To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 518.2.3
- compare with another revision
- download diff
- download tarball
- view history from revision 518.2.3
- Committer: Teddy Hogeborn
- Date: 2011-11-26 23:08:17 UTC
- mto: (518.1.8 mandos-persistent)
- mto: This revision was merged to the branch mainline in revision 524.
- Revision ID: teddy@recompile.se-20111126230817-tv08v831s2yltbkd
Make "enabled" a client config option.
* DBUS-API: Fix wording on "Expires" option.
* clients.conf (enabled): New.
* mandos (Client): "last_enabled" can now be None.
(Client.__init__): Get "enabled" from config. Only set
"last_enabled" and "expires" if enabled.
(ClientDBus.Created_dbus_property): Removed redundant dbus.String().
(ClientDBus.Interval_dbus_property): If changed, only reschedule
checker if enabled.
(main/special_settings): Added "enabled".
* mandos-clients.conf (OPTIONS): Added "enabled".
* DBUS-API: Fix wording on "Expires" option.
* clients.conf (enabled): New.
* mandos (Client): "last_enabled" can now be None.
(Client.__init__): Get "enabled" from config. Only set
"last_enabled" and "expires" if enabled.
(ClientDBus.Created_dbus_property): Removed redundant dbus.String().
(ClientDBus.Interval_dbus_property): If changed, only reschedule
checker if enabled.
(main/special_settings): Added "enabled".
* mandos-clients.conf (OPTIONS): Added "enabled".
- files removed:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
46
41
import errno
42
import gnutls.crypto
47
43
import gnutls.connection
48
44
import gnutls.errors
49
45
import gnutls.library.functions
50
46
import gnutls.library.constants
51
47
import gnutls.library.types
52
try:
53
import ConfigParser as configparser
54
except ImportError:
55
import configparser
48
import ConfigParser as configparser
56
49
import sys
57
50
import re
58
51
import os
67
60
import struct
68
61
import fcntl
69
62
import functools
70
try:
71
import cPickle as pickle
72
except ImportError:
73
import pickle
63
import cPickle as pickle
74
64
import multiprocessing
75
65
import types
76
66
import binascii
77
67
import tempfile
78
import itertools
79
import collections
80
import codecs
81
68
82
69
import dbus
83
70
import dbus.service
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
71
import gobject
88
72
import avahi
89
73
from dbus.mainloop.glib import DBusGMainLoop
90
74
import ctypes
91
75
import ctypes.util
92
76
import xml.dom.minidom
93
77
import inspect
78
import GnuPGInterface
94
79
95
80
try:
96
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
100
85
except ImportError:
101
86
SO_BINDTODEVICE = None
102
87
103
if sys.version_info.major == 2:
104
str = unicode
105
88
106
version = "1.7.1"
89
version = "1.4.1"
107
90
stored_state_file = "clients.pickle"
108
91
109
92
logger = logging.getLogger()
110
syslogger = None
93
syslogger = (logging.handlers.SysLogHandler
94
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
address = str("/dev/log")))
111
96
112
97
try:
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
115
101
except (OSError, AttributeError):
116
117
102
def if_nametoindex(interface):
118
103
"Get an interface index the hard way, i.e. using fcntl()"
119
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
120
105
with contextlib.closing(socket.socket()) as s:
121
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
122
struct.pack(b"16s16x", interface))
123
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
124
111
return interface_index
125
112
126
113
127
def initlogger(debug, level=logging.WARNING):
114
def initlogger(level=logging.WARNING):
128
115
"""init logger and add loglevel"""
129
116
130
global syslogger
131
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
134
117
syslogger.setFormatter(logging.Formatter
135
118
('Mandos [%(process)d]: %(levelname)s:'
136
119
' %(message)s'))
137
120
logger.addHandler(syslogger)
138
121
139
if debug:
140
console = logging.StreamHandler()
141
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
142
' [%(process)d]:'
143
' %(levelname)s:'
144
' %(message)s'))
145
logger.addHandler(console)
122
console = logging.StreamHandler()
123
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
' [%(process)d]:'
125
' %(levelname)s:'
126
' %(message)s'))
127
logger.addHandler(console)
146
128
logger.setLevel(level)
147
129
148
130
149
class PGPError(Exception):
150
"""Exception if encryption/decryption fails"""
131
class CryptoError(Exception):
151
132
pass
152
133
153
134
154
class PGPEngine(object):
135
class Crypto(object):
155
136
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
157
137
def __init__(self):
138
self.gnupg = GnuPGInterface.GnuPG()
158
139
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
159
self.gnupgargs = ['--batch',
160
'--home', self.tempdir,
161
'--force-mdc',
162
'--quiet',
163
'--no-use-agent']
140
self.gnupg = GnuPGInterface.GnuPG()
141
self.gnupg.options.meta_interactive = False
142
self.gnupg.options.homedir = self.tempdir
143
self.gnupg.options.extra_args.extend(['--force-mdc',
144
'--quiet'])
164
145
165
146
def __enter__(self):
166
147
return self
167
148
168
def __exit__(self, exc_type, exc_value, traceback):
149
def __exit__ (self, exc_type, exc_value, traceback):
169
150
self._cleanup()
170
151
return False
171
152
188
169
def password_encode(self, password):
189
170
# Passphrase can not be empty and can not contain newlines or
190
171
# NUL bytes. So we prefix it and hex encode it.
191
encoded = b"mandos" + binascii.hexlify(password)
192
if len(encoded) > 2048:
193
# GnuPG can't handle long passwords, so encode differently
194
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
195
.replace(b"\n", b"\\n")
196
.replace(b"\0", b"\\x00"))
197
return encoded
172
return b"mandos" + binascii.hexlify(password)
198
173
199
174
def encrypt(self, data, password):
200
passphrase = self.password_encode(password)
201
with tempfile.NamedTemporaryFile(
202
dir=self.tempdir) as passfile:
203
passfile.write(passphrase)
204
passfile.flush()
205
proc = subprocess.Popen(['gpg', '--symmetric',
206
'--passphrase-file',
207
passfile.name]
208
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
213
if proc.returncode != 0:
214
raise PGPError(err)
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
177
try:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
182
f.write(data)
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
185
proc.wait()
186
except IOError as e:
187
raise CryptoError(e)
188
self.gnupg.passphrase = None
215
189
return ciphertext
216
190
217
191
def decrypt(self, data, password):
218
passphrase = self.password_encode(password)
219
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
221
passfile.write(passphrase)
222
passfile.flush()
223
proc = subprocess.Popen(['gpg', '--decrypt',
224
'--passphrase-file',
225
passfile.name]
226
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
231
if proc.returncode != 0:
232
raise PGPError(err)
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
194
try:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
199
f.write(data)
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
202
proc.wait()
203
except IOError as e:
204
raise CryptoError(e)
205
self.gnupg.passphrase = None
233
206
return decrypted_plaintext
234
207
235
208
209
236
210
class AvahiError(Exception):
237
211
def __init__(self, value, *args, **kwargs):
238
212
self.value = value
239
return super(AvahiError, self).__init__(value, *args,
240
**kwargs)
241
213
super(AvahiError, self).__init__(value, *args, **kwargs)
214
def __unicode__(self):
215
return unicode(repr(self.value))
242
216
243
217
class AvahiServiceError(AvahiError):
244
218
pass
245
219
246
247
220
class AvahiGroupError(AvahiError):
248
221
pass
249
222
256
229
Used to optionally bind to the specified interface.
257
230
name: string; Example: 'Mandos'
258
231
type: string; Example: '_mandos._tcp'.
259
See <https://www.iana.org/assignments/service-names-port-numbers>
232
See <http://www.dns-sd.org/ServiceTypes.html>
260
233
port: integer; what port to announce
261
234
TXT: list of strings; TXT record for the service
262
235
domain: string; Domain to publish on, default to .local if empty.
268
241
server: D-Bus Server
269
242
bus: dbus.SystemBus()
270
243
"""
271
272
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
244
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
245
servicetype = None, port = None, TXT = None,
246
domain = "", host = "", max_renames = 32768,
247
protocol = avahi.PROTO_UNSPEC, bus = None):
283
248
self.interface = interface
284
249
self.name = name
285
250
self.type = servicetype
294
259
self.server = None
295
260
self.bus = bus
296
261
self.entry_group_state_changed_match = None
297
298
def rename(self, remove=True):
262
def rename(self):
299
263
"""Derived from the Avahi example code"""
300
264
if self.rename_count >= self.max_renames:
301
265
logger.critical("No suitable Zeroconf service name found"
302
266
" after %i retries, exiting.",
303
267
self.rename_count)
304
268
raise AvahiServiceError("Too many renames")
305
self.name = str(
306
self.server.GetAlternativeServiceName(self.name))
307
self.rename_count += 1
269
self.name = unicode(self.server
270
.GetAlternativeServiceName(self.name))
308
271
logger.info("Changing Zeroconf service name to %r ...",
309
272
self.name)
310
if remove:
311
self.remove()
273
self.remove()
312
274
try:
313
275
self.add()
314
276
except dbus.exceptions.DBusException as error:
315
if (error.get_dbus_name()
316
== "org.freedesktop.Avahi.CollisionError"):
317
logger.info("Local Zeroconf service name collision.")
318
return self.rename(remove=False)
319
else:
320
logger.critical("D-Bus Exception", exc_info=error)
321
self.cleanup()
322
os._exit(1)
323
277
logger.critical("DBusException: %s", error)
278
self.cleanup()
279
os._exit(1)
280
self.rename_count += 1
324
281
def remove(self):
325
282
"""Derived from the Avahi example code"""
326
283
if self.entry_group_state_changed_match is not None:
328
285
self.entry_group_state_changed_match = None
329
286
if self.group is not None:
330
287
self.group.Reset()
331
332
288
def add(self):
333
289
"""Derived from the Avahi example code"""
334
290
self.remove()
351
307
dbus.UInt16(self.port),
352
308
avahi.string_array_to_txt_array(self.TXT))
353
309
self.group.Commit()
354
355
310
def entry_group_state_changed(self, state, error):
356
311
"""Derived from the Avahi example code"""
357
312
logger.debug("Avahi entry group state change: %i", state)
363
318
self.rename()
364
319
elif state == avahi.ENTRY_GROUP_FAILURE:
365
320
logger.critical("Avahi: Error in group state changed %s",
366
str(error))
367
raise AvahiGroupError("State changed: {!s}".format(error))
368
321
unicode(error))
322
raise AvahiGroupError("State changed: %s"
323
% unicode(error))
369
324
def cleanup(self):
370
325
"""Derived from the Avahi example code"""
371
326
if self.group is not None:
376
331
pass
377
332
self.group = None
378
333
self.remove()
379
380
334
def server_state_changed(self, state, error=None):
381
335
"""Derived from the Avahi example code"""
382
336
logger.debug("Avahi server state change: %i", state)
383
bad_states = {
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
388
}
337
bad_states = { avahi.SERVER_INVALID:
338
"Zeroconf server invalid",
339
avahi.SERVER_REGISTERING: None,
340
avahi.SERVER_COLLISION:
341
"Zeroconf server name collision",
342
avahi.SERVER_FAILURE:
343
"Zeroconf server failure" }
389
344
if state in bad_states:
390
345
if bad_states[state] is not None:
391
346
if error is None:
394
349
logger.error(bad_states[state] + ": %r", error)
395
350
self.cleanup()
396
351
elif state == avahi.SERVER_RUNNING:
397
try:
398
self.add()
399
except dbus.exceptions.DBusException as error:
400
if (error.get_dbus_name()
401
== "org.freedesktop.Avahi.CollisionError"):
402
logger.info("Local Zeroconf service name"
403
" collision.")
404
return self.rename(remove=False)
405
else:
406
logger.critical("D-Bus Exception", exc_info=error)
407
self.cleanup()
408
os._exit(1)
352
self.add()
409
353
else:
410
354
if error is None:
411
355
logger.debug("Unknown state: %r", state)
412
356
else:
413
357
logger.debug("Unknown state: %r: %r", state, error)
414
415
358
def activate(self):
416
359
"""Derived from the Avahi example code"""
417
360
if self.server is None:
421
364
follow_name_owner_changes=True),
422
365
avahi.DBUS_INTERFACE_SERVER)
423
366
self.server.connect_to_signal("StateChanged",
424
self.server_state_changed)
367
self.server_state_changed)
425
368
self.server_state_changed(self.server.GetState())
426
369
427
428
370
class AvahiServiceToSyslog(AvahiService):
429
def rename(self, *args, **kwargs):
371
def rename(self):
430
372
"""Add the new name to the syslog messages"""
431
ret = AvahiService.rename(self, *args, **kwargs)
432
syslogger.setFormatter(logging.Formatter(
433
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
434
.format(self.name)))
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
377
% self.name))
435
378
return ret
436
379
437
def call_pipe(connection, # : multiprocessing.Connection
438
func, *args, **kwargs):
439
"""This function is meant to be called by multiprocessing.Process
440
441
This function runs func(*args, **kwargs), and writes the resulting
442
return value on the provided multiprocessing.Connection.
443
"""
444
connection.send(func(*args, **kwargs))
445
connection.close()
446
380
def _timedelta_to_milliseconds(td):
381
"Convert a datetime.timedelta() to milliseconds"
382
return ((td.days * 24 * 60 * 60 * 1000)
383
+ (td.seconds * 1000)
384
+ (td.microseconds // 1000))
385
447
386
class Client(object):
448
387
"""A representation of a client host served by this server.
449
388
450
389
Attributes:
451
approved: bool(); 'None' if not yet approved/disapproved
390
_approved: bool(); 'None' if not yet approved/disapproved
452
391
approval_delay: datetime.timedelta(); Time to wait for approval
453
392
approval_duration: datetime.timedelta(); Duration of one approval
454
393
checker: subprocess.Popen(); a running checker process used
472
411
interval: datetime.timedelta(); How often to start a new checker
473
412
last_approval_request: datetime.datetime(); (UTC) or None
474
413
last_checked_ok: datetime.datetime(); (UTC) or None
414
475
415
last_checker_status: integer between 0 and 255 reflecting exit
476
416
status of last checker. -1 reflects crashed
477
checker, -2 means no checker completed yet.
478
last_checker_signal: The signal which killed the last checker, if
479
last_checker_status is -1
417
checker, or None.
480
418
last_enabled: datetime.datetime(); (UTC) or None
481
419
name: string; from the config file, used in log messages and
482
420
D-Bus identifiers
483
421
secret: bytestring; sent verbatim (over TLS) to client
484
422
timeout: datetime.timedelta(); How long from last_checked_ok
485
423
until this client is disabled
486
extended_timeout: extra long timeout when secret has been sent
424
extended_timeout: extra long timeout when password has been sent
487
425
runtime_expansions: Allowed attributes for runtime expansion.
488
426
expires: datetime.datetime(); time (UTC) when a client will be
489
427
disabled, or None
490
server_settings: The server_settings dict from main()
491
428
"""
492
429
493
430
runtime_expansions = ("approval_delay", "approval_duration",
494
"created", "enabled", "expires",
495
"fingerprint", "host", "interval",
496
"last_approval_request", "last_checked_ok",
431
"created", "enabled", "fingerprint",
432
"host", "interval", "last_checked_ok",
497
433
"last_enabled", "name", "timeout")
498
client_defaults = {
499
"timeout": "PT5M",
500
"extended_timeout": "PT15M",
501
"interval": "PT2M",
502
"checker": "fping -q -- %%(host)s",
503
"host": "",
504
"approval_delay": "PT0S",
505
"approval_duration": "PT1S",
506
"approved_by_default": "True",
507
"enabled": "True",
508
}
509
510
@staticmethod
511
def config_parser(config):
512
"""Construct a new dict of client settings of this form:
513
{ client_name: {setting_name: value, ...}, ...}
514
with exceptions for any special settings as defined above.
515
NOTE: Must be a pure function. Must return the same result
516
value given the same arguments.
517
"""
518
settings = {}
519
for client_name in config.sections():
520
section = dict(config.items(client_name))
521
client = settings[client_name] = {}
522
523
client["host"] = section["host"]
524
# Reformat values from string types to Python types
525
client["approved_by_default"] = config.getboolean(
526
client_name, "approved_by_default")
527
client["enabled"] = config.getboolean(client_name,
528
"enabled")
529
530
# Uppercase and remove spaces from fingerprint for later
531
# comparison purposes with return value from the
532
# fingerprint() function
533
client["fingerprint"] = (section["fingerprint"].upper()
534
.replace(" ", ""))
535
if "secret" in section:
536
client["secret"] = section["secret"].decode("base64")
537
elif "secfile" in section:
538
with open(os.path.expanduser(os.path.expandvars
539
(section["secfile"])),
540
"rb") as secfile:
541
client["secret"] = secfile.read()
542
else:
543
raise TypeError("No secret or secfile for section {}"
544
.format(section))
545
client["timeout"] = string_to_delta(section["timeout"])
546
client["extended_timeout"] = string_to_delta(
547
section["extended_timeout"])
548
client["interval"] = string_to_delta(section["interval"])
549
client["approval_delay"] = string_to_delta(
550
section["approval_delay"])
551
client["approval_duration"] = string_to_delta(
552
section["approval_duration"])
553
client["checker_command"] = section["checker"]
554
client["last_approval_request"] = None
555
client["last_checked_ok"] = None
556
client["last_checker_status"] = -2
557
558
return settings
559
560
def __init__(self, settings, name = None, server_settings=None):
434
435
def timeout_milliseconds(self):
436
"Return the 'timeout' attribute in milliseconds"
437
return _timedelta_to_milliseconds(self.timeout)
438
439
def extended_timeout_milliseconds(self):
440
"Return the 'extended_timeout' attribute in milliseconds"
441
return _timedelta_to_milliseconds(self.extended_timeout)
442
443
def interval_milliseconds(self):
444
"Return the 'interval' attribute in milliseconds"
445
return _timedelta_to_milliseconds(self.interval)
446
447
def approval_delay_milliseconds(self):
448
return _timedelta_to_milliseconds(self.approval_delay)
449
450
def __init__(self, name = None, config=None):
451
"""Note: the 'checker' key in 'config' sets the
452
'checker_command' attribute and *not* the 'checker'
453
attribute."""
561
454
self.name = name
562
if server_settings is None:
563
server_settings = {}
564
self.server_settings = server_settings
565
# adding all client settings
566
for setting, value in settings.items():
567
setattr(self, setting, value)
568
569
if self.enabled:
570
if not hasattr(self, "last_enabled"):
571
self.last_enabled = datetime.datetime.utcnow()
572
if not hasattr(self, "expires"):
573
self.expires = (datetime.datetime.utcnow()
574
+ self.timeout)
575
else:
576
self.last_enabled = None
577
self.expires = None
578
455
if config is None:
456
config = {}
579
457
logger.debug("Creating client %r", self.name)
458
# Uppercase and remove spaces from fingerprint for later
459
# comparison purposes with return value from the fingerprint()
460
# function
461
self.fingerprint = (config["fingerprint"].upper()
462
.replace(" ", ""))
580
463
logger.debug(" Fingerprint: %s", self.fingerprint)
581
self.created = settings.get("created",
582
datetime.datetime.utcnow())
583
584
# attributes specific for this server instance
464
if "secret" in config:
465
self.secret = config["secret"].decode("base64")
466
elif "secfile" in config:
467
with open(os.path.expanduser(os.path.expandvars
468
(config["secfile"])),
469
"rb") as secfile:
470
self.secret = secfile.read()
471
else:
472
raise TypeError("No secret or secfile for client %s"
473
% self.name)
474
self.host = config.get("host", "")
475
self.created = datetime.datetime.utcnow()
476
self.enabled = config.get("enabled", True)
477
self.last_approval_request = None
478
if self.enabled:
479
self.last_enabled = datetime.datetime.utcnow()
480
else:
481
self.last_enabled = None
482
self.last_checked_ok = None
483
self.last_checker_status = None
484
self.timeout = string_to_delta(config["timeout"])
485
self.extended_timeout = string_to_delta(config
486
["extended_timeout"])
487
self.interval = string_to_delta(config["interval"])
585
488
self.checker = None
586
489
self.checker_initiator_tag = None
587
490
self.disable_initiator_tag = None
491
if self.enabled:
492
self.expires = datetime.datetime.utcnow() + self.timeout
493
else:
494
self.expires = None
588
495
self.checker_callback_tag = None
496
self.checker_command = config["checker"]
589
497
self.current_checker_command = None
590
self.approved = None
498
self._approved = None
499
self.approved_by_default = config.get("approved_by_default",
500
True)
591
501
self.approvals_pending = 0
592
self.changedstate = multiprocessing_manager.Condition(
593
multiprocessing_manager.Lock())
594
self.client_structure = [attr
595
for attr in self.__dict__.iterkeys()
502
self.approval_delay = string_to_delta(
503
config["approval_delay"])
504
self.approval_duration = string_to_delta(
505
config["approval_duration"])
506
self.changedstate = (multiprocessing_manager
507
.Condition(multiprocessing_manager
508
.Lock()))
509
self.client_structure = [attr for attr in
510
self.__dict__.iterkeys()
596
511
if not attr.startswith("_")]
597
512
self.client_structure.append("client_structure")
598
513
599
for name, t in inspect.getmembers(
600
type(self), lambda obj: isinstance(obj, property)):
514
for name, t in inspect.getmembers(type(self),
515
lambda obj:
516
isinstance(obj,
517
property)):
601
518
if not name.startswith("_"):
602
519
self.client_structure.append(name)
603
520
611
528
if getattr(self, "enabled", False):
612
529
# Already enabled
613
530
return
531
self.send_changedstate()
614
532
self.expires = datetime.datetime.utcnow() + self.timeout
615
533
self.enabled = True
616
534
self.last_enabled = datetime.datetime.utcnow()
617
535
self.init_checker()
618
self.send_changedstate()
619
536
620
537
def disable(self, quiet=True):
621
538
"""Disable this client."""
622
539
if not getattr(self, "enabled", False):
623
540
return False
624
541
if not quiet:
542
self.send_changedstate()
543
if not quiet:
625
544
logger.info("Disabling client %s", self.name)
626
if getattr(self, "disable_initiator_tag", None) is not None:
545
if getattr(self, "disable_initiator_tag", False):
627
546
gobject.source_remove(self.disable_initiator_tag)
628
547
self.disable_initiator_tag = None
629
548
self.expires = None
630
if getattr(self, "checker_initiator_tag", None) is not None:
549
if getattr(self, "checker_initiator_tag", False):
631
550
gobject.source_remove(self.checker_initiator_tag)
632
551
self.checker_initiator_tag = None
633
552
self.stop_checker()
634
553
self.enabled = False
635
if not quiet:
636
self.send_changedstate()
637
554
# Do not run this again if called by a gobject.timeout_add
638
555
return False
639
556
643
560
def init_checker(self):
644
561
# Schedule a new checker to be started an 'interval' from now,
645
562
# and every interval from then on.
646
if self.checker_initiator_tag is not None:
647
gobject.source_remove(self.checker_initiator_tag)
648
self.checker_initiator_tag = gobject.timeout_add(
649
int(self.interval.total_seconds() * 1000),
650
self.start_checker)
563
self.checker_initiator_tag = (gobject.timeout_add
564
(self.interval_milliseconds(),
565
self.start_checker))
651
566
# Schedule a disable() when 'timeout' has passed
652
if self.disable_initiator_tag is not None:
653
gobject.source_remove(self.disable_initiator_tag)
654
self.disable_initiator_tag = gobject.timeout_add(
655
int(self.timeout.total_seconds() * 1000), self.disable)
567
self.disable_initiator_tag = (gobject.timeout_add
568
(self.timeout_milliseconds(),
569
self.disable))
656
570
# Also start a new checker *right now*.
657
571
self.start_checker()
658
572
659
def checker_callback(self, source, condition, connection,
660
command):
573
def checker_callback(self, pid, condition, command):
661
574
"""The checker has completed, so take appropriate actions."""
662
575
self.checker_callback_tag = None
663
576
self.checker = None
664
# Read return code from connection (see call_pipe)
665
returncode = connection.recv()
666
connection.close()
667
668
if returncode >= 0:
669
self.last_checker_status = returncode
670
self.last_checker_signal = None
577
if os.WIFEXITED(condition):
578
self.last_checker_status = os.WEXITSTATUS(condition)
671
579
if self.last_checker_status == 0:
672
580
logger.info("Checker for %(name)s succeeded",
673
581
vars(self))
674
582
self.checked_ok()
675
583
else:
676
logger.info("Checker for %(name)s failed", vars(self))
584
logger.info("Checker for %(name)s failed",
585
vars(self))
677
586
else:
678
587
self.last_checker_status = -1
679
self.last_checker_signal = -returncode
680
588
logger.warning("Checker for %(name)s crashed?",
681
589
vars(self))
682
return False
683
684
def checked_ok(self):
685
"""Assert that the client has been seen, alive and well."""
686
self.last_checked_ok = datetime.datetime.utcnow()
687
self.last_checker_status = 0
688
self.last_checker_signal = None
689
self.bump_timeout()
690
691
def bump_timeout(self, timeout=None):
692
"""Bump up the timeout for this client."""
590
591
def checked_ok(self, timeout=None):
592
"""Bump up the timeout for this client.
593
594
This should only be called when the client has been seen,
595
alive and well.
596
"""
693
597
if timeout is None:
694
598
timeout = self.timeout
599
self.last_checked_ok = datetime.datetime.utcnow()
695
600
if self.disable_initiator_tag is not None:
696
601
gobject.source_remove(self.disable_initiator_tag)
697
self.disable_initiator_tag = None
698
602
if getattr(self, "enabled", False):
699
self.disable_initiator_tag = gobject.timeout_add(
700
int(timeout.total_seconds() * 1000), self.disable)
603
self.disable_initiator_tag = (gobject.timeout_add
604
(_timedelta_to_milliseconds
605
(timeout), self.disable))
701
606
self.expires = datetime.datetime.utcnow() + timeout
702
607
703
608
def need_approval(self):
709
614
If a checker already exists, leave it running and do
710
615
nothing."""
711
616
# The reason for not killing a running checker is that if we
712
# did that, and if a checker (for some reason) started running
713
# slowly and taking more than 'interval' time, then the client
714
# would inevitably timeout, since no checker would get a
715
# chance to run to completion. If we instead leave running
617
# did that, then if a checker (for some reason) started
618
# running slowly and taking more than 'interval' time, the
619
# client would inevitably timeout, since no checker would get
620
# a chance to run to completion. If we instead leave running
716
621
# checkers alone, the checker would have to take more time
717
622
# than 'timeout' for the client to be disabled, which is as it
718
623
# should be.
719
624
720
if self.checker is not None and not self.checker.is_alive():
721
logger.warning("Checker was not alive; joining")
722
self.checker.join()
723
self.checker = None
625
# If a checker exists, make sure it is not a zombie
626
try:
627
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
628
except (AttributeError, OSError) as error:
629
if (isinstance(error, OSError)
630
and error.errno != errno.ECHILD):
631
raise error
632
else:
633
if pid:
634
logger.warning("Checker was a zombie")
635
gobject.source_remove(self.checker_callback_tag)
636
self.checker_callback(pid, status,
637
self.current_checker_command)
724
638
# Start a new checker if needed
725
639
if self.checker is None:
726
# Escape attributes for the shell
727
escaped_attrs = {
728
attr: re.escape(str(getattr(self, attr)))
729
for attr in self.runtime_expansions }
730
640
try:
731
command = self.checker_command % escaped_attrs
732
except TypeError as error:
733
logger.error('Could not format string "%s"',
734
self.checker_command,
735
exc_info=error)
736
return True # Try again later
641
# In case checker_command has exactly one % operator
642
command = self.checker_command % self.host
643
except TypeError:
644
# Escape attributes for the shell
645
escaped_attrs = dict(
646
(attr,
647
re.escape(unicode(str(getattr(self, attr, "")),
648
errors=
649
'replace')))
650
for attr in
651
self.runtime_expansions)
652
653
try:
654
command = self.checker_command % escaped_attrs
655
except TypeError as error:
656
logger.error('Could not format string "%s":'
657
' %s', self.checker_command, error)
658
return True # Try again later
737
659
self.current_checker_command = command
738
logger.info("Starting checker %r for %s", command,
739
self.name)
740
# We don't need to redirect stdout and stderr, since
741
# in normal mode, that is already done by daemon(),
742
# and in debug mode we don't want to. (Stdin is
743
# always replaced by /dev/null.)
744
# The exception is when not debugging but nevertheless
745
# running in the foreground; use the previously
746
# created wnull.
747
popen_args = { "close_fds": True,
748
"shell": True,
749
"cwd": "/" }
750
if (not self.server_settings["debug"]
751
and self.server_settings["foreground"]):
752
popen_args.update({"stdout": wnull,
753
"stderr": wnull })
754
pipe = multiprocessing.Pipe(duplex = False)
755
self.checker = multiprocessing.Process(
756
target = call_pipe,
757
args = (pipe[1], subprocess.call, command),
758
kwargs = popen_args)
759
self.checker.start()
760
self.checker_callback_tag = gobject.io_add_watch(
761
pipe[0].fileno(), gobject.IO_IN,
762
self.checker_callback, pipe[0], command)
660
try:
661
logger.info("Starting checker %r for %s",
662
command, self.name)
663
# We don't need to redirect stdout and stderr, since
664
# in normal mode, that is already done by daemon(),
665
# and in debug mode we don't want to. (Stdin is
666
# always replaced by /dev/null.)
667
self.checker = subprocess.Popen(command,
668
close_fds=True,
669
shell=True, cwd="/")
670
self.checker_callback_tag = (gobject.child_watch_add
671
(self.checker.pid,
672
self.checker_callback,
673
data=command))
674
# The checker may have completed before the gobject
675
# watch was added. Check for this.
676
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
677
if pid:
678
gobject.source_remove(self.checker_callback_tag)
679
self.checker_callback(pid, status, command)
680
except OSError as error:
681
logger.error("Failed to start subprocess: %s",
682
error)
763
683
# Re-run this periodically if run by gobject.timeout_add
764
684
return True
765
685
771
691
if getattr(self, "checker", None) is None:
772
692
return
773
693
logger.debug("Stopping checker for %(name)s", vars(self))
774
self.checker.terminate()
694
try:
695
os.kill(self.checker.pid, signal.SIGTERM)
696
#time.sleep(0.5)
697
#if self.checker.poll() is None:
698
# os.kill(self.checker.pid, signal.SIGKILL)
699
except OSError as error:
700
if error.errno != errno.ESRCH: # No such process
701
raise
775
702
self.checker = None
776
703
777
704
778
def dbus_service_property(dbus_interface,
779
signature="v",
780
access="readwrite",
781
byte_arrays=False):
705
def dbus_service_property(dbus_interface, signature="v",
706
access="readwrite", byte_arrays=False):
782
707
"""Decorators for marking methods of a DBusObjectWithProperties to
783
708
become properties on the D-Bus.
784
709
793
718
# "Set" method, so we fail early here:
794
719
if byte_arrays and signature != "ay":
795
720
raise ValueError("Byte arrays not supported for non-'ay'"
796
" signature {!r}".format(signature))
797
721
" signature %r" % signature)
798
722
def decorator(func):
799
723
func._dbus_is_property = True
800
724
func._dbus_interface = dbus_interface
805
729
func._dbus_name = func._dbus_name[:-14]
806
730
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
807
731
return func
808
809
return decorator
810
811
812
def dbus_interface_annotations(dbus_interface):
813
"""Decorator for marking functions returning interface annotations
814
815
Usage:
816
817
@dbus_interface_annotations("org.example.Interface")
818
def _foo(self): # Function name does not matter
819
return {"org.freedesktop.DBus.Deprecated": "true",
820
"org.freedesktop.DBus.Property.EmitsChangedSignal":
821
"false"}
822
"""
823
824
def decorator(func):
825
func._dbus_is_interface = True
826
func._dbus_interface = dbus_interface
827
func._dbus_name = dbus_interface
828
return func
829
830
return decorator
831
832
833
def dbus_annotations(annotations):
834
"""Decorator to annotate D-Bus methods, signals or properties
835
Usage:
836
837
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
838
"org.freedesktop.DBus.Property."
839
"EmitsChangedSignal": "false"})
840
@dbus_service_property("org.example.Interface", signature="b",
841
access="r")
842
def Property_dbus_property(self):
843
return dbus.Boolean(False)
844
845
See also the DBusObjectWithAnnotations class.
846
"""
847
848
def decorator(func):
849
func._dbus_annotations = annotations
850
return func
851
852
732
return decorator
853
733
854
734
855
735
class DBusPropertyException(dbus.exceptions.DBusException):
856
736
"""A base class for D-Bus property-related exceptions
857
737
"""
858
pass
738
def __unicode__(self):
739
return unicode(str(self))
859
740
860
741
861
742
class DBusPropertyAccessException(DBusPropertyException):
870
751
pass
871
752
872
753
873
class DBusObjectWithAnnotations(dbus.service.Object):
874
"""A D-Bus object with annotations.
875
876
Classes inheriting from this can use the dbus_annotations
877
decorator to add annotations to methods or signals.
878
"""
879
880
@staticmethod
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
883
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
886
"""
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
False)
889
890
def _get_all_dbus_things(self, thing):
891
"""Returns a generator of (name, attribute) pairs
892
"""
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
895
for cls in self.__class__.__mro__
896
for name, athing in
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
898
899
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
900
out_signature = "s",
901
path_keyword = 'object_path',
902
connection_keyword = 'connection')
903
def Introspect(self, object_path, connection):
904
"""Overloading of standard D-Bus method.
905
906
Inserts annotation tags on methods and signals.
907
"""
908
xmlstring = dbus.service.Object.Introspect(self, object_path,
909
connection)
910
try:
911
document = xml.dom.minidom.parseString(xmlstring)
912
913
for if_tag in document.getElementsByTagName("interface"):
914
# Add annotation tags
915
for typ in ("method", "signal"):
916
for tag in if_tag.getElementsByTagName(typ):
917
annots = dict()
918
for name, prop in (self.
919
_get_all_dbus_things(typ)):
920
if (name == tag.getAttribute("name")
921
and prop._dbus_interface
922
== if_tag.getAttribute("name")):
923
annots.update(getattr(
924
prop, "_dbus_annotations", {}))
925
for name, value in annots.items():
926
ann_tag = document.createElement(
927
"annotation")
928
ann_tag.setAttribute("name", name)
929
ann_tag.setAttribute("value", value)
930
tag.appendChild(ann_tag)
931
# Add interface annotation tags
932
for annotation, value in dict(
933
itertools.chain.from_iterable(
934
annotations().items()
935
for name, annotations
936
in self._get_all_dbus_things("interface")
937
if name == if_tag.getAttribute("name")
938
)).items():
939
ann_tag = document.createElement("annotation")
940
ann_tag.setAttribute("name", annotation)
941
ann_tag.setAttribute("value", value)
942
if_tag.appendChild(ann_tag)
943
# Fix argument name for the Introspect method itself
944
if (if_tag.getAttribute("name")
945
== dbus.INTROSPECTABLE_IFACE):
946
for cn in if_tag.getElementsByTagName("method"):
947
if cn.getAttribute("name") == "Introspect":
948
for arg in cn.getElementsByTagName("arg"):
949
if (arg.getAttribute("direction")
950
== "out"):
951
arg.setAttribute("name",
952
"xml_data")
953
xmlstring = document.toxml("utf-8")
954
document.unlink()
955
except (AttributeError, xml.dom.DOMException,
956
xml.parsers.expat.ExpatError) as error:
957
logger.error("Failed to override Introspection method",
958
exc_info=error)
959
return xmlstring
960
961
962
class DBusObjectWithProperties(DBusObjectWithAnnotations):
754
class DBusObjectWithProperties(dbus.service.Object):
963
755
"""A D-Bus object with properties.
964
756
965
757
Classes inheriting from this can use the dbus_service_property
967
759
standard Get(), Set(), and GetAll() methods on the D-Bus.
968
760
"""
969
761
762
@staticmethod
763
def _is_dbus_property(obj):
764
return getattr(obj, "_dbus_is_property", False)
765
766
def _get_all_dbus_properties(self):
767
"""Returns a generator of (name, attribute) pairs
768
"""
769
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
770
for cls in self.__class__.__mro__
771
for name, prop in
772
inspect.getmembers(cls, self._is_dbus_property))
773
970
774
def _get_dbus_property(self, interface_name, property_name):
971
775
"""Returns a bound method if one exists which is a D-Bus
972
776
property with the specified name and interface.
973
777
"""
974
for cls in self.__class__.__mro__:
975
for name, value in inspect.getmembers(
976
cls, self._is_dbus_thing("property")):
778
for cls in self.__class__.__mro__:
779
for name, value in (inspect.getmembers
780
(cls, self._is_dbus_property)):
977
781
if (value._dbus_name == property_name
978
782
and value._dbus_interface == interface_name):
979
783
return value.__get__(self)
980
784
981
785
# No such property
982
raise DBusPropertyNotFound("{}:{}.{}".format(
983
self.dbus_object_path, interface_name, property_name))
984
985
@classmethod
986
def _get_all_interface_names(cls):
987
"""Get a sequence of all interfaces supported by an object"""
988
return (name for name in set(getattr(getattr(x, attr),
989
"_dbus_interface", None)
990
for x in (inspect.getmro(cls))
991
for attr in dir(x))
992
if name is not None)
993
994
@dbus.service.method(dbus.PROPERTIES_IFACE,
995
in_signature="ss",
786
raise DBusPropertyNotFound(self.dbus_object_path + ":"
787
+ interface_name + "."
788
+ property_name)
789
790
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
996
791
out_signature="v")
997
792
def Get(self, interface_name, property_name):
998
793
"""Standard D-Bus property Get() method, see D-Bus standard.
1016
811
# The byte_arrays option is not supported yet on
1017
812
# signatures other than "ay".
1018
813
if prop._dbus_signature != "ay":
1019
raise ValueError("Byte arrays not supported for non-"
1020
"'ay' signature {!r}"
1021
.format(prop._dbus_signature))
1022
value = dbus.ByteArray(b''.join(chr(byte)
1023
for byte in value))
814
raise ValueError
815
value = dbus.ByteArray(''.join(unichr(byte)
816
for byte in value))
1024
817
prop(value)
1025
818
1026
@dbus.service.method(dbus.PROPERTIES_IFACE,
1027
in_signature="s",
819
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1028
820
out_signature="a{sv}")
1029
821
def GetAll(self, interface_name):
1030
822
"""Standard D-Bus property GetAll() method, see D-Bus
1033
825
Note: Will not include properties with access="write".
1034
826
"""
1035
827
properties = {}
1036
for name, prop in self._get_all_dbus_things("property"):
828
for name, prop in self._get_all_dbus_properties():
1037
829
if (interface_name
1038
830
and interface_name != prop._dbus_interface):
1039
831
# Interface non-empty but did not match
1045
837
if not hasattr(value, "variant_level"):
1046
838
properties[name] = value
1047
839
continue
1048
properties[name] = type(value)(
1049
value, variant_level = value.variant_level + 1)
840
properties[name] = type(value)(value, variant_level=
841
value.variant_level+1)
1050
842
return dbus.Dictionary(properties, signature="sv")
1051
843
1052
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1053
def PropertiesChanged(self, interface_name, changed_properties,
1054
invalidated_properties):
1055
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1056
standard.
1057
"""
1058
pass
1059
1060
844
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1061
845
out_signature="s",
1062
846
path_keyword='object_path',
1063
847
connection_keyword='connection')
1064
848
def Introspect(self, object_path, connection):
1065
"""Overloading of standard D-Bus method.
1066
1067
Inserts property tags and interface annotation tags.
849
"""Standard D-Bus method, overloaded to insert property tags.
1068
850
"""
1069
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1070
object_path,
1071
connection)
851
xmlstring = dbus.service.Object.Introspect(self, object_path,
852
connection)
1072
853
try:
1073
854
document = xml.dom.minidom.parseString(xmlstring)
1074
1075
855
def make_tag(document, name, prop):
1076
856
e = document.createElement("property")
1077
857
e.setAttribute("name", name)
1078
858
e.setAttribute("type", prop._dbus_signature)
1079
859
e.setAttribute("access", prop._dbus_access)
1080
860
return e
1081
1082
861
for if_tag in document.getElementsByTagName("interface"):
1083
# Add property tags
1084
862
for tag in (make_tag(document, name, prop)
1085
863
for name, prop
1086
in self._get_all_dbus_things("property")
864
in self._get_all_dbus_properties()
1087
865
if prop._dbus_interface
1088
866
== if_tag.getAttribute("name")):
1089
867
if_tag.appendChild(tag)
1090
# Add annotation tags for properties
1091
for tag in if_tag.getElementsByTagName("property"):
1092
annots = dict()
1093
for name, prop in self._get_all_dbus_things(
1094
"property"):
1095
if (name == tag.getAttribute("name")
1096
and prop._dbus_interface
1097
== if_tag.getAttribute("name")):
1098
annots.update(getattr(
1099
prop, "_dbus_annotations", {}))
1100
for name, value in annots.items():
1101
ann_tag = document.createElement(
1102
"annotation")
1103
ann_tag.setAttribute("name", name)
1104
ann_tag.setAttribute("value", value)
1105
tag.appendChild(ann_tag)
1106
868
# Add the names to the return values for the
1107
869
# "org.freedesktop.DBus.Properties" methods
1108
870
if (if_tag.getAttribute("name")
1123
885
except (AttributeError, xml.dom.DOMException,
1124
886
xml.parsers.expat.ExpatError) as error:
1125
887
logger.error("Failed to override Introspection method",
1126
exc_info=error)
1127
return xmlstring
1128
1129
try:
1130
dbus.OBJECT_MANAGER_IFACE
1131
except AttributeError:
1132
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1133
1134
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1135
"""A D-Bus object with an ObjectManager.
1136
1137
Classes inheriting from this exposes the standard
1138
GetManagedObjects call and the InterfacesAdded and
1139
InterfacesRemoved signals on the standard
1140
"org.freedesktop.DBus.ObjectManager" interface.
1141
1142
Note: No signals are sent automatically; they must be sent
1143
manually.
1144
"""
1145
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1146
out_signature = "a{oa{sa{sv}}}")
1147
def GetManagedObjects(self):
1148
"""This function must be overridden"""
1149
raise NotImplementedError()
1150
1151
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1152
signature = "oa{sa{sv}}")
1153
def InterfacesAdded(self, object_path, interfaces_and_properties):
1154
pass
1155
1156
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1157
def InterfacesRemoved(self, object_path, interfaces):
1158
pass
1159
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1164
def Introspect(self, object_path, connection):
1165
"""Overloading of standard D-Bus method.
1166
1167
Override return argument name of GetManagedObjects to be
1168
"objpath_interfaces_and_properties"
1169
"""
1170
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1171
object_path,
1172
connection)
1173
try:
1174
document = xml.dom.minidom.parseString(xmlstring)
1175
1176
for if_tag in document.getElementsByTagName("interface"):
1177
# Fix argument name for the GetManagedObjects method
1178
if (if_tag.getAttribute("name")
1179
== dbus.OBJECT_MANAGER_IFACE):
1180
for cn in if_tag.getElementsByTagName("method"):
1181
if (cn.getAttribute("name")
1182
== "GetManagedObjects"):
1183
for arg in cn.getElementsByTagName("arg"):
1184
if (arg.getAttribute("direction")
1185
== "out"):
1186
arg.setAttribute(
1187
"name",
1188
"objpath_interfaces"
1189
"_and_properties")
1190
xmlstring = document.toxml("utf-8")
1191
document.unlink()
1192
except (AttributeError, xml.dom.DOMException,
1193
xml.parsers.expat.ExpatError) as error:
1194
logger.error("Failed to override Introspection method",
1195
exc_info = error)
1196
return xmlstring
1197
1198
def datetime_to_dbus(dt, variant_level=0):
888
error)
889
return xmlstring
890
891
892
def datetime_to_dbus (dt, variant_level=0):
1199
893
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1200
894
if dt is None:
1201
895
return dbus.String("", variant_level = variant_level)
1202
return dbus.String(dt.isoformat(), variant_level=variant_level)
1203
1204
1205
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1206
"""A class decorator; applied to a subclass of
1207
dbus.service.Object, it will add alternate D-Bus attributes with
1208
interface names according to the "alt_interface_names" mapping.
1209
Usage:
1210
1211
@alternate_dbus_interfaces({"org.example.Interface":
1212
"net.example.AlternateInterface"})
1213
class SampleDBusObject(dbus.service.Object):
1214
@dbus.service.method("org.example.Interface")
1215
def SampleDBusMethod():
1216
pass
1217
1218
The above "SampleDBusMethod" on "SampleDBusObject" will be
1219
reachable via two interfaces: "org.example.Interface" and
1220
"net.example.AlternateInterface", the latter of which will have
1221
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1222
"true", unless "deprecate" is passed with a False value.
1223
1224
This works for methods and signals, and also for D-Bus properties
1225
(from DBusObjectWithProperties) and interfaces (from the
1226
dbus_interface_annotations decorator).
896
return dbus.String(dt.isoformat(),
897
variant_level=variant_level)
898
899
900
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
901
.__metaclass__):
902
"""Applied to an empty subclass of a D-Bus object, this metaclass
903
will add additional D-Bus attributes matching a certain pattern.
1227
904
"""
1228
1229
def wrapper(cls):
1230
for orig_interface_name, alt_interface_name in (
1231
alt_interface_names.items()):
1232
attr = {}
1233
interface_names = set()
1234
# Go though all attributes of the class
1235
for attrname, attribute in inspect.getmembers(cls):
905
def __new__(mcs, name, bases, attr):
906
# Go through all the base classes which could have D-Bus
907
# methods, signals, or properties in them
908
for base in (b for b in bases
909
if issubclass(b, dbus.service.Object)):
910
# Go though all attributes of the base class
911
for attrname, attribute in inspect.getmembers(base):
1236
912
# Ignore non-D-Bus attributes, and D-Bus attributes
1237
913
# with the wrong interface name
1238
914
if (not hasattr(attribute, "_dbus_interface")
1239
or not attribute._dbus_interface.startswith(
1240
orig_interface_name)):
915
or not attribute._dbus_interface
916
.startswith("se.recompile.Mandos")):
1241
917
continue
1242
918
# Create an alternate D-Bus interface name based on
1243
919
# the current name
1244
alt_interface = attribute._dbus_interface.replace(
1245
orig_interface_name, alt_interface_name)
1246
interface_names.add(alt_interface)
920
alt_interface = (attribute._dbus_interface
921
.replace("se.recompile.Mandos",
922
"se.bsnet.fukt.Mandos"))
1247
923
# Is this a D-Bus signal?
1248
924
if getattr(attribute, "_dbus_is_signal", False):
1249
if sys.version_info.major == 2:
1250
# Extract the original non-method undecorated
1251
# function by black magic
1252
nonmethod_func = (dict(
925
# Extract the original non-method function by
926
# black magic
927
nonmethod_func = (dict(
1253
928
zip(attribute.func_code.co_freevars,
1254
attribute.__closure__))
1255
["func"].cell_contents)
1256
else:
1257
nonmethod_func = attribute
929
attribute.__closure__))["func"]
930
.cell_contents)
1258
931
# Create a new, but exactly alike, function
1259
932
# object, and decorate it to be a new D-Bus signal
1260
933
# with the alternate D-Bus interface name
1261
if sys.version_info.major == 2:
1262
new_function = types.FunctionType(
1263
nonmethod_func.func_code,
1264
nonmethod_func.func_globals,
1265
nonmethod_func.func_name,
1266
nonmethod_func.func_defaults,
1267
nonmethod_func.func_closure)
1268
else:
1269
new_function = types.FunctionType(
1270
nonmethod_func.__code__,
1271
nonmethod_func.__globals__,
1272
nonmethod_func.__name__,
1273
nonmethod_func.__defaults__,
1274
nonmethod_func.__closure__)
1275
new_function = (dbus.service.signal(
1276
alt_interface,
1277
attribute._dbus_signature)(new_function))
1278
# Copy annotations, if any
1279
try:
1280
new_function._dbus_annotations = dict(
1281
attribute._dbus_annotations)
1282
except AttributeError:
1283
pass
934
new_function = (dbus.service.signal
935
(alt_interface,
936
attribute._dbus_signature)
937
(types.FunctionType(
938
nonmethod_func.func_code,
939
nonmethod_func.func_globals,
940
nonmethod_func.func_name,
941
nonmethod_func.func_defaults,
942
nonmethod_func.func_closure)))
1284
943
# Define a creator of a function to call both the
1285
# original and alternate functions, so both the
1286
# original and alternate signals gets sent when
1287
# the function is called
944
# old and new functions, so both the old and new
945
# signals gets sent when the function is called
1288
946
def fixscope(func1, func2):
1289
947
"""This function is a scope container to pass
1290
948
func1 and func2 to the "call_both" function
1291
949
outside of its arguments"""
1292
1293
@functools.wraps(func2)
1294
950
def call_both(*args, **kwargs):
1295
951
"""This function will emit two D-Bus
1296
952
signals by calling func1 and func2"""
1297
953
func1(*args, **kwargs)
1298
954
func2(*args, **kwargs)
1299
# Make wrapper function look like a D-Bus signal
1300
for name, attr in inspect.getmembers(func2):
1301
if name.startswith("_dbus_"):
1302
setattr(call_both, name, attr)
1303
1304
955
return call_both
1305
956
# Create the "call_both" function and add it to
1306
957
# the class
1307
attr[attrname] = fixscope(attribute, new_function)
958
attr[attrname] = fixscope(attribute,
959
new_function)
1308
960
# Is this a D-Bus method?
1309
961
elif getattr(attribute, "_dbus_is_method", False):
1310
962
# Create a new, but exactly alike, function
1311
963
# object. Decorate it to be a new D-Bus method
1312
964
# with the alternate D-Bus interface name. Add it
1313
965
# to the class.
1314
attr[attrname] = (
1315
dbus.service.method(
1316
alt_interface,
1317
attribute._dbus_in_signature,
1318
attribute._dbus_out_signature)
1319
(types.FunctionType(attribute.func_code,
1320
attribute.func_globals,
1321
attribute.func_name,
1322
attribute.func_defaults,
1323
attribute.func_closure)))
1324
# Copy annotations, if any
1325
try:
1326
attr[attrname]._dbus_annotations = dict(
1327
attribute._dbus_annotations)
1328
except AttributeError:
1329
pass
966
attr[attrname] = (dbus.service.method
967
(alt_interface,
968
attribute._dbus_in_signature,
969
attribute._dbus_out_signature)
970
(types.FunctionType
971
(attribute.func_code,
972
attribute.func_globals,
973
attribute.func_name,
974
attribute.func_defaults,
975
attribute.func_closure)))
1330
976
# Is this a D-Bus property?
1331
977
elif getattr(attribute, "_dbus_is_property", False):
1332
978
# Create a new, but exactly alike, function
1333
979
# object, and decorate it to be a new D-Bus
1334
980
# property with the alternate D-Bus interface
1335
981
# name. Add it to the class.
1336
attr[attrname] = (dbus_service_property(
1337
alt_interface, attribute._dbus_signature,
1338
attribute._dbus_access,
1339
attribute._dbus_get_args_options
1340
["byte_arrays"])
1341
(types.FunctionType(
1342
attribute.func_code,
1343
attribute.func_globals,
1344
attribute.func_name,
1345
attribute.func_defaults,
1346
attribute.func_closure)))
1347
# Copy annotations, if any
1348
try:
1349
attr[attrname]._dbus_annotations = dict(
1350
attribute._dbus_annotations)
1351
except AttributeError:
1352
pass
1353
# Is this a D-Bus interface?
1354
elif getattr(attribute, "_dbus_is_interface", False):
1355
# Create a new, but exactly alike, function
1356
# object. Decorate it to be a new D-Bus interface
1357
# with the alternate D-Bus interface name. Add it
1358
# to the class.
1359
attr[attrname] = (
1360
dbus_interface_annotations(alt_interface)
1361
(types.FunctionType(attribute.func_code,
1362
attribute.func_globals,
1363
attribute.func_name,
1364
attribute.func_defaults,
1365
attribute.func_closure)))
1366
if deprecate:
1367
# Deprecate all alternate interfaces
1368
iname="_AlternateDBusNames_interface_annotation{}"
1369
for interface_name in interface_names:
1370
1371
@dbus_interface_annotations(interface_name)
1372
def func(self):
1373
return { "org.freedesktop.DBus.Deprecated":
1374
"true" }
1375
# Find an unused name
1376
for aname in (iname.format(i)
1377
for i in itertools.count()):
1378
if aname not in attr:
1379
attr[aname] = func
1380
break
1381
if interface_names:
1382
# Replace the class with a new subclass of it with
1383
# methods, signals, etc. as created above.
1384
cls = type(b"{}Alternate".format(cls.__name__),
1385
(cls, ), attr)
1386
return cls
1387
1388
return wrapper
1389
1390
1391
@alternate_dbus_interfaces({"se.recompile.Mandos":
1392
"se.bsnet.fukt.Mandos"})
982
attr[attrname] = (dbus_service_property
983
(alt_interface,
984
attribute._dbus_signature,
985
attribute._dbus_access,
986
attribute
987
._dbus_get_args_options
988
["byte_arrays"])
989
(types.FunctionType
990
(attribute.func_code,
991
attribute.func_globals,
992
attribute.func_name,
993
attribute.func_defaults,
994
attribute.func_closure)))
995
return type.__new__(mcs, name, bases, attr)
996
997
1393
998
class ClientDBus(Client, DBusObjectWithProperties):
1394
999
"""A Client class using D-Bus
1395
1000
1399
1004
"""
1400
1005
1401
1006
runtime_expansions = (Client.runtime_expansions
1402
+ ("dbus_object_path", ))
1403
1404
_interface = "se.recompile.Mandos.Client"
1007
+ ("dbus_object_path",))
1405
1008
1406
1009
# dbus.service.Object doesn't use super(), so we can't either.
1407
1010
1408
1011
def __init__(self, bus = None, *args, **kwargs):
1409
1012
self.bus = bus
1410
1013
Client.__init__(self, *args, **kwargs)
1014
1015
self._approvals_pending = 0
1411
1016
# Only now, when this client is initialized, can it show up on
1412
1017
# the D-Bus
1413
client_object_name = str(self.name).translate(
1018
client_object_name = unicode(self.name).translate(
1414
1019
{ord("."): ord("_"),
1415
1020
ord("-"): ord("_")})
1416
self.dbus_object_path = dbus.ObjectPath(
1417
"/clients/" + client_object_name)
1021
self.dbus_object_path = (dbus.ObjectPath
1022
("/clients/" + client_object_name))
1418
1023
DBusObjectWithProperties.__init__(self, self.bus,
1419
1024
self.dbus_object_path)
1420
1421
def notifychangeproperty(transform_func, dbus_name,
1422
type_func=lambda x: x,
1423
variant_level=1,
1424
invalidate_only=False,
1425
_interface=_interface):
1025
1026
def notifychangeproperty(transform_func,
1027
dbus_name, type_func=lambda x: x,
1028
variant_level=1):
1426
1029
""" Modify a variable so that it's a property which announces
1427
1030
its changes to DBus.
1428
1031
1433
1036
to the D-Bus. Default: no transform
1434
1037
variant_level: D-Bus variant level. Default: 1
1435
1038
"""
1436
attrname = "_{}".format(dbus_name)
1437
1039
attrname = "_{0}".format(dbus_name)
1438
1040
def setter(self, value):
1439
1041
if hasattr(self, "dbus_object_path"):
1440
1042
if (not hasattr(self, attrname) or
1441
1043
type_func(getattr(self, attrname, None))
1442
1044
!= type_func(value)):
1443
if invalidate_only:
1444
self.PropertiesChanged(
1445
_interface, dbus.Dictionary(),
1446
dbus.Array((dbus_name, )))
1447
else:
1448
dbus_value = transform_func(
1449
type_func(value),
1450
variant_level = variant_level)
1451
self.PropertyChanged(dbus.String(dbus_name),
1452
dbus_value)
1453
self.PropertiesChanged(
1454
_interface,
1455
dbus.Dictionary({ dbus.String(dbus_name):
1456
dbus_value }),
1457
dbus.Array())
1045
dbus_value = transform_func(type_func(value),
1046
variant_level
1047
=variant_level)
1048
self.PropertyChanged(dbus.String(dbus_name),
1049
dbus_value)
1458
1050
setattr(self, attrname, value)
1459
1051
1460
1052
return property(lambda self: getattr(self, attrname), setter)
1461
1053
1054
1462
1055
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1463
1056
approvals_pending = notifychangeproperty(dbus.Boolean,
1464
1057
"ApprovalPending",
1466
1059
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1467
1060
last_enabled = notifychangeproperty(datetime_to_dbus,
1468
1061
"LastEnabled")
1469
checker = notifychangeproperty(
1470
dbus.Boolean, "CheckerRunning",
1471
type_func = lambda checker: checker is not None)
1062
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1063
type_func = lambda checker:
1064
checker is not None)
1472
1065
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1473
1066
"LastCheckedOK")
1474
last_checker_status = notifychangeproperty(dbus.Int16,
1475
"LastCheckerStatus")
1476
1067
last_approval_request = notifychangeproperty(
1477
1068
datetime_to_dbus, "LastApprovalRequest")
1478
1069
approved_by_default = notifychangeproperty(dbus.Boolean,
1479
1070
"ApprovedByDefault")
1480
approval_delay = notifychangeproperty(
1481
dbus.UInt64, "ApprovalDelay",
1482
type_func = lambda td: td.total_seconds() * 1000)
1071
approval_delay = notifychangeproperty(dbus.UInt16,
1072
"ApprovalDelay",
1073
type_func =
1074
_timedelta_to_milliseconds)
1483
1075
approval_duration = notifychangeproperty(
1484
dbus.UInt64, "ApprovalDuration",
1485
type_func = lambda td: td.total_seconds() * 1000)
1076
dbus.UInt16, "ApprovalDuration",
1077
type_func = _timedelta_to_milliseconds)
1486
1078
host = notifychangeproperty(dbus.String, "Host")
1487
timeout = notifychangeproperty(
1488
dbus.UInt64, "Timeout",
1489
type_func = lambda td: td.total_seconds() * 1000)
1079
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1080
type_func =
1081
_timedelta_to_milliseconds)
1490
1082
extended_timeout = notifychangeproperty(
1491
dbus.UInt64, "ExtendedTimeout",
1492
type_func = lambda td: td.total_seconds() * 1000)
1493
interval = notifychangeproperty(
1494
dbus.UInt64, "Interval",
1495
type_func = lambda td: td.total_seconds() * 1000)
1083
dbus.UInt16, "ExtendedTimeout",
1084
type_func = _timedelta_to_milliseconds)
1085
interval = notifychangeproperty(dbus.UInt16,
1086
"Interval",
1087
type_func =
1088
_timedelta_to_milliseconds)
1496
1089
checker_command = notifychangeproperty(dbus.String, "Checker")
1497
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1498
invalidate_only=True)
1499
1090
1500
1091
del notifychangeproperty
1501
1092
1508
1099
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1509
1100
Client.__del__(self, *args, **kwargs)
1510
1101
1511
def checker_callback(self, source, condition,
1512
connection, command, *args, **kwargs):
1513
ret = Client.checker_callback(self, source, condition,
1514
connection, command, *args,
1515
**kwargs)
1516
exitstatus = self.last_checker_status
1517
if exitstatus >= 0:
1102
def checker_callback(self, pid, condition, command,
1103
*args, **kwargs):
1104
self.checker_callback_tag = None
1105
self.checker = None
1106
if os.WIFEXITED(condition):
1107
exitstatus = os.WEXITSTATUS(condition)
1518
1108
# Emit D-Bus signal
1519
1109
self.CheckerCompleted(dbus.Int16(exitstatus),
1520
# This is specific to GNU libC
1521
dbus.Int64(exitstatus << 8),
1110
dbus.Int64(condition),
1522
1111
dbus.String(command))
1523
1112
else:
1524
1113
# Emit D-Bus signal
1525
1114
self.CheckerCompleted(dbus.Int16(-1),
1526
dbus.Int64(
1527
# This is specific to GNU libC
1528
(exitstatus << 8)
1529
| self.last_checker_signal),
1115
dbus.Int64(condition),
1530
1116
dbus.String(command))
1531
return ret
1117
1118
return Client.checker_callback(self, pid, condition, command,
1119
*args, **kwargs)
1532
1120
1533
1121
def start_checker(self, *args, **kwargs):
1534
old_checker_pid = getattr(self.checker, "pid", None)
1122
old_checker = self.checker
1123
if self.checker is not None:
1124
old_checker_pid = self.checker.pid
1125
else:
1126
old_checker_pid = None
1535
1127
r = Client.start_checker(self, *args, **kwargs)
1536
1128
# Only if new checker process was started
1537
1129
if (self.checker is not None
1541
1133
return r
1542
1134
1543
1135
def _reset_approved(self):
1544
self.approved = None
1136
self._approved = None
1545
1137
return False
1546
1138
1547
1139
def approve(self, value=True):
1548
self.approved = value
1549
gobject.timeout_add(int(self.approval_duration.total_seconds()
1550
* 1000), self._reset_approved)
1551
1140
self.send_changedstate()
1141
self._approved = value
1142
gobject.timeout_add(_timedelta_to_milliseconds
1143
(self.approval_duration),
1144
self._reset_approved)
1145
1552
1146
1553
1147
## D-Bus methods, signals & properties
1554
1555
## Interfaces
1148
_interface = "se.recompile.Mandos.Client"
1556
1149
1557
1150
## Signals
1558
1151
1569
1162
pass
1570
1163
1571
1164
# PropertyChanged - signal
1572
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1573
1165
@dbus.service.signal(_interface, signature="sv")
1574
1166
def PropertyChanged(self, property, value):
1575
1167
"D-Bus signal"
1596
1188
"D-Bus signal"
1597
1189
return self.need_approval()
1598
1190
1191
# NeRwequest - signal
1192
@dbus.service.signal(_interface, signature="s")
1193
def NewRequest(self, ip):
1194
"""D-Bus signal
1195
Is sent after a client request a password.
1196
"""
1197
pass
1198
1599
1199
## Methods
1600
1200
1601
1201
# Approve - method
1609
1209
self.checked_ok()
1610
1210
1611
1211
# Enable - method
1612
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1613
1212
@dbus.service.method(_interface)
1614
1213
def Enable(self):
1615
1214
"D-Bus method"
1616
1215
self.enable()
1617
1216
1618
1217
# StartChecker - method
1619
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1620
1218
@dbus.service.method(_interface)
1621
1219
def StartChecker(self):
1622
1220
"D-Bus method"
1623
1221
self.start_checker()
1624
1222
1625
1223
# Disable - method
1626
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1627
1224
@dbus.service.method(_interface)
1628
1225
def Disable(self):
1629
1226
"D-Bus method"
1630
1227
self.disable()
1631
1228
1632
1229
# StopChecker - method
1633
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1634
1230
@dbus.service.method(_interface)
1635
1231
def StopChecker(self):
1636
1232
self.stop_checker()
1643
1239
return dbus.Boolean(bool(self.approvals_pending))
1644
1240
1645
1241
# ApprovedByDefault - property
1646
@dbus_service_property(_interface,
1647
signature="b",
1242
@dbus_service_property(_interface, signature="b",
1648
1243
access="readwrite")
1649
1244
def ApprovedByDefault_dbus_property(self, value=None):
1650
1245
if value is None: # get
1652
1247
self.approved_by_default = bool(value)
1653
1248
1654
1249
# ApprovalDelay - property
1655
@dbus_service_property(_interface,
1656
signature="t",
1250
@dbus_service_property(_interface, signature="t",
1657
1251
access="readwrite")
1658
1252
def ApprovalDelay_dbus_property(self, value=None):
1659
1253
if value is None: # get
1660
return dbus.UInt64(self.approval_delay.total_seconds()
1661
* 1000)
1254
return dbus.UInt64(self.approval_delay_milliseconds())
1662
1255
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1663
1256
1664
1257
# ApprovalDuration - property
1665
@dbus_service_property(_interface,
1666
signature="t",
1258
@dbus_service_property(_interface, signature="t",
1667
1259
access="readwrite")
1668
1260
def ApprovalDuration_dbus_property(self, value=None):
1669
1261
if value is None: # get
1670
return dbus.UInt64(self.approval_duration.total_seconds()
1671
* 1000)
1262
return dbus.UInt64(_timedelta_to_milliseconds(
1263
self.approval_duration))
1672
1264
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1673
1265
1674
1266
# Name - property
1675
@dbus_annotations(
1676
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1677
1267
@dbus_service_property(_interface, signature="s", access="read")
1678
1268
def Name_dbus_property(self):
1679
1269
return dbus.String(self.name)
1680
1270
1681
1271
# Fingerprint - property
1682
@dbus_annotations(
1683
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1684
1272
@dbus_service_property(_interface, signature="s", access="read")
1685
1273
def Fingerprint_dbus_property(self):
1686
1274
return dbus.String(self.fingerprint)
1687
1275
1688
1276
# Host - property
1689
@dbus_service_property(_interface,
1690
signature="s",
1277
@dbus_service_property(_interface, signature="s",
1691
1278
access="readwrite")
1692
1279
def Host_dbus_property(self, value=None):
1693
1280
if value is None: # get
1694
1281
return dbus.String(self.host)
1695
self.host = str(value)
1282
self.host = value
1696
1283
1697
1284
# Created - property
1698
@dbus_annotations(
1699
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1700
1285
@dbus_service_property(_interface, signature="s", access="read")
1701
1286
def Created_dbus_property(self):
1702
1287
return datetime_to_dbus(self.created)
1707
1292
return datetime_to_dbus(self.last_enabled)
1708
1293
1709
1294
# Enabled - property
1710
@dbus_service_property(_interface,
1711
signature="b",
1295
@dbus_service_property(_interface, signature="b",
1712
1296
access="readwrite")
1713
1297
def Enabled_dbus_property(self, value=None):
1714
1298
if value is None: # get
1719
1303
self.disable()
1720
1304
1721
1305
# LastCheckedOK - property
1722
@dbus_service_property(_interface,
1723
signature="s",
1306
@dbus_service_property(_interface, signature="s",
1724
1307
access="readwrite")
1725
1308
def LastCheckedOK_dbus_property(self, value=None):
1726
1309
if value is not None:
1728
1311
return
1729
1312
return datetime_to_dbus(self.last_checked_ok)
1730
1313
1731
# LastCheckerStatus - property
1732
@dbus_service_property(_interface, signature="n", access="read")
1733
def LastCheckerStatus_dbus_property(self):
1734
return dbus.Int16(self.last_checker_status)
1735
1736
1314
# Expires - property
1737
1315
@dbus_service_property(_interface, signature="s", access="read")
1738
1316
def Expires_dbus_property(self):
1744
1322
return datetime_to_dbus(self.last_approval_request)
1745
1323
1746
1324
# Timeout - property
1747
@dbus_service_property(_interface,
1748
signature="t",
1325
@dbus_service_property(_interface, signature="t",
1749
1326
access="readwrite")
1750
1327
def Timeout_dbus_property(self, value=None):
1751
1328
if value is None: # get
1752
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1753
old_timeout = self.timeout
1329
return dbus.UInt64(self.timeout_milliseconds())
1754
1330
self.timeout = datetime.timedelta(0, 0, 0, value)
1755
# Reschedule disabling
1756
if self.enabled:
1757
now = datetime.datetime.utcnow()
1758
self.expires += self.timeout - old_timeout
1759
if self.expires <= now:
1760
# The timeout has passed
1761
self.disable()
1762
else:
1763
if (getattr(self, "disable_initiator_tag", None)
1764
is None):
1765
return
1766
gobject.source_remove(self.disable_initiator_tag)
1767
self.disable_initiator_tag = gobject.timeout_add(
1768
int((self.expires - now).total_seconds() * 1000),
1769
self.disable)
1331
if getattr(self, "disable_initiator_tag", None) is None:
1332
return
1333
# Reschedule timeout
1334
gobject.source_remove(self.disable_initiator_tag)
1335
self.disable_initiator_tag = None
1336
self.expires = None
1337
time_to_die = _timedelta_to_milliseconds((self
1338
.last_checked_ok
1339
+ self.timeout)
1340
- datetime.datetime
1341
.utcnow())
1342
if time_to_die <= 0:
1343
# The timeout has passed
1344
self.disable()
1345
else:
1346
self.expires = (datetime.datetime.utcnow()
1347
+ datetime.timedelta(milliseconds =
1348
time_to_die))
1349
self.disable_initiator_tag = (gobject.timeout_add
1350
(time_to_die, self.disable))
1770
1351
1771
1352
# ExtendedTimeout - property
1772
@dbus_service_property(_interface,
1773
signature="t",
1353
@dbus_service_property(_interface, signature="t",
1774
1354
access="readwrite")
1775
1355
def ExtendedTimeout_dbus_property(self, value=None):
1776
1356
if value is None: # get
1777
return dbus.UInt64(self.extended_timeout.total_seconds()
1778
* 1000)
1357
return dbus.UInt64(self.extended_timeout_milliseconds())
1779
1358
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1780
1359
1781
1360
# Interval - property
1782
@dbus_service_property(_interface,
1783
signature="t",
1361
@dbus_service_property(_interface, signature="t",
1784
1362
access="readwrite")
1785
1363
def Interval_dbus_property(self, value=None):
1786
1364
if value is None: # get
1787
return dbus.UInt64(self.interval.total_seconds() * 1000)
1365
return dbus.UInt64(self.interval_milliseconds())
1788
1366
self.interval = datetime.timedelta(0, 0, 0, value)
1789
1367
if getattr(self, "checker_initiator_tag", None) is None:
1790
1368
return
1791
1369
if self.enabled:
1792
1370
# Reschedule checker run
1793
1371
gobject.source_remove(self.checker_initiator_tag)
1794
self.checker_initiator_tag = gobject.timeout_add(
1795
value, self.start_checker)
1796
self.start_checker() # Start one now, too
1372
self.checker_initiator_tag = (gobject.timeout_add
1373
(value, self.start_checker))
1374
self.start_checker() # Start one now, too
1797
1375
1798
1376
# Checker - property
1799
@dbus_service_property(_interface,
1800
signature="s",
1377
@dbus_service_property(_interface, signature="s",
1801
1378
access="readwrite")
1802
1379
def Checker_dbus_property(self, value=None):
1803
1380
if value is None: # get
1804
1381
return dbus.String(self.checker_command)
1805
self.checker_command = str(value)
1382
self.checker_command = value
1806
1383
1807
1384
# CheckerRunning - property
1808
@dbus_service_property(_interface,
1809
signature="b",
1385
@dbus_service_property(_interface, signature="b",
1810
1386
access="readwrite")
1811
1387
def CheckerRunning_dbus_property(self, value=None):
1812
1388
if value is None: # get
1817
1393
self.stop_checker()
1818
1394
1819
1395
# ObjectPath - property
1820
@dbus_annotations(
1821
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
1822
"org.freedesktop.DBus.Deprecated": "true"})
1823
1396
@dbus_service_property(_interface, signature="o", access="read")
1824
1397
def ObjectPath_dbus_property(self):
1825
1398
return self.dbus_object_path # is already a dbus.ObjectPath
1826
1399
1827
1400
# Secret = property
1828
@dbus_annotations(
1829
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1830
"invalidates"})
1831
@dbus_service_property(_interface,
1832
signature="ay",
1833
access="write",
1834
byte_arrays=True)
1401
@dbus_service_property(_interface, signature="ay",
1402
access="write", byte_arrays=True)
1835
1403
def Secret_dbus_property(self, value):
1836
self.secret = bytes(value)
1404
self.secret = str(value)
1837
1405
1838
1406
del _interface
1839
1407
1843
1411
self._pipe = child_pipe
1844
1412
self._pipe.send(('init', fpr, address))
1845
1413
if not self._pipe.recv():
1846
raise KeyError(fpr)
1414
raise KeyError()
1847
1415
1848
1416
def __getattribute__(self, name):
1849
if name == '_pipe':
1417
if(name == '_pipe'):
1850
1418
return super(ProxyClient, self).__getattribute__(name)
1851
1419
self._pipe.send(('getattr', name))
1852
1420
data = self._pipe.recv()
1853
1421
if data[0] == 'data':
1854
1422
return data[1]
1855
1423
if data[0] == 'function':
1856
1857
1424
def func(*args, **kwargs):
1858
1425
self._pipe.send(('funcall', name, args, kwargs))
1859
1426
return self._pipe.recv()[1]
1860
1861
1427
return func
1862
1428
1863
1429
def __setattr__(self, name, value):
1864
if name == '_pipe':
1430
if(name == '_pipe'):
1865
1431
return super(ProxyClient, self).__setattr__(name, value)
1866
1432
self._pipe.send(('setattr', name, value))
1867
1433
1868
1434
1435
class ClientDBusTransitional(ClientDBus):
1436
__metaclass__ = AlternateDBusNamesMetaclass
1437
1438
1869
1439
class ClientHandler(socketserver.BaseRequestHandler, object):
1870
1440
"""A class to handle client connections.
1871
1441
1875
1445
def handle(self):
1876
1446
with contextlib.closing(self.server.child_pipe) as child_pipe:
1877
1447
logger.info("TCP connection from: %s",
1878
str(self.client_address))
1448
unicode(self.client_address))
1879
1449
logger.debug("Pipe FD: %d",
1880
1450
self.server.child_pipe.fileno())
1881
1451
1882
session = gnutls.connection.ClientSession(
1883
self.request, gnutls.connection.X509Credentials())
1452
session = (gnutls.connection
1453
.ClientSession(self.request,
1454
gnutls.connection
1455
.X509Credentials()))
1884
1456
1885
1457
# Note: gnutls.connection.X509Credentials is really a
1886
1458
# generic GnuTLS certificate credentials object so long as
1895
1467
priority = self.server.gnutls_priority
1896
1468
if priority is None:
1897
1469
priority = "NORMAL"
1898
gnutls.library.functions.gnutls_priority_set_direct(
1899
session._c_object, priority, None)
1470
(gnutls.library.functions
1471
.gnutls_priority_set_direct(session._c_object,
1472
priority, None))
1900
1473
1901
1474
# Start communication using the Mandos protocol
1902
1475
# Get protocol number
1904
1477
logger.debug("Protocol version: %r", line)
1905
1478
try:
1906
1479
if int(line.strip().split()[0]) > 1:
1907
raise RuntimeError(line)
1480
raise RuntimeError
1908
1481
except (ValueError, IndexError, RuntimeError) as error:
1909
1482
logger.error("Unknown protocol version: %s", error)
1910
1483
return
1922
1495
approval_required = False
1923
1496
try:
1924
1497
try:
1925
fpr = self.fingerprint(
1926
self.peer_certificate(session))
1498
fpr = self.fingerprint(self.peer_certificate
1499
(session))
1927
1500
except (TypeError,
1928
1501
gnutls.errors.GNUTLSError) as error:
1929
1502
logger.warning("Bad certificate: %s", error)
1930
1503
return
1931
1504
logger.debug("Fingerprint: %s", fpr)
1505
if self.server.use_dbus:
1506
# Emit D-Bus signal
1507
client.NewRequest(str(self.client_address))
1932
1508
1933
1509
try:
1934
1510
client = ProxyClient(child_pipe, fpr,
1944
1520
while True:
1945
1521
if not client.enabled:
1946
1522
logger.info("Client %s is disabled",
1947
client.name)
1523
client.name)
1948
1524
if self.server.use_dbus:
1949
1525
# Emit D-Bus signal
1950
1526
client.Rejected("Disabled")
1951
1527
return
1952
1528
1953
if client.approved or not client.approval_delay:
1529
if client._approved or not client.approval_delay:
1954
1530
#We are approved or approval is disabled
1955
1531
break
1956
elif client.approved is None:
1532
elif client._approved is None:
1957
1533
logger.info("Client %s needs approval",
1958
1534
client.name)
1959
1535
if self.server.use_dbus:
1960
1536
# Emit D-Bus signal
1961
1537
client.NeedApproval(
1962
client.approval_delay.total_seconds()
1963
* 1000, client.approved_by_default)
1538
client.approval_delay_milliseconds(),
1539
client.approved_by_default)
1964
1540
else:
1965
1541
logger.warning("Client %s was not approved",
1966
1542
client.name)
1972
1548
#wait until timeout or approved
1973
1549
time = datetime.datetime.now()
1974
1550
client.changedstate.acquire()
1975
client.changedstate.wait(delay.total_seconds())
1551
(client.changedstate.wait
1552
(float(client._timedelta_to_milliseconds(delay)
1553
/ 1000)))
1976
1554
client.changedstate.release()
1977
1555
time2 = datetime.datetime.now()
1978
1556
if (time2 - time) >= delay:
1994
1572
try:
1995
1573
sent = session.send(client.secret[sent_size:])
1996
1574
except gnutls.errors.GNUTLSError as error:
1997
logger.warning("gnutls send failed",
1998
exc_info=error)
1575
logger.warning("gnutls send failed")
1999
1576
return
2000
logger.debug("Sent: %d, remaining: %d", sent,
2001
len(client.secret) - (sent_size
2002
+ sent))
1577
logger.debug("Sent: %d, remaining: %d",
1578
sent, len(client.secret)
1579
- (sent_size + sent))
2003
1580
sent_size += sent
2004
1581
2005
1582
logger.info("Sending secret to %s", client.name)
2006
1583
# bump the timeout using extended_timeout
2007
client.bump_timeout(client.extended_timeout)
1584
client.checked_ok(client.extended_timeout)
2008
1585
if self.server.use_dbus:
2009
1586
# Emit D-Bus signal
2010
1587
client.GotSecret()
2015
1592
try:
2016
1593
session.bye()
2017
1594
except gnutls.errors.GNUTLSError as error:
2018
logger.warning("GnuTLS bye failed",
2019
exc_info=error)
1595
logger.warning("GnuTLS bye failed")
2020
1596
2021
1597
@staticmethod
2022
1598
def peer_certificate(session):
2023
1599
"Return the peer's OpenPGP certificate as a bytestring"
2024
1600
# If not an OpenPGP certificate...
2025
if (gnutls.library.functions.gnutls_certificate_type_get(
2026
session._c_object)
1601
if (gnutls.library.functions
1602
.gnutls_certificate_type_get(session._c_object)
2027
1603
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
2028
1604
# ...do the normal thing
2029
1605
return session.peer_certificate
2043
1619
def fingerprint(openpgp):
2044
1620
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2045
1621
# New GnuTLS "datum" with the OpenPGP public key
2046
datum = gnutls.library.types.gnutls_datum_t(
2047
ctypes.cast(ctypes.c_char_p(openpgp),
2048
ctypes.POINTER(ctypes.c_ubyte)),
2049
ctypes.c_uint(len(openpgp)))
1622
datum = (gnutls.library.types
1623
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1624
ctypes.POINTER
1625
(ctypes.c_ubyte)),
1626
ctypes.c_uint(len(openpgp))))
2050
1627
# New empty GnuTLS certificate
2051
1628
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2052
gnutls.library.functions.gnutls_openpgp_crt_init(
2053
ctypes.byref(crt))
1629
(gnutls.library.functions
1630
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2054
1631
# Import the OpenPGP public key into the certificate
2055
gnutls.library.functions.gnutls_openpgp_crt_import(
2056
crt, ctypes.byref(datum),
2057
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1632
(gnutls.library.functions
1633
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1634
gnutls.library.constants
1635
.GNUTLS_OPENPGP_FMT_RAW))
2058
1636
# Verify the self signature in the key
2059
1637
crtverify = ctypes.c_uint()
2060
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2061
crt, 0, ctypes.byref(crtverify))
1638
(gnutls.library.functions
1639
.gnutls_openpgp_crt_verify_self(crt, 0,
1640
ctypes.byref(crtverify)))
2062
1641
if crtverify.value != 0:
2063
1642
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2064
raise gnutls.errors.CertificateSecurityError(
2065
"Verify failed")
1643
raise (gnutls.errors.CertificateSecurityError
1644
("Verify failed"))
2066
1645
# New buffer for the fingerprint
2067
1646
buf = ctypes.create_string_buffer(20)
2068
1647
buf_len = ctypes.c_size_t()
2069
1648
# Get the fingerprint from the certificate into the buffer
2070
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2071
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1649
(gnutls.library.functions
1650
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1651
ctypes.byref(buf_len)))
2072
1652
# Deinit the certificate
2073
1653
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2074
1654
# Convert the buffer to a Python bytestring
2080
1660
2081
1661
class MultiprocessingMixIn(object):
2082
1662
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2083
2084
1663
def sub_process_main(self, request, address):
2085
1664
try:
2086
1665
self.finish_request(request, address)
2087
except Exception:
1666
except:
2088
1667
self.handle_error(request, address)
2089
1668
self.close_request(request)
2090
1669
2091
1670
def process_request(self, request, address):
2092
1671
"""Start a new process to process the request."""
2093
1672
proc = multiprocessing.Process(target = self.sub_process_main,
2094
args = (request, address))
1673
args = (request,
1674
address))
2095
1675
proc.start()
2096
1676
return proc
2097
1677
2098
1678
2099
1679
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2100
1680
""" adds a pipe to the MixIn """
2101
2102
1681
def process_request(self, request, client_address):
2103
1682
"""Overrides and wraps the original process_request().
2104
1683
2113
1692
2114
1693
def add_pipe(self, parent_pipe, proc):
2115
1694
"""Dummy function; override as necessary"""
2116
raise NotImplementedError()
1695
raise NotImplementedError
2117
1696
2118
1697
2119
1698
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2125
1704
interface: None or a network interface name (string)
2126
1705
use_ipv6: Boolean; to use IPv6 or not
2127
1706
"""
2128
2129
1707
def __init__(self, server_address, RequestHandlerClass,
2130
interface=None,
2131
use_ipv6=True,
2132
socketfd=None):
2133
"""If socketfd is set, use that file descriptor instead of
2134
creating a new one with socket.socket().
2135
"""
1708
interface=None, use_ipv6=True):
2136
1709
self.interface = interface
2137
1710
if use_ipv6:
2138
1711
self.address_family = socket.AF_INET6
2139
if socketfd is not None:
2140
# Save the file descriptor
2141
self.socketfd = socketfd
2142
# Save the original socket.socket() function
2143
self.socket_socket = socket.socket
2144
# To implement --socket, we monkey patch socket.socket.
2145
#
2146
# (When socketserver.TCPServer is a new-style class, we
2147
# could make self.socket into a property instead of monkey
2148
# patching socket.socket.)
2149
#
2150
# Create a one-time-only replacement for socket.socket()
2151
@functools.wraps(socket.socket)
2152
def socket_wrapper(*args, **kwargs):
2153
# Restore original function so subsequent calls are
2154
# not affected.
2155
socket.socket = self.socket_socket
2156
del self.socket_socket
2157
# This time only, return a new socket object from the
2158
# saved file descriptor.
2159
return socket.fromfd(self.socketfd, *args, **kwargs)
2160
# Replace socket.socket() function with wrapper
2161
socket.socket = socket_wrapper
2162
# The socketserver.TCPServer.__init__ will call
2163
# socket.socket(), which might be our replacement,
2164
# socket_wrapper(), if socketfd was set.
2165
1712
socketserver.TCPServer.__init__(self, server_address,
2166
1713
RequestHandlerClass)
2167
2168
1714
def server_bind(self):
2169
1715
"""This overrides the normal server_bind() function
2170
1716
to bind to an interface if one was specified, and also NOT to
2176
1722
self.interface)
2177
1723
else:
2178
1724
try:
2179
self.socket.setsockopt(
2180
socket.SOL_SOCKET, SO_BINDTODEVICE,
2181
(self.interface + "\0").encode("utf-8"))
1725
self.socket.setsockopt(socket.SOL_SOCKET,
1726
SO_BINDTODEVICE,
1727
str(self.interface
1728
+ '\0'))
2182
1729
except socket.error as error:
2183
if error.errno == errno.EPERM:
2184
logger.error("No permission to bind to"
2185
" interface %s", self.interface)
2186
elif error.errno == errno.ENOPROTOOPT:
1730
if error[0] == errno.EPERM:
1731
logger.error("No permission to"
1732
" bind to interface %s",
1733
self.interface)
1734
elif error[0] == errno.ENOPROTOOPT:
2187
1735
logger.error("SO_BINDTODEVICE not available;"
2188
1736
" cannot bind to interface %s",
2189
1737
self.interface)
2190
elif error.errno == errno.ENODEV:
2191
logger.error("Interface %s does not exist,"
2192
" cannot bind", self.interface)
2193
1738
else:
2194
1739
raise
2195
1740
# Only bind(2) the socket if we really need to.
2198
1743
if self.address_family == socket.AF_INET6:
2199
1744
any_address = "::" # in6addr_any
2200
1745
else:
2201
any_address = "0.0.0.0" # INADDR_ANY
1746
any_address = socket.INADDR_ANY
2202
1747
self.server_address = (any_address,
2203
1748
self.server_address[1])
2204
1749
elif not self.server_address[1]:
2205
self.server_address = (self.server_address[0], 0)
1750
self.server_address = (self.server_address[0],
1751
0)
2206
1752
# if self.interface:
2207
1753
# self.server_address = (self.server_address[0],
2208
1754
# 0, # port
2222
1768
2223
1769
Assumes a gobject.MainLoop event loop.
2224
1770
"""
2225
2226
1771
def __init__(self, server_address, RequestHandlerClass,
2227
interface=None,
2228
use_ipv6=True,
2229
clients=None,
2230
gnutls_priority=None,
2231
use_dbus=True,
2232
socketfd=None):
1772
interface=None, use_ipv6=True, clients=None,
1773
gnutls_priority=None, use_dbus=True):
2233
1774
self.enabled = False
2234
1775
self.clients = clients
2235
1776
if self.clients is None:
2239
1780
IPv6_TCPServer.__init__(self, server_address,
2240
1781
RequestHandlerClass,
2241
1782
interface = interface,
2242
use_ipv6 = use_ipv6,
2243
socketfd = socketfd)
2244
1783
use_ipv6 = use_ipv6)
2245
1784
def server_activate(self):
2246
1785
if self.enabled:
2247
1786
return socketserver.TCPServer.server_activate(self)
2251
1790
2252
1791
def add_pipe(self, parent_pipe, proc):
2253
1792
# Call "handle_ipc" for both data and EOF events
2254
gobject.io_add_watch(
2255
parent_pipe.fileno(),
2256
gobject.IO_IN | gobject.IO_HUP,
2257
functools.partial(self.handle_ipc,
2258
parent_pipe = parent_pipe,
2259
proc = proc))
1793
gobject.io_add_watch(parent_pipe.fileno(),
1794
gobject.IO_IN | gobject.IO_HUP,
1795
functools.partial(self.handle_ipc,
1796
parent_pipe =
1797
parent_pipe,
1798
proc = proc))
2260
1799
2261
def handle_ipc(self, source, condition,
2262
parent_pipe=None,
2263
proc = None,
2264
client_object=None):
1800
def handle_ipc(self, source, condition, parent_pipe=None,
1801
proc = None, client_object=None):
1802
condition_names = {
1803
gobject.IO_IN: "IN", # There is data to read.
1804
gobject.IO_OUT: "OUT", # Data can be written (without
1805
# blocking).
1806
gobject.IO_PRI: "PRI", # There is urgent data to read.
1807
gobject.IO_ERR: "ERR", # Error condition.
1808
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1809
# broken, usually for pipes and
1810
# sockets).
1811
}
1812
conditions_string = ' | '.join(name
1813
for cond, name in
1814
condition_names.iteritems()
1815
if cond & condition)
2265
1816
# error, or the other end of multiprocessing.Pipe has closed
2266
if condition & (gobject.IO_ERR | gobject.IO_HUP):
1817
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2267
1818
# Wait for other process to exit
2268
1819
proc.join()
2269
1820
return False
2290
1841
parent_pipe.send(False)
2291
1842
return False
2292
1843
2293
gobject.io_add_watch(
2294
parent_pipe.fileno(),
2295
gobject.IO_IN | gobject.IO_HUP,
2296
functools.partial(self.handle_ipc,
2297
parent_pipe = parent_pipe,
2298
proc = proc,
2299
client_object = client))
1844
gobject.io_add_watch(parent_pipe.fileno(),
1845
gobject.IO_IN | gobject.IO_HUP,
1846
functools.partial(self.handle_ipc,
1847
parent_pipe =
1848
parent_pipe,
1849
proc = proc,
1850
client_object =
1851
client))
2300
1852
parent_pipe.send(True)
2301
1853
# remove the old hook in favor of the new above hook on
2302
1854
# same fileno
2308
1860
2309
1861
parent_pipe.send(('data', getattr(client_object,
2310
1862
funcname)(*args,
2311
**kwargs)))
1863
**kwargs)))
2312
1864
2313
1865
if command == 'getattr':
2314
1866
attrname = request[1]
2315
if isinstance(client_object.__getattribute__(attrname),
2316
collections.Callable):
2317
parent_pipe.send(('function', ))
1867
if callable(client_object.__getattribute__(attrname)):
1868
parent_pipe.send(('function',))
2318
1869
else:
2319
parent_pipe.send((
2320
'data', client_object.__getattribute__(attrname)))
1870
parent_pipe.send(('data', client_object
1871
.__getattribute__(attrname)))
2321
1872
2322
1873
if command == 'setattr':
2323
1874
attrname = request[1]
2327
1878
return True
2328
1879
2329
1880
2330
def rfc3339_duration_to_delta(duration):
2331
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2332
2333
>>> rfc3339_duration_to_delta("P7D")
2334
datetime.timedelta(7)
2335
>>> rfc3339_duration_to_delta("PT60S")
2336
datetime.timedelta(0, 60)
2337
>>> rfc3339_duration_to_delta("PT60M")
2338
datetime.timedelta(0, 3600)
2339
>>> rfc3339_duration_to_delta("PT24H")
2340
datetime.timedelta(1)
2341
>>> rfc3339_duration_to_delta("P1W")
2342
datetime.timedelta(7)
2343
>>> rfc3339_duration_to_delta("PT5M30S")
2344
datetime.timedelta(0, 330)
2345
>>> rfc3339_duration_to_delta("P1DT3M20S")
2346
datetime.timedelta(1, 200)
2347
"""
2348
2349
# Parsing an RFC 3339 duration with regular expressions is not
2350
# possible - there would have to be multiple places for the same
2351
# values, like seconds. The current code, while more esoteric, is
2352
# cleaner without depending on a parsing library. If Python had a
2353
# built-in library for parsing we would use it, but we'd like to
2354
# avoid excessive use of external libraries.
2355
2356
# New type for defining tokens, syntax, and semantics all-in-one
2357
Token = collections.namedtuple("Token", (
2358
"regexp", # To match token; if "value" is not None, must have
2359
# a "group" containing digits
2360
"value", # datetime.timedelta or None
2361
"followers")) # Tokens valid after this token
2362
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2363
# the "duration" ABNF definition in RFC 3339, Appendix A.
2364
token_end = Token(re.compile(r"$"), None, frozenset())
2365
token_second = Token(re.compile(r"(\d+)S"),
2366
datetime.timedelta(seconds=1),
2367
frozenset((token_end, )))
2368
token_minute = Token(re.compile(r"(\d+)M"),
2369
datetime.timedelta(minutes=1),
2370
frozenset((token_second, token_end)))
2371
token_hour = Token(re.compile(r"(\d+)H"),
2372
datetime.timedelta(hours=1),
2373
frozenset((token_minute, token_end)))
2374
token_time = Token(re.compile(r"T"),
2375
None,
2376
frozenset((token_hour, token_minute,
2377
token_second)))
2378
token_day = Token(re.compile(r"(\d+)D"),
2379
datetime.timedelta(days=1),
2380
frozenset((token_time, token_end)))
2381
token_month = Token(re.compile(r"(\d+)M"),
2382
datetime.timedelta(weeks=4),
2383
frozenset((token_day, token_end)))
2384
token_year = Token(re.compile(r"(\d+)Y"),
2385
datetime.timedelta(weeks=52),
2386
frozenset((token_month, token_end)))
2387
token_week = Token(re.compile(r"(\d+)W"),
2388
datetime.timedelta(weeks=1),
2389
frozenset((token_end, )))
2390
token_duration = Token(re.compile(r"P"), None,
2391
frozenset((token_year, token_month,
2392
token_day, token_time,
2393
token_week)))
2394
# Define starting values
2395
value = datetime.timedelta() # Value so far
2396
found_token = None
2397
followers = frozenset((token_duration, )) # Following valid tokens
2398
s = duration # String left to parse
2399
# Loop until end token is found
2400
while found_token is not token_end:
2401
# Search for any currently valid tokens
2402
for token in followers:
2403
match = token.regexp.match(s)
2404
if match is not None:
2405
# Token found
2406
if token.value is not None:
2407
# Value found, parse digits
2408
factor = int(match.group(1), 10)
2409
# Add to value so far
2410
value += factor * token.value
2411
# Strip token from string
2412
s = token.regexp.sub("", s, 1)
2413
# Go to found token
2414
found_token = token
2415
# Set valid next tokens
2416
followers = found_token.followers
2417
break
2418
else:
2419
# No currently valid tokens were found
2420
raise ValueError("Invalid RFC 3339 duration: {!r}"
2421
.format(duration))
2422
# End token found
2423
return value
2424
2425
2426
1881
def string_to_delta(interval):
2427
1882
"""Parse a string and return a datetime.timedelta
2428
1883
2439
1894
>>> string_to_delta('5m 30s')
2440
1895
datetime.timedelta(0, 330)
2441
1896
"""
2442
2443
try:
2444
return rfc3339_duration_to_delta(interval)
2445
except ValueError:
2446
pass
2447
2448
1897
timevalue = datetime.timedelta(0)
2449
1898
for s in interval.split():
2450
1899
try:
2451
suffix = s[-1]
1900
suffix = unicode(s[-1])
2452
1901
value = int(s[:-1])
2453
1902
if suffix == "d":
2454
1903
delta = datetime.timedelta(value)
2461
1910
elif suffix == "w":
2462
1911
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2463
1912
else:
2464
raise ValueError("Unknown suffix {!r}".format(suffix))
2465
except IndexError as e:
1913
raise ValueError("Unknown suffix %r" % suffix)
1914
except (ValueError, IndexError) as e:
2466
1915
raise ValueError(*(e.args))
2467
1916
timevalue += delta
2468
1917
return timevalue
2481
1930
sys.exit()
2482
1931
if not noclose:
2483
1932
# Close all standard open file descriptors
2484
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1933
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2485
1934
if not stat.S_ISCHR(os.fstat(null).st_mode):
2486
1935
raise OSError(errno.ENODEV,
2487
"{} not a character device"
2488
.format(os.devnull))
1936
"%s not a character device"
1937
% os.path.devnull)
2489
1938
os.dup2(null, sys.stdin.fileno())
2490
1939
os.dup2(null, sys.stdout.fileno())
2491
1940
os.dup2(null, sys.stderr.fileno())
2500
1949
2501
1950
parser = argparse.ArgumentParser()
2502
1951
parser.add_argument("-v", "--version", action="version",
2503
version = "%(prog)s {}".format(version),
1952
version = "%%(prog)s %s" % version,
2504
1953
help="show version number and exit")
2505
1954
parser.add_argument("-i", "--interface", metavar="IF",
2506
1955
help="Bind to interface IF")
2512
1961
help="Run self-test")
2513
1962
parser.add_argument("--debug", action="store_true",
2514
1963
help="Debug mode; run in foreground and log"
2515
" to terminal", default=None)
1964
" to terminal")
2516
1965
parser.add_argument("--debuglevel", metavar="LEVEL",
2517
1966
help="Debug level for stdout output")
2518
1967
parser.add_argument("--priority", help="GnuTLS"
2525
1974
" files")
2526
1975
parser.add_argument("--no-dbus", action="store_false",
2527
1976
dest="use_dbus", help="Do not provide D-Bus"
2528
" system bus interface", default=None)
1977
" system bus interface")
2529
1978
parser.add_argument("--no-ipv6", action="store_false",
2530
dest="use_ipv6", help="Do not use IPv6",
2531
default=None)
1979
dest="use_ipv6", help="Do not use IPv6")
2532
1980
parser.add_argument("--no-restore", action="store_false",
2533
1981
dest="restore", help="Do not restore stored"
2534
" state", default=None)
2535
parser.add_argument("--socket", type=int,
2536
help="Specify a file descriptor to a network"
2537
" socket to use instead of creating one")
1982
" state")
2538
1983
parser.add_argument("--statedir", metavar="DIR",
2539
1984
help="Directory to save/restore state in")
2540
parser.add_argument("--foreground", action="store_true",
2541
help="Run in foreground", default=None)
2542
parser.add_argument("--no-zeroconf", action="store_false",
2543
dest="zeroconf", help="Do not use Zeroconf",
2544
default=None)
2545
1985
2546
1986
options = parser.parse_args()
2547
1987
2548
1988
if options.check:
2549
1989
import doctest
2550
fail_count, test_count = doctest.testmod()
2551
sys.exit(os.EX_OK if fail_count == 0 else 1)
1990
doctest.testmod()
1991
sys.exit()
2552
1992
2553
1993
# Default values for config file for server-global settings
2554
1994
server_defaults = { "interface": "",
2556
1996
"port": "",
2557
1997
"debug": "False",
2558
1998
"priority":
2559
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2560
":+SIGN-DSA-SHA256",
1999
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2561
2000
"servicename": "Mandos",
2562
2001
"use_dbus": "True",
2563
2002
"use_ipv6": "True",
2564
2003
"debuglevel": "",
2565
2004
"restore": "True",
2566
"socket": "",
2567
"statedir": "/var/lib/mandos",
2568
"foreground": "False",
2569
"zeroconf": "True",
2570
}
2005
"statedir": "/var/lib/mandos"
2006
}
2571
2007
2572
2008
# Parse config file for server-global settings
2573
2009
server_config = configparser.SafeConfigParser(server_defaults)
2574
2010
del server_defaults
2575
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2011
server_config.read(os.path.join(options.configdir,
2012
"mandos.conf"))
2576
2013
# Convert the SafeConfigParser object to a dict
2577
2014
server_settings = server_config.defaults()
2578
2015
# Use the appropriate methods on the non-string config options
2579
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2016
for option in ("debug", "use_dbus", "use_ipv6"):
2580
2017
server_settings[option] = server_config.getboolean("DEFAULT",
2581
2018
option)
2582
2019
if server_settings["port"]:
2583
2020
server_settings["port"] = server_config.getint("DEFAULT",
2584
2021
"port")
2585
if server_settings["socket"]:
2586
server_settings["socket"] = server_config.getint("DEFAULT",
2587
"socket")
2588
# Later, stdin will, and stdout and stderr might, be dup'ed
2589
# over with an opened os.devnull. But we don't want this to
2590
# happen with a supplied network socket.
2591
if 0 <= server_settings["socket"] <= 2:
2592
server_settings["socket"] = os.dup(server_settings
2593
["socket"])
2594
2022
del server_config
2595
2023
2596
2024
# Override the settings from the config file with command line
2597
2025
# options, if set.
2598
2026
for option in ("interface", "address", "port", "debug",
2599
"priority", "servicename", "configdir", "use_dbus",
2600
"use_ipv6", "debuglevel", "restore", "statedir",
2601
"socket", "foreground", "zeroconf"):
2027
"priority", "servicename", "configdir",
2028
"use_dbus", "use_ipv6", "debuglevel", "restore",
2029
"statedir"):
2602
2030
value = getattr(options, option)
2603
2031
if value is not None:
2604
2032
server_settings[option] = value
2605
2033
del options
2606
2034
# Force all strings to be unicode
2607
2035
for option in server_settings.keys():
2608
if isinstance(server_settings[option], bytes):
2609
server_settings[option] = (server_settings[option]
2610
.decode("utf-8"))
2611
# Force all boolean options to be boolean
2612
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2613
"foreground", "zeroconf"):
2614
server_settings[option] = bool(server_settings[option])
2615
# Debug implies foreground
2616
if server_settings["debug"]:
2617
server_settings["foreground"] = True
2036
if type(server_settings[option]) is str:
2037
server_settings[option] = unicode(server_settings[option])
2618
2038
# Now we have our good server settings in "server_settings"
2619
2039
2620
2040
##################################################################
2621
2041
2622
if (not server_settings["zeroconf"]
2623
and not (server_settings["port"]
2624
or server_settings["socket"] != "")):
2625
parser.error("Needs port or socket to work without Zeroconf")
2626
2627
2042
# For convenience
2628
2043
debug = server_settings["debug"]
2629
2044
debuglevel = server_settings["debuglevel"]
2631
2046
use_ipv6 = server_settings["use_ipv6"]
2632
2047
stored_state_path = os.path.join(server_settings["statedir"],
2633
2048
stored_state_file)
2634
foreground = server_settings["foreground"]
2635
zeroconf = server_settings["zeroconf"]
2636
2049
2637
2050
if debug:
2638
initlogger(debug, logging.DEBUG)
2051
initlogger(logging.DEBUG)
2639
2052
else:
2640
2053
if not debuglevel:
2641
initlogger(debug)
2054
initlogger()
2642
2055
else:
2643
2056
level = getattr(logging, debuglevel.upper())
2644
initlogger(debug, level)
2057
initlogger(level)
2645
2058
2646
2059
if server_settings["servicename"] != "Mandos":
2647
syslogger.setFormatter(
2648
logging.Formatter('Mandos ({}) [%(process)d]:'
2649
' %(levelname)s: %(message)s'.format(
2650
server_settings["servicename"])))
2060
syslogger.setFormatter(logging.Formatter
2061
('Mandos (%s) [%%(process)d]:'
2062
' %%(levelname)s: %%(message)s'
2063
% server_settings["servicename"]))
2651
2064
2652
2065
# Parse config file with clients
2653
client_config = configparser.SafeConfigParser(Client
2654
.client_defaults)
2066
client_defaults = { "timeout": "5m",
2067
"extended_timeout": "15m",
2068
"interval": "2m",
2069
"checker": "fping -q -- %%(host)s",
2070
"host": "",
2071
"approval_delay": "0s",
2072
"approval_duration": "1s",
2073
}
2074
client_config = configparser.SafeConfigParser(client_defaults)
2655
2075
client_config.read(os.path.join(server_settings["configdir"],
2656
2076
"clients.conf"))
2657
2077
2658
2078
global mandos_dbus_service
2659
2079
mandos_dbus_service = None
2660
2080
2661
socketfd = None
2662
if server_settings["socket"] != "":
2663
socketfd = server_settings["socket"]
2664
tcp_server = MandosServer(
2665
(server_settings["address"], server_settings["port"]),
2666
ClientHandler,
2667
interface=(server_settings["interface"] or None),
2668
use_ipv6=use_ipv6,
2669
gnutls_priority=server_settings["priority"],
2670
use_dbus=use_dbus,
2671
socketfd=socketfd)
2672
if not foreground:
2673
pidfilename = "/run/mandos.pid"
2674
if not os.path.isdir("/run/."):
2675
pidfilename = "/var/run/mandos.pid"
2676
pidfile = None
2081
tcp_server = MandosServer((server_settings["address"],
2082
server_settings["port"]),
2083
ClientHandler,
2084
interface=(server_settings["interface"]
2085
or None),
2086
use_ipv6=use_ipv6,
2087
gnutls_priority=
2088
server_settings["priority"],
2089
use_dbus=use_dbus)
2090
if not debug:
2091
pidfilename = "/var/run/mandos.pid"
2677
2092
try:
2678
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2679
except IOError as e:
2680
logger.error("Could not open file %r", pidfilename,
2681
exc_info=e)
2093
pidfile = open(pidfilename, "w")
2094
except IOError:
2095
logger.error("Could not open file %r", pidfilename)
2682
2096
2683
for name in ("_mandos", "mandos", "nobody"):
2097
try:
2098
uid = pwd.getpwnam("_mandos").pw_uid
2099
gid = pwd.getpwnam("_mandos").pw_gid
2100
except KeyError:
2684
2101
try:
2685
uid = pwd.getpwnam(name).pw_uid
2686
gid = pwd.getpwnam(name).pw_gid
2687
break
2102
uid = pwd.getpwnam("mandos").pw_uid
2103
gid = pwd.getpwnam("mandos").pw_gid
2688
2104
except KeyError:
2689
continue
2690
else:
2691
uid = 65534
2692
gid = 65534
2105
try:
2106
uid = pwd.getpwnam("nobody").pw_uid
2107
gid = pwd.getpwnam("nobody").pw_gid
2108
except KeyError:
2109
uid = 65534
2110
gid = 65534
2693
2111
try:
2694
2112
os.setgid(gid)
2695
2113
os.setuid(uid)
2696
2114
except OSError as error:
2697
if error.errno != errno.EPERM:
2698
raise
2115
if error[0] != errno.EPERM:
2116
raise error
2699
2117
2700
2118
if debug:
2701
2119
# Enable all possible GnuTLS debugging
2708
2126
def debug_gnutls(level, string):
2709
2127
logger.debug("GnuTLS: %s", string[:-1])
2710
2128
2711
gnutls.library.functions.gnutls_global_set_log_function(
2712
debug_gnutls)
2129
(gnutls.library.functions
2130
.gnutls_global_set_log_function(debug_gnutls))
2713
2131
2714
2132
# Redirect stdin so all checkers get /dev/null
2715
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2133
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2716
2134
os.dup2(null, sys.stdin.fileno())
2717
2135
if null > 2:
2718
2136
os.close(null)
2137
else:
2138
# No console logging
2139
logger.removeHandler(console)
2719
2140
2720
2141
# Need to fork before connecting to D-Bus
2721
if not foreground:
2142
if not debug:
2722
2143
# Close all input and output, do double fork, etc.
2723
2144
daemon()
2724
2145
2725
# multiprocessing will use threads, so before we use gobject we
2726
# need to inform gobject that threads will be used.
2727
gobject.threads_init()
2728
2729
2146
global main_loop
2730
2147
# From the Avahi example code
2731
DBusGMainLoop(set_as_default=True)
2148
DBusGMainLoop(set_as_default=True )
2732
2149
main_loop = gobject.MainLoop()
2733
2150
bus = dbus.SystemBus()
2734
2151
# End of Avahi example code
2735
2152
if use_dbus:
2736
2153
try:
2737
2154
bus_name = dbus.service.BusName("se.recompile.Mandos",
2738
bus,
2739
do_not_queue=True)
2740
old_bus_name = dbus.service.BusName(
2741
"se.bsnet.fukt.Mandos", bus,
2742
do_not_queue=True)
2743
except dbus.exceptions.DBusException as e:
2744
logger.error("Disabling D-Bus:", exc_info=e)
2155
bus, do_not_queue=True)
2156
old_bus_name = (dbus.service.BusName
2157
("se.bsnet.fukt.Mandos", bus,
2158
do_not_queue=True))
2159
except dbus.exceptions.NameExistsException as e:
2160
logger.error(unicode(e) + ", disabling D-Bus")
2745
2161
use_dbus = False
2746
2162
server_settings["use_dbus"] = False
2747
2163
tcp_server.use_dbus = False
2748
if zeroconf:
2749
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2750
service = AvahiServiceToSyslog(
2751
name = server_settings["servicename"],
2752
servicetype = "_mandos._tcp",
2753
protocol = protocol,
2754
bus = bus)
2755
if server_settings["interface"]:
2756
service.interface = if_nametoindex(
2757
server_settings["interface"].encode("utf-8"))
2164
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2165
service = AvahiServiceToSyslog(name =
2166
server_settings["servicename"],
2167
servicetype = "_mandos._tcp",
2168
protocol = protocol, bus = bus)
2169
if server_settings["interface"]:
2170
service.interface = (if_nametoindex
2171
(str(server_settings["interface"])))
2758
2172
2759
2173
global multiprocessing_manager
2760
2174
multiprocessing_manager = multiprocessing.Manager()
2761
2175
2762
2176
client_class = Client
2763
2177
if use_dbus:
2764
client_class = functools.partial(ClientDBus, bus = bus)
2765
2766
client_settings = Client.config_parser(client_config)
2178
client_class = functools.partial(ClientDBusTransitional,
2179
bus = bus)
2180
2181
special_settings = {
2182
# Some settings need to be accessd by special methods;
2183
# booleans need .getboolean(), etc. Here is a list of them:
2184
"approved_by_default":
2185
lambda section:
2186
client_config.getboolean(section, "approved_by_default"),
2187
"enabled":
2188
lambda section:
2189
client_config.getboolean(section, "enabled"),
2190
}
2191
# Construct a new dict of client settings of this form:
2192
# { client_name: {setting_name: value, ...}, ...}
2193
# with exceptions for any special settings as defined above
2194
client_settings = dict((clientname,
2195
dict((setting,
2196
(value
2197
if setting not in special_settings
2198
else special_settings[setting]
2199
(clientname)))
2200
for setting, value in
2201
client_config.items(clientname)))
2202
for clientname in client_config.sections())
2203
2767
2204
old_client_settings = {}
2768
clients_data = {}
2769
2770
# This is used to redirect stdout and stderr for checker processes
2771
global wnull
2772
wnull = open(os.devnull, "w") # A writable /dev/null
2773
# Only used if server is running in foreground but not in debug
2774
# mode
2775
if debug or not foreground:
2776
wnull.close()
2205
clients_data = []
2777
2206
2778
2207
# Get client data and settings from last running state.
2779
2208
if server_settings["restore"]:
2780
2209
try:
2781
2210
with open(stored_state_path, "rb") as stored_state:
2782
clients_data, old_client_settings = pickle.load(
2783
stored_state)
2211
clients_data, old_client_settings = (pickle.load
2212
(stored_state))
2784
2213
os.remove(stored_state_path)
2785
2214
except IOError as e:
2786
if e.errno == errno.ENOENT:
2787
logger.warning("Could not load persistent state:"
2788
" {}".format(os.strerror(e.errno)))
2789
else:
2790
logger.critical("Could not load persistent state:",
2791
exc_info=e)
2215
logger.warning("Could not load persistent state: {0}"
2216
.format(e))
2217
if e.errno != errno.ENOENT:
2792
2218
raise
2793
except EOFError as e:
2794
logger.warning("Could not load persistent state: "
2795
"EOFError:",
2796
exc_info=e)
2797
2219
2798
with PGPEngine() as pgp:
2799
for client_name, client in clients_data.items():
2800
# Skip removed clients
2801
if client_name not in client_settings:
2802
continue
2220
with Crypto() as crypt:
2221
for client in clients_data:
2222
client_name = client["name"]
2803
2223
2804
2224
# Decide which value to use after restoring saved state.
2805
2225
# We have three different values: Old config file,
2811
2231
# For each value in new config, check if it
2812
2232
# differs from the old config value (Except for
2813
2233
# the "secret" attribute)
2814
if (name != "secret"
2815
and (value !=
2816
old_client_settings[client_name][name])):
2817
client[name] = value
2234
if (name != "secret" and
2235
value != old_client_settings[client_name]
2236
[name]):
2237
setattr(client, name, value)
2818
2238
except KeyError:
2819
2239
pass
2820
2240
2821
2241
# Clients who has passed its expire date can still be
2822
# enabled if its last checker was successful. A Client
2823
# whose checker succeeded before we stored its state is
2824
# assumed to have successfully run all checkers during
2825
# downtime.
2826
if client["enabled"]:
2827
if datetime.datetime.utcnow() >= client["expires"]:
2828
if not client["last_checked_ok"]:
2829
logger.warning(
2830
"disabling client {} - Client never "
2831
"performed a successful checker".format(
2832
client_name))
2833
client["enabled"] = False
2834
elif client["last_checker_status"] != 0:
2835
logger.warning(
2836
"disabling client {} - Client last"
2837
" checker failed with error code"
2838
" {}".format(
2839
client_name,
2840
client["last_checker_status"]))
2242
# enabled if its last checker was sucessful. Clients
2243
# whose checker failed before we stored its state is
2244
# assumed to have failed all checkers during downtime.
2245
if client["enabled"] and client["last_checked_ok"]:
2246
if ((datetime.datetime.utcnow()
2247
- client["last_checked_ok"])
2248
> client["interval"]):
2249
if client["last_checker_status"] != 0:
2841
2250
client["enabled"] = False
2842
2251
else:
2843
client["expires"] = (
2844
datetime.datetime.utcnow()
2845
+ client["timeout"])
2846
logger.debug("Last checker succeeded,"
2847
" keeping {} enabled".format(
2848
client_name))
2252
client["expires"] = (datetime.datetime
2253
.utcnow()
2254
+ client["timeout"])
2255
2256
client["changedstate"] = (multiprocessing_manager
2257
.Condition
2258
(multiprocessing_manager
2259
.Lock()))
2260
if use_dbus:
2261
new_client = (ClientDBusTransitional.__new__
2262
(ClientDBusTransitional))
2263
tcp_server.clients[client_name] = new_client
2264
new_client.bus = bus
2265
for name, value in client.iteritems():
2266
setattr(new_client, name, value)
2267
client_object_name = unicode(client_name).translate(
2268
{ord("."): ord("_"),
2269
ord("-"): ord("_")})
2270
new_client.dbus_object_path = (dbus.ObjectPath
2271
("/clients/"
2272
+ client_object_name))
2273
DBusObjectWithProperties.__init__(new_client,
2274
new_client.bus,
2275
new_client
2276
.dbus_object_path)
2277
else:
2278
tcp_server.clients[client_name] = (Client.__new__
2279
(Client))
2280
for name, value in client.iteritems():
2281
setattr(tcp_server.clients[client_name],
2282
name, value)
2283
2849
2284
try:
2850
client["secret"] = pgp.decrypt(
2851
client["encrypted_secret"],
2285
tcp_server.clients[client_name].secret = (
2286
crypt.decrypt(tcp_server.clients[client_name]
2287
.encrypted_secret,
2288
client_settings[client_name]
2289
["secret"]))
2290
except CryptoError:
2291
# If decryption fails, we use secret from new settings
2292
tcp_server.clients[client_name].secret = (
2852
2293
client_settings[client_name]["secret"])
2853
except PGPError:
2854
# If decryption fails, we use secret from new settings
2855
logger.debug("Failed to decrypt {} old secret".format(
2856
client_name))
2857
client["secret"] = (client_settings[client_name]
2858
["secret"])
2859
2860
# Add/remove clients based on new changes made to config
2861
for client_name in (set(old_client_settings)
2862
- set(client_settings)):
2863
del clients_data[client_name]
2864
for client_name in (set(client_settings)
2865
- set(old_client_settings)):
2866
clients_data[client_name] = client_settings[client_name]
2867
2868
# Create all client objects
2869
for client_name, client in clients_data.items():
2870
tcp_server.clients[client_name] = client_class(
2871
name = client_name,
2872
settings = client,
2873
server_settings = server_settings)
2294
2295
# Create/remove clients based on new changes made to config
2296
for clientname in set(old_client_settings) - set(client_settings):
2297
del tcp_server.clients[clientname]
2298
for clientname in set(client_settings) - set(old_client_settings):
2299
tcp_server.clients[clientname] = (client_class(name
2300
= clientname,
2301
config =
2302
client_settings
2303
[clientname]))
2874
2304
2875
2305
if not tcp_server.clients:
2876
2306
logger.warning("No clients defined")
2877
2878
if not foreground:
2879
if pidfile is not None:
2880
pid = os.getpid()
2881
try:
2882
with pidfile:
2883
print(pid, file=pidfile)
2884
except IOError:
2885
logger.error("Could not write to file %r with PID %d",
2886
pidfilename, pid)
2887
del pidfile
2307
2308
if not debug:
2309
try:
2310
with pidfile:
2311
pid = os.getpid()
2312
pidfile.write(str(pid) + "\n".encode("utf-8"))
2313
del pidfile
2314
except IOError:
2315
logger.error("Could not write to file %r with PID %d",
2316
pidfilename, pid)
2317
except NameError:
2318
# "pidfile" was never created
2319
pass
2888
2320
del pidfilename
2321
2322
signal.signal(signal.SIGINT, signal.SIG_IGN)
2889
2323
2890
2324
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2891
2325
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2892
2326
2893
2327
if use_dbus:
2894
2895
@alternate_dbus_interfaces(
2896
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2897
class MandosDBusService(DBusObjectWithObjectManager):
2328
class MandosDBusService(dbus.service.Object):
2898
2329
"""A D-Bus proxy object"""
2899
2900
2330
def __init__(self):
2901
2331
dbus.service.Object.__init__(self, bus, "/")
2902
2903
2332
_interface = "se.recompile.Mandos"
2904
2333
2905
2334
@dbus.service.signal(_interface, signature="o")
2912
2341
"D-Bus signal"
2913
2342
pass
2914
2343
2915
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2916
"true"})
2917
2344
@dbus.service.signal(_interface, signature="os")
2918
2345
def ClientRemoved(self, objpath, name):
2919
2346
"D-Bus signal"
2920
2347
pass
2921
2348
2922
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2923
"true"})
2924
2349
@dbus.service.method(_interface, out_signature="ao")
2925
2350
def GetAllClients(self):
2926
2351
"D-Bus method"
2927
return dbus.Array(c.dbus_object_path for c in
2352
return dbus.Array(c.dbus_object_path
2353
for c in
2928
2354
tcp_server.clients.itervalues())
2929
2355
2930
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2931
"true"})
2932
2356
@dbus.service.method(_interface,
2933
2357
out_signature="a{oa{sv}}")
2934
2358
def GetAllClientsWithProperties(self):
2935
2359
"D-Bus method"
2936
2360
return dbus.Dictionary(
2937
{ c.dbus_object_path: c.GetAll(
2938
"se.recompile.Mandos.Client")
2939
for c in tcp_server.clients.itervalues() },
2361
((c.dbus_object_path, c.GetAll(""))
2362
for c in tcp_server.clients.itervalues()),
2940
2363
signature="oa{sv}")
2941
2364
2942
2365
@dbus.service.method(_interface, in_signature="o")
2946
2369
if c.dbus_object_path == object_path:
2947
2370
del tcp_server.clients[c.name]
2948
2371
c.remove_from_connection()
2949
# Don't signal the disabling
2372
# Don't signal anything except ClientRemoved
2950
2373
c.disable(quiet=True)
2951
# Emit D-Bus signal for removal
2952
self.client_removed_signal(c)
2374
# Emit D-Bus signal
2375
self.ClientRemoved(object_path, c.name)
2953
2376
return
2954
2377
raise KeyError(object_path)
2955
2378
2956
2379
del _interface
2957
2958
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
2959
out_signature = "a{oa{sa{sv}}}")
2960
def GetManagedObjects(self):
2961
"""D-Bus method"""
2962
return dbus.Dictionary(
2963
{ client.dbus_object_path:
2964
dbus.Dictionary(
2965
{ interface: client.GetAll(interface)
2966
for interface in
2967
client._get_all_interface_names()})
2968
for client in tcp_server.clients.values()})
2969
2970
def client_added_signal(self, client):
2971
"""Send the new standard signal and the old signal"""
2972
if use_dbus:
2973
# New standard signal
2974
self.InterfacesAdded(
2975
client.dbus_object_path,
2976
dbus.Dictionary(
2977
{ interface: client.GetAll(interface)
2978
for interface in
2979
client._get_all_interface_names()}))
2980
# Old signal
2981
self.ClientAdded(client.dbus_object_path)
2982
2983
def client_removed_signal(self, client):
2984
"""Send the new standard signal and the old signal"""
2985
if use_dbus:
2986
# New standard signal
2987
self.InterfacesRemoved(
2988
client.dbus_object_path,
2989
client._get_all_interface_names())
2990
# Old signal
2991
self.ClientRemoved(client.dbus_object_path,
2992
client.name)
2993
2380
2994
mandos_dbus_service = MandosDBusService()
2381
class MandosDBusServiceTransitional(MandosDBusService):
2382
__metaclass__ = AlternateDBusNamesMetaclass
2383
mandos_dbus_service = MandosDBusServiceTransitional()
2995
2384
2996
2385
def cleanup():
2997
2386
"Cleanup function; run on exit"
2998
if zeroconf:
2999
service.cleanup()
2387
service.cleanup()
3000
2388
3001
2389
multiprocessing.active_children()
3002
wnull.close()
3003
2390
if not (tcp_server.clients or client_settings):
3004
2391
return
3005
2392
3006
2393
# Store client before exiting. Secrets are encrypted with key
3007
2394
# based on what config file has. If config file is
3008
2395
# removed/edited, old secret will thus be unrecovable.
3009
clients = {}
3010
with PGPEngine() as pgp:
2396
clients = []
2397
with Crypto() as crypt:
3011
2398
for client in tcp_server.clients.itervalues():
3012
2399
key = client_settings[client.name]["secret"]
3013
client.encrypted_secret = pgp.encrypt(client.secret,
3014
key)
2400
client.encrypted_secret = crypt.encrypt(client.secret,
2401
key)
3015
2402
client_dict = {}
3016
2403
3017
# A list of attributes that can not be pickled
3018
# + secret.
3019
exclude = { "bus", "changedstate", "secret",
3020
"checker", "server_settings" }
3021
for name, typ in inspect.getmembers(dbus.service
3022
.Object):
2404
# A list of attributes that will not be stored when
2405
# shutting down.
2406
exclude = set(("bus", "changedstate", "secret"))
2407
for name, typ in (inspect.getmembers
2408
(dbus.service.Object)):
3023
2409
exclude.add(name)
3024
2410
3025
2411
client_dict["encrypted_secret"] = (client
3028
2414
if attr not in exclude:
3029
2415
client_dict[attr] = getattr(client, attr)
3030
2416
3031
clients[client.name] = client_dict
2417
clients.append(client_dict)
3032
2418
del client_settings[client.name]["secret"]
3033
2419
3034
2420
try:
3035
with tempfile.NamedTemporaryFile(
3036
mode='wb',
3037
suffix=".pickle",
3038
prefix='clients-',
3039
dir=os.path.dirname(stored_state_path),
3040
delete=False) as stored_state:
2421
with os.fdopen(os.open(stored_state_path,
2422
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2423
0600), "wb") as stored_state:
3041
2424
pickle.dump((clients, client_settings), stored_state)
3042
tempname = stored_state.name
3043
os.rename(tempname, stored_state_path)
3044
2425
except (IOError, OSError) as e:
3045
if not debug:
3046
try:
3047
os.remove(tempname)
3048
except NameError:
3049
pass
3050
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3051
logger.warning("Could not save persistent state: {}"
3052
.format(os.strerror(e.errno)))
3053
else:
3054
logger.warning("Could not save persistent state:",
3055
exc_info=e)
2426
logger.warning("Could not save persistent state: {0}"
2427
.format(e))
2428
if e.errno not in (errno.ENOENT, errno.EACCES):
3056
2429
raise
3057
2430
3058
2431
# Delete all clients, and settings from config
3060
2433
name, client = tcp_server.clients.popitem()
3061
2434
if use_dbus:
3062
2435
client.remove_from_connection()
3063
# Don't signal the disabling
2436
# Don't signal anything except ClientRemoved
3064
2437
client.disable(quiet=True)
3065
# Emit D-Bus signal for removal
3066
2438
if use_dbus:
3067
mandos_dbus_service.client_removed_signal(client)
2439
# Emit D-Bus signal
2440
mandos_dbus_service.ClientRemoved(client
2441
.dbus_object_path,
2442
client.name)
3068
2443
client_settings.clear()
3069
2444
3070
2445
atexit.register(cleanup)
3071
2446
3072
2447
for client in tcp_server.clients.itervalues():
3073
2448
if use_dbus:
3074
# Emit D-Bus signal for adding
3075
mandos_dbus_service.client_added_signal(client)
2449
# Emit D-Bus signal
2450
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3076
2451
# Need to initiate checking of clients
3077
2452
if client.enabled:
3078
2453
client.init_checker()
3081
2456
tcp_server.server_activate()
3082
2457
3083
2458
# Find out what port we got
3084
if zeroconf:
3085
service.port = tcp_server.socket.getsockname()[1]
2459
service.port = tcp_server.socket.getsockname()[1]
3086
2460
if use_ipv6:
3087
2461
logger.info("Now listening on address %r, port %d,"
3088
" flowinfo %d, scope_id %d",
3089
*tcp_server.socket.getsockname())
2462
" flowinfo %d, scope_id %d"
2463
% tcp_server.socket.getsockname())
3090
2464
else: # IPv4
3091
logger.info("Now listening on address %r, port %d",
3092
*tcp_server.socket.getsockname())
2465
logger.info("Now listening on address %r, port %d"
2466
% tcp_server.socket.getsockname())
3093
2467
3094
2468
#service.interface = tcp_server.socket.getsockname()[3]
3095
2469
3096
2470
try:
3097
if zeroconf:
3098
# From the Avahi example code
3099
try:
3100
service.activate()
3101
except dbus.exceptions.DBusException as error:
3102
logger.critical("D-Bus Exception", exc_info=error)
3103
cleanup()
3104
sys.exit(1)
3105
# End of Avahi example code
2471
# From the Avahi example code
2472
try:
2473
service.activate()
2474
except dbus.exceptions.DBusException as error:
2475
logger.critical("DBusException: %s", error)
2476
cleanup()
2477
sys.exit(1)
2478
# End of Avahi example code
3106
2479
3107
2480
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3108
2481
lambda *args, **kwargs:
3112
2485
logger.debug("Starting main loop")
3113
2486
main_loop.run()
3114
2487
except AvahiError as error:
3115
logger.critical("Avahi Error", exc_info=error)
2488
logger.critical("AvahiError: %s", error)
3116
2489
cleanup()
3117
2490
sys.exit(1)
3118
2491
except KeyboardInterrupt:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0