To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 518.1.9
- compare with another revision
- download diff
- download tarball
- view history from revision 518.1.9
- Committer: Björn Påhlsson
- Date: 2011-11-27 19:51:00 UTC
- mto: (518.2.5 persistent-state-gpgme)
- mto: This revision was merged to the branch mainline in revision 524.
- Revision ID: belorn@recompile.se-20111127195100-fx0mpeia9xihvpmd
renamed variables
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/tests
- debian/upstream
- dracut-module
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
#
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
#
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
#
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
#
32
#
34
33
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
38
try:
39
from future_builtins import *
40
except ImportError:
41
pass
42
43
try:
44
import SocketServer as socketserver
45
except ImportError:
46
import socketserver
37
import SocketServer as socketserver
47
38
import socket
48
39
import argparse
49
40
import datetime
50
41
import errno
51
try:
52
import ConfigParser as configparser
53
except ImportError:
54
import configparser
42
import gnutls.crypto
43
import gnutls.connection
44
import gnutls.errors
45
import gnutls.library.functions
46
import gnutls.library.constants
47
import gnutls.library.types
48
import ConfigParser as configparser
55
49
import sys
56
50
import re
57
51
import os
66
60
import struct
67
61
import fcntl
68
62
import functools
69
try:
70
import cPickle as pickle
71
except ImportError:
72
import pickle
63
import cPickle as pickle
73
64
import multiprocessing
74
65
import types
75
66
import binascii
76
67
import tempfile
77
import itertools
78
import collections
79
import codecs
80
import unittest
81
import random
82
68
83
69
import dbus
84
70
import dbus.service
85
import gi
86
from gi.repository import GLib
71
import gobject
72
import avahi
87
73
from dbus.mainloop.glib import DBusGMainLoop
88
74
import ctypes
89
75
import ctypes.util
90
76
import xml.dom.minidom
91
77
import inspect
92
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
97
# Add collections.abc.Callable if it does not exist
98
try:
99
collections.abc.Callable
100
except AttributeError:
101
class abc:
102
Callable = collections.Callable
103
collections.abc = abc
104
del abc
105
106
# Show warnings by default
107
if not sys.warnoptions:
108
import warnings
109
warnings.simplefilter("default")
110
111
# Try to find the value of SO_BINDTODEVICE:
112
try:
113
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
114
# newer, and it is also the most natural place for it:
78
import GnuPGInterface
79
80
try:
115
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
116
82
except AttributeError:
117
83
try:
118
# This is where SO_BINDTODEVICE was up to and including Python
119
# 2.6, and also 3.2:
120
84
from IN import SO_BINDTODEVICE
121
85
except ImportError:
122
# In Python 2.7 it seems to have been removed entirely.
123
# Try running the C preprocessor:
124
try:
125
cc = subprocess.Popen(["cc", "--language=c", "-E",
126
"/dev/stdin"],
127
stdin=subprocess.PIPE,
128
stdout=subprocess.PIPE)
129
stdout = cc.communicate(
130
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
131
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
132
except (OSError, ValueError, IndexError):
133
# No value found
134
SO_BINDTODEVICE = None
135
136
if sys.version_info < (3, 2):
137
configparser.Configparser = configparser.SafeConfigParser
138
139
version = "1.8.9"
86
SO_BINDTODEVICE = None
87
88
89
version = "1.4.1"
140
90
stored_state_file = "clients.pickle"
141
91
142
92
logger = logging.getLogger()
143
logging.captureWarnings(True) # Show warnings via the logging system
144
syslogger = None
93
syslogger = (logging.handlers.SysLogHandler
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
address = str("/dev/log")))
145
96
146
97
try:
147
if_nametoindex = ctypes.cdll.LoadLibrary(
148
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
149
101
except (OSError, AttributeError):
150
151
102
def if_nametoindex(interface):
152
103
"Get an interface index the hard way, i.e. using fcntl()"
153
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
154
105
with contextlib.closing(socket.socket()) as s:
155
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
156
struct.pack(b"16s16x", interface))
157
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
158
111
return interface_index
159
112
160
113
161
def copy_function(func):
162
"""Make a copy of a function"""
163
if sys.version_info.major == 2:
164
return types.FunctionType(func.func_code,
165
func.func_globals,
166
func.func_name,
167
func.func_defaults,
168
func.func_closure)
169
else:
170
return types.FunctionType(func.__code__,
171
func.__globals__,
172
func.__name__,
173
func.__defaults__,
174
func.__closure__)
175
176
177
def initlogger(debug, level=logging.WARNING):
114
def initlogger(level=logging.WARNING):
178
115
"""init logger and add loglevel"""
179
180
global syslogger
181
syslogger = (logging.handlers.SysLogHandler(
182
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
183
address="/dev/log"))
116
184
117
syslogger.setFormatter(logging.Formatter
185
118
('Mandos [%(process)d]: %(levelname)s:'
186
119
' %(message)s'))
187
120
logger.addHandler(syslogger)
188
189
if debug:
190
console = logging.StreamHandler()
191
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
192
' [%(process)d]:'
193
' %(levelname)s:'
194
' %(message)s'))
195
logger.addHandler(console)
121
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
196
128
logger.setLevel(level)
197
129
198
130
201
133
pass
202
134
203
135
204
class PGPEngine:
136
class PGPEngine(object):
205
137
"""A simple class for OpenPGP symmetric encryption & decryption"""
206
207
138
def __init__(self):
139
self.gnupg = GnuPGInterface.GnuPG()
208
140
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
209
self.gpg = "gpg"
210
try:
211
output = subprocess.check_output(["gpgconf"])
212
for line in output.splitlines():
213
name, text, path = line.split(b":")
214
if name == b"gpg":
215
self.gpg = path
216
break
217
except OSError as e:
218
if e.errno != errno.ENOENT:
219
raise
220
self.gnupgargs = ['--batch',
221
'--homedir', self.tempdir,
222
'--force-mdc',
223
'--quiet']
224
# Only GPG version 1 has the --no-use-agent option.
225
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
226
self.gnupgargs.append("--no-use-agent")
227
141
self.gnupg = GnuPGInterface.GnuPG()
142
self.gnupg.options.meta_interactive = False
143
self.gnupg.options.homedir = self.tempdir
144
self.gnupg.options.extra_args.extend(['--force-mdc',
145
'--quiet'])
146
228
147
def __enter__(self):
229
148
return self
230
231
def __exit__(self, exc_type, exc_value, traceback):
149
150
def __exit__ (self, exc_type, exc_value, traceback):
232
151
self._cleanup()
233
152
return False
234
153
235
154
def __del__(self):
236
155
self._cleanup()
237
156
238
157
def _cleanup(self):
239
158
if self.tempdir is not None:
240
159
# Delete contents of tempdir
241
160
for root, dirs, files in os.walk(self.tempdir,
242
topdown=False):
161
topdown = False):
243
162
for filename in files:
244
163
os.remove(os.path.join(root, filename))
245
164
for dirname in dirs:
247
166
# Remove tempdir
248
167
os.rmdir(self.tempdir)
249
168
self.tempdir = None
250
169
251
170
def password_encode(self, password):
252
171
# Passphrase can not be empty and can not contain newlines or
253
172
# NUL bytes. So we prefix it and hex encode it.
254
encoded = b"mandos" + binascii.hexlify(password)
255
if len(encoded) > 2048:
256
# GnuPG can't handle long passwords, so encode differently
257
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
258
.replace(b"\n", b"\\n")
259
.replace(b"\0", b"\\x00"))
260
return encoded
261
173
return b"mandos" + binascii.hexlify(password)
174
262
175
def encrypt(self, data, password):
263
passphrase = self.password_encode(password)
264
with tempfile.NamedTemporaryFile(
265
dir=self.tempdir) as passfile:
266
passfile.write(passphrase)
267
passfile.flush()
268
proc = subprocess.Popen([self.gpg, '--symmetric',
269
'--passphrase-file',
270
passfile.name]
271
+ self.gnupgargs,
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
ciphertext, err = proc.communicate(input=data)
276
if proc.returncode != 0:
277
raise PGPError(err)
176
self.gnupg.passphrase = self.password_encode(password)
177
with open(os.devnull) as devnull:
178
try:
179
proc = self.gnupg.run(['--symmetric'],
180
create_fhs=['stdin', 'stdout'],
181
attach_fhs={'stderr': devnull})
182
with contextlib.closing(proc.handles['stdin']) as f:
183
f.write(data)
184
with contextlib.closing(proc.handles['stdout']) as f:
185
ciphertext = f.read()
186
proc.wait()
187
except IOError as e:
188
raise PGPError(e)
189
self.gnupg.passphrase = None
278
190
return ciphertext
279
191
280
192
def decrypt(self, data, password):
281
passphrase = self.password_encode(password)
282
with tempfile.NamedTemporaryFile(
283
dir=self.tempdir) as passfile:
284
passfile.write(passphrase)
285
passfile.flush()
286
proc = subprocess.Popen([self.gpg, '--decrypt',
287
'--passphrase-file',
288
passfile.name]
289
+ self.gnupgargs,
290
stdin=subprocess.PIPE,
291
stdout=subprocess.PIPE,
292
stderr=subprocess.PIPE)
293
decrypted_plaintext, err = proc.communicate(input=data)
294
if proc.returncode != 0:
295
raise PGPError(err)
193
self.gnupg.passphrase = self.password_encode(password)
194
with open(os.devnull) as devnull:
195
try:
196
proc = self.gnupg.run(['--decrypt'],
197
create_fhs=['stdin', 'stdout'],
198
attach_fhs={'stderr': devnull})
199
with contextlib.closing(proc.handles['stdin'] ) as f:
200
f.write(data)
201
with contextlib.closing(proc.handles['stdout']) as f:
202
decrypted_plaintext = f.read()
203
proc.wait()
204
except IOError as e:
205
raise PGPError(e)
206
self.gnupg.passphrase = None
296
207
return decrypted_plaintext
297
208
298
209
299
# Pretend that we have an Avahi module
300
class avahi:
301
"""This isn't so much a class as it is a module-like namespace."""
302
IF_UNSPEC = -1 # avahi-common/address.h
303
PROTO_UNSPEC = -1 # avahi-common/address.h
304
PROTO_INET = 0 # avahi-common/address.h
305
PROTO_INET6 = 1 # avahi-common/address.h
306
DBUS_NAME = "org.freedesktop.Avahi"
307
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
308
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
309
DBUS_PATH_SERVER = "/"
310
311
@staticmethod
312
def string_array_to_txt_array(t):
313
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
314
for s in t), signature="ay")
315
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
316
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
317
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
318
SERVER_INVALID = 0 # avahi-common/defs.h
319
SERVER_REGISTERING = 1 # avahi-common/defs.h
320
SERVER_RUNNING = 2 # avahi-common/defs.h
321
SERVER_COLLISION = 3 # avahi-common/defs.h
322
SERVER_FAILURE = 4 # avahi-common/defs.h
323
324
210
325
211
class AvahiError(Exception):
326
212
def __init__(self, value, *args, **kwargs):
327
213
self.value = value
328
return super(AvahiError, self).__init__(value, *args,
329
**kwargs)
330
214
super(AvahiError, self).__init__(value, *args, **kwargs)
215
def __unicode__(self):
216
return unicode(repr(self.value))
331
217
332
218
class AvahiServiceError(AvahiError):
333
219
pass
334
220
335
336
221
class AvahiGroupError(AvahiError):
337
222
pass
338
223
339
224
340
class AvahiService:
225
class AvahiService(object):
341
226
"""An Avahi (Zeroconf) service.
342
227
343
228
Attributes:
344
229
interface: integer; avahi.IF_UNSPEC or an interface index.
345
230
Used to optionally bind to the specified interface.
346
231
name: string; Example: 'Mandos'
347
232
type: string; Example: '_mandos._tcp'.
348
See <https://www.iana.org/assignments/service-names-port-numbers>
233
See <http://www.dns-sd.org/ServiceTypes.html>
349
234
port: integer; what port to announce
350
235
TXT: list of strings; TXT record for the service
351
236
domain: string; Domain to publish on, default to .local if empty.
357
242
server: D-Bus Server
358
243
bus: dbus.SystemBus()
359
244
"""
360
361
def __init__(self,
362
interface=avahi.IF_UNSPEC,
363
name=None,
364
servicetype=None,
365
port=None,
366
TXT=None,
367
domain="",
368
host="",
369
max_renames=32768,
370
protocol=avahi.PROTO_UNSPEC,
371
bus=None):
245
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
246
servicetype = None, port = None, TXT = None,
247
domain = "", host = "", max_renames = 32768,
248
protocol = avahi.PROTO_UNSPEC, bus = None):
372
249
self.interface = interface
373
250
self.name = name
374
251
self.type = servicetype
383
260
self.server = None
384
261
self.bus = bus
385
262
self.entry_group_state_changed_match = None
386
387
def rename(self, remove=True):
263
def rename(self):
388
264
"""Derived from the Avahi example code"""
389
265
if self.rename_count >= self.max_renames:
390
266
logger.critical("No suitable Zeroconf service name found"
391
267
" after %i retries, exiting.",
392
268
self.rename_count)
393
269
raise AvahiServiceError("Too many renames")
394
self.name = str(
395
self.server.GetAlternativeServiceName(self.name))
396
self.rename_count += 1
270
self.name = unicode(self.server
271
.GetAlternativeServiceName(self.name))
397
272
logger.info("Changing Zeroconf service name to %r ...",
398
273
self.name)
399
if remove:
400
self.remove()
274
self.remove()
401
275
try:
402
276
self.add()
403
277
except dbus.exceptions.DBusException as error:
404
if (error.get_dbus_name()
405
== "org.freedesktop.Avahi.CollisionError"):
406
logger.info("Local Zeroconf service name collision.")
407
return self.rename(remove=False)
408
else:
409
logger.critical("D-Bus Exception", exc_info=error)
410
self.cleanup()
411
os._exit(1)
412
278
logger.critical("DBusException: %s", error)
279
self.cleanup()
280
os._exit(1)
281
self.rename_count += 1
413
282
def remove(self):
414
283
"""Derived from the Avahi example code"""
415
284
if self.entry_group_state_changed_match is not None:
417
286
self.entry_group_state_changed_match = None
418
287
if self.group is not None:
419
288
self.group.Reset()
420
421
289
def add(self):
422
290
"""Derived from the Avahi example code"""
423
291
self.remove()
440
308
dbus.UInt16(self.port),
441
309
avahi.string_array_to_txt_array(self.TXT))
442
310
self.group.Commit()
443
444
311
def entry_group_state_changed(self, state, error):
445
312
"""Derived from the Avahi example code"""
446
313
logger.debug("Avahi entry group state change: %i", state)
447
314
448
315
if state == avahi.ENTRY_GROUP_ESTABLISHED:
449
316
logger.debug("Zeroconf service established.")
450
317
elif state == avahi.ENTRY_GROUP_COLLISION:
452
319
self.rename()
453
320
elif state == avahi.ENTRY_GROUP_FAILURE:
454
321
logger.critical("Avahi: Error in group state changed %s",
455
str(error))
456
raise AvahiGroupError("State changed: {!s}".format(error))
457
322
unicode(error))
323
raise AvahiGroupError("State changed: %s"
324
% unicode(error))
458
325
def cleanup(self):
459
326
"""Derived from the Avahi example code"""
460
327
if self.group is not None:
465
332
pass
466
333
self.group = None
467
334
self.remove()
468
469
335
def server_state_changed(self, state, error=None):
470
336
"""Derived from the Avahi example code"""
471
337
logger.debug("Avahi server state change: %i", state)
472
bad_states = {
473
avahi.SERVER_INVALID: "Zeroconf server invalid",
474
avahi.SERVER_REGISTERING: None,
475
avahi.SERVER_COLLISION: "Zeroconf server name collision",
476
avahi.SERVER_FAILURE: "Zeroconf server failure",
477
}
338
bad_states = { avahi.SERVER_INVALID:
339
"Zeroconf server invalid",
340
avahi.SERVER_REGISTERING: None,
341
avahi.SERVER_COLLISION:
342
"Zeroconf server name collision",
343
avahi.SERVER_FAILURE:
344
"Zeroconf server failure" }
478
345
if state in bad_states:
479
346
if bad_states[state] is not None:
480
347
if error is None:
483
350
logger.error(bad_states[state] + ": %r", error)
484
351
self.cleanup()
485
352
elif state == avahi.SERVER_RUNNING:
486
try:
487
self.add()
488
except dbus.exceptions.DBusException as error:
489
if (error.get_dbus_name()
490
== "org.freedesktop.Avahi.CollisionError"):
491
logger.info("Local Zeroconf service name"
492
" collision.")
493
return self.rename(remove=False)
494
else:
495
logger.critical("D-Bus Exception", exc_info=error)
496
self.cleanup()
497
os._exit(1)
353
self.add()
498
354
else:
499
355
if error is None:
500
356
logger.debug("Unknown state: %r", state)
501
357
else:
502
358
logger.debug("Unknown state: %r: %r", state, error)
503
504
359
def activate(self):
505
360
"""Derived from the Avahi example code"""
506
361
if self.server is None:
510
365
follow_name_owner_changes=True),
511
366
avahi.DBUS_INTERFACE_SERVER)
512
367
self.server.connect_to_signal("StateChanged",
513
self.server_state_changed)
368
self.server_state_changed)
514
369
self.server_state_changed(self.server.GetState())
515
370
516
517
371
class AvahiServiceToSyslog(AvahiService):
518
def rename(self, *args, **kwargs):
372
def rename(self):
519
373
"""Add the new name to the syslog messages"""
520
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
521
syslogger.setFormatter(logging.Formatter(
522
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
523
.format(self.name)))
374
ret = AvahiService.rename(self)
375
syslogger.setFormatter(logging.Formatter
376
('Mandos (%s) [%%(process)d]:'
377
' %%(levelname)s: %%(message)s'
378
% self.name))
524
379
return ret
525
380
526
527
# Pretend that we have a GnuTLS module
528
class gnutls:
529
"""This isn't so much a class as it is a module-like namespace."""
530
531
library = ctypes.util.find_library("gnutls")
532
if library is None:
533
library = ctypes.util.find_library("gnutls-deb0")
534
_library = ctypes.cdll.LoadLibrary(library)
535
del library
536
537
# Unless otherwise indicated, the constants and types below are
538
# all from the gnutls/gnutls.h C header file.
539
540
# Constants
541
E_SUCCESS = 0
542
E_INTERRUPTED = -52
543
E_AGAIN = -28
544
CRT_OPENPGP = 2
545
CRT_RAWPK = 3
546
CLIENT = 2
547
SHUT_RDWR = 0
548
CRD_CERTIFICATE = 1
549
E_NO_CERTIFICATE_FOUND = -49
550
X509_FMT_DER = 0
551
NO_TICKETS = 1<<10
552
ENABLE_RAWPK = 1<<18
553
CTYPE_PEERS = 3
554
KEYID_USE_SHA256 = 1 # gnutls/x509.h
555
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
556
557
# Types
558
class session_int(ctypes.Structure):
559
_fields_ = []
560
session_t = ctypes.POINTER(session_int)
561
562
class certificate_credentials_st(ctypes.Structure):
563
_fields_ = []
564
certificate_credentials_t = ctypes.POINTER(
565
certificate_credentials_st)
566
certificate_type_t = ctypes.c_int
567
568
class datum_t(ctypes.Structure):
569
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
570
('size', ctypes.c_uint)]
571
572
class openpgp_crt_int(ctypes.Structure):
573
_fields_ = []
574
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
575
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
576
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
577
credentials_type_t = ctypes.c_int
578
transport_ptr_t = ctypes.c_void_p
579
close_request_t = ctypes.c_int
580
581
# Exceptions
582
class Error(Exception):
583
def __init__(self, message=None, code=None, args=()):
584
# Default usage is by a message string, but if a return
585
# code is passed, convert it to a string with
586
# gnutls.strerror()
587
self.code = code
588
if message is None and code is not None:
589
message = gnutls.strerror(code)
590
return super(gnutls.Error, self).__init__(
591
message, *args)
592
593
class CertificateSecurityError(Error):
594
pass
595
596
# Classes
597
class Credentials:
598
def __init__(self):
599
self._c_object = gnutls.certificate_credentials_t()
600
gnutls.certificate_allocate_credentials(
601
ctypes.byref(self._c_object))
602
self.type = gnutls.CRD_CERTIFICATE
603
604
def __del__(self):
605
gnutls.certificate_free_credentials(self._c_object)
606
607
class ClientSession:
608
def __init__(self, socket, credentials=None):
609
self._c_object = gnutls.session_t()
610
gnutls_flags = gnutls.CLIENT
611
if gnutls.check_version(b"3.5.6"):
612
gnutls_flags |= gnutls.NO_TICKETS
613
if gnutls.has_rawpk:
614
gnutls_flags |= gnutls.ENABLE_RAWPK
615
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
616
del gnutls_flags
617
gnutls.set_default_priority(self._c_object)
618
gnutls.transport_set_ptr(self._c_object, socket.fileno())
619
gnutls.handshake_set_private_extensions(self._c_object,
620
True)
621
self.socket = socket
622
if credentials is None:
623
credentials = gnutls.Credentials()
624
gnutls.credentials_set(self._c_object, credentials.type,
625
ctypes.cast(credentials._c_object,
626
ctypes.c_void_p))
627
self.credentials = credentials
628
629
def __del__(self):
630
gnutls.deinit(self._c_object)
631
632
def handshake(self):
633
return gnutls.handshake(self._c_object)
634
635
def send(self, data):
636
data = bytes(data)
637
data_len = len(data)
638
while data_len > 0:
639
data_len -= gnutls.record_send(self._c_object,
640
data[-data_len:],
641
data_len)
642
643
def bye(self):
644
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
645
646
# Error handling functions
647
def _error_code(result):
648
"""A function to raise exceptions on errors, suitable
649
for the 'restype' attribute on ctypes functions"""
650
if result >= 0:
651
return result
652
if result == gnutls.E_NO_CERTIFICATE_FOUND:
653
raise gnutls.CertificateSecurityError(code=result)
654
raise gnutls.Error(code=result)
655
656
def _retry_on_error(result, func, arguments):
657
"""A function to retry on some errors, suitable
658
for the 'errcheck' attribute on ctypes functions"""
659
while result < 0:
660
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
661
return _error_code(result)
662
result = func(*arguments)
663
return result
664
665
# Unless otherwise indicated, the function declarations below are
666
# all from the gnutls/gnutls.h C header file.
667
668
# Functions
669
priority_set_direct = _library.gnutls_priority_set_direct
670
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
671
ctypes.POINTER(ctypes.c_char_p)]
672
priority_set_direct.restype = _error_code
673
674
init = _library.gnutls_init
675
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
676
init.restype = _error_code
677
678
set_default_priority = _library.gnutls_set_default_priority
679
set_default_priority.argtypes = [session_t]
680
set_default_priority.restype = _error_code
681
682
record_send = _library.gnutls_record_send
683
record_send.argtypes = [session_t, ctypes.c_void_p,
684
ctypes.c_size_t]
685
record_send.restype = ctypes.c_ssize_t
686
record_send.errcheck = _retry_on_error
687
688
certificate_allocate_credentials = (
689
_library.gnutls_certificate_allocate_credentials)
690
certificate_allocate_credentials.argtypes = [
691
ctypes.POINTER(certificate_credentials_t)]
692
certificate_allocate_credentials.restype = _error_code
693
694
certificate_free_credentials = (
695
_library.gnutls_certificate_free_credentials)
696
certificate_free_credentials.argtypes = [
697
certificate_credentials_t]
698
certificate_free_credentials.restype = None
699
700
handshake_set_private_extensions = (
701
_library.gnutls_handshake_set_private_extensions)
702
handshake_set_private_extensions.argtypes = [session_t,
703
ctypes.c_int]
704
handshake_set_private_extensions.restype = None
705
706
credentials_set = _library.gnutls_credentials_set
707
credentials_set.argtypes = [session_t, credentials_type_t,
708
ctypes.c_void_p]
709
credentials_set.restype = _error_code
710
711
strerror = _library.gnutls_strerror
712
strerror.argtypes = [ctypes.c_int]
713
strerror.restype = ctypes.c_char_p
714
715
certificate_type_get = _library.gnutls_certificate_type_get
716
certificate_type_get.argtypes = [session_t]
717
certificate_type_get.restype = _error_code
718
719
certificate_get_peers = _library.gnutls_certificate_get_peers
720
certificate_get_peers.argtypes = [session_t,
721
ctypes.POINTER(ctypes.c_uint)]
722
certificate_get_peers.restype = ctypes.POINTER(datum_t)
723
724
global_set_log_level = _library.gnutls_global_set_log_level
725
global_set_log_level.argtypes = [ctypes.c_int]
726
global_set_log_level.restype = None
727
728
global_set_log_function = _library.gnutls_global_set_log_function
729
global_set_log_function.argtypes = [log_func]
730
global_set_log_function.restype = None
731
732
deinit = _library.gnutls_deinit
733
deinit.argtypes = [session_t]
734
deinit.restype = None
735
736
handshake = _library.gnutls_handshake
737
handshake.argtypes = [session_t]
738
handshake.restype = _error_code
739
handshake.errcheck = _retry_on_error
740
741
transport_set_ptr = _library.gnutls_transport_set_ptr
742
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
743
transport_set_ptr.restype = None
744
745
bye = _library.gnutls_bye
746
bye.argtypes = [session_t, close_request_t]
747
bye.restype = _error_code
748
bye.errcheck = _retry_on_error
749
750
check_version = _library.gnutls_check_version
751
check_version.argtypes = [ctypes.c_char_p]
752
check_version.restype = ctypes.c_char_p
753
754
_need_version = b"3.3.0"
755
if check_version(_need_version) is None:
756
raise self.Error("Needs GnuTLS {} or later"
757
.format(_need_version))
758
759
_tls_rawpk_version = b"3.6.6"
760
has_rawpk = bool(check_version(_tls_rawpk_version))
761
762
if has_rawpk:
763
# Types
764
class pubkey_st(ctypes.Structure):
765
_fields = []
766
pubkey_t = ctypes.POINTER(pubkey_st)
767
768
x509_crt_fmt_t = ctypes.c_int
769
770
# All the function declarations below are from gnutls/abstract.h
771
pubkey_init = _library.gnutls_pubkey_init
772
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
773
pubkey_init.restype = _error_code
774
775
pubkey_import = _library.gnutls_pubkey_import
776
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
777
x509_crt_fmt_t]
778
pubkey_import.restype = _error_code
779
780
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
781
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
782
ctypes.POINTER(ctypes.c_ubyte),
783
ctypes.POINTER(ctypes.c_size_t)]
784
pubkey_get_key_id.restype = _error_code
785
786
pubkey_deinit = _library.gnutls_pubkey_deinit
787
pubkey_deinit.argtypes = [pubkey_t]
788
pubkey_deinit.restype = None
789
else:
790
# All the function declarations below are from gnutls/openpgp.h
791
792
openpgp_crt_init = _library.gnutls_openpgp_crt_init
793
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
794
openpgp_crt_init.restype = _error_code
795
796
openpgp_crt_import = _library.gnutls_openpgp_crt_import
797
openpgp_crt_import.argtypes = [openpgp_crt_t,
798
ctypes.POINTER(datum_t),
799
openpgp_crt_fmt_t]
800
openpgp_crt_import.restype = _error_code
801
802
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
803
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
804
ctypes.POINTER(ctypes.c_uint)]
805
openpgp_crt_verify_self.restype = _error_code
806
807
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
808
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
809
openpgp_crt_deinit.restype = None
810
811
openpgp_crt_get_fingerprint = (
812
_library.gnutls_openpgp_crt_get_fingerprint)
813
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
814
ctypes.c_void_p,
815
ctypes.POINTER(
816
ctypes.c_size_t)]
817
openpgp_crt_get_fingerprint.restype = _error_code
818
819
if check_version(b"3.6.4"):
820
certificate_type_get2 = _library.gnutls_certificate_type_get2
821
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
822
certificate_type_get2.restype = _error_code
823
824
# Remove non-public functions
825
del _error_code, _retry_on_error
826
827
828
def call_pipe(connection, # : multiprocessing.Connection
829
func, *args, **kwargs):
830
"""This function is meant to be called by multiprocessing.Process
831
832
This function runs func(*args, **kwargs), and writes the resulting
833
return value on the provided multiprocessing.Connection.
834
"""
835
connection.send(func(*args, **kwargs))
836
connection.close()
837
838
839
class Client:
381
def _timedelta_to_milliseconds(td):
382
"Convert a datetime.timedelta() to milliseconds"
383
return ((td.days * 24 * 60 * 60 * 1000)
384
+ (td.seconds * 1000)
385
+ (td.microseconds // 1000))
386
387
class Client(object):
840
388
"""A representation of a client host served by this server.
841
389
842
390
Attributes:
843
approved: bool(); 'None' if not yet approved/disapproved
391
_approved: bool(); 'None' if not yet approved/disapproved
844
392
approval_delay: datetime.timedelta(); Time to wait for approval
845
393
approval_duration: datetime.timedelta(); Duration of one approval
846
checker: multiprocessing.Process(); a running checker process used
847
to see if the client lives. 'None' if no process is
848
running.
849
checker_callback_tag: a GLib event source tag, or None
394
checker: subprocess.Popen(); a running checker process used
395
to see if the client lives.
396
'None' if no process is running.
397
checker_callback_tag: a gobject event source tag, or None
850
398
checker_command: string; External command which is run to check
851
399
if client lives. %() expansions are done at
852
400
runtime with vars(self) as dict, so that for
853
401
instance %(name)s can be used in the command.
854
checker_initiator_tag: a GLib event source tag, or None
402
checker_initiator_tag: a gobject event source tag, or None
855
403
created: datetime.datetime(); (UTC) object creation
856
404
client_structure: Object describing what attributes a client has
857
405
and is used for storing the client at exit
858
406
current_checker_command: string; current running checker_command
859
disable_initiator_tag: a GLib event source tag, or None
407
disable_initiator_tag: a gobject event source tag, or None
860
408
enabled: bool()
861
409
fingerprint: string (40 or 32 hexadecimal digits); used to
862
uniquely identify an OpenPGP client
863
key_id: string (64 hexadecimal digits); used to uniquely identify
864
a client using raw public keys
410
uniquely identify the client
865
411
host: string; available for use by the checker command
866
412
interval: datetime.timedelta(); How often to start a new checker
867
413
last_approval_request: datetime.datetime(); (UTC) or None
868
414
last_checked_ok: datetime.datetime(); (UTC) or None
415
869
416
last_checker_status: integer between 0 and 255 reflecting exit
870
417
status of last checker. -1 reflects crashed
871
checker, -2 means no checker completed yet.
872
last_checker_signal: The signal which killed the last checker, if
873
last_checker_status is -1
418
checker, or None.
874
419
last_enabled: datetime.datetime(); (UTC) or None
875
420
name: string; from the config file, used in log messages and
876
421
D-Bus identifiers
877
422
secret: bytestring; sent verbatim (over TLS) to client
878
423
timeout: datetime.timedelta(); How long from last_checked_ok
879
424
until this client is disabled
880
extended_timeout: extra long timeout when secret has been sent
425
extended_timeout: extra long timeout when password has been sent
881
426
runtime_expansions: Allowed attributes for runtime expansion.
882
427
expires: datetime.datetime(); time (UTC) when a client will be
883
428
disabled, or None
884
server_settings: The server_settings dict from main()
885
429
"""
886
430
887
431
runtime_expansions = ("approval_delay", "approval_duration",
888
"created", "enabled", "expires", "key_id",
889
"fingerprint", "host", "interval",
890
"last_approval_request", "last_checked_ok",
432
"created", "enabled", "fingerprint",
433
"host", "interval", "last_checked_ok",
891
434
"last_enabled", "name", "timeout")
892
client_defaults = {
893
"timeout": "PT5M",
894
"extended_timeout": "PT15M",
895
"interval": "PT2M",
896
"checker": "fping -q -- %%(host)s",
897
"host": "",
898
"approval_delay": "PT0S",
899
"approval_duration": "PT1S",
900
"approved_by_default": "True",
901
"enabled": "True",
902
}
903
904
@staticmethod
905
def config_parser(config):
906
"""Construct a new dict of client settings of this form:
907
{ client_name: {setting_name: value, ...}, ...}
908
with exceptions for any special settings as defined above.
909
NOTE: Must be a pure function. Must return the same result
910
value given the same arguments.
911
"""
912
settings = {}
913
for client_name in config.sections():
914
section = dict(config.items(client_name))
915
client = settings[client_name] = {}
916
917
client["host"] = section["host"]
918
# Reformat values from string types to Python types
919
client["approved_by_default"] = config.getboolean(
920
client_name, "approved_by_default")
921
client["enabled"] = config.getboolean(client_name,
922
"enabled")
923
924
# Uppercase and remove spaces from key_id and fingerprint
925
# for later comparison purposes with return value from the
926
# key_id() and fingerprint() functions
927
client["key_id"] = (section.get("key_id", "").upper()
928
.replace(" ", ""))
929
client["fingerprint"] = (section["fingerprint"].upper()
930
.replace(" ", ""))
931
if "secret" in section:
932
client["secret"] = codecs.decode(section["secret"]
933
.encode("utf-8"),
934
"base64")
935
elif "secfile" in section:
936
with open(os.path.expanduser(os.path.expandvars
937
(section["secfile"])),
938
"rb") as secfile:
939
client["secret"] = secfile.read()
940
else:
941
raise TypeError("No secret or secfile for section {}"
942
.format(section))
943
client["timeout"] = string_to_delta(section["timeout"])
944
client["extended_timeout"] = string_to_delta(
945
section["extended_timeout"])
946
client["interval"] = string_to_delta(section["interval"])
947
client["approval_delay"] = string_to_delta(
948
section["approval_delay"])
949
client["approval_duration"] = string_to_delta(
950
section["approval_duration"])
951
client["checker_command"] = section["checker"]
952
client["last_approval_request"] = None
953
client["last_checked_ok"] = None
954
client["last_checker_status"] = -2
955
956
return settings
957
958
def __init__(self, settings, name=None, server_settings=None):
435
436
def timeout_milliseconds(self):
437
"Return the 'timeout' attribute in milliseconds"
438
return _timedelta_to_milliseconds(self.timeout)
439
440
def extended_timeout_milliseconds(self):
441
"Return the 'extended_timeout' attribute in milliseconds"
442
return _timedelta_to_milliseconds(self.extended_timeout)
443
444
def interval_milliseconds(self):
445
"Return the 'interval' attribute in milliseconds"
446
return _timedelta_to_milliseconds(self.interval)
447
448
def approval_delay_milliseconds(self):
449
return _timedelta_to_milliseconds(self.approval_delay)
450
451
def __init__(self, name = None, config=None):
452
"""Note: the 'checker' key in 'config' sets the
453
'checker_command' attribute and *not* the 'checker'
454
attribute."""
959
455
self.name = name
960
if server_settings is None:
961
server_settings = {}
962
self.server_settings = server_settings
963
# adding all client settings
964
for setting, value in settings.items():
965
setattr(self, setting, value)
966
967
if self.enabled:
968
if not hasattr(self, "last_enabled"):
969
self.last_enabled = datetime.datetime.utcnow()
970
if not hasattr(self, "expires"):
971
self.expires = (datetime.datetime.utcnow()
972
+ self.timeout)
973
else:
974
self.last_enabled = None
975
self.expires = None
976
456
if config is None:
457
config = {}
977
458
logger.debug("Creating client %r", self.name)
978
logger.debug(" Key ID: %s", self.key_id)
459
# Uppercase and remove spaces from fingerprint for later
460
# comparison purposes with return value from the fingerprint()
461
# function
462
self.fingerprint = (config["fingerprint"].upper()
463
.replace(" ", ""))
979
464
logger.debug(" Fingerprint: %s", self.fingerprint)
980
self.created = settings.get("created",
981
datetime.datetime.utcnow())
982
983
# attributes specific for this server instance
465
if "secret" in config:
466
self.secret = config["secret"].decode("base64")
467
elif "secfile" in config:
468
with open(os.path.expanduser(os.path.expandvars
469
(config["secfile"])),
470
"rb") as secfile:
471
self.secret = secfile.read()
472
else:
473
raise TypeError("No secret or secfile for client %s"
474
% self.name)
475
self.host = config.get("host", "")
476
self.created = datetime.datetime.utcnow()
477
self.enabled = config.get("enabled", True)
478
self.last_approval_request = None
479
if self.enabled:
480
self.last_enabled = datetime.datetime.utcnow()
481
else:
482
self.last_enabled = None
483
self.last_checked_ok = None
484
self.last_checker_status = None
485
self.timeout = string_to_delta(config["timeout"])
486
self.extended_timeout = string_to_delta(config
487
["extended_timeout"])
488
self.interval = string_to_delta(config["interval"])
984
489
self.checker = None
985
490
self.checker_initiator_tag = None
986
491
self.disable_initiator_tag = None
492
if self.enabled:
493
self.expires = datetime.datetime.utcnow() + self.timeout
494
else:
495
self.expires = None
987
496
self.checker_callback_tag = None
497
self.checker_command = config["checker"]
988
498
self.current_checker_command = None
989
self.approved = None
499
self._approved = None
500
self.approved_by_default = config.get("approved_by_default",
501
True)
990
502
self.approvals_pending = 0
991
self.changedstate = multiprocessing_manager.Condition(
992
multiprocessing_manager.Lock())
993
self.client_structure = [attr
994
for attr in self.__dict__.keys()
503
self.approval_delay = string_to_delta(
504
config["approval_delay"])
505
self.approval_duration = string_to_delta(
506
config["approval_duration"])
507
self.changedstate = (multiprocessing_manager
508
.Condition(multiprocessing_manager
509
.Lock()))
510
self.client_structure = [attr for attr in
511
self.__dict__.iterkeys()
995
512
if not attr.startswith("_")]
996
513
self.client_structure.append("client_structure")
997
998
for name, t in inspect.getmembers(
999
type(self), lambda obj: isinstance(obj, property)):
514
515
for name, t in inspect.getmembers(type(self),
516
lambda obj:
517
isinstance(obj,
518
property)):
1000
519
if not name.startswith("_"):
1001
520
self.client_structure.append(name)
1002
521
1003
522
# Send notice to process children that client state has changed
1004
523
def send_changedstate(self):
1005
524
with self.changedstate:
1006
525
self.changedstate.notify_all()
1007
526
1008
527
def enable(self):
1009
528
"""Start this client's checker and timeout hooks"""
1010
529
if getattr(self, "enabled", False):
1011
530
# Already enabled
1012
531
return
532
self.send_changedstate()
1013
533
self.expires = datetime.datetime.utcnow() + self.timeout
1014
534
self.enabled = True
1015
535
self.last_enabled = datetime.datetime.utcnow()
1016
536
self.init_checker()
1017
self.send_changedstate()
1018
537
1019
538
def disable(self, quiet=True):
1020
539
"""Disable this client."""
1021
540
if not getattr(self, "enabled", False):
1022
541
return False
1023
542
if not quiet:
543
self.send_changedstate()
544
if not quiet:
1024
545
logger.info("Disabling client %s", self.name)
1025
if getattr(self, "disable_initiator_tag", None) is not None:
1026
GLib.source_remove(self.disable_initiator_tag)
546
if getattr(self, "disable_initiator_tag", False):
547
gobject.source_remove(self.disable_initiator_tag)
1027
548
self.disable_initiator_tag = None
1028
549
self.expires = None
1029
if getattr(self, "checker_initiator_tag", None) is not None:
1030
GLib.source_remove(self.checker_initiator_tag)
550
if getattr(self, "checker_initiator_tag", False):
551
gobject.source_remove(self.checker_initiator_tag)
1031
552
self.checker_initiator_tag = None
1032
553
self.stop_checker()
1033
554
self.enabled = False
1034
if not quiet:
1035
self.send_changedstate()
1036
# Do not run this again if called by a GLib.timeout_add
555
# Do not run this again if called by a gobject.timeout_add
1037
556
return False
1038
557
1039
558
def __del__(self):
1040
559
self.disable()
1041
560
1042
561
def init_checker(self):
1043
562
# Schedule a new checker to be started an 'interval' from now,
1044
563
# and every interval from then on.
1045
if self.checker_initiator_tag is not None:
1046
GLib.source_remove(self.checker_initiator_tag)
1047
self.checker_initiator_tag = GLib.timeout_add(
1048
random.randrange(int(self.interval.total_seconds() * 1000
1049
+ 1)),
1050
self.start_checker)
564
self.checker_initiator_tag = (gobject.timeout_add
565
(self.interval_milliseconds(),
566
self.start_checker))
1051
567
# Schedule a disable() when 'timeout' has passed
1052
if self.disable_initiator_tag is not None:
1053
GLib.source_remove(self.disable_initiator_tag)
1054
self.disable_initiator_tag = GLib.timeout_add(
1055
int(self.timeout.total_seconds() * 1000), self.disable)
568
self.disable_initiator_tag = (gobject.timeout_add
569
(self.timeout_milliseconds(),
570
self.disable))
1056
571
# Also start a new checker *right now*.
1057
572
self.start_checker()
1058
1059
def checker_callback(self, source, condition, connection,
1060
command):
573
574
def checker_callback(self, pid, condition, command):
1061
575
"""The checker has completed, so take appropriate actions."""
1062
# Read return code from connection (see call_pipe)
1063
returncode = connection.recv()
1064
connection.close()
1065
if self.checker is not None:
1066
self.checker.join()
1067
576
self.checker_callback_tag = None
1068
577
self.checker = None
1069
1070
if returncode >= 0:
1071
self.last_checker_status = returncode
1072
self.last_checker_signal = None
578
if os.WIFEXITED(condition):
579
self.last_checker_status = os.WEXITSTATUS(condition)
1073
580
if self.last_checker_status == 0:
1074
581
logger.info("Checker for %(name)s succeeded",
1075
582
vars(self))
1076
583
self.checked_ok()
1077
584
else:
1078
logger.info("Checker for %(name)s failed", vars(self))
585
logger.info("Checker for %(name)s failed",
586
vars(self))
1079
587
else:
1080
588
self.last_checker_status = -1
1081
self.last_checker_signal = -returncode
1082
589
logger.warning("Checker for %(name)s crashed?",
1083
590
vars(self))
1084
return False
1085
1086
def checked_ok(self):
1087
"""Assert that the client has been seen, alive and well."""
1088
self.last_checked_ok = datetime.datetime.utcnow()
1089
self.last_checker_status = 0
1090
self.last_checker_signal = None
1091
self.bump_timeout()
1092
1093
def bump_timeout(self, timeout=None):
1094
"""Bump up the timeout for this client."""
591
592
def checked_ok(self, timeout=None):
593
"""Bump up the timeout for this client.
594
595
This should only be called when the client has been seen,
596
alive and well.
597
"""
1095
598
if timeout is None:
1096
599
timeout = self.timeout
600
self.last_checked_ok = datetime.datetime.utcnow()
1097
601
if self.disable_initiator_tag is not None:
1098
GLib.source_remove(self.disable_initiator_tag)
1099
self.disable_initiator_tag = None
602
gobject.source_remove(self.disable_initiator_tag)
1100
603
if getattr(self, "enabled", False):
1101
self.disable_initiator_tag = GLib.timeout_add(
1102
int(timeout.total_seconds() * 1000), self.disable)
604
self.disable_initiator_tag = (gobject.timeout_add
605
(_timedelta_to_milliseconds
606
(timeout), self.disable))
1103
607
self.expires = datetime.datetime.utcnow() + timeout
1104
608
1105
609
def need_approval(self):
1106
610
self.last_approval_request = datetime.datetime.utcnow()
1107
611
1108
612
def start_checker(self):
1109
613
"""Start a new checker subprocess if one is not running.
1110
614
1111
615
If a checker already exists, leave it running and do
1112
616
nothing."""
1113
617
# The reason for not killing a running checker is that if we
1114
# did that, and if a checker (for some reason) started running
1115
# slowly and taking more than 'interval' time, then the client
1116
# would inevitably timeout, since no checker would get a
1117
# chance to run to completion. If we instead leave running
618
# did that, then if a checker (for some reason) started
619
# running slowly and taking more than 'interval' time, the
620
# client would inevitably timeout, since no checker would get
621
# a chance to run to completion. If we instead leave running
1118
622
# checkers alone, the checker would have to take more time
1119
623
# than 'timeout' for the client to be disabled, which is as it
1120
624
# should be.
1121
1122
if self.checker is not None and not self.checker.is_alive():
1123
logger.warning("Checker was not alive; joining")
1124
self.checker.join()
1125
self.checker = None
625
626
# If a checker exists, make sure it is not a zombie
627
try:
628
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
629
except (AttributeError, OSError) as error:
630
if (isinstance(error, OSError)
631
and error.errno != errno.ECHILD):
632
raise error
633
else:
634
if pid:
635
logger.warning("Checker was a zombie")
636
gobject.source_remove(self.checker_callback_tag)
637
self.checker_callback(pid, status,
638
self.current_checker_command)
1126
639
# Start a new checker if needed
1127
640
if self.checker is None:
1128
# Escape attributes for the shell
1129
escaped_attrs = {
1130
attr: re.escape(str(getattr(self, attr)))
1131
for attr in self.runtime_expansions}
1132
641
try:
1133
command = self.checker_command % escaped_attrs
1134
except TypeError as error:
1135
logger.error('Could not format string "%s"',
1136
self.checker_command,
1137
exc_info=error)
1138
return True # Try again later
642
# In case checker_command has exactly one % operator
643
command = self.checker_command % self.host
644
except TypeError:
645
# Escape attributes for the shell
646
escaped_attrs = dict(
647
(attr,
648
re.escape(unicode(str(getattr(self, attr, "")),
649
errors=
650
'replace')))
651
for attr in
652
self.runtime_expansions)
653
654
try:
655
command = self.checker_command % escaped_attrs
656
except TypeError as error:
657
logger.error('Could not format string "%s":'
658
' %s', self.checker_command, error)
659
return True # Try again later
1139
660
self.current_checker_command = command
1140
logger.info("Starting checker %r for %s", command,
1141
self.name)
1142
# We don't need to redirect stdout and stderr, since
1143
# in normal mode, that is already done by daemon(),
1144
# and in debug mode we don't want to. (Stdin is
1145
# always replaced by /dev/null.)
1146
# The exception is when not debugging but nevertheless
1147
# running in the foreground; use the previously
1148
# created wnull.
1149
popen_args = {"close_fds": True,
1150
"shell": True,
1151
"cwd": "/"}
1152
if (not self.server_settings["debug"]
1153
and self.server_settings["foreground"]):
1154
popen_args.update({"stdout": wnull,
1155
"stderr": wnull})
1156
pipe = multiprocessing.Pipe(duplex=False)
1157
self.checker = multiprocessing.Process(
1158
target=call_pipe,
1159
args=(pipe[1], subprocess.call, command),
1160
kwargs=popen_args)
1161
self.checker.start()
1162
self.checker_callback_tag = GLib.io_add_watch(
1163
GLib.IOChannel.unix_new(pipe[0].fileno()),
1164
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1165
self.checker_callback, pipe[0], command)
1166
# Re-run this periodically if run by GLib.timeout_add
661
try:
662
logger.info("Starting checker %r for %s",
663
command, self.name)
664
# We don't need to redirect stdout and stderr, since
665
# in normal mode, that is already done by daemon(),
666
# and in debug mode we don't want to. (Stdin is
667
# always replaced by /dev/null.)
668
self.checker = subprocess.Popen(command,
669
close_fds=True,
670
shell=True, cwd="/")
671
self.checker_callback_tag = (gobject.child_watch_add
672
(self.checker.pid,
673
self.checker_callback,
674
data=command))
675
# The checker may have completed before the gobject
676
# watch was added. Check for this.
677
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
678
if pid:
679
gobject.source_remove(self.checker_callback_tag)
680
self.checker_callback(pid, status, command)
681
except OSError as error:
682
logger.error("Failed to start subprocess: %s",
683
error)
684
# Re-run this periodically if run by gobject.timeout_add
1167
685
return True
1168
686
1169
687
def stop_checker(self):
1170
688
"""Force the checker process, if any, to stop."""
1171
689
if self.checker_callback_tag:
1172
GLib.source_remove(self.checker_callback_tag)
690
gobject.source_remove(self.checker_callback_tag)
1173
691
self.checker_callback_tag = None
1174
692
if getattr(self, "checker", None) is None:
1175
693
return
1176
694
logger.debug("Stopping checker for %(name)s", vars(self))
1177
self.checker.terminate()
695
try:
696
os.kill(self.checker.pid, signal.SIGTERM)
697
#time.sleep(0.5)
698
#if self.checker.poll() is None:
699
# os.kill(self.checker.pid, signal.SIGKILL)
700
except OSError as error:
701
if error.errno != errno.ESRCH: # No such process
702
raise
1178
703
self.checker = None
1179
704
1180
705
1181
def dbus_service_property(dbus_interface,
1182
signature="v",
1183
access="readwrite",
1184
byte_arrays=False):
706
def dbus_service_property(dbus_interface, signature="v",
707
access="readwrite", byte_arrays=False):
1185
708
"""Decorators for marking methods of a DBusObjectWithProperties to
1186
709
become properties on the D-Bus.
1187
710
1188
711
The decorated method will be called with no arguments by "Get"
1189
712
and with one argument by "Set".
1190
713
1191
714
The parameters, where they are supported, are the same as
1192
715
dbus.service.method, except there is only "signature", since the
1193
716
type from Get() and the type sent to Set() is the same.
1196
719
# "Set" method, so we fail early here:
1197
720
if byte_arrays and signature != "ay":
1198
721
raise ValueError("Byte arrays not supported for non-'ay'"
1199
" signature {!r}".format(signature))
1200
722
" signature %r" % signature)
1201
723
def decorator(func):
1202
724
func._dbus_is_property = True
1203
725
func._dbus_interface = dbus_interface
1206
728
func._dbus_name = func.__name__
1207
729
if func._dbus_name.endswith("_dbus_property"):
1208
730
func._dbus_name = func._dbus_name[:-14]
1209
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1210
return func
1211
1212
return decorator
1213
1214
1215
def dbus_interface_annotations(dbus_interface):
1216
"""Decorator for marking functions returning interface annotations
1217
1218
Usage:
1219
1220
@dbus_interface_annotations("org.example.Interface")
1221
def _foo(self): # Function name does not matter
1222
return {"org.freedesktop.DBus.Deprecated": "true",
1223
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1224
"false"}
1225
"""
1226
1227
def decorator(func):
1228
func._dbus_is_interface = True
1229
func._dbus_interface = dbus_interface
1230
func._dbus_name = dbus_interface
1231
return func
1232
1233
return decorator
1234
1235
1236
def dbus_annotations(annotations):
1237
"""Decorator to annotate D-Bus methods, signals or properties
1238
Usage:
1239
1240
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1241
"org.freedesktop.DBus.Property."
1242
"EmitsChangedSignal": "false"})
1243
@dbus_service_property("org.example.Interface", signature="b",
1244
access="r")
1245
def Property_dbus_property(self):
1246
return dbus.Boolean(False)
1247
1248
See also the DBusObjectWithAnnotations class.
1249
"""
1250
1251
def decorator(func):
1252
func._dbus_annotations = annotations
1253
return func
1254
731
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
732
return func
1255
733
return decorator
1256
734
1257
735
1258
736
class DBusPropertyException(dbus.exceptions.DBusException):
1259
737
"""A base class for D-Bus property-related exceptions
1260
738
"""
1261
pass
739
def __unicode__(self):
740
return unicode(str(self))
1262
741
1263
742
1264
743
class DBusPropertyAccessException(DBusPropertyException):
1273
752
pass
1274
753
1275
754
1276
class DBusObjectWithAnnotations(dbus.service.Object):
1277
"""A D-Bus object with annotations.
1278
1279
Classes inheriting from this can use the dbus_annotations
1280
decorator to add annotations to methods or signals.
1281
"""
1282
1283
@staticmethod
1284
def _is_dbus_thing(thing):
1285
"""Returns a function testing if an attribute is a D-Bus thing
1286
1287
If called like _is_dbus_thing("method") it returns a function
1288
suitable for use as predicate to inspect.getmembers().
1289
"""
1290
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1291
False)
1292
1293
def _get_all_dbus_things(self, thing):
1294
"""Returns a generator of (name, attribute) pairs
1295
"""
1296
return ((getattr(athing.__get__(self), "_dbus_name", name),
1297
athing.__get__(self))
1298
for cls in self.__class__.__mro__
1299
for name, athing in
1300
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1301
1302
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1303
out_signature="s",
1304
path_keyword='object_path',
1305
connection_keyword='connection')
1306
def Introspect(self, object_path, connection):
1307
"""Overloading of standard D-Bus method.
1308
1309
Inserts annotation tags on methods and signals.
1310
"""
1311
xmlstring = dbus.service.Object.Introspect(self, object_path,
1312
connection)
1313
try:
1314
document = xml.dom.minidom.parseString(xmlstring)
1315
1316
for if_tag in document.getElementsByTagName("interface"):
1317
# Add annotation tags
1318
for typ in ("method", "signal"):
1319
for tag in if_tag.getElementsByTagName(typ):
1320
annots = dict()
1321
for name, prop in (self.
1322
_get_all_dbus_things(typ)):
1323
if (name == tag.getAttribute("name")
1324
and prop._dbus_interface
1325
== if_tag.getAttribute("name")):
1326
annots.update(getattr(
1327
prop, "_dbus_annotations", {}))
1328
for name, value in annots.items():
1329
ann_tag = document.createElement(
1330
"annotation")
1331
ann_tag.setAttribute("name", name)
1332
ann_tag.setAttribute("value", value)
1333
tag.appendChild(ann_tag)
1334
# Add interface annotation tags
1335
for annotation, value in dict(
1336
itertools.chain.from_iterable(
1337
annotations().items()
1338
for name, annotations
1339
in self._get_all_dbus_things("interface")
1340
if name == if_tag.getAttribute("name")
1341
)).items():
1342
ann_tag = document.createElement("annotation")
1343
ann_tag.setAttribute("name", annotation)
1344
ann_tag.setAttribute("value", value)
1345
if_tag.appendChild(ann_tag)
1346
# Fix argument name for the Introspect method itself
1347
if (if_tag.getAttribute("name")
1348
== dbus.INTROSPECTABLE_IFACE):
1349
for cn in if_tag.getElementsByTagName("method"):
1350
if cn.getAttribute("name") == "Introspect":
1351
for arg in cn.getElementsByTagName("arg"):
1352
if (arg.getAttribute("direction")
1353
== "out"):
1354
arg.setAttribute("name",
1355
"xml_data")
1356
xmlstring = document.toxml("utf-8")
1357
document.unlink()
1358
except (AttributeError, xml.dom.DOMException,
1359
xml.parsers.expat.ExpatError) as error:
1360
logger.error("Failed to override Introspection method",
1361
exc_info=error)
1362
return xmlstring
1363
1364
1365
class DBusObjectWithProperties(DBusObjectWithAnnotations):
755
class DBusObjectWithProperties(dbus.service.Object):
1366
756
"""A D-Bus object with properties.
1367
757
1368
758
Classes inheriting from this can use the dbus_service_property
1369
759
decorator to expose methods as D-Bus properties. It exposes the
1370
760
standard Get(), Set(), and GetAll() methods on the D-Bus.
1371
761
"""
1372
762
763
@staticmethod
764
def _is_dbus_property(obj):
765
return getattr(obj, "_dbus_is_property", False)
766
767
def _get_all_dbus_properties(self):
768
"""Returns a generator of (name, attribute) pairs
769
"""
770
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
771
for cls in self.__class__.__mro__
772
for name, prop in
773
inspect.getmembers(cls, self._is_dbus_property))
774
1373
775
def _get_dbus_property(self, interface_name, property_name):
1374
776
"""Returns a bound method if one exists which is a D-Bus
1375
777
property with the specified name and interface.
1376
778
"""
1377
for cls in self.__class__.__mro__:
1378
for name, value in inspect.getmembers(
1379
cls, self._is_dbus_thing("property")):
779
for cls in self.__class__.__mro__:
780
for name, value in (inspect.getmembers
781
(cls, self._is_dbus_property)):
1380
782
if (value._dbus_name == property_name
1381
783
and value._dbus_interface == interface_name):
1382
784
return value.__get__(self)
1383
785
1384
786
# No such property
1385
raise DBusPropertyNotFound("{}:{}.{}".format(
1386
self.dbus_object_path, interface_name, property_name))
1387
1388
@classmethod
1389
def _get_all_interface_names(cls):
1390
"""Get a sequence of all interfaces supported by an object"""
1391
return (name for name in set(getattr(getattr(x, attr),
1392
"_dbus_interface", None)
1393
for x in (inspect.getmro(cls))
1394
for attr in dir(x))
1395
if name is not None)
1396
1397
@dbus.service.method(dbus.PROPERTIES_IFACE,
1398
in_signature="ss",
787
raise DBusPropertyNotFound(self.dbus_object_path + ":"
788
+ interface_name + "."
789
+ property_name)
790
791
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1399
792
out_signature="v")
1400
793
def Get(self, interface_name, property_name):
1401
794
"""Standard D-Bus property Get() method, see D-Bus standard.
1407
800
if not hasattr(value, "variant_level"):
1408
801
return value
1409
802
return type(value)(value, variant_level=value.variant_level+1)
1410
803
1411
804
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1412
805
def Set(self, interface_name, property_name, value):
1413
806
"""Standard D-Bus property Set() method, see D-Bus standard.
1419
812
# The byte_arrays option is not supported yet on
1420
813
# signatures other than "ay".
1421
814
if prop._dbus_signature != "ay":
1422
raise ValueError("Byte arrays not supported for non-"
1423
"'ay' signature {!r}"
1424
.format(prop._dbus_signature))
1425
value = dbus.ByteArray(bytes(value))
815
raise ValueError
816
value = dbus.ByteArray(''.join(unichr(byte)
817
for byte in value))
1426
818
prop(value)
1427
1428
@dbus.service.method(dbus.PROPERTIES_IFACE,
1429
in_signature="s",
819
820
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1430
821
out_signature="a{sv}")
1431
822
def GetAll(self, interface_name):
1432
823
"""Standard D-Bus property GetAll() method, see D-Bus
1433
824
standard.
1434
825
1435
826
Note: Will not include properties with access="write".
1436
827
"""
1437
828
properties = {}
1438
for name, prop in self._get_all_dbus_things("property"):
829
for name, prop in self._get_all_dbus_properties():
1439
830
if (interface_name
1440
831
and interface_name != prop._dbus_interface):
1441
832
# Interface non-empty but did not match
1447
838
if not hasattr(value, "variant_level"):
1448
839
properties[name] = value
1449
840
continue
1450
properties[name] = type(value)(
1451
value, variant_level=value.variant_level + 1)
841
properties[name] = type(value)(value, variant_level=
842
value.variant_level+1)
1452
843
return dbus.Dictionary(properties, signature="sv")
1453
1454
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1455
def PropertiesChanged(self, interface_name, changed_properties,
1456
invalidated_properties):
1457
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1458
standard.
1459
"""
1460
pass
1461
844
1462
845
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1463
846
out_signature="s",
1464
847
path_keyword='object_path',
1465
848
connection_keyword='connection')
1466
849
def Introspect(self, object_path, connection):
1467
"""Overloading of standard D-Bus method.
1468
1469
Inserts property tags and interface annotation tags.
850
"""Standard D-Bus method, overloaded to insert property tags.
1470
851
"""
1471
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1472
object_path,
1473
connection)
852
xmlstring = dbus.service.Object.Introspect(self, object_path,
853
connection)
1474
854
try:
1475
855
document = xml.dom.minidom.parseString(xmlstring)
1476
1477
856
def make_tag(document, name, prop):
1478
857
e = document.createElement("property")
1479
858
e.setAttribute("name", name)
1480
859
e.setAttribute("type", prop._dbus_signature)
1481
860
e.setAttribute("access", prop._dbus_access)
1482
861
return e
1483
1484
862
for if_tag in document.getElementsByTagName("interface"):
1485
# Add property tags
1486
863
for tag in (make_tag(document, name, prop)
1487
864
for name, prop
1488
in self._get_all_dbus_things("property")
865
in self._get_all_dbus_properties()
1489
866
if prop._dbus_interface
1490
867
== if_tag.getAttribute("name")):
1491
868
if_tag.appendChild(tag)
1492
# Add annotation tags for properties
1493
for tag in if_tag.getElementsByTagName("property"):
1494
annots = dict()
1495
for name, prop in self._get_all_dbus_things(
1496
"property"):
1497
if (name == tag.getAttribute("name")
1498
and prop._dbus_interface
1499
== if_tag.getAttribute("name")):
1500
annots.update(getattr(
1501
prop, "_dbus_annotations", {}))
1502
for name, value in annots.items():
1503
ann_tag = document.createElement(
1504
"annotation")
1505
ann_tag.setAttribute("name", name)
1506
ann_tag.setAttribute("value", value)
1507
tag.appendChild(ann_tag)
1508
869
# Add the names to the return values for the
1509
870
# "org.freedesktop.DBus.Properties" methods
1510
871
if (if_tag.getAttribute("name")
1525
886
except (AttributeError, xml.dom.DOMException,
1526
887
xml.parsers.expat.ExpatError) as error:
1527
888
logger.error("Failed to override Introspection method",
1528
exc_info=error)
1529
return xmlstring
1530
1531
1532
try:
1533
dbus.OBJECT_MANAGER_IFACE
1534
except AttributeError:
1535
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1536
1537
1538
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1539
"""A D-Bus object with an ObjectManager.
1540
1541
Classes inheriting from this exposes the standard
1542
GetManagedObjects call and the InterfacesAdded and
1543
InterfacesRemoved signals on the standard
1544
"org.freedesktop.DBus.ObjectManager" interface.
1545
1546
Note: No signals are sent automatically; they must be sent
1547
manually.
1548
"""
1549
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1550
out_signature="a{oa{sa{sv}}}")
1551
def GetManagedObjects(self):
1552
"""This function must be overridden"""
1553
raise NotImplementedError()
1554
1555
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1556
signature="oa{sa{sv}}")
1557
def InterfacesAdded(self, object_path, interfaces_and_properties):
1558
pass
1559
1560
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1561
def InterfacesRemoved(self, object_path, interfaces):
1562
pass
1563
1564
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1565
out_signature="s",
1566
path_keyword='object_path',
1567
connection_keyword='connection')
1568
def Introspect(self, object_path, connection):
1569
"""Overloading of standard D-Bus method.
1570
1571
Override return argument name of GetManagedObjects to be
1572
"objpath_interfaces_and_properties"
1573
"""
1574
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1575
object_path,
1576
connection)
1577
try:
1578
document = xml.dom.minidom.parseString(xmlstring)
1579
1580
for if_tag in document.getElementsByTagName("interface"):
1581
# Fix argument name for the GetManagedObjects method
1582
if (if_tag.getAttribute("name")
1583
== dbus.OBJECT_MANAGER_IFACE):
1584
for cn in if_tag.getElementsByTagName("method"):
1585
if (cn.getAttribute("name")
1586
== "GetManagedObjects"):
1587
for arg in cn.getElementsByTagName("arg"):
1588
if (arg.getAttribute("direction")
1589
== "out"):
1590
arg.setAttribute(
1591
"name",
1592
"objpath_interfaces"
1593
"_and_properties")
1594
xmlstring = document.toxml("utf-8")
1595
document.unlink()
1596
except (AttributeError, xml.dom.DOMException,
1597
xml.parsers.expat.ExpatError) as error:
1598
logger.error("Failed to override Introspection method",
1599
exc_info=error)
1600
return xmlstring
1601
1602
1603
def datetime_to_dbus(dt, variant_level=0):
889
error)
890
return xmlstring
891
892
893
def datetime_to_dbus (dt, variant_level=0):
1604
894
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1605
895
if dt is None:
1606
return dbus.String("", variant_level=variant_level)
1607
return dbus.String(dt.isoformat(), variant_level=variant_level)
1608
1609
1610
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1611
"""A class decorator; applied to a subclass of
1612
dbus.service.Object, it will add alternate D-Bus attributes with
1613
interface names according to the "alt_interface_names" mapping.
1614
Usage:
1615
1616
@alternate_dbus_interfaces({"org.example.Interface":
1617
"net.example.AlternateInterface"})
1618
class SampleDBusObject(dbus.service.Object):
1619
@dbus.service.method("org.example.Interface")
1620
def SampleDBusMethod():
1621
pass
1622
1623
The above "SampleDBusMethod" on "SampleDBusObject" will be
1624
reachable via two interfaces: "org.example.Interface" and
1625
"net.example.AlternateInterface", the latter of which will have
1626
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1627
"true", unless "deprecate" is passed with a False value.
1628
1629
This works for methods and signals, and also for D-Bus properties
1630
(from DBusObjectWithProperties) and interfaces (from the
1631
dbus_interface_annotations decorator).
896
return dbus.String("", variant_level = variant_level)
897
return dbus.String(dt.isoformat(),
898
variant_level=variant_level)
899
900
901
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
902
.__metaclass__):
903
"""Applied to an empty subclass of a D-Bus object, this metaclass
904
will add additional D-Bus attributes matching a certain pattern.
1632
905
"""
1633
1634
def wrapper(cls):
1635
for orig_interface_name, alt_interface_name in (
1636
alt_interface_names.items()):
1637
attr = {}
1638
interface_names = set()
1639
# Go though all attributes of the class
1640
for attrname, attribute in inspect.getmembers(cls):
906
def __new__(mcs, name, bases, attr):
907
# Go through all the base classes which could have D-Bus
908
# methods, signals, or properties in them
909
for base in (b for b in bases
910
if issubclass(b, dbus.service.Object)):
911
# Go though all attributes of the base class
912
for attrname, attribute in inspect.getmembers(base):
1641
913
# Ignore non-D-Bus attributes, and D-Bus attributes
1642
914
# with the wrong interface name
1643
915
if (not hasattr(attribute, "_dbus_interface")
1644
or not attribute._dbus_interface.startswith(
1645
orig_interface_name)):
916
or not attribute._dbus_interface
917
.startswith("se.recompile.Mandos")):
1646
918
continue
1647
919
# Create an alternate D-Bus interface name based on
1648
920
# the current name
1649
alt_interface = attribute._dbus_interface.replace(
1650
orig_interface_name, alt_interface_name)
1651
interface_names.add(alt_interface)
921
alt_interface = (attribute._dbus_interface
922
.replace("se.recompile.Mandos",
923
"se.bsnet.fukt.Mandos"))
1652
924
# Is this a D-Bus signal?
1653
925
if getattr(attribute, "_dbus_is_signal", False):
1654
# Extract the original non-method undecorated
1655
# function by black magic
1656
if sys.version_info.major == 2:
1657
nonmethod_func = (dict(
926
# Extract the original non-method function by
927
# black magic
928
nonmethod_func = (dict(
1658
929
zip(attribute.func_code.co_freevars,
1659
attribute.__closure__))
1660
["func"].cell_contents)
1661
else:
1662
nonmethod_func = (dict(
1663
zip(attribute.__code__.co_freevars,
1664
attribute.__closure__))
1665
["func"].cell_contents)
930
attribute.__closure__))["func"]
931
.cell_contents)
1666
932
# Create a new, but exactly alike, function
1667
933
# object, and decorate it to be a new D-Bus signal
1668
934
# with the alternate D-Bus interface name
1669
new_function = copy_function(nonmethod_func)
1670
new_function = (dbus.service.signal(
1671
alt_interface,
1672
attribute._dbus_signature)(new_function))
1673
# Copy annotations, if any
1674
try:
1675
new_function._dbus_annotations = dict(
1676
attribute._dbus_annotations)
1677
except AttributeError:
1678
pass
1679
935
new_function = (dbus.service.signal
936
(alt_interface,
937
attribute._dbus_signature)
938
(types.FunctionType(
939
nonmethod_func.func_code,
940
nonmethod_func.func_globals,
941
nonmethod_func.func_name,
942
nonmethod_func.func_defaults,
943
nonmethod_func.func_closure)))
1680
944
# Define a creator of a function to call both the
1681
# original and alternate functions, so both the
1682
# original and alternate signals gets sent when
1683
# the function is called
945
# old and new functions, so both the old and new
946
# signals gets sent when the function is called
1684
947
def fixscope(func1, func2):
1685
948
"""This function is a scope container to pass
1686
949
func1 and func2 to the "call_both" function
1687
950
outside of its arguments"""
1688
1689
@functools.wraps(func2)
1690
951
def call_both(*args, **kwargs):
1691
952
"""This function will emit two D-Bus
1692
953
signals by calling func1 and func2"""
1693
954
func1(*args, **kwargs)
1694
955
func2(*args, **kwargs)
1695
# Make wrapper function look like a D-Bus
1696
# signal
1697
for name, attr in inspect.getmembers(func2):
1698
if name.startswith("_dbus_"):
1699
setattr(call_both, name, attr)
1700
1701
956
return call_both
1702
957
# Create the "call_both" function and add it to
1703
958
# the class
1704
attr[attrname] = fixscope(attribute, new_function)
959
attr[attrname] = fixscope(attribute,
960
new_function)
1705
961
# Is this a D-Bus method?
1706
962
elif getattr(attribute, "_dbus_is_method", False):
1707
963
# Create a new, but exactly alike, function
1708
964
# object. Decorate it to be a new D-Bus method
1709
965
# with the alternate D-Bus interface name. Add it
1710
966
# to the class.
1711
attr[attrname] = (
1712
dbus.service.method(
1713
alt_interface,
1714
attribute._dbus_in_signature,
1715
attribute._dbus_out_signature)
1716
(copy_function(attribute)))
1717
# Copy annotations, if any
1718
try:
1719
attr[attrname]._dbus_annotations = dict(
1720
attribute._dbus_annotations)
1721
except AttributeError:
1722
pass
967
attr[attrname] = (dbus.service.method
968
(alt_interface,
969
attribute._dbus_in_signature,
970
attribute._dbus_out_signature)
971
(types.FunctionType
972
(attribute.func_code,
973
attribute.func_globals,
974
attribute.func_name,
975
attribute.func_defaults,
976
attribute.func_closure)))
1723
977
# Is this a D-Bus property?
1724
978
elif getattr(attribute, "_dbus_is_property", False):
1725
979
# Create a new, but exactly alike, function
1726
980
# object, and decorate it to be a new D-Bus
1727
981
# property with the alternate D-Bus interface
1728
982
# name. Add it to the class.
1729
attr[attrname] = (dbus_service_property(
1730
alt_interface, attribute._dbus_signature,
1731
attribute._dbus_access,
1732
attribute._dbus_get_args_options
1733
["byte_arrays"])
1734
(copy_function(attribute)))
1735
# Copy annotations, if any
1736
try:
1737
attr[attrname]._dbus_annotations = dict(
1738
attribute._dbus_annotations)
1739
except AttributeError:
1740
pass
1741
# Is this a D-Bus interface?
1742
elif getattr(attribute, "_dbus_is_interface", False):
1743
# Create a new, but exactly alike, function
1744
# object. Decorate it to be a new D-Bus interface
1745
# with the alternate D-Bus interface name. Add it
1746
# to the class.
1747
attr[attrname] = (
1748
dbus_interface_annotations(alt_interface)
1749
(copy_function(attribute)))
1750
if deprecate:
1751
# Deprecate all alternate interfaces
1752
iname = "_AlternateDBusNames_interface_annotation{}"
1753
for interface_name in interface_names:
1754
1755
@dbus_interface_annotations(interface_name)
1756
def func(self):
1757
return {"org.freedesktop.DBus.Deprecated":
1758
"true"}
1759
# Find an unused name
1760
for aname in (iname.format(i)
1761
for i in itertools.count()):
1762
if aname not in attr:
1763
attr[aname] = func
1764
break
1765
if interface_names:
1766
# Replace the class with a new subclass of it with
1767
# methods, signals, etc. as created above.
1768
if sys.version_info.major == 2:
1769
cls = type(b"{}Alternate".format(cls.__name__),
1770
(cls, ), attr)
1771
else:
1772
cls = type("{}Alternate".format(cls.__name__),
1773
(cls, ), attr)
1774
return cls
1775
1776
return wrapper
1777
1778
1779
@alternate_dbus_interfaces({"se.recompile.Mandos":
1780
"se.bsnet.fukt.Mandos"})
983
attr[attrname] = (dbus_service_property
984
(alt_interface,
985
attribute._dbus_signature,
986
attribute._dbus_access,
987
attribute
988
._dbus_get_args_options
989
["byte_arrays"])
990
(types.FunctionType
991
(attribute.func_code,
992
attribute.func_globals,
993
attribute.func_name,
994
attribute.func_defaults,
995
attribute.func_closure)))
996
return type.__new__(mcs, name, bases, attr)
997
998
1781
999
class ClientDBus(Client, DBusObjectWithProperties):
1782
1000
"""A Client class using D-Bus
1783
1001
1784
1002
Attributes:
1785
1003
dbus_object_path: dbus.ObjectPath
1786
1004
bus: dbus.SystemBus()
1787
1005
"""
1788
1006
1789
1007
runtime_expansions = (Client.runtime_expansions
1790
+ ("dbus_object_path", ))
1791
1792
_interface = "se.recompile.Mandos.Client"
1793
1008
+ ("dbus_object_path",))
1009
1794
1010
# dbus.service.Object doesn't use super(), so we can't either.
1795
1796
def __init__(self, bus=None, *args, **kwargs):
1011
1012
def __init__(self, bus = None, *args, **kwargs):
1797
1013
self.bus = bus
1798
1014
Client.__init__(self, *args, **kwargs)
1015
1016
self._approvals_pending = 0
1799
1017
# Only now, when this client is initialized, can it show up on
1800
1018
# the D-Bus
1801
client_object_name = str(self.name).translate(
1019
client_object_name = unicode(self.name).translate(
1802
1020
{ord("."): ord("_"),
1803
1021
ord("-"): ord("_")})
1804
self.dbus_object_path = dbus.ObjectPath(
1805
"/clients/" + client_object_name)
1022
self.dbus_object_path = (dbus.ObjectPath
1023
("/clients/" + client_object_name))
1806
1024
DBusObjectWithProperties.__init__(self, self.bus,
1807
1025
self.dbus_object_path)
1808
1809
def notifychangeproperty(transform_func, dbus_name,
1810
type_func=lambda x: x,
1811
variant_level=1,
1812
invalidate_only=False,
1813
_interface=_interface):
1026
1027
def notifychangeproperty(transform_func,
1028
dbus_name, type_func=lambda x: x,
1029
variant_level=1):
1814
1030
""" Modify a variable so that it's a property which announces
1815
1031
its changes to DBus.
1816
1032
1817
1033
transform_fun: Function that takes a value and a variant_level
1818
1034
and transforms it to a D-Bus type.
1819
1035
dbus_name: D-Bus name of the variable
1821
1037
to the D-Bus. Default: no transform
1822
1038
variant_level: D-Bus variant level. Default: 1
1823
1039
"""
1824
attrname = "_{}".format(dbus_name)
1825
1040
attrname = "_{0}".format(dbus_name)
1826
1041
def setter(self, value):
1827
1042
if hasattr(self, "dbus_object_path"):
1828
1043
if (not hasattr(self, attrname) or
1829
1044
type_func(getattr(self, attrname, None))
1830
1045
!= type_func(value)):
1831
if invalidate_only:
1832
self.PropertiesChanged(
1833
_interface, dbus.Dictionary(),
1834
dbus.Array((dbus_name, )))
1835
else:
1836
dbus_value = transform_func(
1837
type_func(value),
1838
variant_level=variant_level)
1839
self.PropertyChanged(dbus.String(dbus_name),
1840
dbus_value)
1841
self.PropertiesChanged(
1842
_interface,
1843
dbus.Dictionary({dbus.String(dbus_name):
1844
dbus_value}),
1845
dbus.Array())
1046
dbus_value = transform_func(type_func(value),
1047
variant_level
1048
=variant_level)
1049
self.PropertyChanged(dbus.String(dbus_name),
1050
dbus_value)
1846
1051
setattr(self, attrname, value)
1847
1052
1848
1053
return property(lambda self: getattr(self, attrname), setter)
1849
1054
1055
1850
1056
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1851
1057
approvals_pending = notifychangeproperty(dbus.Boolean,
1852
1058
"ApprovalPending",
1853
type_func=bool)
1059
type_func = bool)
1854
1060
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1855
1061
last_enabled = notifychangeproperty(datetime_to_dbus,
1856
1062
"LastEnabled")
1857
checker = notifychangeproperty(
1858
dbus.Boolean, "CheckerRunning",
1859
type_func=lambda checker: checker is not None)
1063
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1064
type_func = lambda checker:
1065
checker is not None)
1860
1066
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1861
1067
"LastCheckedOK")
1862
last_checker_status = notifychangeproperty(dbus.Int16,
1863
"LastCheckerStatus")
1864
1068
last_approval_request = notifychangeproperty(
1865
1069
datetime_to_dbus, "LastApprovalRequest")
1866
1070
approved_by_default = notifychangeproperty(dbus.Boolean,
1867
1071
"ApprovedByDefault")
1868
approval_delay = notifychangeproperty(
1869
dbus.UInt64, "ApprovalDelay",
1870
type_func=lambda td: td.total_seconds() * 1000)
1072
approval_delay = notifychangeproperty(dbus.UInt16,
1073
"ApprovalDelay",
1074
type_func =
1075
_timedelta_to_milliseconds)
1871
1076
approval_duration = notifychangeproperty(
1872
dbus.UInt64, "ApprovalDuration",
1873
type_func=lambda td: td.total_seconds() * 1000)
1077
dbus.UInt16, "ApprovalDuration",
1078
type_func = _timedelta_to_milliseconds)
1874
1079
host = notifychangeproperty(dbus.String, "Host")
1875
timeout = notifychangeproperty(
1876
dbus.UInt64, "Timeout",
1877
type_func=lambda td: td.total_seconds() * 1000)
1080
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1081
type_func =
1082
_timedelta_to_milliseconds)
1878
1083
extended_timeout = notifychangeproperty(
1879
dbus.UInt64, "ExtendedTimeout",
1880
type_func=lambda td: td.total_seconds() * 1000)
1881
interval = notifychangeproperty(
1882
dbus.UInt64, "Interval",
1883
type_func=lambda td: td.total_seconds() * 1000)
1084
dbus.UInt16, "ExtendedTimeout",
1085
type_func = _timedelta_to_milliseconds)
1086
interval = notifychangeproperty(dbus.UInt16,
1087
"Interval",
1088
type_func =
1089
_timedelta_to_milliseconds)
1884
1090
checker_command = notifychangeproperty(dbus.String, "Checker")
1885
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1886
invalidate_only=True)
1887
1091
1888
1092
del notifychangeproperty
1889
1093
1890
1094
def __del__(self, *args, **kwargs):
1891
1095
try:
1892
1096
self.remove_from_connection()
1895
1099
if hasattr(DBusObjectWithProperties, "__del__"):
1896
1100
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1897
1101
Client.__del__(self, *args, **kwargs)
1898
1899
def checker_callback(self, source, condition,
1900
connection, command, *args, **kwargs):
1901
ret = Client.checker_callback(self, source, condition,
1902
connection, command, *args,
1903
**kwargs)
1904
exitstatus = self.last_checker_status
1905
if exitstatus >= 0:
1102
1103
def checker_callback(self, pid, condition, command,
1104
*args, **kwargs):
1105
self.checker_callback_tag = None
1106
self.checker = None
1107
if os.WIFEXITED(condition):
1108
exitstatus = os.WEXITSTATUS(condition)
1906
1109
# Emit D-Bus signal
1907
1110
self.CheckerCompleted(dbus.Int16(exitstatus),
1908
# This is specific to GNU libC
1909
dbus.Int64(exitstatus << 8),
1111
dbus.Int64(condition),
1910
1112
dbus.String(command))
1911
1113
else:
1912
1114
# Emit D-Bus signal
1913
1115
self.CheckerCompleted(dbus.Int16(-1),
1914
dbus.Int64(
1915
# This is specific to GNU libC
1916
(exitstatus << 8)
1917
| self.last_checker_signal),
1116
dbus.Int64(condition),
1918
1117
dbus.String(command))
1919
return ret
1920
1118
1119
return Client.checker_callback(self, pid, condition, command,
1120
*args, **kwargs)
1121
1921
1122
def start_checker(self, *args, **kwargs):
1922
old_checker_pid = getattr(self.checker, "pid", None)
1123
old_checker = self.checker
1124
if self.checker is not None:
1125
old_checker_pid = self.checker.pid
1126
else:
1127
old_checker_pid = None
1923
1128
r = Client.start_checker(self, *args, **kwargs)
1924
1129
# Only if new checker process was started
1925
1130
if (self.checker is not None
1927
1132
# Emit D-Bus signal
1928
1133
self.CheckerStarted(self.current_checker_command)
1929
1134
return r
1930
1135
1931
1136
def _reset_approved(self):
1932
self.approved = None
1137
self._approved = None
1933
1138
return False
1934
1139
1935
1140
def approve(self, value=True):
1936
self.approved = value
1937
GLib.timeout_add(int(self.approval_duration.total_seconds()
1938
* 1000), self._reset_approved)
1939
1141
self.send_changedstate()
1940
1941
# D-Bus methods, signals & properties
1942
1943
# Interfaces
1944
1945
# Signals
1946
1142
self._approved = value
1143
gobject.timeout_add(_timedelta_to_milliseconds
1144
(self.approval_duration),
1145
self._reset_approved)
1146
1147
1148
## D-Bus methods, signals & properties
1149
_interface = "se.recompile.Mandos.Client"
1150
1151
## Signals
1152
1947
1153
# CheckerCompleted - signal
1948
1154
@dbus.service.signal(_interface, signature="nxs")
1949
1155
def CheckerCompleted(self, exitcode, waitstatus, command):
1950
1156
"D-Bus signal"
1951
1157
pass
1952
1158
1953
1159
# CheckerStarted - signal
1954
1160
@dbus.service.signal(_interface, signature="s")
1955
1161
def CheckerStarted(self, command):
1956
1162
"D-Bus signal"
1957
1163
pass
1958
1164
1959
1165
# PropertyChanged - signal
1960
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1961
1166
@dbus.service.signal(_interface, signature="sv")
1962
1167
def PropertyChanged(self, property, value):
1963
1168
"D-Bus signal"
1964
1169
pass
1965
1170
1966
1171
# GotSecret - signal
1967
1172
@dbus.service.signal(_interface)
1968
1173
def GotSecret(self):
1971
1176
server to mandos-client
1972
1177
"""
1973
1178
pass
1974
1179
1975
1180
# Rejected - signal
1976
1181
@dbus.service.signal(_interface, signature="s")
1977
1182
def Rejected(self, reason):
1978
1183
"D-Bus signal"
1979
1184
pass
1980
1185
1981
1186
# NeedApproval - signal
1982
1187
@dbus.service.signal(_interface, signature="tb")
1983
1188
def NeedApproval(self, timeout, default):
1984
1189
"D-Bus signal"
1985
1190
return self.need_approval()
1986
1987
# Methods
1988
1191
1192
# NeRwequest - signal
1193
@dbus.service.signal(_interface, signature="s")
1194
def NewRequest(self, ip):
1195
"""D-Bus signal
1196
Is sent after a client request a password.
1197
"""
1198
pass
1199
1200
## Methods
1201
1989
1202
# Approve - method
1990
1203
@dbus.service.method(_interface, in_signature="b")
1991
1204
def Approve(self, value):
1992
1205
self.approve(value)
1993
1206
1994
1207
# CheckedOK - method
1995
1208
@dbus.service.method(_interface)
1996
1209
def CheckedOK(self):
1997
1210
self.checked_ok()
1998
1211
1999
1212
# Enable - method
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2001
1213
@dbus.service.method(_interface)
2002
1214
def Enable(self):
2003
1215
"D-Bus method"
2004
1216
self.enable()
2005
1217
2006
1218
# StartChecker - method
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2008
1219
@dbus.service.method(_interface)
2009
1220
def StartChecker(self):
2010
1221
"D-Bus method"
2011
1222
self.start_checker()
2012
1223
2013
1224
# Disable - method
2014
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2015
1225
@dbus.service.method(_interface)
2016
1226
def Disable(self):
2017
1227
"D-Bus method"
2018
1228
self.disable()
2019
1229
2020
1230
# StopChecker - method
2021
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2022
1231
@dbus.service.method(_interface)
2023
1232
def StopChecker(self):
2024
1233
self.stop_checker()
2025
2026
# Properties
2027
1234
1235
## Properties
1236
2028
1237
# ApprovalPending - property
2029
1238
@dbus_service_property(_interface, signature="b", access="read")
2030
1239
def ApprovalPending_dbus_property(self):
2031
1240
return dbus.Boolean(bool(self.approvals_pending))
2032
1241
2033
1242
# ApprovedByDefault - property
2034
@dbus_service_property(_interface,
2035
signature="b",
1243
@dbus_service_property(_interface, signature="b",
2036
1244
access="readwrite")
2037
1245
def ApprovedByDefault_dbus_property(self, value=None):
2038
1246
if value is None: # get
2039
1247
return dbus.Boolean(self.approved_by_default)
2040
1248
self.approved_by_default = bool(value)
2041
1249
2042
1250
# ApprovalDelay - property
2043
@dbus_service_property(_interface,
2044
signature="t",
1251
@dbus_service_property(_interface, signature="t",
2045
1252
access="readwrite")
2046
1253
def ApprovalDelay_dbus_property(self, value=None):
2047
1254
if value is None: # get
2048
return dbus.UInt64(self.approval_delay.total_seconds()
2049
* 1000)
1255
return dbus.UInt64(self.approval_delay_milliseconds())
2050
1256
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2051
1257
2052
1258
# ApprovalDuration - property
2053
@dbus_service_property(_interface,
2054
signature="t",
1259
@dbus_service_property(_interface, signature="t",
2055
1260
access="readwrite")
2056
1261
def ApprovalDuration_dbus_property(self, value=None):
2057
1262
if value is None: # get
2058
return dbus.UInt64(self.approval_duration.total_seconds()
2059
* 1000)
1263
return dbus.UInt64(_timedelta_to_milliseconds(
1264
self.approval_duration))
2060
1265
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2061
1266
2062
1267
# Name - property
2063
@dbus_annotations(
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2065
1268
@dbus_service_property(_interface, signature="s", access="read")
2066
1269
def Name_dbus_property(self):
2067
1270
return dbus.String(self.name)
2068
2069
# KeyID - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2072
@dbus_service_property(_interface, signature="s", access="read")
2073
def KeyID_dbus_property(self):
2074
return dbus.String(self.key_id)
2075
1271
2076
1272
# Fingerprint - property
2077
@dbus_annotations(
2078
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2079
1273
@dbus_service_property(_interface, signature="s", access="read")
2080
1274
def Fingerprint_dbus_property(self):
2081
1275
return dbus.String(self.fingerprint)
2082
1276
2083
1277
# Host - property
2084
@dbus_service_property(_interface,
2085
signature="s",
1278
@dbus_service_property(_interface, signature="s",
2086
1279
access="readwrite")
2087
1280
def Host_dbus_property(self, value=None):
2088
1281
if value is None: # get
2089
1282
return dbus.String(self.host)
2090
self.host = str(value)
2091
1283
self.host = value
1284
2092
1285
# Created - property
2093
@dbus_annotations(
2094
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2095
1286
@dbus_service_property(_interface, signature="s", access="read")
2096
1287
def Created_dbus_property(self):
2097
1288
return datetime_to_dbus(self.created)
2098
1289
2099
1290
# LastEnabled - property
2100
1291
@dbus_service_property(_interface, signature="s", access="read")
2101
1292
def LastEnabled_dbus_property(self):
2102
1293
return datetime_to_dbus(self.last_enabled)
2103
1294
2104
1295
# Enabled - property
2105
@dbus_service_property(_interface,
2106
signature="b",
1296
@dbus_service_property(_interface, signature="b",
2107
1297
access="readwrite")
2108
1298
def Enabled_dbus_property(self, value=None):
2109
1299
if value is None: # get
2112
1302
self.enable()
2113
1303
else:
2114
1304
self.disable()
2115
1305
2116
1306
# LastCheckedOK - property
2117
@dbus_service_property(_interface,
2118
signature="s",
1307
@dbus_service_property(_interface, signature="s",
2119
1308
access="readwrite")
2120
1309
def LastCheckedOK_dbus_property(self, value=None):
2121
1310
if value is not None:
2122
1311
self.checked_ok()
2123
1312
return
2124
1313
return datetime_to_dbus(self.last_checked_ok)
2125
2126
# LastCheckerStatus - property
2127
@dbus_service_property(_interface, signature="n", access="read")
2128
def LastCheckerStatus_dbus_property(self):
2129
return dbus.Int16(self.last_checker_status)
2130
1314
2131
1315
# Expires - property
2132
1316
@dbus_service_property(_interface, signature="s", access="read")
2133
1317
def Expires_dbus_property(self):
2134
1318
return datetime_to_dbus(self.expires)
2135
1319
2136
1320
# LastApprovalRequest - property
2137
1321
@dbus_service_property(_interface, signature="s", access="read")
2138
1322
def LastApprovalRequest_dbus_property(self):
2139
1323
return datetime_to_dbus(self.last_approval_request)
2140
1324
2141
1325
# Timeout - property
2142
@dbus_service_property(_interface,
2143
signature="t",
1326
@dbus_service_property(_interface, signature="t",
2144
1327
access="readwrite")
2145
1328
def Timeout_dbus_property(self, value=None):
2146
1329
if value is None: # get
2147
return dbus.UInt64(self.timeout.total_seconds() * 1000)
2148
old_timeout = self.timeout
1330
return dbus.UInt64(self.timeout_milliseconds())
2149
1331
self.timeout = datetime.timedelta(0, 0, 0, value)
2150
# Reschedule disabling
2151
if self.enabled:
2152
now = datetime.datetime.utcnow()
2153
self.expires += self.timeout - old_timeout
2154
if self.expires <= now:
2155
# The timeout has passed
2156
self.disable()
2157
else:
2158
if (getattr(self, "disable_initiator_tag", None)
2159
is None):
2160
return
2161
GLib.source_remove(self.disable_initiator_tag)
2162
self.disable_initiator_tag = GLib.timeout_add(
2163
int((self.expires - now).total_seconds() * 1000),
2164
self.disable)
2165
1332
if getattr(self, "disable_initiator_tag", None) is None:
1333
return
1334
# Reschedule timeout
1335
gobject.source_remove(self.disable_initiator_tag)
1336
self.disable_initiator_tag = None
1337
self.expires = None
1338
time_to_die = _timedelta_to_milliseconds((self
1339
.last_checked_ok
1340
+ self.timeout)
1341
- datetime.datetime
1342
.utcnow())
1343
if time_to_die <= 0:
1344
# The timeout has passed
1345
self.disable()
1346
else:
1347
self.expires = (datetime.datetime.utcnow()
1348
+ datetime.timedelta(milliseconds =
1349
time_to_die))
1350
self.disable_initiator_tag = (gobject.timeout_add
1351
(time_to_die, self.disable))
1352
2166
1353
# ExtendedTimeout - property
2167
@dbus_service_property(_interface,
2168
signature="t",
1354
@dbus_service_property(_interface, signature="t",
2169
1355
access="readwrite")
2170
1356
def ExtendedTimeout_dbus_property(self, value=None):
2171
1357
if value is None: # get
2172
return dbus.UInt64(self.extended_timeout.total_seconds()
2173
* 1000)
1358
return dbus.UInt64(self.extended_timeout_milliseconds())
2174
1359
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2175
1360
2176
1361
# Interval - property
2177
@dbus_service_property(_interface,
2178
signature="t",
1362
@dbus_service_property(_interface, signature="t",
2179
1363
access="readwrite")
2180
1364
def Interval_dbus_property(self, value=None):
2181
1365
if value is None: # get
2182
return dbus.UInt64(self.interval.total_seconds() * 1000)
1366
return dbus.UInt64(self.interval_milliseconds())
2183
1367
self.interval = datetime.timedelta(0, 0, 0, value)
2184
1368
if getattr(self, "checker_initiator_tag", None) is None:
2185
1369
return
2186
1370
if self.enabled:
2187
1371
# Reschedule checker run
2188
GLib.source_remove(self.checker_initiator_tag)
2189
self.checker_initiator_tag = GLib.timeout_add(
2190
value, self.start_checker)
2191
self.start_checker() # Start one now, too
2192
1372
gobject.source_remove(self.checker_initiator_tag)
1373
self.checker_initiator_tag = (gobject.timeout_add
1374
(value, self.start_checker))
1375
self.start_checker() # Start one now, too
1376
2193
1377
# Checker - property
2194
@dbus_service_property(_interface,
2195
signature="s",
1378
@dbus_service_property(_interface, signature="s",
2196
1379
access="readwrite")
2197
1380
def Checker_dbus_property(self, value=None):
2198
1381
if value is None: # get
2199
1382
return dbus.String(self.checker_command)
2200
self.checker_command = str(value)
2201
1383
self.checker_command = value
1384
2202
1385
# CheckerRunning - property
2203
@dbus_service_property(_interface,
2204
signature="b",
1386
@dbus_service_property(_interface, signature="b",
2205
1387
access="readwrite")
2206
1388
def CheckerRunning_dbus_property(self, value=None):
2207
1389
if value is None: # get
2210
1392
self.start_checker()
2211
1393
else:
2212
1394
self.stop_checker()
2213
1395
2214
1396
# ObjectPath - property
2215
@dbus_annotations(
2216
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2217
"org.freedesktop.DBus.Deprecated": "true"})
2218
1397
@dbus_service_property(_interface, signature="o", access="read")
2219
1398
def ObjectPath_dbus_property(self):
2220
return self.dbus_object_path # is already a dbus.ObjectPath
2221
1399
return self.dbus_object_path # is already a dbus.ObjectPath
1400
2222
1401
# Secret = property
2223
@dbus_annotations(
2224
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2225
"invalidates"})
2226
@dbus_service_property(_interface,
2227
signature="ay",
2228
access="write",
2229
byte_arrays=True)
1402
@dbus_service_property(_interface, signature="ay",
1403
access="write", byte_arrays=True)
2230
1404
def Secret_dbus_property(self, value):
2231
self.secret = bytes(value)
2232
1405
self.secret = str(value)
1406
2233
1407
del _interface
2234
1408
2235
1409
2236
class ProxyClient:
2237
def __init__(self, child_pipe, key_id, fpr, address):
1410
class ProxyClient(object):
1411
def __init__(self, child_pipe, fpr, address):
2238
1412
self._pipe = child_pipe
2239
self._pipe.send(('init', key_id, fpr, address))
1413
self._pipe.send(('init', fpr, address))
2240
1414
if not self._pipe.recv():
2241
raise KeyError(key_id or fpr)
2242
1415
raise KeyError()
1416
2243
1417
def __getattribute__(self, name):
2244
if name == '_pipe':
1418
if(name == '_pipe'):
2245
1419
return super(ProxyClient, self).__getattribute__(name)
2246
1420
self._pipe.send(('getattr', name))
2247
1421
data = self._pipe.recv()
2248
1422
if data[0] == 'data':
2249
1423
return data[1]
2250
1424
if data[0] == 'function':
2251
2252
1425
def func(*args, **kwargs):
2253
1426
self._pipe.send(('funcall', name, args, kwargs))
2254
1427
return self._pipe.recv()[1]
2255
2256
1428
return func
2257
1429
2258
1430
def __setattr__(self, name, value):
2259
if name == '_pipe':
1431
if(name == '_pipe'):
2260
1432
return super(ProxyClient, self).__setattr__(name, value)
2261
1433
self._pipe.send(('setattr', name, value))
2262
1434
2263
1435
1436
class ClientDBusTransitional(ClientDBus):
1437
__metaclass__ = AlternateDBusNamesMetaclass
1438
1439
2264
1440
class ClientHandler(socketserver.BaseRequestHandler, object):
2265
1441
"""A class to handle client connections.
2266
1442
2267
1443
Instantiated once for each connection to handle it.
2268
1444
Note: This will run in its own forked process."""
2269
1445
2270
1446
def handle(self):
2271
1447
with contextlib.closing(self.server.child_pipe) as child_pipe:
2272
1448
logger.info("TCP connection from: %s",
2273
str(self.client_address))
1449
unicode(self.client_address))
2274
1450
logger.debug("Pipe FD: %d",
2275
1451
self.server.child_pipe.fileno())
2276
2277
session = gnutls.ClientSession(self.request)
2278
2279
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2280
# "+AES-256-CBC", "+SHA1",
2281
# "+COMP-NULL", "+CTYPE-OPENPGP",
2282
# "+DHE-DSS"))
1452
1453
session = (gnutls.connection
1454
.ClientSession(self.request,
1455
gnutls.connection
1456
.X509Credentials()))
1457
1458
# Note: gnutls.connection.X509Credentials is really a
1459
# generic GnuTLS certificate credentials object so long as
1460
# no X.509 keys are added to it. Therefore, we can use it
1461
# here despite using OpenPGP certificates.
1462
1463
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1464
# "+AES-256-CBC", "+SHA1",
1465
# "+COMP-NULL", "+CTYPE-OPENPGP",
1466
# "+DHE-DSS"))
2283
1467
# Use a fallback default, since this MUST be set.
2284
1468
priority = self.server.gnutls_priority
2285
1469
if priority is None:
2286
1470
priority = "NORMAL"
2287
gnutls.priority_set_direct(session._c_object,
2288
priority.encode("utf-8"),
2289
None)
2290
1471
(gnutls.library.functions
1472
.gnutls_priority_set_direct(session._c_object,
1473
priority, None))
1474
2291
1475
# Start communication using the Mandos protocol
2292
1476
# Get protocol number
2293
1477
line = self.request.makefile().readline()
2294
1478
logger.debug("Protocol version: %r", line)
2295
1479
try:
2296
1480
if int(line.strip().split()[0]) > 1:
2297
raise RuntimeError(line)
1481
raise RuntimeError
2298
1482
except (ValueError, IndexError, RuntimeError) as error:
2299
1483
logger.error("Unknown protocol version: %s", error)
2300
1484
return
2301
1485
2302
1486
# Start GnuTLS connection
2303
1487
try:
2304
1488
session.handshake()
2305
except gnutls.Error as error:
1489
except gnutls.errors.GNUTLSError as error:
2306
1490
logger.warning("Handshake failed: %s", error)
2307
1491
# Do not run session.bye() here: the session is not
2308
1492
# established. Just abandon the request.
2309
1493
return
2310
1494
logger.debug("Handshake succeeded")
2311
1495
2312
1496
approval_required = False
2313
1497
try:
2314
if gnutls.has_rawpk:
2315
fpr = b""
2316
try:
2317
key_id = self.key_id(
2318
self.peer_certificate(session))
2319
except (TypeError, gnutls.Error) as error:
2320
logger.warning("Bad certificate: %s", error)
2321
return
2322
logger.debug("Key ID: %s", key_id)
2323
2324
else:
2325
key_id = b""
2326
try:
2327
fpr = self.fingerprint(
2328
self.peer_certificate(session))
2329
except (TypeError, gnutls.Error) as error:
2330
logger.warning("Bad certificate: %s", error)
2331
return
2332
logger.debug("Fingerprint: %s", fpr)
2333
2334
try:
2335
client = ProxyClient(child_pipe, key_id, fpr,
1498
try:
1499
fpr = self.fingerprint(self.peer_certificate
1500
(session))
1501
except (TypeError,
1502
gnutls.errors.GNUTLSError) as error:
1503
logger.warning("Bad certificate: %s", error)
1504
return
1505
logger.debug("Fingerprint: %s", fpr)
1506
if self.server.use_dbus:
1507
# Emit D-Bus signal
1508
client.NewRequest(str(self.client_address))
1509
1510
try:
1511
client = ProxyClient(child_pipe, fpr,
2336
1512
self.client_address)
2337
1513
except KeyError:
2338
1514
return
2339
1515
2340
1516
if client.approval_delay:
2341
1517
delay = client.approval_delay
2342
1518
client.approvals_pending += 1
2343
1519
approval_required = True
2344
1520
2345
1521
while True:
2346
1522
if not client.enabled:
2347
1523
logger.info("Client %s is disabled",
2348
client.name)
1524
client.name)
2349
1525
if self.server.use_dbus:
2350
1526
# Emit D-Bus signal
2351
1527
client.Rejected("Disabled")
2352
1528
return
2353
2354
if client.approved or not client.approval_delay:
2355
# We are approved or approval is disabled
1529
1530
if client._approved or not client.approval_delay:
1531
#We are approved or approval is disabled
2356
1532
break
2357
elif client.approved is None:
1533
elif client._approved is None:
2358
1534
logger.info("Client %s needs approval",
2359
1535
client.name)
2360
1536
if self.server.use_dbus:
2361
1537
# Emit D-Bus signal
2362
1538
client.NeedApproval(
2363
client.approval_delay.total_seconds()
2364
* 1000, client.approved_by_default)
1539
client.approval_delay_milliseconds(),
1540
client.approved_by_default)
2365
1541
else:
2366
1542
logger.warning("Client %s was not approved",
2367
1543
client.name)
2369
1545
# Emit D-Bus signal
2370
1546
client.Rejected("Denied")
2371
1547
return
2372
2373
# wait until timeout or approved
1548
1549
#wait until timeout or approved
2374
1550
time = datetime.datetime.now()
2375
1551
client.changedstate.acquire()
2376
client.changedstate.wait(delay.total_seconds())
1552
(client.changedstate.wait
1553
(float(client._timedelta_to_milliseconds(delay)
1554
/ 1000)))
2377
1555
client.changedstate.release()
2378
1556
time2 = datetime.datetime.now()
2379
1557
if (time2 - time) >= delay:
2389
1567
break
2390
1568
else:
2391
1569
delay -= time2 - time
2392
2393
try:
2394
session.send(client.secret)
2395
except gnutls.Error as error:
2396
logger.warning("gnutls send failed",
2397
exc_info=error)
2398
return
2399
1570
1571
sent_size = 0
1572
while sent_size < len(client.secret):
1573
try:
1574
sent = session.send(client.secret[sent_size:])
1575
except gnutls.errors.GNUTLSError as error:
1576
logger.warning("gnutls send failed")
1577
return
1578
logger.debug("Sent: %d, remaining: %d",
1579
sent, len(client.secret)
1580
- (sent_size + sent))
1581
sent_size += sent
1582
2400
1583
logger.info("Sending secret to %s", client.name)
2401
1584
# bump the timeout using extended_timeout
2402
client.bump_timeout(client.extended_timeout)
1585
client.checked_ok(client.extended_timeout)
2403
1586
if self.server.use_dbus:
2404
1587
# Emit D-Bus signal
2405
1588
client.GotSecret()
2406
1589
2407
1590
finally:
2408
1591
if approval_required:
2409
1592
client.approvals_pending -= 1
2410
1593
try:
2411
1594
session.bye()
2412
except gnutls.Error as error:
2413
logger.warning("GnuTLS bye failed",
2414
exc_info=error)
2415
1595
except gnutls.errors.GNUTLSError as error:
1596
logger.warning("GnuTLS bye failed")
1597
2416
1598
@staticmethod
2417
1599
def peer_certificate(session):
2418
"Return the peer's certificate as a bytestring"
2419
try:
2420
cert_type = gnutls.certificate_type_get2(session._c_object,
2421
gnutls.CTYPE_PEERS)
2422
except AttributeError:
2423
cert_type = gnutls.certificate_type_get(session._c_object)
2424
if gnutls.has_rawpk:
2425
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2426
else:
2427
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2428
# If not a valid certificate type...
2429
if cert_type not in valid_cert_types:
2430
logger.info("Cert type %r not in %r", cert_type,
2431
valid_cert_types)
2432
# ...return invalid data
2433
return b""
1600
"Return the peer's OpenPGP certificate as a bytestring"
1601
# If not an OpenPGP certificate...
1602
if (gnutls.library.functions
1603
.gnutls_certificate_type_get(session._c_object)
1604
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1605
# ...do the normal thing
1606
return session.peer_certificate
2434
1607
list_size = ctypes.c_uint(1)
2435
cert_list = (gnutls.certificate_get_peers
1608
cert_list = (gnutls.library.functions
1609
.gnutls_certificate_get_peers
2436
1610
(session._c_object, ctypes.byref(list_size)))
2437
1611
if not bool(cert_list) and list_size.value != 0:
2438
raise gnutls.Error("error getting peer certificate")
1612
raise gnutls.errors.GNUTLSError("error getting peer"
1613
" certificate")
2439
1614
if list_size.value == 0:
2440
1615
return None
2441
1616
cert = cert_list[0]
2442
1617
return ctypes.string_at(cert.data, cert.size)
2443
2444
@staticmethod
2445
def key_id(certificate):
2446
"Convert a certificate bytestring to a hexdigit key ID"
2447
# New GnuTLS "datum" with the public key
2448
datum = gnutls.datum_t(
2449
ctypes.cast(ctypes.c_char_p(certificate),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.c_uint(len(certificate)))
2452
# XXX all these need to be created in the gnutls "module"
2453
# New empty GnuTLS certificate
2454
pubkey = gnutls.pubkey_t()
2455
gnutls.pubkey_init(ctypes.byref(pubkey))
2456
# Import the raw public key into the certificate
2457
gnutls.pubkey_import(pubkey,
2458
ctypes.byref(datum),
2459
gnutls.X509_FMT_DER)
2460
# New buffer for the key ID
2461
buf = ctypes.create_string_buffer(32)
2462
buf_len = ctypes.c_size_t(len(buf))
2463
# Get the key ID from the raw public key into the buffer
2464
gnutls.pubkey_get_key_id(pubkey,
2465
gnutls.KEYID_USE_SHA256,
2466
ctypes.cast(ctypes.byref(buf),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.byref(buf_len))
2469
# Deinit the certificate
2470
gnutls.pubkey_deinit(pubkey)
2471
2472
# Convert the buffer to a Python bytestring
2473
key_id = ctypes.string_at(buf, buf_len.value)
2474
# Convert the bytestring to hexadecimal notation
2475
hex_key_id = binascii.hexlify(key_id).upper()
2476
return hex_key_id
2477
1618
2478
1619
@staticmethod
2479
1620
def fingerprint(openpgp):
2480
1621
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2481
1622
# New GnuTLS "datum" with the OpenPGP public key
2482
datum = gnutls.datum_t(
2483
ctypes.cast(ctypes.c_char_p(openpgp),
2484
ctypes.POINTER(ctypes.c_ubyte)),
2485
ctypes.c_uint(len(openpgp)))
1623
datum = (gnutls.library.types
1624
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1625
ctypes.POINTER
1626
(ctypes.c_ubyte)),
1627
ctypes.c_uint(len(openpgp))))
2486
1628
# New empty GnuTLS certificate
2487
crt = gnutls.openpgp_crt_t()
2488
gnutls.openpgp_crt_init(ctypes.byref(crt))
1629
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1630
(gnutls.library.functions
1631
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2489
1632
# Import the OpenPGP public key into the certificate
2490
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2491
gnutls.OPENPGP_FMT_RAW)
1633
(gnutls.library.functions
1634
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1635
gnutls.library.constants
1636
.GNUTLS_OPENPGP_FMT_RAW))
2492
1637
# Verify the self signature in the key
2493
1638
crtverify = ctypes.c_uint()
2494
gnutls.openpgp_crt_verify_self(crt, 0,
2495
ctypes.byref(crtverify))
1639
(gnutls.library.functions
1640
.gnutls_openpgp_crt_verify_self(crt, 0,
1641
ctypes.byref(crtverify)))
2496
1642
if crtverify.value != 0:
2497
gnutls.openpgp_crt_deinit(crt)
2498
raise gnutls.CertificateSecurityError(code
2499
=crtverify.value)
1643
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1644
raise (gnutls.errors.CertificateSecurityError
1645
("Verify failed"))
2500
1646
# New buffer for the fingerprint
2501
1647
buf = ctypes.create_string_buffer(20)
2502
1648
buf_len = ctypes.c_size_t()
2503
1649
# Get the fingerprint from the certificate into the buffer
2504
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2505
ctypes.byref(buf_len))
1650
(gnutls.library.functions
1651
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1652
ctypes.byref(buf_len)))
2506
1653
# Deinit the certificate
2507
gnutls.openpgp_crt_deinit(crt)
1654
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2508
1655
# Convert the buffer to a Python bytestring
2509
1656
fpr = ctypes.string_at(buf, buf_len.value)
2510
1657
# Convert the bytestring to hexadecimal notation
2512
1659
return hex_fpr
2513
1660
2514
1661
2515
class MultiprocessingMixIn:
1662
class MultiprocessingMixIn(object):
2516
1663
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2517
2518
1664
def sub_process_main(self, request, address):
2519
1665
try:
2520
1666
self.finish_request(request, address)
2521
except Exception:
1667
except:
2522
1668
self.handle_error(request, address)
2523
1669
self.close_request(request)
2524
1670
2525
1671
def process_request(self, request, address):
2526
1672
"""Start a new process to process the request."""
2527
proc = multiprocessing.Process(target=self.sub_process_main,
2528
args=(request, address))
1673
proc = multiprocessing.Process(target = self.sub_process_main,
1674
args = (request,
1675
address))
2529
1676
proc.start()
2530
1677
return proc
2531
1678
2532
1679
2533
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1680
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2534
1681
""" adds a pipe to the MixIn """
2535
2536
1682
def process_request(self, request, client_address):
2537
1683
"""Overrides and wraps the original process_request().
2538
1684
2539
1685
This function creates a new pipe in self.pipe
2540
1686
"""
2541
1687
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2542
1688
2543
1689
proc = MultiprocessingMixIn.process_request(self, request,
2544
1690
client_address)
2545
1691
self.child_pipe.close()
2546
1692
self.add_pipe(parent_pipe, proc)
2547
1693
2548
1694
def add_pipe(self, parent_pipe, proc):
2549
1695
"""Dummy function; override as necessary"""
2550
raise NotImplementedError()
1696
raise NotImplementedError
2551
1697
2552
1698
2553
1699
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2554
socketserver.TCPServer):
1700
socketserver.TCPServer, object):
2555
1701
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2556
1702
2557
1703
Attributes:
2558
1704
enabled: Boolean; whether this server is activated yet
2559
1705
interface: None or a network interface name (string)
2560
1706
use_ipv6: Boolean; to use IPv6 or not
2561
1707
"""
2562
2563
1708
def __init__(self, server_address, RequestHandlerClass,
2564
interface=None,
2565
use_ipv6=True,
2566
socketfd=None):
2567
"""If socketfd is set, use that file descriptor instead of
2568
creating a new one with socket.socket().
2569
"""
1709
interface=None, use_ipv6=True):
2570
1710
self.interface = interface
2571
1711
if use_ipv6:
2572
1712
self.address_family = socket.AF_INET6
2573
if socketfd is not None:
2574
# Save the file descriptor
2575
self.socketfd = socketfd
2576
# Save the original socket.socket() function
2577
self.socket_socket = socket.socket
2578
2579
# To implement --socket, we monkey patch socket.socket.
2580
#
2581
# (When socketserver.TCPServer is a new-style class, we
2582
# could make self.socket into a property instead of monkey
2583
# patching socket.socket.)
2584
#
2585
# Create a one-time-only replacement for socket.socket()
2586
@functools.wraps(socket.socket)
2587
def socket_wrapper(*args, **kwargs):
2588
# Restore original function so subsequent calls are
2589
# not affected.
2590
socket.socket = self.socket_socket
2591
del self.socket_socket
2592
# This time only, return a new socket object from the
2593
# saved file descriptor.
2594
return socket.fromfd(self.socketfd, *args, **kwargs)
2595
# Replace socket.socket() function with wrapper
2596
socket.socket = socket_wrapper
2597
# The socketserver.TCPServer.__init__ will call
2598
# socket.socket(), which might be our replacement,
2599
# socket_wrapper(), if socketfd was set.
2600
1713
socketserver.TCPServer.__init__(self, server_address,
2601
1714
RequestHandlerClass)
2602
2603
1715
def server_bind(self):
2604
1716
"""This overrides the normal server_bind() function
2605
1717
to bind to an interface if one was specified, and also NOT to
2606
1718
bind to an address or port if they were not specified."""
2607
global SO_BINDTODEVICE
2608
1719
if self.interface is not None:
2609
1720
if SO_BINDTODEVICE is None:
2610
# Fall back to a hard-coded value which seems to be
2611
# common enough.
2612
logger.warning("SO_BINDTODEVICE not found, trying 25")
2613
SO_BINDTODEVICE = 25
2614
try:
2615
self.socket.setsockopt(
2616
socket.SOL_SOCKET, SO_BINDTODEVICE,
2617
(self.interface + "\0").encode("utf-8"))
2618
except socket.error as error:
2619
if error.errno == errno.EPERM:
2620
logger.error("No permission to bind to"
2621
" interface %s", self.interface)
2622
elif error.errno == errno.ENOPROTOOPT:
2623
logger.error("SO_BINDTODEVICE not available;"
2624
" cannot bind to interface %s",
2625
self.interface)
2626
elif error.errno == errno.ENODEV:
2627
logger.error("Interface %s does not exist,"
2628
" cannot bind", self.interface)
2629
else:
2630
raise
1721
logger.error("SO_BINDTODEVICE does not exist;"
1722
" cannot bind to interface %s",
1723
self.interface)
1724
else:
1725
try:
1726
self.socket.setsockopt(socket.SOL_SOCKET,
1727
SO_BINDTODEVICE,
1728
str(self.interface
1729
+ '\0'))
1730
except socket.error as error:
1731
if error[0] == errno.EPERM:
1732
logger.error("No permission to"
1733
" bind to interface %s",
1734
self.interface)
1735
elif error[0] == errno.ENOPROTOOPT:
1736
logger.error("SO_BINDTODEVICE not available;"
1737
" cannot bind to interface %s",
1738
self.interface)
1739
else:
1740
raise
2631
1741
# Only bind(2) the socket if we really need to.
2632
1742
if self.server_address[0] or self.server_address[1]:
2633
if self.server_address[1]:
2634
self.allow_reuse_address = True
2635
1743
if not self.server_address[0]:
2636
1744
if self.address_family == socket.AF_INET6:
2637
any_address = "::" # in6addr_any
1745
any_address = "::" # in6addr_any
2638
1746
else:
2639
any_address = "0.0.0.0" # INADDR_ANY
1747
any_address = socket.INADDR_ANY
2640
1748
self.server_address = (any_address,
2641
1749
self.server_address[1])
2642
1750
elif not self.server_address[1]:
2643
self.server_address = (self.server_address[0], 0)
1751
self.server_address = (self.server_address[0],
1752
0)
2644
1753
# if self.interface:
2645
1754
# self.server_address = (self.server_address[0],
2646
1755
# 0, # port
2652
1761
2653
1762
class MandosServer(IPv6_TCPServer):
2654
1763
"""Mandos server.
2655
1764
2656
1765
Attributes:
2657
1766
clients: set of Client objects
2658
1767
gnutls_priority GnuTLS priority string
2659
1768
use_dbus: Boolean; to emit D-Bus signals or not
2660
2661
Assumes a GLib.MainLoop event loop.
1769
1770
Assumes a gobject.MainLoop event loop.
2662
1771
"""
2663
2664
1772
def __init__(self, server_address, RequestHandlerClass,
2665
interface=None,
2666
use_ipv6=True,
2667
clients=None,
2668
gnutls_priority=None,
2669
use_dbus=True,
2670
socketfd=None):
1773
interface=None, use_ipv6=True, clients=None,
1774
gnutls_priority=None, use_dbus=True):
2671
1775
self.enabled = False
2672
1776
self.clients = clients
2673
1777
if self.clients is None:
2676
1780
self.gnutls_priority = gnutls_priority
2677
1781
IPv6_TCPServer.__init__(self, server_address,
2678
1782
RequestHandlerClass,
2679
interface=interface,
2680
use_ipv6=use_ipv6,
2681
socketfd=socketfd)
2682
1783
interface = interface,
1784
use_ipv6 = use_ipv6)
2683
1785
def server_activate(self):
2684
1786
if self.enabled:
2685
1787
return socketserver.TCPServer.server_activate(self)
2686
1788
2687
1789
def enable(self):
2688
1790
self.enabled = True
2689
1791
2690
1792
def add_pipe(self, parent_pipe, proc):
2691
1793
# Call "handle_ipc" for both data and EOF events
2692
GLib.io_add_watch(
2693
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2694
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2695
functools.partial(self.handle_ipc,
2696
parent_pipe=parent_pipe,
2697
proc=proc))
2698
2699
def handle_ipc(self, source, condition,
2700
parent_pipe=None,
2701
proc=None,
2702
client_object=None):
1794
gobject.io_add_watch(parent_pipe.fileno(),
1795
gobject.IO_IN | gobject.IO_HUP,
1796
functools.partial(self.handle_ipc,
1797
parent_pipe =
1798
parent_pipe,
1799
proc = proc))
1800
1801
def handle_ipc(self, source, condition, parent_pipe=None,
1802
proc = None, client_object=None):
1803
condition_names = {
1804
gobject.IO_IN: "IN", # There is data to read.
1805
gobject.IO_OUT: "OUT", # Data can be written (without
1806
# blocking).
1807
gobject.IO_PRI: "PRI", # There is urgent data to read.
1808
gobject.IO_ERR: "ERR", # Error condition.
1809
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1810
# broken, usually for pipes and
1811
# sockets).
1812
}
1813
conditions_string = ' | '.join(name
1814
for cond, name in
1815
condition_names.iteritems()
1816
if cond & condition)
2703
1817
# error, or the other end of multiprocessing.Pipe has closed
2704
if condition & (GLib.IO_ERR | GLib.IO_HUP):
1818
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2705
1819
# Wait for other process to exit
2706
1820
proc.join()
2707
1821
return False
2708
1822
2709
1823
# Read a request from the child
2710
1824
request = parent_pipe.recv()
2711
1825
command = request[0]
2712
1826
2713
1827
if command == 'init':
2714
key_id = request[1].decode("ascii")
2715
fpr = request[2].decode("ascii")
2716
address = request[3]
2717
2718
for c in self.clients.values():
2719
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2720
continue
2721
if key_id and c.key_id == key_id:
2722
client = c
2723
break
2724
if fpr and c.fingerprint == fpr:
1828
fpr = request[1]
1829
address = request[2]
1830
1831
for c in self.clients.itervalues():
1832
if c.fingerprint == fpr:
2725
1833
client = c
2726
1834
break
2727
1835
else:
2728
logger.info("Client not found for key ID: %s, address"
2729
": %s", key_id or fpr, address)
1836
logger.info("Client not found for fingerprint: %s, ad"
1837
"dress: %s", fpr, address)
2730
1838
if self.use_dbus:
2731
1839
# Emit D-Bus signal
2732
mandos_dbus_service.ClientNotFound(key_id or fpr,
1840
mandos_dbus_service.ClientNotFound(fpr,
2733
1841
address[0])
2734
1842
parent_pipe.send(False)
2735
1843
return False
2736
2737
GLib.io_add_watch(
2738
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2739
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2740
functools.partial(self.handle_ipc,
2741
parent_pipe=parent_pipe,
2742
proc=proc,
2743
client_object=client))
1844
1845
gobject.io_add_watch(parent_pipe.fileno(),
1846
gobject.IO_IN | gobject.IO_HUP,
1847
functools.partial(self.handle_ipc,
1848
parent_pipe =
1849
parent_pipe,
1850
proc = proc,
1851
client_object =
1852
client))
2744
1853
parent_pipe.send(True)
2745
1854
# remove the old hook in favor of the new above hook on
2746
1855
# same fileno
2749
1858
funcname = request[1]
2750
1859
args = request[2]
2751
1860
kwargs = request[3]
2752
1861
2753
1862
parent_pipe.send(('data', getattr(client_object,
2754
1863
funcname)(*args,
2755
**kwargs)))
2756
1864
**kwargs)))
1865
2757
1866
if command == 'getattr':
2758
1867
attrname = request[1]
2759
if isinstance(client_object.__getattribute__(attrname),
2760
collections.abc.Callable):
2761
parent_pipe.send(('function', ))
1868
if callable(client_object.__getattribute__(attrname)):
1869
parent_pipe.send(('function',))
2762
1870
else:
2763
parent_pipe.send((
2764
'data', client_object.__getattribute__(attrname)))
2765
1871
parent_pipe.send(('data', client_object
1872
.__getattribute__(attrname)))
1873
2766
1874
if command == 'setattr':
2767
1875
attrname = request[1]
2768
1876
value = request[2]
2769
1877
setattr(client_object, attrname, value)
2770
1878
2771
1879
return True
2772
1880
2773
1881
2774
def rfc3339_duration_to_delta(duration):
2775
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2776
2777
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2780
True
2781
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2782
True
2783
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2784
True
2785
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2786
True
2787
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2788
True
2789
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2790
True
2791
"""
2792
2793
# Parsing an RFC 3339 duration with regular expressions is not
2794
# possible - there would have to be multiple places for the same
2795
# values, like seconds. The current code, while more esoteric, is
2796
# cleaner without depending on a parsing library. If Python had a
2797
# built-in library for parsing we would use it, but we'd like to
2798
# avoid excessive use of external libraries.
2799
2800
# New type for defining tokens, syntax, and semantics all-in-one
2801
Token = collections.namedtuple("Token", (
2802
"regexp", # To match token; if "value" is not None, must have
2803
# a "group" containing digits
2804
"value", # datetime.timedelta or None
2805
"followers")) # Tokens valid after this token
2806
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2807
# the "duration" ABNF definition in RFC 3339, Appendix A.
2808
token_end = Token(re.compile(r"$"), None, frozenset())
2809
token_second = Token(re.compile(r"(\d+)S"),
2810
datetime.timedelta(seconds=1),
2811
frozenset((token_end, )))
2812
token_minute = Token(re.compile(r"(\d+)M"),
2813
datetime.timedelta(minutes=1),
2814
frozenset((token_second, token_end)))
2815
token_hour = Token(re.compile(r"(\d+)H"),
2816
datetime.timedelta(hours=1),
2817
frozenset((token_minute, token_end)))
2818
token_time = Token(re.compile(r"T"),
2819
None,
2820
frozenset((token_hour, token_minute,
2821
token_second)))
2822
token_day = Token(re.compile(r"(\d+)D"),
2823
datetime.timedelta(days=1),
2824
frozenset((token_time, token_end)))
2825
token_month = Token(re.compile(r"(\d+)M"),
2826
datetime.timedelta(weeks=4),
2827
frozenset((token_day, token_end)))
2828
token_year = Token(re.compile(r"(\d+)Y"),
2829
datetime.timedelta(weeks=52),
2830
frozenset((token_month, token_end)))
2831
token_week = Token(re.compile(r"(\d+)W"),
2832
datetime.timedelta(weeks=1),
2833
frozenset((token_end, )))
2834
token_duration = Token(re.compile(r"P"), None,
2835
frozenset((token_year, token_month,
2836
token_day, token_time,
2837
token_week)))
2838
# Define starting values:
2839
# Value so far
2840
value = datetime.timedelta()
2841
found_token = None
2842
# Following valid tokens
2843
followers = frozenset((token_duration, ))
2844
# String left to parse
2845
s = duration
2846
# Loop until end token is found
2847
while found_token is not token_end:
2848
# Search for any currently valid tokens
2849
for token in followers:
2850
match = token.regexp.match(s)
2851
if match is not None:
2852
# Token found
2853
if token.value is not None:
2854
# Value found, parse digits
2855
factor = int(match.group(1), 10)
2856
# Add to value so far
2857
value += factor * token.value
2858
# Strip token from string
2859
s = token.regexp.sub("", s, 1)
2860
# Go to found token
2861
found_token = token
2862
# Set valid next tokens
2863
followers = found_token.followers
2864
break
2865
else:
2866
# No currently valid tokens were found
2867
raise ValueError("Invalid RFC 3339 duration: {!r}"
2868
.format(duration))
2869
# End token found
2870
return value
2871
2872
2873
1882
def string_to_delta(interval):
2874
1883
"""Parse a string and return a datetime.timedelta
2875
2876
>>> string_to_delta('7d') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2879
True
2880
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2881
True
2882
>>> string_to_delta('24h') == datetime.timedelta(1)
2883
True
2884
>>> string_to_delta('1w') == datetime.timedelta(7)
2885
True
2886
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2887
True
1884
1885
>>> string_to_delta('7d')
1886
datetime.timedelta(7)
1887
>>> string_to_delta('60s')
1888
datetime.timedelta(0, 60)
1889
>>> string_to_delta('60m')
1890
datetime.timedelta(0, 3600)
1891
>>> string_to_delta('24h')
1892
datetime.timedelta(1)
1893
>>> string_to_delta('1w')
1894
datetime.timedelta(7)
1895
>>> string_to_delta('5m 30s')
1896
datetime.timedelta(0, 330)
2888
1897
"""
2889
2890
try:
2891
return rfc3339_duration_to_delta(interval)
2892
except ValueError:
2893
pass
2894
2895
1898
timevalue = datetime.timedelta(0)
2896
1899
for s in interval.split():
2897
1900
try:
2898
suffix = s[-1]
1901
suffix = unicode(s[-1])
2899
1902
value = int(s[:-1])
2900
1903
if suffix == "d":
2901
1904
delta = datetime.timedelta(value)
2908
1911
elif suffix == "w":
2909
1912
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2910
1913
else:
2911
raise ValueError("Unknown suffix {!r}".format(suffix))
2912
except IndexError as e:
1914
raise ValueError("Unknown suffix %r" % suffix)
1915
except (ValueError, IndexError) as e:
2913
1916
raise ValueError(*(e.args))
2914
1917
timevalue += delta
2915
1918
return timevalue
2916
1919
2917
1920
2918
def daemon(nochdir=False, noclose=False):
1921
def daemon(nochdir = False, noclose = False):
2919
1922
"""See daemon(3). Standard BSD Unix function.
2920
1923
2921
1924
This should really exist as os.daemon, but it doesn't (yet)."""
2922
1925
if os.fork():
2923
1926
sys.exit()
2928
1931
sys.exit()
2929
1932
if not noclose:
2930
1933
# Close all standard open file descriptors
2931
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1934
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2932
1935
if not stat.S_ISCHR(os.fstat(null).st_mode):
2933
1936
raise OSError(errno.ENODEV,
2934
"{} not a character device"
2935
.format(os.devnull))
1937
"%s not a character device"
1938
% os.path.devnull)
2936
1939
os.dup2(null, sys.stdin.fileno())
2937
1940
os.dup2(null, sys.stdout.fileno())
2938
1941
os.dup2(null, sys.stderr.fileno())
2941
1944
2942
1945
2943
1946
def main():
2944
1947
2945
1948
##################################################################
2946
1949
# Parsing of options, both command line and config file
2947
1950
2948
1951
parser = argparse.ArgumentParser()
2949
1952
parser.add_argument("-v", "--version", action="version",
2950
version="%(prog)s {}".format(version),
1953
version = "%%(prog)s %s" % version,
2951
1954
help="show version number and exit")
2952
1955
parser.add_argument("-i", "--interface", metavar="IF",
2953
1956
help="Bind to interface IF")
2959
1962
help="Run self-test")
2960
1963
parser.add_argument("--debug", action="store_true",
2961
1964
help="Debug mode; run in foreground and log"
2962
" to terminal", default=None)
1965
" to terminal")
2963
1966
parser.add_argument("--debuglevel", metavar="LEVEL",
2964
1967
help="Debug level for stdout output")
2965
1968
parser.add_argument("--priority", help="GnuTLS"
2972
1975
" files")
2973
1976
parser.add_argument("--no-dbus", action="store_false",
2974
1977
dest="use_dbus", help="Do not provide D-Bus"
2975
" system bus interface", default=None)
1978
" system bus interface")
2976
1979
parser.add_argument("--no-ipv6", action="store_false",
2977
dest="use_ipv6", help="Do not use IPv6",
2978
default=None)
1980
dest="use_ipv6", help="Do not use IPv6")
2979
1981
parser.add_argument("--no-restore", action="store_false",
2980
1982
dest="restore", help="Do not restore stored"
2981
" state", default=None)
2982
parser.add_argument("--socket", type=int,
2983
help="Specify a file descriptor to a network"
2984
" socket to use instead of creating one")
1983
" state")
2985
1984
parser.add_argument("--statedir", metavar="DIR",
2986
1985
help="Directory to save/restore state in")
2987
parser.add_argument("--foreground", action="store_true",
2988
help="Run in foreground", default=None)
2989
parser.add_argument("--no-zeroconf", action="store_false",
2990
dest="zeroconf", help="Do not use Zeroconf",
2991
default=None)
2992
1986
2993
1987
options = parser.parse_args()
2994
1988
1989
if options.check:
1990
import doctest
1991
doctest.testmod()
1992
sys.exit()
1993
2995
1994
# Default values for config file for server-global settings
2996
if gnutls.has_rawpk:
2997
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2998
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2999
else:
3000
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3001
":+SIGN-DSA-SHA256")
3002
server_defaults = {"interface": "",
3003
"address": "",
3004
"port": "",
3005
"debug": "False",
3006
"priority": priority,
3007
"servicename": "Mandos",
3008
"use_dbus": "True",
3009
"use_ipv6": "True",
3010
"debuglevel": "",
3011
"restore": "True",
3012
"socket": "",
3013
"statedir": "/var/lib/mandos",
3014
"foreground": "False",
3015
"zeroconf": "True",
3016
}
3017
del priority
3018
1995
server_defaults = { "interface": "",
1996
"address": "",
1997
"port": "",
1998
"debug": "False",
1999
"priority":
2000
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2001
"servicename": "Mandos",
2002
"use_dbus": "True",
2003
"use_ipv6": "True",
2004
"debuglevel": "",
2005
"restore": "True",
2006
"statedir": "/var/lib/mandos"
2007
}
2008
3019
2009
# Parse config file for server-global settings
3020
server_config = configparser.ConfigParser(server_defaults)
2010
server_config = configparser.SafeConfigParser(server_defaults)
3021
2011
del server_defaults
3022
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3023
# Convert the ConfigParser object to a dict
2012
server_config.read(os.path.join(options.configdir,
2013
"mandos.conf"))
2014
# Convert the SafeConfigParser object to a dict
3024
2015
server_settings = server_config.defaults()
3025
2016
# Use the appropriate methods on the non-string config options
3026
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3027
"foreground", "zeroconf"):
2017
for option in ("debug", "use_dbus", "use_ipv6"):
3028
2018
server_settings[option] = server_config.getboolean("DEFAULT",
3029
2019
option)
3030
2020
if server_settings["port"]:
3031
2021
server_settings["port"] = server_config.getint("DEFAULT",
3032
2022
"port")
3033
if server_settings["socket"]:
3034
server_settings["socket"] = server_config.getint("DEFAULT",
3035
"socket")
3036
# Later, stdin will, and stdout and stderr might, be dup'ed
3037
# over with an opened os.devnull. But we don't want this to
3038
# happen with a supplied network socket.
3039
if 0 <= server_settings["socket"] <= 2:
3040
server_settings["socket"] = os.dup(server_settings
3041
["socket"])
3042
2023
del server_config
3043
2024
3044
2025
# Override the settings from the config file with command line
3045
2026
# options, if set.
3046
2027
for option in ("interface", "address", "port", "debug",
3047
"priority", "servicename", "configdir", "use_dbus",
3048
"use_ipv6", "debuglevel", "restore", "statedir",
3049
"socket", "foreground", "zeroconf"):
2028
"priority", "servicename", "configdir",
2029
"use_dbus", "use_ipv6", "debuglevel", "restore",
2030
"statedir"):
3050
2031
value = getattr(options, option)
3051
2032
if value is not None:
3052
2033
server_settings[option] = value
3053
2034
del options
3054
2035
# Force all strings to be unicode
3055
2036
for option in server_settings.keys():
3056
if isinstance(server_settings[option], bytes):
3057
server_settings[option] = (server_settings[option]
3058
.decode("utf-8"))
3059
# Force all boolean options to be boolean
3060
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3061
"foreground", "zeroconf"):
3062
server_settings[option] = bool(server_settings[option])
3063
# Debug implies foreground
3064
if server_settings["debug"]:
3065
server_settings["foreground"] = True
2037
if type(server_settings[option]) is str:
2038
server_settings[option] = unicode(server_settings[option])
3066
2039
# Now we have our good server settings in "server_settings"
3067
2040
3068
2041
##################################################################
3069
3070
if (not server_settings["zeroconf"]
3071
and not (server_settings["port"]
3072
or server_settings["socket"] != "")):
3073
parser.error("Needs port or socket to work without Zeroconf")
3074
2042
3075
2043
# For convenience
3076
2044
debug = server_settings["debug"]
3077
2045
debuglevel = server_settings["debuglevel"]
3079
2047
use_ipv6 = server_settings["use_ipv6"]
3080
2048
stored_state_path = os.path.join(server_settings["statedir"],
3081
2049
stored_state_file)
3082
foreground = server_settings["foreground"]
3083
zeroconf = server_settings["zeroconf"]
3084
2050
3085
2051
if debug:
3086
initlogger(debug, logging.DEBUG)
2052
initlogger(logging.DEBUG)
3087
2053
else:
3088
2054
if not debuglevel:
3089
initlogger(debug)
2055
initlogger()
3090
2056
else:
3091
2057
level = getattr(logging, debuglevel.upper())
3092
initlogger(debug, level)
3093
2058
initlogger(level)
2059
3094
2060
if server_settings["servicename"] != "Mandos":
3095
syslogger.setFormatter(
3096
logging.Formatter('Mandos ({}) [%(process)d]:'
3097
' %(levelname)s: %(message)s'.format(
3098
server_settings["servicename"])))
3099
2061
syslogger.setFormatter(logging.Formatter
2062
('Mandos (%s) [%%(process)d]:'
2063
' %%(levelname)s: %%(message)s'
2064
% server_settings["servicename"]))
2065
3100
2066
# Parse config file with clients
3101
client_config = configparser.ConfigParser(Client.client_defaults)
2067
client_defaults = { "timeout": "5m",
2068
"extended_timeout": "15m",
2069
"interval": "2m",
2070
"checker": "fping -q -- %%(host)s",
2071
"host": "",
2072
"approval_delay": "0s",
2073
"approval_duration": "1s",
2074
}
2075
client_config = configparser.SafeConfigParser(client_defaults)
3102
2076
client_config.read(os.path.join(server_settings["configdir"],
3103
2077
"clients.conf"))
3104
2078
3105
2079
global mandos_dbus_service
3106
2080
mandos_dbus_service = None
3107
3108
socketfd = None
3109
if server_settings["socket"] != "":
3110
socketfd = server_settings["socket"]
3111
tcp_server = MandosServer(
3112
(server_settings["address"], server_settings["port"]),
3113
ClientHandler,
3114
interface=(server_settings["interface"] or None),
3115
use_ipv6=use_ipv6,
3116
gnutls_priority=server_settings["priority"],
3117
use_dbus=use_dbus,
3118
socketfd=socketfd)
3119
if not foreground:
3120
pidfilename = "/run/mandos.pid"
3121
if not os.path.isdir("/run/."):
3122
pidfilename = "/var/run/mandos.pid"
3123
pidfile = None
3124
try:
3125
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3126
except IOError as e:
3127
logger.error("Could not open file %r", pidfilename,
3128
exc_info=e)
3129
3130
for name, group in (("_mandos", "_mandos"),
3131
("mandos", "mandos"),
3132
("nobody", "nogroup")):
3133
try:
3134
uid = pwd.getpwnam(name).pw_uid
3135
gid = pwd.getpwnam(group).pw_gid
3136
break
2081
2082
tcp_server = MandosServer((server_settings["address"],
2083
server_settings["port"]),
2084
ClientHandler,
2085
interface=(server_settings["interface"]
2086
or None),
2087
use_ipv6=use_ipv6,
2088
gnutls_priority=
2089
server_settings["priority"],
2090
use_dbus=use_dbus)
2091
if not debug:
2092
pidfilename = "/var/run/mandos.pid"
2093
try:
2094
pidfile = open(pidfilename, "w")
2095
except IOError:
2096
logger.error("Could not open file %r", pidfilename)
2097
2098
try:
2099
uid = pwd.getpwnam("_mandos").pw_uid
2100
gid = pwd.getpwnam("_mandos").pw_gid
2101
except KeyError:
2102
try:
2103
uid = pwd.getpwnam("mandos").pw_uid
2104
gid = pwd.getpwnam("mandos").pw_gid
3137
2105
except KeyError:
3138
continue
3139
else:
3140
uid = 65534
3141
gid = 65534
2106
try:
2107
uid = pwd.getpwnam("nobody").pw_uid
2108
gid = pwd.getpwnam("nobody").pw_gid
2109
except KeyError:
2110
uid = 65534
2111
gid = 65534
3142
2112
try:
3143
2113
os.setgid(gid)
3144
2114
os.setuid(uid)
3145
if debug:
3146
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3147
gid))
3148
2115
except OSError as error:
3149
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3150
.format(uid, gid, os.strerror(error.errno)))
3151
if error.errno != errno.EPERM:
3152
raise
3153
2116
if error[0] != errno.EPERM:
2117
raise error
2118
3154
2119
if debug:
3155
2120
# Enable all possible GnuTLS debugging
3156
2121
3157
2122
# "Use a log level over 10 to enable all debugging options."
3158
2123
# - GnuTLS manual
3159
gnutls.global_set_log_level(11)
3160
3161
@gnutls.log_func
2124
gnutls.library.functions.gnutls_global_set_log_level(11)
2125
2126
@gnutls.library.types.gnutls_log_func
3162
2127
def debug_gnutls(level, string):
3163
2128
logger.debug("GnuTLS: %s", string[:-1])
3164
3165
gnutls.global_set_log_function(debug_gnutls)
3166
2129
2130
(gnutls.library.functions
2131
.gnutls_global_set_log_function(debug_gnutls))
2132
3167
2133
# Redirect stdin so all checkers get /dev/null
3168
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2134
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
3169
2135
os.dup2(null, sys.stdin.fileno())
3170
2136
if null > 2:
3171
2137
os.close(null)
3172
2138
else:
2139
# No console logging
2140
logger.removeHandler(console)
2141
3173
2142
# Need to fork before connecting to D-Bus
3174
if not foreground:
2143
if not debug:
3175
2144
# Close all input and output, do double fork, etc.
3176
2145
daemon()
3177
3178
if gi.version_info < (3, 10, 2):
3179
# multiprocessing will use threads, so before we use GLib we
3180
# need to inform GLib that threads will be used.
3181
GLib.threads_init()
3182
2146
3183
2147
global main_loop
3184
2148
# From the Avahi example code
3185
DBusGMainLoop(set_as_default=True)
3186
main_loop = GLib.MainLoop()
2149
DBusGMainLoop(set_as_default=True )
2150
main_loop = gobject.MainLoop()
3187
2151
bus = dbus.SystemBus()
3188
2152
# End of Avahi example code
3189
2153
if use_dbus:
3190
2154
try:
3191
2155
bus_name = dbus.service.BusName("se.recompile.Mandos",
3192
bus,
3193
do_not_queue=True)
3194
old_bus_name = dbus.service.BusName(
3195
"se.bsnet.fukt.Mandos", bus,
3196
do_not_queue=True)
3197
except dbus.exceptions.DBusException as e:
3198
logger.error("Disabling D-Bus:", exc_info=e)
2156
bus, do_not_queue=True)
2157
old_bus_name = (dbus.service.BusName
2158
("se.bsnet.fukt.Mandos", bus,
2159
do_not_queue=True))
2160
except dbus.exceptions.NameExistsException as e:
2161
logger.error(unicode(e) + ", disabling D-Bus")
3199
2162
use_dbus = False
3200
2163
server_settings["use_dbus"] = False
3201
2164
tcp_server.use_dbus = False
3202
if zeroconf:
3203
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3204
service = AvahiServiceToSyslog(
3205
name=server_settings["servicename"],
3206
servicetype="_mandos._tcp",
3207
protocol=protocol,
3208
bus=bus)
3209
if server_settings["interface"]:
3210
service.interface = if_nametoindex(
3211
server_settings["interface"].encode("utf-8"))
3212
2165
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2166
service = AvahiServiceToSyslog(name =
2167
server_settings["servicename"],
2168
servicetype = "_mandos._tcp",
2169
protocol = protocol, bus = bus)
2170
if server_settings["interface"]:
2171
service.interface = (if_nametoindex
2172
(str(server_settings["interface"])))
2173
3213
2174
global multiprocessing_manager
3214
2175
multiprocessing_manager = multiprocessing.Manager()
3215
2176
3216
2177
client_class = Client
3217
2178
if use_dbus:
3218
client_class = functools.partial(ClientDBus, bus=bus)
3219
3220
client_settings = Client.config_parser(client_config)
2179
client_class = functools.partial(ClientDBusTransitional,
2180
bus = bus)
2181
2182
special_settings = {
2183
# Some settings need to be accessd by special methods;
2184
# booleans need .getboolean(), etc. Here is a list of them:
2185
"approved_by_default":
2186
lambda section:
2187
client_config.getboolean(section, "approved_by_default"),
2188
"enabled":
2189
lambda section:
2190
client_config.getboolean(section, "enabled"),
2191
}
2192
# Construct a new dict of client settings of this form:
2193
# { client_name: {setting_name: value, ...}, ...}
2194
# with exceptions for any special settings as defined above
2195
client_settings = dict((clientname,
2196
dict((setting,
2197
(value
2198
if setting not in special_settings
2199
else special_settings[setting]
2200
(clientname)))
2201
for setting, value in
2202
client_config.items(clientname)))
2203
for clientname in client_config.sections())
2204
3221
2205
old_client_settings = {}
3222
clients_data = {}
3223
3224
# This is used to redirect stdout and stderr for checker processes
3225
global wnull
3226
wnull = open(os.devnull, "w") # A writable /dev/null
3227
# Only used if server is running in foreground but not in debug
3228
# mode
3229
if debug or not foreground:
3230
wnull.close()
3231
2206
clients_data = []
2207
3232
2208
# Get client data and settings from last running state.
3233
2209
if server_settings["restore"]:
3234
2210
try:
3235
2211
with open(stored_state_path, "rb") as stored_state:
3236
if sys.version_info.major == 2:
3237
clients_data, old_client_settings = pickle.load(
3238
stored_state)
3239
else:
3240
bytes_clients_data, bytes_old_client_settings = (
3241
pickle.load(stored_state, encoding="bytes"))
3242
# Fix bytes to strings
3243
# clients_data
3244
# .keys()
3245
clients_data = {(key.decode("utf-8")
3246
if isinstance(key, bytes)
3247
else key): value
3248
for key, value in
3249
bytes_clients_data.items()}
3250
del bytes_clients_data
3251
for key in clients_data:
3252
value = {(k.decode("utf-8")
3253
if isinstance(k, bytes) else k): v
3254
for k, v in
3255
clients_data[key].items()}
3256
clients_data[key] = value
3257
# .client_structure
3258
value["client_structure"] = [
3259
(s.decode("utf-8")
3260
if isinstance(s, bytes)
3261
else s) for s in
3262
value["client_structure"]]
3263
# .name, .host, and .checker_command
3264
for k in ("name", "host", "checker_command"):
3265
if isinstance(value[k], bytes):
3266
value[k] = value[k].decode("utf-8")
3267
if "key_id" not in value:
3268
value["key_id"] = ""
3269
elif "fingerprint" not in value:
3270
value["fingerprint"] = ""
3271
# old_client_settings
3272
# .keys()
3273
old_client_settings = {
3274
(key.decode("utf-8")
3275
if isinstance(key, bytes)
3276
else key): value
3277
for key, value in
3278
bytes_old_client_settings.items()}
3279
del bytes_old_client_settings
3280
# .host and .checker_command
3281
for value in old_client_settings.values():
3282
for attribute in ("host", "checker_command"):
3283
if isinstance(value[attribute], bytes):
3284
value[attribute] = (value[attribute]
3285
.decode("utf-8"))
2212
clients_data, old_client_settings = (pickle.load
2213
(stored_state))
3286
2214
os.remove(stored_state_path)
3287
2215
except IOError as e:
3288
if e.errno == errno.ENOENT:
3289
logger.warning("Could not load persistent state:"
3290
" {}".format(os.strerror(e.errno)))
3291
else:
3292
logger.critical("Could not load persistent state:",
3293
exc_info=e)
2216
logger.warning("Could not load persistent state: {0}"
2217
.format(e))
2218
if e.errno != errno.ENOENT:
3294
2219
raise
3295
except EOFError as e:
3296
logger.warning("Could not load persistent state: "
3297
"EOFError:",
3298
exc_info=e)
3299
2220
3300
2221
with PGPEngine() as pgp:
3301
for client_name, client in clients_data.items():
3302
# Skip removed clients
3303
if client_name not in client_settings:
3304
continue
3305
2222
for client in clients_data:
2223
client_name = client["name"]
2224
3306
2225
# Decide which value to use after restoring saved state.
3307
2226
# We have three different values: Old config file,
3308
2227
# new config file, and saved state.
3313
2232
# For each value in new config, check if it
3314
2233
# differs from the old config value (Except for
3315
2234
# the "secret" attribute)
3316
if (name != "secret"
3317
and (value !=
3318
old_client_settings[client_name][name])):
3319
client[name] = value
2235
if (name != "secret" and
2236
value != old_client_settings[client_name]
2237
[name]):
2238
setattr(client, name, value)
3320
2239
except KeyError:
3321
2240
pass
3322
2241
3323
2242
# Clients who has passed its expire date can still be
3324
# enabled if its last checker was successful. A Client
3325
# whose checker succeeded before we stored its state is
3326
# assumed to have successfully run all checkers during
3327
# downtime.
3328
if client["enabled"]:
3329
if datetime.datetime.utcnow() >= client["expires"]:
3330
if not client["last_checked_ok"]:
3331
logger.warning(
3332
"disabling client {} - Client never "
3333
"performed a successful checker".format(
3334
client_name))
3335
client["enabled"] = False
3336
elif client["last_checker_status"] != 0:
3337
logger.warning(
3338
"disabling client {} - Client last"
3339
" checker failed with error code"
3340
" {}".format(
3341
client_name,
3342
client["last_checker_status"]))
2243
# enabled if its last checker was sucessful. Clients
2244
# whose checker failed before we stored its state is
2245
# assumed to have failed all checkers during downtime.
2246
if client["enabled"] and client["last_checked_ok"]:
2247
if ((datetime.datetime.utcnow()
2248
- client["last_checked_ok"])
2249
> client["interval"]):
2250
if client["last_checker_status"] != 0:
3343
2251
client["enabled"] = False
3344
2252
else:
3345
client["expires"] = (
3346
datetime.datetime.utcnow()
3347
+ client["timeout"])
3348
logger.debug("Last checker succeeded,"
3349
" keeping {} enabled".format(
3350
client_name))
2253
client["expires"] = (datetime.datetime
2254
.utcnow()
2255
+ client["timeout"])
2256
2257
client["changedstate"] = (multiprocessing_manager
2258
.Condition
2259
(multiprocessing_manager
2260
.Lock()))
2261
if use_dbus:
2262
new_client = (ClientDBusTransitional.__new__
2263
(ClientDBusTransitional))
2264
tcp_server.clients[client_name] = new_client
2265
new_client.bus = bus
2266
for name, value in client.iteritems():
2267
setattr(new_client, name, value)
2268
client_object_name = unicode(client_name).translate(
2269
{ord("."): ord("_"),
2270
ord("-"): ord("_")})
2271
new_client.dbus_object_path = (dbus.ObjectPath
2272
("/clients/"
2273
+ client_object_name))
2274
DBusObjectWithProperties.__init__(new_client,
2275
new_client.bus,
2276
new_client
2277
.dbus_object_path)
2278
else:
2279
tcp_server.clients[client_name] = (Client.__new__
2280
(Client))
2281
for name, value in client.iteritems():
2282
setattr(tcp_server.clients[client_name],
2283
name, value)
2284
3351
2285
try:
3352
client["secret"] = pgp.decrypt(
3353
client["encrypted_secret"],
3354
client_settings[client_name]["secret"])
2286
tcp_server.clients[client_name].secret = (
2287
pgp.decrypt(tcp_server.clients[client_name]
2288
.encrypted_secret,
2289
client_settings[client_name]
2290
["secret"]))
3355
2291
except PGPError:
3356
2292
# If decryption fails, we use secret from new settings
3357
logger.debug("Failed to decrypt {} old secret".format(
3358
client_name))
3359
client["secret"] = (client_settings[client_name]
3360
["secret"])
3361
3362
# Add/remove clients based on new changes made to config
3363
for client_name in (set(old_client_settings)
3364
- set(client_settings)):
3365
del clients_data[client_name]
3366
for client_name in (set(client_settings)
3367
- set(old_client_settings)):
3368
clients_data[client_name] = client_settings[client_name]
3369
3370
# Create all client objects
3371
for client_name, client in clients_data.items():
3372
tcp_server.clients[client_name] = client_class(
3373
name=client_name,
3374
settings=client,
3375
server_settings=server_settings)
3376
2293
tcp_server.clients[client_name].secret = (
2294
client_settings[client_name]["secret"])
2295
2296
# Create/remove clients based on new changes made to config
2297
for clientname in set(old_client_settings) - set(client_settings):
2298
del tcp_server.clients[clientname]
2299
for clientname in set(client_settings) - set(old_client_settings):
2300
tcp_server.clients[clientname] = (client_class(name
2301
= clientname,
2302
config =
2303
client_settings
2304
[clientname]))
2305
3377
2306
if not tcp_server.clients:
3378
2307
logger.warning("No clients defined")
3379
3380
if not foreground:
3381
if pidfile is not None:
3382
pid = os.getpid()
3383
try:
3384
with pidfile:
3385
print(pid, file=pidfile)
3386
except IOError:
3387
logger.error("Could not write to file %r with PID %d",
3388
pidfilename, pid)
3389
del pidfile
2308
2309
if not debug:
2310
try:
2311
with pidfile:
2312
pid = os.getpid()
2313
pidfile.write(str(pid) + "\n".encode("utf-8"))
2314
del pidfile
2315
except IOError:
2316
logger.error("Could not write to file %r with PID %d",
2317
pidfilename, pid)
2318
except NameError:
2319
# "pidfile" was never created
2320
pass
3390
2321
del pidfilename
3391
3392
for termsig in (signal.SIGHUP, signal.SIGTERM):
3393
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3394
lambda: main_loop.quit() and False)
3395
2322
2323
signal.signal(signal.SIGINT, signal.SIG_IGN)
2324
2325
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2326
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2327
3396
2328
if use_dbus:
3397
3398
@alternate_dbus_interfaces(
3399
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3400
class MandosDBusService(DBusObjectWithObjectManager):
2329
class MandosDBusService(dbus.service.Object):
3401
2330
"""A D-Bus proxy object"""
3402
3403
2331
def __init__(self):
3404
2332
dbus.service.Object.__init__(self, bus, "/")
3405
3406
2333
_interface = "se.recompile.Mandos"
3407
2334
3408
2335
@dbus.service.signal(_interface, signature="o")
3409
2336
def ClientAdded(self, objpath):
3410
2337
"D-Bus signal"
3411
2338
pass
3412
2339
3413
2340
@dbus.service.signal(_interface, signature="ss")
3414
def ClientNotFound(self, key_id, address):
2341
def ClientNotFound(self, fingerprint, address):
3415
2342
"D-Bus signal"
3416
2343
pass
3417
3418
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3419
"true"})
2344
3420
2345
@dbus.service.signal(_interface, signature="os")
3421
2346
def ClientRemoved(self, objpath, name):
3422
2347
"D-Bus signal"
3423
2348
pass
3424
3425
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3426
"true"})
2349
3427
2350
@dbus.service.method(_interface, out_signature="ao")
3428
2351
def GetAllClients(self):
3429
2352
"D-Bus method"
3430
return dbus.Array(c.dbus_object_path for c in
3431
tcp_server.clients.values())
3432
3433
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3434
"true"})
2353
return dbus.Array(c.dbus_object_path
2354
for c in
2355
tcp_server.clients.itervalues())
2356
3435
2357
@dbus.service.method(_interface,
3436
2358
out_signature="a{oa{sv}}")
3437
2359
def GetAllClientsWithProperties(self):
3438
2360
"D-Bus method"
3439
2361
return dbus.Dictionary(
3440
{c.dbus_object_path: c.GetAll(
3441
"se.recompile.Mandos.Client")
3442
for c in tcp_server.clients.values()},
2362
((c.dbus_object_path, c.GetAll(""))
2363
for c in tcp_server.clients.itervalues()),
3443
2364
signature="oa{sv}")
3444
2365
3445
2366
@dbus.service.method(_interface, in_signature="o")
3446
2367
def RemoveClient(self, object_path):
3447
2368
"D-Bus method"
3448
for c in tcp_server.clients.values():
2369
for c in tcp_server.clients.itervalues():
3449
2370
if c.dbus_object_path == object_path:
3450
2371
del tcp_server.clients[c.name]
3451
2372
c.remove_from_connection()
3452
# Don't signal the disabling
2373
# Don't signal anything except ClientRemoved
3453
2374
c.disable(quiet=True)
3454
# Emit D-Bus signal for removal
3455
self.client_removed_signal(c)
2375
# Emit D-Bus signal
2376
self.ClientRemoved(object_path, c.name)
3456
2377
return
3457
2378
raise KeyError(object_path)
3458
2379
3459
2380
del _interface
3460
3461
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3462
out_signature="a{oa{sa{sv}}}")
3463
def GetManagedObjects(self):
3464
"""D-Bus method"""
3465
return dbus.Dictionary(
3466
{client.dbus_object_path:
3467
dbus.Dictionary(
3468
{interface: client.GetAll(interface)
3469
for interface in
3470
client._get_all_interface_names()})
3471
for client in tcp_server.clients.values()})
3472
3473
def client_added_signal(self, client):
3474
"""Send the new standard signal and the old signal"""
3475
if use_dbus:
3476
# New standard signal
3477
self.InterfacesAdded(
3478
client.dbus_object_path,
3479
dbus.Dictionary(
3480
{interface: client.GetAll(interface)
3481
for interface in
3482
client._get_all_interface_names()}))
3483
# Old signal
3484
self.ClientAdded(client.dbus_object_path)
3485
3486
def client_removed_signal(self, client):
3487
"""Send the new standard signal and the old signal"""
3488
if use_dbus:
3489
# New standard signal
3490
self.InterfacesRemoved(
3491
client.dbus_object_path,
3492
client._get_all_interface_names())
3493
# Old signal
3494
self.ClientRemoved(client.dbus_object_path,
3495
client.name)
3496
3497
mandos_dbus_service = MandosDBusService()
3498
3499
# Save modules to variables to exempt the modules from being
3500
# unloaded before the function registered with atexit() is run.
3501
mp = multiprocessing
3502
wn = wnull
3503
2381
2382
class MandosDBusServiceTransitional(MandosDBusService):
2383
__metaclass__ = AlternateDBusNamesMetaclass
2384
mandos_dbus_service = MandosDBusServiceTransitional()
2385
3504
2386
def cleanup():
3505
2387
"Cleanup function; run on exit"
3506
if zeroconf:
3507
service.cleanup()
3508
3509
mp.active_children()
3510
wn.close()
2388
service.cleanup()
2389
2390
multiprocessing.active_children()
3511
2391
if not (tcp_server.clients or client_settings):
3512
2392
return
3513
2393
3514
2394
# Store client before exiting. Secrets are encrypted with key
3515
2395
# based on what config file has. If config file is
3516
2396
# removed/edited, old secret will thus be unrecovable.
3517
clients = {}
2397
clients = []
3518
2398
with PGPEngine() as pgp:
3519
for client in tcp_server.clients.values():
2399
for client in tcp_server.clients.itervalues():
3520
2400
key = client_settings[client.name]["secret"]
3521
2401
client.encrypted_secret = pgp.encrypt(client.secret,
3522
2402
key)
3523
2403
client_dict = {}
3524
3525
# A list of attributes that can not be pickled
3526
# + secret.
3527
exclude = {"bus", "changedstate", "secret",
3528
"checker", "server_settings"}
3529
for name, typ in inspect.getmembers(dbus.service
3530
.Object):
2404
2405
# A list of attributes that will not be stored when
2406
# shutting down.
2407
exclude = set(("bus", "changedstate", "secret"))
2408
for name, typ in (inspect.getmembers
2409
(dbus.service.Object)):
3531
2410
exclude.add(name)
3532
2411
3533
2412
client_dict["encrypted_secret"] = (client
3534
2413
.encrypted_secret)
3535
2414
for attr in client.client_structure:
3536
2415
if attr not in exclude:
3537
2416
client_dict[attr] = getattr(client, attr)
3538
3539
clients[client.name] = client_dict
2417
2418
clients.append(client_dict)
3540
2419
del client_settings[client.name]["secret"]
3541
2420
3542
2421
try:
3543
with tempfile.NamedTemporaryFile(
3544
mode='wb',
3545
suffix=".pickle",
3546
prefix='clients-',
3547
dir=os.path.dirname(stored_state_path),
3548
delete=False) as stored_state:
3549
pickle.dump((clients, client_settings), stored_state,
3550
protocol=2)
3551
tempname = stored_state.name
3552
os.rename(tempname, stored_state_path)
2422
with os.fdopen(os.open(stored_state_path,
2423
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2424
0600), "wb") as stored_state:
2425
pickle.dump((clients, client_settings), stored_state)
3553
2426
except (IOError, OSError) as e:
3554
if not debug:
3555
try:
3556
os.remove(tempname)
3557
except NameError:
3558
pass
3559
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3560
logger.warning("Could not save persistent state: {}"
3561
.format(os.strerror(e.errno)))
3562
else:
3563
logger.warning("Could not save persistent state:",
3564
exc_info=e)
2427
logger.warning("Could not save persistent state: {0}"
2428
.format(e))
2429
if e.errno not in (errno.ENOENT, errno.EACCES):
3565
2430
raise
3566
2431
3567
2432
# Delete all clients, and settings from config
3568
2433
while tcp_server.clients:
3569
2434
name, client = tcp_server.clients.popitem()
3570
2435
if use_dbus:
3571
2436
client.remove_from_connection()
3572
# Don't signal the disabling
2437
# Don't signal anything except ClientRemoved
3573
2438
client.disable(quiet=True)
3574
# Emit D-Bus signal for removal
3575
2439
if use_dbus:
3576
mandos_dbus_service.client_removed_signal(client)
2440
# Emit D-Bus signal
2441
mandos_dbus_service.ClientRemoved(client
2442
.dbus_object_path,
2443
client.name)
3577
2444
client_settings.clear()
3578
2445
3579
2446
atexit.register(cleanup)
3580
3581
for client in tcp_server.clients.values():
2447
2448
for client in tcp_server.clients.itervalues():
3582
2449
if use_dbus:
3583
# Emit D-Bus signal for adding
3584
mandos_dbus_service.client_added_signal(client)
2450
# Emit D-Bus signal
2451
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3585
2452
# Need to initiate checking of clients
3586
2453
if client.enabled:
3587
2454
client.init_checker()
3588
2455
3589
2456
tcp_server.enable()
3590
2457
tcp_server.server_activate()
3591
2458
3592
2459
# Find out what port we got
3593
if zeroconf:
3594
service.port = tcp_server.socket.getsockname()[1]
2460
service.port = tcp_server.socket.getsockname()[1]
3595
2461
if use_ipv6:
3596
2462
logger.info("Now listening on address %r, port %d,"
3597
" flowinfo %d, scope_id %d",
3598
*tcp_server.socket.getsockname())
2463
" flowinfo %d, scope_id %d"
2464
% tcp_server.socket.getsockname())
3599
2465
else: # IPv4
3600
logger.info("Now listening on address %r, port %d",
3601
*tcp_server.socket.getsockname())
3602
3603
# service.interface = tcp_server.socket.getsockname()[3]
3604
2466
logger.info("Now listening on address %r, port %d"
2467
% tcp_server.socket.getsockname())
2468
2469
#service.interface = tcp_server.socket.getsockname()[3]
2470
3605
2471
try:
3606
if zeroconf:
3607
# From the Avahi example code
3608
try:
3609
service.activate()
3610
except dbus.exceptions.DBusException as error:
3611
logger.critical("D-Bus Exception", exc_info=error)
3612
cleanup()
3613
sys.exit(1)
3614
# End of Avahi example code
3615
3616
GLib.io_add_watch(
3617
GLib.IOChannel.unix_new(tcp_server.fileno()),
3618
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3619
lambda *args, **kwargs: (tcp_server.handle_request
3620
(*args[2:], **kwargs) or True))
3621
2472
# From the Avahi example code
2473
try:
2474
service.activate()
2475
except dbus.exceptions.DBusException as error:
2476
logger.critical("DBusException: %s", error)
2477
cleanup()
2478
sys.exit(1)
2479
# End of Avahi example code
2480
2481
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2482
lambda *args, **kwargs:
2483
(tcp_server.handle_request
2484
(*args[2:], **kwargs) or True))
2485
3622
2486
logger.debug("Starting main loop")
3623
2487
main_loop.run()
3624
2488
except AvahiError as error:
3625
logger.critical("Avahi Error", exc_info=error)
2489
logger.critical("AvahiError: %s", error)
3626
2490
cleanup()
3627
2491
sys.exit(1)
3628
2492
except KeyboardInterrupt:
3633
2497
# Must run before the D-Bus bus name gets deregistered
3634
2498
cleanup()
3635
2499
3636
3637
def should_only_run_tests():
3638
parser = argparse.ArgumentParser(add_help=False)
3639
parser.add_argument("--check", action='store_true')
3640
args, unknown_args = parser.parse_known_args()
3641
run_tests = args.check
3642
if run_tests:
3643
# Remove --check argument from sys.argv
3644
sys.argv[1:] = unknown_args
3645
return run_tests
3646
3647
# Add all tests from doctest strings
3648
def load_tests(loader, tests, none):
3649
import doctest
3650
tests.addTests(doctest.DocTestSuite())
3651
return tests
3652
2500
3653
2501
if __name__ == '__main__':
3654
try:
3655
if should_only_run_tests():
3656
# Call using ./mandos --check [--verbose]
3657
unittest.main()
3658
else:
3659
main()
3660
finally:
3661
logging.shutdown()
2502
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0