_dbus=True):
2088
1622
self.enabled = False
2089
1623
self.clients = clients
2090
1624
if self.clients is None:
2091
self.clients = {}
1625
self.clients = set()
2092
1626
self.use_dbus = use_dbus
2093
1627
self.gnutls_priority = gnutls_priority
2094
1628
IPv6_TCPServer.__init__(self, server_address,
2095
1629
RequestHandlerClass,
2096
1630
interface = interface,
2097
use_ipv6 = use_ipv6,
2098
socketfd = socketfd)
2099
1631
use_ipv6 = use_ipv6)
2100
1632
def server_activate(self):
2101
1633
if self.enabled:
2102
1634
return socketserver.TCPServer.server_activate(self)
2106
1638
2107
1639
def add_pipe(self, parent_pipe, proc):
2108
1640
# Call "handle_ipc" for both data and EOF events
2109
gobject.io_add_watch(
2110
parent_pipe.fileno(),
2111
gobject.IO_IN | gobject.IO_HUP,
2112
functools.partial(self.handle_ipc,
2113
parent_pipe = parent_pipe,
2114
proc = proc))
1641
gobject.io_add_watch(parent_pipe.fileno(),
1642
gobject.IO_IN | gobject.IO_HUP,
1643
functools.partial(self.handle_ipc,
1644
parent_pipe =
1645
parent_pipe,
1646
proc = proc))
2115
1647
2116
def handle_ipc(self, source, condition,
2117
parent_pipe=None,
2118
proc = None,
2119
client_object=None):
1648
def handle_ipc(self, source, condition, parent_pipe=None,
1649
proc = None, client_object=None):
1650
condition_names = {
1651
gobject.IO_IN: "IN", # There is data to read.
1652
gobject.IO_OUT: "OUT", # Data can be written (without
1653
# blocking).
1654
gobject.IO_PRI: "PRI", # There is urgent data to read.
1655
gobject.IO_ERR: "ERR", # Error condition.
1656
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1657
# broken, usually for pipes and
1658
# sockets).
1659
}
1660
conditions_string = ' | '.join(name
1661
for cond, name in
1662
condition_names.iteritems()
1663
if cond & condition)
2120
1664
# error, or the other end of multiprocessing.Pipe has closed
2121
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1665
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2122
1666
# Wait for other process to exit
2123
1667
proc.join()
2124
1668
return False
2131
1675
fpr = request[1]
2132
1676
address = request[2]
2133
1677
2134
for c in self.clients.itervalues():
1678
for c in self.clients:
2135
1679
if c.fingerprint == fpr:
2136
1680
client = c
2137
1681
break
2145
1689
parent_pipe.send(False)
2146
1690
return False
2147
1691
2148
gobject.io_add_watch(
2149
parent_pipe.fileno(),
2150
gobject.IO_IN | gobject.IO_HUP,
2151
functools.partial(self.handle_ipc,
2152
parent_pipe = parent_pipe,
2153
proc = proc,
2154
client_object = client))
1692
gobject.io_add_watch(parent_pipe.fileno(),
1693
gobject.IO_IN | gobject.IO_HUP,
1694
functools.partial(self.handle_ipc,
1695
parent_pipe =
1696
parent_pipe,
1697
proc = proc,
1698
client_object =
1699
client))
2155
1700
parent_pipe.send(True)
2156
1701
# remove the old hook in favor of the new above hook on
2157
1702
# same fileno
2163
1708
2164
1709
parent_pipe.send(('data', getattr(client_object,
2165
1710
funcname)(*args,
2166
**kwargs)))
1711
**kwargs)))
2167
1712
2168
1713
if command == 'getattr':
2169
1714
attrname = request[1]
2170
if isinstance(client_object.__getattribute__(attrname),
2171
collections.Callable):
2172
parent_pipe.send(('function', ))
1715
if callable(client_object.__getattribute__(attrname)):
1716
parent_pipe.send(('function',))
2173
1717
else:
2174
parent_pipe.send((
2175
'data', client_object.__getattribute__(attrname)))
1718
parent_pipe.send(('data', client_object
1719
.__getattribute__(attrname)))
2176
1720
2177
1721
if command == 'setattr':
2178
1722
attrname = request[1]
2182
1726
return True
2183
1727
2184
1728
2185
def rfc3339_duration_to_delta(duration):
2186
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2187
2188
>>> rfc3339_duration_to_delta("P7D")
2189
datetime.timedelta(7)
2190
>>> rfc3339_duration_to_delta("PT60S")
2191
datetime.timedelta(0, 60)
2192
>>> rfc3339_duration_to_delta("PT60M")
2193
datetime.timedelta(0, 3600)
2194
>>> rfc3339_duration_to_delta("PT24H")
2195
datetime.timedelta(1)
2196
>>> rfc3339_duration_to_delta("P1W")
2197
datetime.timedelta(7)
2198
>>> rfc3339_duration_to_delta("PT5M30S")
2199
datetime.timedelta(0, 330)
2200
>>> rfc3339_duration_to_delta("P1DT3M20S")
2201
datetime.timedelta(1, 200)
2202
"""
2203
2204
# Parsing an RFC 3339 duration with regular expressions is not
2205
# possible - there would have to be multiple places for the same
2206
# values, like seconds. The current code, while more esoteric, is
2207
# cleaner without depending on a parsing library. If Python had a
2208
# built-in library for parsing we would use it, but we'd like to
2209
# avoid excessive use of external libraries.
2210
2211
# New type for defining tokens, syntax, and semantics all-in-one
2212
Token = collections.namedtuple("Token", (
2213
"regexp", # To match token; if "value" is not None, must have
2214
# a "group" containing digits
2215
"value", # datetime.timedelta or None
2216
"followers")) # Tokens valid after this token
2217
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2218
# the "duration" ABNF definition in RFC 3339, Appendix A.
2219
token_end = Token(re.compile(r"$"), None, frozenset())
2220
token_second = Token(re.compile(r"(\d+)S"),
2221
datetime.timedelta(seconds=1),
2222
frozenset((token_end, )))
2223
token_minute = Token(re.compile(r"(\d+)M"),
2224
datetime.timedelta(minutes=1),
2225
frozenset((token_second, token_end)))
2226
token_hour = Token(re.compile(r"(\d+)H"),
2227
datetime.timedelta(hours=1),
2228
frozenset((token_minute, token_end)))
2229
token_time = Token(re.compile(r"T"),
2230
None,
2231
frozenset((token_hour, token_minute,
2232
token_second)))
2233
token_day = Token(re.compile(r"(\d+)D"),
2234
datetime.timedelta(days=1),
2235
frozenset((token_time, token_end)))
2236
token_month = Token(re.compile(r"(\d+)M"),
2237
datetime.timedelta(weeks=4),
2238
frozenset((token_day, token_end)))
2239
token_year = Token(re.compile(r"(\d+)Y"),
2240
datetime.timedelta(weeks=52),
2241
frozenset((token_month, token_end)))
2242
token_week = Token(re.compile(r"(\d+)W"),
2243
datetime.timedelta(weeks=1),
2244
frozenset((token_end, )))
2245
token_duration = Token(re.compile(r"P"), None,
2246
frozenset((token_year, token_month,
2247
token_day, token_time,
2248
token_week)))
2249
# Define starting values
2250
value = datetime.timedelta() # Value so far
2251
found_token = None
2252
followers = frozenset((token_duration, )) # Following valid tokens
2253
s = duration # String left to parse
2254
# Loop until end token is found
2255
while found_token is not token_end:
2256
# Search for any currently valid tokens
2257
for token in followers:
2258
match = token.regexp.match(s)
2259
if match is not None:
2260
# Token found
2261
if token.value is not None:
2262
# Value found, parse digits
2263
factor = int(match.group(1), 10)
2264
# Add to value so far
2265
value += factor * token.value
2266
# Strip token from string
2267
s = token.regexp.sub("", s, 1)
2268
# Go to found token
2269
found_token = token
2270
# Set valid next tokens
2271
followers = found_token.followers
2272
break
2273
else:
2274
# No currently valid tokens were found
2275
raise ValueError("Invalid RFC 3339 duration: {!r}"
2276
.format(duration))
2277
# End token found
2278
return value
2279
2280
2281
1729
def string_to_delta(interval):
2282
1730
"""Parse a string and return a datetime.timedelta
2283
1731
2294
1742
>>> string_to_delta('5m 30s')
2295
1743
datetime.timedelta(0, 330)
2296
1744
"""
2297
2298
try:
2299
return rfc3339_duration_to_delta(interval)
2300
except ValueError:
2301
pass
2302
2303
1745
timevalue = datetime.timedelta(0)
2304
1746
for s in interval.split():
2305
1747
try:
2306
suffix = s[-1]
1748
suffix = unicode(s[-1])
2307
1749
value = int(s[:-1])
2308
1750
if suffix == "d":
2309
1751
delta = datetime.timedelta(value)
2316
1758
elif suffix == "w":
2317
1759
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2318
1760
else:
2319
raise ValueError("Unknown suffix {!r}".format(suffix))
2320
except IndexError as e:
1761
raise ValueError("Unknown suffix %r" % suffix)
1762
except (ValueError, IndexError) as e:
2321
1763
raise ValueError(*(e.args))
2322
1764
timevalue += delta
2323
1765
return timevalue
2324
1766
2325
1767
1768
def if_nametoindex(interface):
1769
"""Call the C function if_nametoindex(), or equivalent
1770
1771
Note: This function cannot accept a unicode string."""
1772
global if_nametoindex
1773
try:
1774
if_nametoindex = (ctypes.cdll.LoadLibrary
1775
(ctypes.util.find_library("c"))
1776
.if_nametoindex)
1777
except (OSError, AttributeError):
1778
logger.warning("Doing if_nametoindex the hard way")
1779
def if_nametoindex(interface):
1780
"Get an interface index the hard way, i.e. using fcntl()"
1781
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1782
with contextlib.closing(socket.socket()) as s:
1783
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1784
struct.pack(str("16s16x"),
1785
interface))
1786
interface_index = struct.unpack(str("I"),
1787
ifreq[16:20])[0]
1788
return interface_index
1789
return if_nametoindex(interface)
1790
1791
2326
1792
def daemon(nochdir = False, noclose = False):
2327
1793
"""See daemon(3). Standard BSD Unix function.
2328
1794
2336
1802
sys.exit()
2337
1803
if not noclose:
2338
1804
# Close all standard open file descriptors
2339
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1805
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2340
1806
if not stat.S_ISCHR(os.fstat(null).st_mode):
2341
1807
raise OSError(errno.ENODEV,
2342
"{} not a character device"
2343
.format(os.devnull))
1808
"%s not a character device"
1809
% os.path.devnull)
2344
1810
os.dup2(null, sys.stdin.fileno())
2345
1811
os.dup2(null, sys.stdout.fileno())
2346
1812
os.dup2(null, sys.stderr.fileno())
2355
1821
2356
1822
parser = argparse.ArgumentParser()
2357
1823
parser.add_argument("-v", "--version", action="version",
2358
version = "%(prog)s {}".format(version),
1824
version = "%%(prog)s %s" % version,
2359
1825
help="show version number and exit")
2360
1826
parser.add_argument("-i", "--interface", metavar="IF",
2361
1827
help="Bind to interface IF")
2367
1833
help="Run self-test")
2368
1834
parser.add_argument("--debug", action="store_true",
2369
1835
help="Debug mode; run in foreground and log"
2370
" to terminal", default=None)
1836
" to terminal")
2371
1837
parser.add_argument("--debuglevel", metavar="LEVEL",
2372
1838
help="Debug level for stdout output")
2373
1839
parser.add_argument("--priority", help="GnuTLS"
2380
1846
" files")
2381
1847
parser.add_argument("--no-dbus", action="store_false",
2382
1848
dest="use_dbus", help="Do not provide D-Bus"
2383
" system bus interface", default=None)
1849
" system bus interface")
2384
1850
parser.add_argument("--no-ipv6", action="store_false",
2385
dest="use_ipv6", help="Do not use IPv6",
2386
default=None)
2387
parser.add_argument("--no-restore", action="store_false",
2388
dest="restore", help="Do not restore stored"
2389
" state", default=None)
2390
parser.add_argument("--socket", type=int,
2391
help="Specify a file descriptor to a network"
2392
" socket to use instead of creating one")
2393
parser.add_argument("--statedir", metavar="DIR",
2394
help="Directory to save/restore state in")
2395
parser.add_argument("--foreground", action="store_true",
2396
help="Run in foreground", default=None)
2397
parser.add_argument("--no-zeroconf", action="store_false",
2398
dest="zeroconf", help="Do not use Zeroconf",
2399
default=None)
2400
1851
dest="use_ipv6", help="Do not use IPv6")
2401
1852
options = parser.parse_args()
2402
1853
2403
1854
if options.check:
2404
1855
import doctest
2405
fail_count, test_count = doctest.testmod()
2406
sys.exit(os.EX_OK if fail_count == 0 else 1)
1856
doctest.testmod()
1857
sys.exit()
2407
1858
2408
1859
# Default values for config file for server-global settings
2409
1860
server_defaults = { "interface": "",
2411
1862
"port": "",
2412
1863
"debug": "False",
2413
1864
"priority":
2414
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2415
":+SIGN-DSA-SHA256",
1865
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2416
1866
"servicename": "Mandos",
2417
1867
"use_dbus": "True",
2418
1868
"use_ipv6": "True",
2419
1869
"debuglevel": "",
2420
"restore": "True",
2421
"socket": "",
2422
"statedir": "/var/lib/mandos",
2423
"foreground": "False",
2424
"zeroconf": "True",
2425
}
1870
}
2426
1871
2427
1872
# Parse config file for server-global settings
2428
1873
server_config = configparser.SafeConfigParser(server_defaults)
2429
1874
del server_defaults
2430
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1875
server_config.read(os.path.join(options.configdir,
1876
"mandos.conf"))
2431
1877
# Convert the SafeConfigParser object to a dict
2432
1878
server_settings = server_config.defaults()
2433
1879
# Use the appropriate methods on the non-string config options
2434
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1880
for option in ("debug", "use_dbus", "use_ipv6"):
2435
1881
server_settings[option] = server_config.getboolean("DEFAULT",
2436
1882
option)
2437
1883
if server_settings["port"]:
2438
1884
server_settings["port"] = server_config.getint("DEFAULT",
2439
1885
"port")
2440
if server_settings["socket"]:
2441
server_settings["socket"] = server_config.getint("DEFAULT",
2442
"socket")
2443
# Later, stdin will, and stdout and stderr might, be dup'ed
2444
# over with an opened os.devnull. But we don't want this to
2445
# happen with a supplied network socket.
2446
if 0 <= server_settings["socket"] <= 2:
2447
server_settings["socket"] = os.dup(server_settings
2448
["socket"])
2449
1886
del server_config
2450
1887
2451
1888
# Override the settings from the config file with command line
2452
1889
# options, if set.
2453
1890
for option in ("interface", "address", "port", "debug",
2454
"priority", "servicename", "configdir", "use_dbus",
2455
"use_ipv6", "debuglevel", "restore", "statedir",
2456
"socket", "foreground", "zeroconf"):
1891
"priority", "servicename", "configdir",
1892
"use_dbus", "use_ipv6", "debuglevel"):
2457
1893
value = getattr(options, option)
2458
1894
if value is not None:
2459
1895
server_settings[option] = value
2460
1896
del options
2461
1897
# Force all strings to be unicode
2462
1898
for option in server_settings.keys():
2463
if isinstance(server_settings[option], bytes):
2464
server_settings[option] = (server_settings[option]
2465
.decode("utf-8"))
2466
# Force all boolean options to be boolean
2467
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2468
"foreground", "zeroconf"):
2469
server_settings[option] = bool(server_settings[option])
2470
# Debug implies foreground
2471
if server_settings["debug"]:
2472
server_settings["foreground"] = True
1899
if type(server_settings[option]) is str:
1900
server_settings[option] = unicode(server_settings[option])
2473
1901
# Now we have our good server settings in "server_settings"
2474
1902
2475
1903
##################################################################
2476
1904
2477
if (not server_settings["zeroconf"]
2478
and not (server_settings["port"]
2479
or server_settings["socket"] != "")):
2480
parser.error("Needs port or socket to work without Zeroconf")
2481
2482
1905
# For convenience
2483
1906
debug = server_settings["debug"]
2484
1907
debuglevel = server_settings["debuglevel"]
2485
1908
use_dbus = server_settings["use_dbus"]
2486
1909
use_ipv6 = server_settings["use_ipv6"]
2487
stored_state_path = os.path.join(server_settings["statedir"],
2488
stored_state_file)
2489
foreground = server_settings["foreground"]
2490
zeroconf = server_settings["zeroconf"]
2491
2492
if debug:
2493
initlogger(debug, logging.DEBUG)
2494
else:
2495
if not debuglevel:
2496
initlogger(debug)
2497
else:
2498
level = getattr(logging, debuglevel.upper())
2499
initlogger(debug, level)
2500
1910
2501
1911
if server_settings["servicename"] != "Mandos":
2502
syslogger.setFormatter(
2503
logging.Formatter('Mandos ({}) [%(process)d]:'
2504
' %(levelname)s: %(message)s'.format(
2505
server_settings["servicename"])))
1912
syslogger.setFormatter(logging.Formatter
1913
('Mandos (%s) [%%(process)d]:'
1914
' %%(levelname)s: %%(message)s'
1915
% server_settings["servicename"]))
2506
1916
2507
1917
# Parse config file with clients
2508
client_config = configparser.SafeConfigParser(Client
2509
.client_defaults)
1918
client_defaults = { "timeout": "5m",
1919
"extended_timeout": "15m",
1920
"interval": "2m",
1921
"checker": "fping -q -- %%(host)s",
1922
"host": "",
1923
"approval_delay": "0s",
1924
"approval_duration": "1s",
1925
}
1926
client_config = configparser.SafeConfigParser(client_defaults)
2510
1927
client_config.read(os.path.join(server_settings["configdir"],
2511
1928
"clients.conf"))
2512
1929
2513
1930
global mandos_dbus_service
2514
1931
mandos_dbus_service = None
2515
1932
2516
socketfd = None
2517
if server_settings["socket"] != "":
2518
socketfd = server_settings["socket"]
2519
tcp_server = MandosServer(
2520
(server_settings["address"], server_settings["port"]),
2521
ClientHandler,
2522
interface=(server_settings["interface"] or None),
2523
use_ipv6=use_ipv6,
2524
gnutls_priority=server_settings["priority"],
2525
use_dbus=use_dbus,
2526
socketfd=socketfd)
2527
if not foreground:
2528
pidfilename = "/run/mandos.pid"
2529
if not os.path.isdir("/run/."):
2530
pidfilename = "/var/run/mandos.pid"
2531
pidfile = None
1933
tcp_server = MandosServer((server_settings["address"],
1934
server_settings["port"]),
1935
ClientHandler,
1936
interface=(server_settings["interface"]
1937
or None),
1938
use_ipv6=use_ipv6,
1939
gnutls_priority=
1940
server_settings["priority"],
1941
use_dbus=use_dbus)
1942
if not debug:
1943
pidfilename = "/var/run/mandos.pid"
2532
1944
try:
2533
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2534
except IOError as e:
2535
logger.error("Could not open file %r", pidfilename,
2536
exc_info=e)
1945
pidfile = open(pidfilename, "w")
1946
except IOError:
1947
logger.error("Could not open file %r", pidfilename)
2537
1948
2538
for name in ("_mandos", "mandos", "nobody"):
1949
try:
1950
uid = pwd.getpwnam("_mandos").pw_uid
1951
gid = pwd.getpwnam("_mandos").pw_gid
1952
except KeyError:
2539
1953
try:
2540
uid = pwd.getpwnam(name).pw_uid
2541
gid = pwd.getpwnam(name).pw_gid
2542
break
1954
uid = pwd.getpwnam("mandos").pw_uid
1955
gid = pwd.getpwnam("mandos").pw_gid
2543
1956
except KeyError:
2544
continue
2545
else:
2546
uid = 65534
2547
gid = 65534
1957
try:
1958
uid = pwd.getpwnam("nobody").pw_uid
1959
gid = pwd.getpwnam("nobody").pw_gid
1960
except KeyError:
1961
uid = 65534
1962
gid = 65534
2548
1963
try:
2549
1964
os.setgid(gid)
2550
1965
os.setuid(uid)
2551
1966
except OSError as error:
2552
if error.errno != errno.EPERM:
2553
raise
1967
if error[0] != errno.EPERM:
1968
raise error
1969
1970
if not debug and not debuglevel:
1971
syslogger.setLevel(logging.WARNING)
1972
console.setLevel(logging.WARNING)
1973
if debuglevel:
1974
level = getattr(logging, debuglevel.upper())
1975
syslogger.setLevel(level)
1976
console.setLevel(level)
2554
1977
2555
1978
if debug:
2556
1979
# Enable all possible GnuTLS debugging
2563
1986
def debug_gnutls(level, string):
2564
1987
logger.debug("GnuTLS: %s", string[:-1])
2565
1988
2566
gnutls.library.functions.gnutls_global_set_log_function(
2567
debug_gnutls)
1989
(gnutls.library.functions
1990
.gnutls_global_set_log_function(debug_gnutls))
2568
1991
2569
1992
# Redirect stdin so all checkers get /dev/null
2570
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1993
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2571
1994
os.dup2(null, sys.stdin.fileno())
2572
1995
if null > 2:
2573
1996
os.close(null)
1997
else:
1998
# No console logging
1999
logger.removeHandler(console)
2574
2000
2575
2001
# Need to fork before connecting to D-Bus
2576
if not foreground:
2002
if not debug:
2577
2003
# Close all input and output, do double fork, etc.
2578
2004
daemon()
2579
2005
2580
# multiprocessing will use threads, so before we use gobject we
2581
# need to inform gobject that threads will be used.
2582
gobject.threads_init()
2583
2584
2006
global main_loop
2585
2007
# From the Avahi example code
2586
DBusGMainLoop(set_as_default=True)
2008
DBusGMainLoop(set_as_default=True )
2587
2009
main_loop = gobject.MainLoop()
2588
2010
bus = dbus.SystemBus()
2589
2011
# End of Avahi example code
2590
2012
if use_dbus:
2591
2013
try:
2592
2014
bus_name = dbus.service.BusName("se.recompile.Mandos",
2593
bus,
2594
do_not_queue=True)
2595
old_bus_name = dbus.service.BusName(
2596
"se.bsnet.fukt.Mandos", bus,
2597
do_not_queue=True)
2598
except dbus.exceptions.DBusException as e:
2599
logger.error("Disabling D-Bus:", exc_info=e)
2015
bus, do_not_queue=True)
2016
old_bus_name = (dbus.service.BusName
2017
("se.bsnet.fukt.Mandos", bus,
2018
do_not_queue=True))
2019
except dbus.exceptions.NameExistsException as e:
2020
logger.error(unicode(e) + ", disabling D-Bus")
2600
2021
use_dbus = False
2601
2022
server_settings["use_dbus"] = False
2602
2023
tcp_server.use_dbus = False
2603
if zeroconf:
2604
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2605
service = AvahiServiceToSyslog(
2606
name = server_settings["servicename"],
2607
servicetype = "_mandos._tcp",
2608
protocol = protocol,
2609
bus = bus)
2610
if server_settings["interface"]:
2611
service.interface = if_nametoindex(
2612
server_settings["interface"].encode("utf-8"))
2024
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2025
service = AvahiService(name = server_settings["servicename"],
2026
servicetype = "_mandos._tcp",
2027
protocol = protocol, bus = bus)
2028
if server_settings["interface"]:
2029
service.interface = (if_nametoindex
2030
(str(server_settings["interface"])))
2613
2031
2614
2032
global multiprocessing_manager
2615
2033
multiprocessing_manager = multiprocessing.Manager()
2616
2034
2617
2035
client_class = Client
2618
2036
if use_dbus:
2619
client_class = functools.partial(ClientDBus, bus = bus)
2620
2621
client_settings = Client.config_parser(client_config)
2622
old_client_settings = {}
2623
clients_data = {}
2624
2625
# This is used to redirect stdout and stderr for checker processes
2626
global wnull
2627
wnull = open(os.devnull, "w") # A writable /dev/null
2628
# Only used if server is running in foreground but not in debug
2629
# mode
2630
if debug or not foreground:
2631
wnull.close()
2632
2633
# Get client data and settings from last running state.
2634
if server_settings["restore"]:
2635
try:
2636
with open(stored_state_path, "rb") as stored_state:
2637
clients_data, old_client_settings = pickle.load(
2638
stored_state)
2639
os.remove(stored_state_path)
2640
except IOError as e:
2641
if e.errno == errno.ENOENT:
2642
logger.warning("Could not load persistent state:"
2643
" {}".format(os.strerror(e.errno)))
2644
else:
2645
logger.critical("Could not load persistent state:",
2646
exc_info=e)
2647
raise
2648
except EOFError as e:
2649
logger.warning("Could not load persistent state: "
2650
"EOFError:",
2651
exc_info=e)
2652
2653
with PGPEngine() as pgp:
2654
for client_name, client in clients_data.items():
2655
# Skip removed clients
2656
if client_name not in client_settings:
2657
continue
2658
2659
# Decide which value to use after restoring saved state.
2660
# We have three different values: Old config file,
2661
# new config file, and saved state.
2662
# New config value takes precedence if it differs from old
2663
# config value, otherwise use saved state.
2664
for name, value in client_settings[client_name].items():
2665
try:
2666
# For each value in new config, check if it
2667
# differs from the old config value (Except for
2668
# the "secret" attribute)
2669
if (name != "secret"
2670
and (value !=
2671
old_client_settings[client_name][name])):
2672
client[name] = value
2673
except KeyError:
2674
pass
2675
2676
# Clients who has passed its expire date can still be
2677
# enabled if its last checker was successful. A Client
2678
# whose checker succeeded before we stored its state is
2679
# assumed to have successfully run all checkers during
2680
# downtime.
2681
if client["enabled"]:
2682
if datetime.datetime.utcnow() >= client["expires"]:
2683
if not client["last_checked_ok"]:
2684
logger.warning(
2685
"disabling client {} - Client never "
2686
"performed a successful checker".format(
2687
client_name))
2688
client["enabled"] = False
2689
elif client["last_checker_status"] != 0:
2690
logger.warning(
2691
"disabling client {} - Client last"
2692
" checker failed with error code"
2693
" {}".format(
2694
client_name,
2695
client["last_checker_status"]))
2696
client["enabled"] = False
2697
else:
2698
client["expires"] = (
2699
datetime.datetime.utcnow()
2700
+ client["timeout"])
2701
logger.debug("Last checker succeeded,"
2702
" keeping {} enabled".format(
2703
client_name))
2037
client_class = functools.partial(ClientDBusTransitional,
2038
bus = bus)
2039
def client_config_items(config, section):
2040
special_settings = {
2041
"approved_by_default":
2042
lambda: config.getboolean(section,
2043
"approved_by_default"),
2044
}
2045
for name, value in config.items(section):
2704
2046
try:
2705
client["secret"] = pgp.decrypt(
2706
client["encrypted_secret"],
2707
client_settings[client_name]["secret"])
2708
except PGPError:
2709
# If decryption fails, we use secret from new settings
2710
logger.debug("Failed to decrypt {} old secret".format(
2711
client_name))
2712
client["secret"] = (client_settings[client_name]
2713
["secret"])
2714
2715
# Add/remove clients based on new changes made to config
2716
for client_name in (set(old_client_settings)
2717
- set(client_settings)):
2718
del clients_data[client_name]
2719
for client_name in (set(client_settings)
2720
- set(old_client_settings)):
2721
clients_data[client_name] = client_settings[client_name]
2722
2723
# Create all client objects
2724
for client_name, client in clients_data.items():
2725
tcp_server.clients[client_name] = client_class(
2726
name = client_name,
2727
settings = client,
2728
server_settings = server_settings)
2729
2047
yield (name, special_settings[name]())
2048
except KeyError:
2049
yield (name, value)
2050
2051
tcp_server.clients.update(set(
2052
client_class(name = section,
2053
config= dict(client_config_items(
2054
client_config, section)))
2055
for section in client_config.sections()))
2730
2056
if not tcp_server.clients:
2731
2057
logger.warning("No clients defined")
2732
2733
if not foreground:
2734
if pidfile is not None:
2735
pid = os.getpid()
2736
try:
2737
with pidfile:
2738
print(pid, file=pidfile)
2739
except IOError:
2740
logger.error("Could not write to file %r with PID %d",
2741
pidfilename, pid)
2742
del pidfile
2058
2059
if not debug:
2060
try:
2061
with pidfile:
2062
pid = os.getpid()
2063
pidfile.write(str(pid) + "\n".encode("utf-8"))
2064
del pidfile
2065
except IOError:
2066
logger.error("Could not write to file %r with PID %d",
2067
pidfilename, pid)
2068
except NameError:
2069
# "pidfile" was never created
2070
pass
2743
2071
del pidfilename
2072
2073
signal.signal(signal.SIGINT, signal.SIG_IGN)
2744
2074
2745
2075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2746
2076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2747
2077
2748
2078
if use_dbus:
2749
2750
@alternate_dbus_interfaces(
2751
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2752
class MandosDBusService(DBusObjectWithProperties):
2079
class MandosDBusService(dbus.service.Object):
2753
2080
"""A D-Bus proxy object"""
2754
2755
2081
def __init__(self):
2756
2082
dbus.service.Object.__init__(self, bus, "/")
2757
2758
2083
_interface = "se.recompile.Mandos"
2759
2084
2760
@dbus_interface_annotations(_interface)
2761
def _foo(self):
2762
return {
2763
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2764
"false" }
2765
2766
2085
@dbus.service.signal(_interface, signature="o")
2767
2086
def ClientAdded(self, objpath):
2768
2087
"D-Bus signal"
2781
2100
@dbus.service.method(_interface, out_signature="ao")
2782
2101
def GetAllClients(self):
2783
2102
"D-Bus method"
2784
return dbus.Array(c.dbus_object_path for c in
2785
tcp_server.clients.itervalues())
2103
return dbus.Array(c.dbus_object_path
2104
for c in tcp_server.clients)
2786
2105
2787
2106
@dbus.service.method(_interface,
2788
2107
out_signature="a{oa{sv}}")
2789
2108
def GetAllClientsWithProperties(self):
2790
2109
"D-Bus method"
2791
2110
return dbus.Dictionary(
2792
{ c.dbus_object_path: c.GetAll("")
2793
for c in tcp_server.clients.itervalues() },
2111
((c.dbus_object_path, c.GetAll(""))
2112
for c in tcp_server.clients),
2794
2113
signature="oa{sv}")
2795
2114
2796
2115
@dbus.service.method(_interface, in_signature="o")
2797
2116
def RemoveClient(self, object_path):
2798
2117
"D-Bus method"
2799
for c in tcp_server.clients.itervalues():
2118
for c in tcp_server.clients:
2800
2119
if c.dbus_object_path == object_path:
2801
del tcp_server.clients[c.name]
2120
tcp_server.clients.remove(c)
2802
2121
c.remove_from_connection()
2803
2122
# Don't signal anything except ClientRemoved
2804
2123
c.disable(quiet=True)
2809
2128
2810
2129
del _interface
2811
2130
2812
mandos_dbus_service = MandosDBusService()
2131
class MandosDBusServiceTransitional(MandosDBusService):
2132
__metaclass__ = AlternateDBusNamesMetaclass
2133
mandos_dbus_service = MandosDBusServiceTransitional()
2813
2134
2814
2135
def cleanup():
2815
2136
"Cleanup function; run on exit"
2816
if zeroconf:
2817
service.cleanup()
2137
service.cleanup()
2818
2138
2819
2139
multiprocessing.active_children()
2820
wnull.close()
2821
if not (tcp_server.clients or client_settings):
2822
return
2823
2824
# Store client before exiting. Secrets are encrypted with key
2825
# based on what config file has. If config file is
2826
# removed/edited, old secret will thus be unrecovable.
2827
clients = {}
2828
with PGPEngine() as pgp:
2829
for client in tcp_server.clients.itervalues():
2830
key = client_settings[client.name]["secret"]
2831
client.encrypted_secret = pgp.encrypt(client.secret,
2832
key)
2833
client_dict = {}
2834
2835
# A list of attributes that can not be pickled
2836
# + secret.
2837
exclude = { "bus", "changedstate", "secret",
2838
"checker", "server_settings" }
2839
for name, typ in inspect.getmembers(dbus.service
2840
.Object):
2841
exclude.add(name)
2842
2843
client_dict["encrypted_secret"] = (client
2844
.encrypted_secret)
2845
for attr in client.client_structure:
2846
if attr not in exclude:
2847
client_dict[attr] = getattr(client, attr)
2848
2849
clients[client.name] = client_dict
2850
del client_settings[client.name]["secret"]
2851
2852
try:
2853
with tempfile.NamedTemporaryFile(
2854
mode='wb',
2855
suffix=".pickle",
2856
prefix='clients-',
2857
dir=os.path.dirname(stored_state_path),
2858
delete=False) as stored_state:
2859
pickle.dump((clients, client_settings), stored_state)
2860
tempname = stored_state.name
2861
os.rename(tempname, stored_state_path)
2862
except (IOError, OSError) as e:
2863
if not debug:
2864
try:
2865
os.remove(tempname)
2866
except NameError:
2867
pass
2868
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2869
logger.warning("Could not save persistent state: {}"
2870
.format(os.strerror(e.errno)))
2871
else:
2872
logger.warning("Could not save persistent state:",
2873
exc_info=e)
2874
raise
2875
2876
# Delete all clients, and settings from config
2877
2140
while tcp_server.clients:
2878
name, client = tcp_server.clients.popitem()
2141
client = tcp_server.clients.pop()
2879
2142
if use_dbus:
2880
2143
client.remove_from_connection()
2144
client.disable_hook = None
2881
2145
# Don't signal anything except ClientRemoved
2882
2146
client.disable(quiet=True)
2883
2147
if use_dbus:
2884
2148
# Emit D-Bus signal
2885
mandos_dbus_service.ClientRemoved(
2886
client.dbus_object_path, client.name)
2887
client_settings.clear()
2149
mandos_dbus_service.ClientRemoved(client
2150
.dbus_object_path,
2151
client.name)
2888
2152
2889
2153
atexit.register(cleanup)
2890
2154
2891
for client in tcp_server.clients.itervalues():
2155
for client in tcp_server.clients:
2892
2156
if use_dbus:
2893
2157
# Emit D-Bus signal
2894
2158
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2895
# Need to initiate checking of clients
2896
if client.enabled:
2897
client.init_checker()
2159
client.enable()
2898
2160
2899
2161
tcp_server.enable()
2900
2162
tcp_server.server_activate()
2901
2163
2902
2164
# Find out what port we got
2903
if zeroconf:
2904
service.port = tcp_server.socket.getsockname()[1]
2165
service.port = tcp_server.socket.getsockname()[1]
2905
2166
if use_ipv6:
2906
2167
logger.info("Now listening on address %r, port %d,"
2907
" flowinfo %d, scope_id %d",
2908
*tcp_server.socket.getsockname())
2168
" flowinfo %d, scope_id %d"
2169
% tcp_server.socket.getsockname())
2909
2170
else: # IPv4
2910
logger.info("Now listening on address %r, port %d",
2911
*tcp_server.socket.getsockname())
2171
logger.info("Now listening on address %r, port %d"
2172
% tcp_server.socket.getsockname())
2912
2173
2913
2174
#service.interface = tcp_server.socket.getsockname()[3]
2914
2175
2915
2176
try:
2916
if zeroconf:
2917
# From the Avahi example code
2918
try:
2919
service.activate()
2920
except dbus.exceptions.DBusException as error:
2921
logger.critical("D-Bus Exception", exc_info=error)
2922
cleanup()
2923
sys.exit(1)
2924
# End of Avahi example code
2177
# From the Avahi example code
2178
try:
2179
service.activate()
2180
except dbus.exceptions.DBusException as error:
2181
logger.critical("DBusException: %s", error)
2182
cleanup()
2183
sys.exit(1)
2184
# End of Avahi example code
2925
2185
2926
2186
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2927
2187
lambda *args, **kwargs:
2931
2191
logger.debug("Starting main loop")
2932
2192
main_loop.run()
2933
2193
except AvahiError as error:
2934
logger.critical("Avahi Error", exc_info=error)
2194
logger.critical("AvahiError: %s", error)
2935
2195
cleanup()
2936
2196
sys.exit(1)
2937
2197
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0