101
88
except ImportError:
102
89
SO_BINDTODEVICE = None
104
if sys.version_info.major == 2:
108
92
stored_state_file = "clients.pickle"
110
94
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
116
103
except (OSError, AttributeError):
118
104
def if_nametoindex(interface):
119
105
"Get an interface index the hard way, i.e. using fcntl()"
120
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
107
with contextlib.closing(socket.socket()) as s:
122
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
125
113
return interface_index
128
116
def initlogger(debug, level=logging.WARNING):
129
117
"""init logger and add loglevel"""
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
119
syslogger.setFormatter(logging.Formatter
136
120
('Mandos [%(process)d]: %(levelname)s:'
189
174
def password_encode(self, password):
190
175
# Passphrase can not be empty and can not contain newlines or
191
176
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
177
return b"mandos" + binascii.hexlify(password)
200
179
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
216
194
return ciphertext
218
196
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
234
211
return decrypted_plaintext
237
214
class AvahiError(Exception):
238
215
def __init__(self, value, *args, **kwargs):
239
216
self.value = value
240
return super(AvahiError, self).__init__(value, *args,
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
244
221
class AvahiServiceError(AvahiError):
248
224
class AvahiGroupError(AvahiError):
297
266
self.entry_group_state_changed_match = None
299
def rename(self, remove=True):
300
269
"""Derived from the Avahi example code"""
301
270
if self.rename_count >= self.max_renames:
302
271
logger.critical("No suitable Zeroconf service name found"
303
272
" after %i retries, exiting.",
304
273
self.rename_count)
305
274
raise AvahiServiceError("Too many renames")
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
309
277
logger.info("Changing Zeroconf service name to %r ...",
315
282
except dbus.exceptions.DBusException as error:
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
321
logger.critical("D-Bus Exception", exc_info=error)
283
logger.critical("D-Bus Exception", exc_info=error)
286
self.rename_count += 1
325
288
def remove(self):
326
289
"""Derived from the Avahi example code"""
381
345
def server_state_changed(self, state, error=None):
382
346
"""Derived from the Avahi example code"""
383
347
logger.debug("Avahi server state change: %i", state)
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
390
355
if state in bad_states:
391
356
if bad_states[state] is not None:
392
357
if error is None:
422
376
follow_name_owner_changes=True),
423
377
avahi.DBUS_INTERFACE_SERVER)
424
378
self.server.connect_to_signal("StateChanged",
425
self.server_state_changed)
379
self.server_state_changed)
426
380
self.server_state_changed(self.server.GetState())
429
383
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
385
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
445
connection.send(func(*args, **kwargs))
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
448
401
class Client(object):
449
402
"""A representation of a client host served by this server.
496
446
"fingerprint", "host", "interval",
497
447
"last_approval_request", "last_checked_ok",
498
448
"last_enabled", "name", "timeout")
501
"extended_timeout": "PT15M",
503
"checker": "fping -q -- %%(host)s",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
460
def timeout_milliseconds(self):
461
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
468
def interval_milliseconds(self):
469
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
512
476
def config_parser(config):
590
551
self.current_checker_command = None
591
552
self.approved = None
592
553
self.approvals_pending = 0
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
597
559
if not attr.startswith("_")]
598
560
self.client_structure.append("client_structure")
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
562
for name, t in inspect.getmembers(type(self),
602
566
if not name.startswith("_"):
603
567
self.client_structure.append(name)
646
610
# and every interval from then on.
647
611
if self.checker_initiator_tag is not None:
648
612
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
613
self.checker_initiator_tag = (gobject.timeout_add
614
(self.interval_milliseconds(),
652
616
# Schedule a disable() when 'timeout' has passed
653
617
if self.disable_initiator_tag is not None:
654
618
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
619
self.disable_initiator_tag = (gobject.timeout_add
620
(self.timeout_milliseconds(),
657
622
# Also start a new checker *right now*.
658
623
self.start_checker()
660
def checker_callback(self, source, condition, connection,
625
def checker_callback(self, pid, condition, command):
662
626
"""The checker has completed, so take appropriate actions."""
663
627
self.checker_callback_tag = None
664
628
self.checker = None
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
672
631
if self.last_checker_status == 0:
673
632
logger.info("Checker for %(name)s succeeded",
675
634
self.checked_ok()
677
logger.info("Checker for %(name)s failed", vars(self))
636
logger.info("Checker for %(name)s failed",
679
639
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
681
640
logger.warning("Checker for %(name)s crashed?",
685
643
def checked_ok(self):
686
644
"""Assert that the client has been seen, alive and well."""
687
645
self.last_checked_ok = datetime.datetime.utcnow()
688
646
self.last_checker_status = 0
689
self.last_checker_signal = None
690
647
self.bump_timeout()
692
649
def bump_timeout(self, timeout=None):
718
676
# than 'timeout' for the client to be disabled, which is as it
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
679
# If a checker exists, make sure it is not a zombie
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except (AttributeError, OSError) as error:
683
if (isinstance(error, OSError)
684
and error.errno != errno.ECHILD):
688
logger.warning("Checker was a zombie")
689
gobject.source_remove(self.checker_callback_tag)
690
self.checker_callback(pid, status,
691
self.current_checker_command)
725
692
# Start a new checker if needed
726
693
if self.checker is None:
727
694
# Escape attributes for the shell
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
695
escaped_attrs = dict(
696
(attr, re.escape(unicode(getattr(self, attr))))
698
self.runtime_expansions)
732
700
command = self.checker_command % escaped_attrs
733
701
except TypeError as error:
734
702
logger.error('Could not format string "%s"',
735
self.checker_command,
703
self.checker_command, exc_info=error)
704
return True # Try again later
705
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
self.checker = subprocess.Popen(command,
716
except OSError as error:
717
logger.error("Failed to start subprocess",
737
return True # Try again later
738
self.current_checker_command = command
739
logger.info("Starting checker %r for %s", command,
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
748
popen_args = { "close_fds": True,
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
758
args = (pipe[1], subprocess.call, command),
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
719
self.checker_callback_tag = (gobject.child_watch_add
721
self.checker_callback,
723
# The checker may have completed before the gobject
724
# watch was added. Check for this.
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
727
gobject.source_remove(self.checker_callback_tag)
728
self.checker_callback(pid, status, command)
764
729
# Re-run this periodically if run by gobject.timeout_add
835
801
"""Decorator to annotate D-Bus methods, signals or properties
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
804
@dbus_service_property("org.example.Interface", signature="b",
806
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
"org.freedesktop.DBus.Property."
808
"EmitsChangedSignal": "false"})
843
809
def Property_dbus_property(self):
844
810
return dbus.Boolean(False)
846
See also the DBusObjectWithAnnotations class.
849
812
def decorator(func):
850
813
func._dbus_annotations = annotations
856
818
class DBusPropertyException(dbus.exceptions.DBusException):
857
819
"""A base class for D-Bus property-related exceptions
821
def __unicode__(self):
822
return unicode(str(self))
862
825
class DBusPropertyAccessException(DBusPropertyException):
885
849
If called like _is_dbus_thing("method") it returns a function
886
850
suitable for use as predicate to inspect.getmembers().
888
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
891
855
def _get_all_dbus_things(self, thing):
892
856
"""Returns a generator of (name, attribute) pairs
894
return ((getattr(athing.__get__(self), "_dbus_name", name),
858
return ((getattr(athing.__get__(self), "_dbus_name",
895
860
athing.__get__(self))
896
861
for cls in self.__class__.__mro__
897
862
for name, athing in
898
inspect.getmembers(cls, self._is_dbus_thing(thing)))
900
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
902
path_keyword = 'object_path',
903
connection_keyword = 'connection')
904
def Introspect(self, object_path, connection):
905
"""Overloading of standard D-Bus method.
907
Inserts annotation tags on methods and signals.
909
xmlstring = dbus.service.Object.Introspect(self, object_path,
912
document = xml.dom.minidom.parseString(xmlstring)
914
for if_tag in document.getElementsByTagName("interface"):
915
# Add annotation tags
916
for typ in ("method", "signal"):
917
for tag in if_tag.getElementsByTagName(typ):
919
for name, prop in (self.
920
_get_all_dbus_things(typ)):
921
if (name == tag.getAttribute("name")
922
and prop._dbus_interface
923
== if_tag.getAttribute("name")):
924
annots.update(getattr(
925
prop, "_dbus_annotations", {}))
926
for name, value in annots.items():
927
ann_tag = document.createElement(
929
ann_tag.setAttribute("name", name)
930
ann_tag.setAttribute("value", value)
931
tag.appendChild(ann_tag)
932
# Add interface annotation tags
933
for annotation, value in dict(
934
itertools.chain.from_iterable(
935
annotations().items()
936
for name, annotations
937
in self._get_all_dbus_things("interface")
938
if name == if_tag.getAttribute("name")
940
ann_tag = document.createElement("annotation")
941
ann_tag.setAttribute("name", annotation)
942
ann_tag.setAttribute("value", value)
943
if_tag.appendChild(ann_tag)
944
# Fix argument name for the Introspect method itself
945
if (if_tag.getAttribute("name")
946
== dbus.INTROSPECTABLE_IFACE):
947
for cn in if_tag.getElementsByTagName("method"):
948
if cn.getAttribute("name") == "Introspect":
949
for arg in cn.getElementsByTagName("arg"):
950
if (arg.getAttribute("direction")
952
arg.setAttribute("name",
954
xmlstring = document.toxml("utf-8")
956
except (AttributeError, xml.dom.DOMException,
957
xml.parsers.expat.ExpatError) as error:
958
logger.error("Failed to override Introspection method",
963
class DBusObjectWithProperties(DBusObjectWithAnnotations):
964
"""A D-Bus object with properties.
966
Classes inheriting from this can use the dbus_service_property
967
decorator to expose methods as D-Bus properties. It exposes the
968
standard Get(), Set(), and GetAll() methods on the D-Bus.
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
971
866
def _get_dbus_property(self, interface_name, property_name):
972
867
"""Returns a bound method if one exists which is a D-Bus
973
868
property with the specified name and interface.
975
for cls in self.__class__.__mro__:
976
for name, value in inspect.getmembers(
977
cls, self._is_dbus_thing("property")):
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
978
874
if (value._dbus_name == property_name
979
875
and value._dbus_interface == interface_name):
980
876
return value.__get__(self)
982
878
# No such property
983
raise DBusPropertyNotFound("{}:{}.{}".format(
984
self.dbus_object_path, interface_name, property_name))
987
def _get_all_interface_names(cls):
988
"""Get a sequence of all interfaces supported by an object"""
989
return (name for name in set(getattr(getattr(x, attr),
990
"_dbus_interface", None)
991
for x in (inspect.getmro(cls))
995
@dbus.service.method(dbus.PROPERTIES_IFACE,
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
997
884
out_signature="v")
998
885
def Get(self, interface_name, property_name):
999
886
"""Standard D-Bus property Get() method, see D-Bus standard.
1088
961
if prop._dbus_interface
1089
962
== if_tag.getAttribute("name")):
1090
963
if_tag.appendChild(tag)
1091
# Add annotation tags for properties
1092
for tag in if_tag.getElementsByTagName("property"):
1094
for name, prop in self._get_all_dbus_things(
1096
if (name == tag.getAttribute("name")
1097
and prop._dbus_interface
1098
== if_tag.getAttribute("name")):
1099
annots.update(getattr(
1100
prop, "_dbus_annotations", {}))
1101
for name, value in annots.items():
1102
ann_tag = document.createElement(
1104
ann_tag.setAttribute("name", name)
1105
ann_tag.setAttribute("value", value)
1106
tag.appendChild(ann_tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
1107
995
# Add the names to the return values for the
1108
996
# "org.freedesktop.DBus.Properties" methods
1109
997
if (if_tag.getAttribute("name")
1127
1015
exc_info=error)
1128
1016
return xmlstring
1131
dbus.OBJECT_MANAGER_IFACE
1132
except AttributeError:
1133
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1135
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1136
"""A D-Bus object with an ObjectManager.
1138
Classes inheriting from this exposes the standard
1139
GetManagedObjects call and the InterfacesAdded and
1140
InterfacesRemoved signals on the standard
1141
"org.freedesktop.DBus.ObjectManager" interface.
1143
Note: No signals are sent automatically; they must be sent
1146
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1147
out_signature = "a{oa{sa{sv}}}")
1148
def GetManagedObjects(self):
1149
"""This function must be overridden"""
1150
raise NotImplementedError()
1152
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1153
signature = "oa{sa{sv}}")
1154
def InterfacesAdded(self, object_path, interfaces_and_properties):
1157
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1158
def InterfacesRemoved(self, object_path, interfaces):
1161
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1162
out_signature = "s",
1163
path_keyword = 'object_path',
1164
connection_keyword = 'connection')
1165
def Introspect(self, object_path, connection):
1166
"""Overloading of standard D-Bus method.
1168
Override return argument name of GetManagedObjects to be
1169
"objpath_interfaces_and_properties"
1171
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1175
document = xml.dom.minidom.parseString(xmlstring)
1177
for if_tag in document.getElementsByTagName("interface"):
1178
# Fix argument name for the GetManagedObjects method
1179
if (if_tag.getAttribute("name")
1180
== dbus.OBJECT_MANAGER_IFACE):
1181
for cn in if_tag.getElementsByTagName("method"):
1182
if (cn.getAttribute("name")
1183
== "GetManagedObjects"):
1184
for arg in cn.getElementsByTagName("arg"):
1185
if (arg.getAttribute("direction")
1189
"objpath_interfaces"
1191
xmlstring = document.toxml("utf-8")
1193
except (AttributeError, xml.dom.DOMException,
1194
xml.parsers.expat.ExpatError) as error:
1195
logger.error("Failed to override Introspection method",
1199
def datetime_to_dbus(dt, variant_level=0):
1019
def datetime_to_dbus (dt, variant_level=0):
1200
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1202
1022
return dbus.String("", variant_level = variant_level)
1203
return dbus.String(dt.isoformat(), variant_level=variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1206
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1237
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1238
1058
# with the wrong interface name
1239
1059
if (not hasattr(attribute, "_dbus_interface")
1240
or not attribute._dbus_interface.startswith(
1241
orig_interface_name)):
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1243
1063
# Create an alternate D-Bus interface name based on
1244
1064
# the current name
1245
alt_interface = attribute._dbus_interface.replace(
1246
orig_interface_name, alt_interface_name)
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1247
1068
interface_names.add(alt_interface)
1248
1069
# Is this a D-Bus signal?
1249
1070
if getattr(attribute, "_dbus_is_signal", False):
1250
if sys.version_info.major == 2:
1251
# Extract the original non-method undecorated
1252
# function by black magic
1253
nonmethod_func = (dict(
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1254
1074
zip(attribute.func_code.co_freevars,
1255
attribute.__closure__))
1256
["func"].cell_contents)
1258
nonmethod_func = attribute
1075
attribute.__closure__))["func"]
1259
1077
# Create a new, but exactly alike, function
1260
1078
# object, and decorate it to be a new D-Bus signal
1261
1079
# with the alternate D-Bus interface name
1262
if sys.version_info.major == 2:
1263
new_function = types.FunctionType(
1264
nonmethod_func.func_code,
1265
nonmethod_func.func_globals,
1266
nonmethod_func.func_name,
1267
nonmethod_func.func_defaults,
1268
nonmethod_func.func_closure)
1270
new_function = types.FunctionType(
1271
nonmethod_func.__code__,
1272
nonmethod_func.__globals__,
1273
nonmethod_func.__name__,
1274
nonmethod_func.__defaults__,
1275
nonmethod_func.__closure__)
1276
new_function = (dbus.service.signal(
1278
attribute._dbus_signature)(new_function))
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1279
1089
# Copy annotations, if any
1281
new_function._dbus_annotations = dict(
1282
attribute._dbus_annotations)
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1283
1093
except AttributeError:
1285
1095
# Define a creator of a function to call both the
1312
1115
# object. Decorate it to be a new D-Bus method
1313
1116
# with the alternate D-Bus interface name. Add it
1314
1117
# to the class.
1316
dbus.service.method(
1318
attribute._dbus_in_signature,
1319
attribute._dbus_out_signature)
1320
(types.FunctionType(attribute.func_code,
1321
attribute.func_globals,
1322
attribute.func_name,
1323
attribute.func_defaults,
1324
attribute.func_closure)))
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1325
1128
# Copy annotations, if any
1327
attr[attrname]._dbus_annotations = dict(
1328
attribute._dbus_annotations)
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1329
1132
except AttributeError:
1331
1134
# Is this a D-Bus property?
1334
1137
# object, and decorate it to be a new D-Bus
1335
1138
# property with the alternate D-Bus interface
1336
1139
# name. Add it to the class.
1337
attr[attrname] = (dbus_service_property(
1338
alt_interface, attribute._dbus_signature,
1339
attribute._dbus_access,
1340
attribute._dbus_get_args_options
1342
(types.FunctionType(
1343
attribute.func_code,
1344
attribute.func_globals,
1345
attribute.func_name,
1346
attribute.func_defaults,
1347
attribute.func_closure)))
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1348
1153
# Copy annotations, if any
1350
attr[attrname]._dbus_annotations = dict(
1351
attribute._dbus_annotations)
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1352
1157
except AttributeError:
1354
1159
# Is this a D-Bus interface?
1411
1213
Client.__init__(self, *args, **kwargs)
1412
1214
# Only now, when this client is initialized, can it show up on
1414
client_object_name = str(self.name).translate(
1216
client_object_name = unicode(self.name).translate(
1415
1217
{ord("."): ord("_"),
1416
1218
ord("-"): ord("_")})
1417
self.dbus_object_path = dbus.ObjectPath(
1418
"/clients/" + client_object_name)
1219
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
1419
1221
DBusObjectWithProperties.__init__(self, self.bus,
1420
1222
self.dbus_object_path)
1422
def notifychangeproperty(transform_func, dbus_name,
1423
type_func=lambda x: x,
1425
invalidate_only=False,
1426
_interface=_interface):
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1427
1227
""" Modify a variable so that it's a property which announces
1428
1228
its changes to DBus.
1434
1234
to the D-Bus. Default: no transform
1435
1235
variant_level: D-Bus variant level. Default: 1
1437
attrname = "_{}".format(dbus_name)
1237
attrname = "_{0}".format(dbus_name)
1439
1238
def setter(self, value):
1440
1239
if hasattr(self, "dbus_object_path"):
1441
1240
if (not hasattr(self, attrname) or
1442
1241
type_func(getattr(self, attrname, None))
1443
1242
!= type_func(value)):
1445
self.PropertiesChanged(
1446
_interface, dbus.Dictionary(),
1447
dbus.Array((dbus_name, )))
1449
dbus_value = transform_func(
1451
variant_level = variant_level)
1452
self.PropertyChanged(dbus.String(dbus_name),
1454
self.PropertiesChanged(
1456
dbus.Dictionary({ dbus.String(dbus_name):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1459
1248
setattr(self, attrname, value)
1461
1250
return property(lambda self: getattr(self, attrname), setter)
1478
1267
datetime_to_dbus, "LastApprovalRequest")
1479
1268
approved_by_default = notifychangeproperty(dbus.Boolean,
1480
1269
"ApprovedByDefault")
1481
approval_delay = notifychangeproperty(
1482
dbus.UInt64, "ApprovalDelay",
1483
type_func = lambda td: td.total_seconds() * 1000)
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1484
1274
approval_duration = notifychangeproperty(
1485
1275
dbus.UInt64, "ApprovalDuration",
1486
type_func = lambda td: td.total_seconds() * 1000)
1276
type_func = timedelta_to_milliseconds)
1487
1277
host = notifychangeproperty(dbus.String, "Host")
1488
timeout = notifychangeproperty(
1489
dbus.UInt64, "Timeout",
1490
type_func = lambda td: td.total_seconds() * 1000)
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1491
1281
extended_timeout = notifychangeproperty(
1492
1282
dbus.UInt64, "ExtendedTimeout",
1493
type_func = lambda td: td.total_seconds() * 1000)
1494
interval = notifychangeproperty(
1495
dbus.UInt64, "Interval",
1496
type_func = lambda td: td.total_seconds() * 1000)
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1497
1288
checker_command = notifychangeproperty(dbus.String, "Checker")
1498
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1499
invalidate_only=True)
1501
1290
del notifychangeproperty
1509
1298
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1510
1299
Client.__del__(self, *args, **kwargs)
1512
def checker_callback(self, source, condition,
1513
connection, command, *args, **kwargs):
1514
ret = Client.checker_callback(self, source, condition,
1515
connection, command, *args,
1517
exitstatus = self.last_checker_status
1301
def checker_callback(self, pid, condition, command,
1303
self.checker_callback_tag = None
1305
if os.WIFEXITED(condition):
1306
exitstatus = os.WEXITSTATUS(condition)
1519
1307
# Emit D-Bus signal
1520
1308
self.CheckerCompleted(dbus.Int16(exitstatus),
1521
# This is specific to GNU libC
1522
dbus.Int64(exitstatus << 8),
1309
dbus.Int64(condition),
1523
1310
dbus.String(command))
1525
1312
# Emit D-Bus signal
1526
1313
self.CheckerCompleted(dbus.Int16(-1),
1528
# This is specific to GNU libC
1530
| self.last_checker_signal),
1314
dbus.Int64(condition),
1531
1315
dbus.String(command))
1317
return Client.checker_callback(self, pid, condition, command,
1534
1320
def start_checker(self, *args, **kwargs):
1535
old_checker_pid = getattr(self.checker, "pid", None)
1321
old_checker = self.checker
1322
if self.checker is not None:
1323
old_checker_pid = self.checker.pid
1325
old_checker_pid = None
1536
1326
r = Client.start_checker(self, *args, **kwargs)
1537
1327
# Only if new checker process was started
1538
1328
if (self.checker is not None
1653
1444
self.approved_by_default = bool(value)
1655
1446
# ApprovalDelay - property
1656
@dbus_service_property(_interface,
1447
@dbus_service_property(_interface, signature="t",
1658
1448
access="readwrite")
1659
1449
def ApprovalDelay_dbus_property(self, value=None):
1660
1450
if value is None: # get
1661
return dbus.UInt64(self.approval_delay.total_seconds()
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1663
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1665
1454
# ApprovalDuration - property
1666
@dbus_service_property(_interface,
1455
@dbus_service_property(_interface, signature="t",
1668
1456
access="readwrite")
1669
1457
def ApprovalDuration_dbus_property(self, value=None):
1670
1458
if value is None: # get
1671
return dbus.UInt64(self.approval_duration.total_seconds()
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1673
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1675
1463
# Name - property
1677
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1678
1464
@dbus_service_property(_interface, signature="s", access="read")
1679
1465
def Name_dbus_property(self):
1680
1466
return dbus.String(self.name)
1682
1468
# Fingerprint - property
1684
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1685
1469
@dbus_service_property(_interface, signature="s", access="read")
1686
1470
def Fingerprint_dbus_property(self):
1687
1471
return dbus.String(self.fingerprint)
1689
1473
# Host - property
1690
@dbus_service_property(_interface,
1474
@dbus_service_property(_interface, signature="s",
1692
1475
access="readwrite")
1693
1476
def Host_dbus_property(self, value=None):
1694
1477
if value is None: # get
1695
1478
return dbus.String(self.host)
1696
self.host = str(value)
1479
self.host = unicode(value)
1698
1481
# Created - property
1700
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1701
1482
@dbus_service_property(_interface, signature="s", access="read")
1702
1483
def Created_dbus_property(self):
1703
1484
return datetime_to_dbus(self.created)
1767
1546
gobject.source_remove(self.disable_initiator_tag)
1768
self.disable_initiator_tag = gobject.timeout_add(
1769
int((self.expires - now).total_seconds() * 1000),
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1772
1552
# ExtendedTimeout - property
1773
@dbus_service_property(_interface,
1553
@dbus_service_property(_interface, signature="t",
1775
1554
access="readwrite")
1776
1555
def ExtendedTimeout_dbus_property(self, value=None):
1777
1556
if value is None: # get
1778
return dbus.UInt64(self.extended_timeout.total_seconds()
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1780
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1782
1560
# Interval - property
1783
@dbus_service_property(_interface,
1561
@dbus_service_property(_interface, signature="t",
1785
1562
access="readwrite")
1786
1563
def Interval_dbus_property(self, value=None):
1787
1564
if value is None: # get
1788
return dbus.UInt64(self.interval.total_seconds() * 1000)
1565
return dbus.UInt64(self.interval_milliseconds())
1789
1566
self.interval = datetime.timedelta(0, 0, 0, value)
1790
1567
if getattr(self, "checker_initiator_tag", None) is None:
1792
1569
if self.enabled:
1793
1570
# Reschedule checker run
1794
1571
gobject.source_remove(self.checker_initiator_tag)
1795
self.checker_initiator_tag = gobject.timeout_add(
1796
value, self.start_checker)
1797
self.start_checker() # Start one now, too
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1799
1576
# Checker - property
1800
@dbus_service_property(_interface,
1577
@dbus_service_property(_interface, signature="s",
1802
1578
access="readwrite")
1803
1579
def Checker_dbus_property(self, value=None):
1804
1580
if value is None: # get
1805
1581
return dbus.String(self.checker_command)
1806
self.checker_command = str(value)
1582
self.checker_command = unicode(value)
1808
1584
# CheckerRunning - property
1809
@dbus_service_property(_interface,
1585
@dbus_service_property(_interface, signature="b",
1811
1586
access="readwrite")
1812
1587
def CheckerRunning_dbus_property(self, value=None):
1813
1588
if value is None: # get
2044
1814
def fingerprint(openpgp):
2045
1815
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2046
1816
# New GnuTLS "datum" with the OpenPGP public key
2047
datum = gnutls.library.types.gnutls_datum_t(
2048
ctypes.cast(ctypes.c_char_p(openpgp),
2049
ctypes.POINTER(ctypes.c_ubyte)),
2050
ctypes.c_uint(len(openpgp)))
1817
datum = (gnutls.library.types
1818
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1821
ctypes.c_uint(len(openpgp))))
2051
1822
# New empty GnuTLS certificate
2052
1823
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2053
gnutls.library.functions.gnutls_openpgp_crt_init(
1824
(gnutls.library.functions
1825
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2055
1826
# Import the OpenPGP public key into the certificate
2056
gnutls.library.functions.gnutls_openpgp_crt_import(
2057
crt, ctypes.byref(datum),
2058
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1827
(gnutls.library.functions
1828
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
gnutls.library.constants
1830
.GNUTLS_OPENPGP_FMT_RAW))
2059
1831
# Verify the self signature in the key
2060
1832
crtverify = ctypes.c_uint()
2061
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2062
crt, 0, ctypes.byref(crtverify))
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_verify_self(crt, 0,
1835
ctypes.byref(crtverify)))
2063
1836
if crtverify.value != 0:
2064
1837
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2065
raise gnutls.errors.CertificateSecurityError(
1838
raise (gnutls.errors.CertificateSecurityError
2067
1840
# New buffer for the fingerprint
2068
1841
buf = ctypes.create_string_buffer(20)
2069
1842
buf_len = ctypes.c_size_t()
2070
1843
# Get the fingerprint from the certificate into the buffer
2071
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2072
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1844
(gnutls.library.functions
1845
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
ctypes.byref(buf_len)))
2073
1847
# Deinit the certificate
2074
1848
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2075
1849
# Convert the buffer to a Python bytestring
2126
1898
interface: None or a network interface name (string)
2127
1899
use_ipv6: Boolean; to use IPv6 or not
2130
1901
def __init__(self, server_address, RequestHandlerClass,
2134
"""If socketfd is set, use that file descriptor instead of
2135
creating a new one with socket.socket().
1902
interface=None, use_ipv6=True):
2137
1903
self.interface = interface
2139
1905
self.address_family = socket.AF_INET6
2140
if socketfd is not None:
2141
# Save the file descriptor
2142
self.socketfd = socketfd
2143
# Save the original socket.socket() function
2144
self.socket_socket = socket.socket
2145
# To implement --socket, we monkey patch socket.socket.
2147
# (When socketserver.TCPServer is a new-style class, we
2148
# could make self.socket into a property instead of monkey
2149
# patching socket.socket.)
2151
# Create a one-time-only replacement for socket.socket()
2152
@functools.wraps(socket.socket)
2153
def socket_wrapper(*args, **kwargs):
2154
# Restore original function so subsequent calls are
2156
socket.socket = self.socket_socket
2157
del self.socket_socket
2158
# This time only, return a new socket object from the
2159
# saved file descriptor.
2160
return socket.fromfd(self.socketfd, *args, **kwargs)
2161
# Replace socket.socket() function with wrapper
2162
socket.socket = socket_wrapper
2163
# The socketserver.TCPServer.__init__ will call
2164
# socket.socket(), which might be our replacement,
2165
# socket_wrapper(), if socketfd was set.
2166
1906
socketserver.TCPServer.__init__(self, server_address,
2167
1907
RequestHandlerClass)
2169
1908
def server_bind(self):
2170
1909
"""This overrides the normal server_bind() function
2171
1910
to bind to an interface if one was specified, and also NOT to
2177
1916
self.interface)
2180
self.socket.setsockopt(
2181
socket.SOL_SOCKET, SO_BINDTODEVICE,
2182
(self.interface + "\0").encode("utf-8"))
1919
self.socket.setsockopt(socket.SOL_SOCKET,
2183
1923
except socket.error as error:
2184
1924
if error.errno == errno.EPERM:
2185
logger.error("No permission to bind to"
2186
" interface %s", self.interface)
1925
logger.error("No permission to"
1926
" bind to interface %s",
2187
1928
elif error.errno == errno.ENOPROTOOPT:
2188
1929
logger.error("SO_BINDTODEVICE not available;"
2189
1930
" cannot bind to interface %s",
2190
1931
self.interface)
2191
1932
elif error.errno == errno.ENODEV:
2192
logger.error("Interface %s does not exist,"
2193
" cannot bind", self.interface)
1933
logger.error("Interface %s does not"
1934
" exist, cannot bind",
2196
1938
# Only bind(2) the socket if we really need to.
2253
1989
def add_pipe(self, parent_pipe, proc):
2254
1990
# Call "handle_ipc" for both data and EOF events
2255
gobject.io_add_watch(
2256
parent_pipe.fileno(),
2257
gobject.IO_IN | gobject.IO_HUP,
2258
functools.partial(self.handle_ipc,
2259
parent_pipe = parent_pipe,
1991
gobject.io_add_watch(parent_pipe.fileno(),
1992
gobject.IO_IN | gobject.IO_HUP,
1993
functools.partial(self.handle_ipc,
2262
def handle_ipc(self, source, condition,
2265
client_object=None):
1998
def handle_ipc(self, source, condition, parent_pipe=None,
1999
proc = None, client_object=None):
2266
2000
# error, or the other end of multiprocessing.Pipe has closed
2267
2001
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2268
2002
# Wait for other process to exit
2331
def rfc3339_duration_to_delta(duration):
2332
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2334
>>> rfc3339_duration_to_delta("P7D")
2335
datetime.timedelta(7)
2336
>>> rfc3339_duration_to_delta("PT60S")
2337
datetime.timedelta(0, 60)
2338
>>> rfc3339_duration_to_delta("PT60M")
2339
datetime.timedelta(0, 3600)
2340
>>> rfc3339_duration_to_delta("PT24H")
2341
datetime.timedelta(1)
2342
>>> rfc3339_duration_to_delta("P1W")
2343
datetime.timedelta(7)
2344
>>> rfc3339_duration_to_delta("PT5M30S")
2345
datetime.timedelta(0, 330)
2346
>>> rfc3339_duration_to_delta("P1DT3M20S")
2347
datetime.timedelta(1, 200)
2350
# Parsing an RFC 3339 duration with regular expressions is not
2351
# possible - there would have to be multiple places for the same
2352
# values, like seconds. The current code, while more esoteric, is
2353
# cleaner without depending on a parsing library. If Python had a
2354
# built-in library for parsing we would use it, but we'd like to
2355
# avoid excessive use of external libraries.
2357
# New type for defining tokens, syntax, and semantics all-in-one
2358
Token = collections.namedtuple("Token", (
2359
"regexp", # To match token; if "value" is not None, must have
2360
# a "group" containing digits
2361
"value", # datetime.timedelta or None
2362
"followers")) # Tokens valid after this token
2363
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2364
# the "duration" ABNF definition in RFC 3339, Appendix A.
2365
token_end = Token(re.compile(r"$"), None, frozenset())
2366
token_second = Token(re.compile(r"(\d+)S"),
2367
datetime.timedelta(seconds=1),
2368
frozenset((token_end, )))
2369
token_minute = Token(re.compile(r"(\d+)M"),
2370
datetime.timedelta(minutes=1),
2371
frozenset((token_second, token_end)))
2372
token_hour = Token(re.compile(r"(\d+)H"),
2373
datetime.timedelta(hours=1),
2374
frozenset((token_minute, token_end)))
2375
token_time = Token(re.compile(r"T"),
2377
frozenset((token_hour, token_minute,
2379
token_day = Token(re.compile(r"(\d+)D"),
2380
datetime.timedelta(days=1),
2381
frozenset((token_time, token_end)))
2382
token_month = Token(re.compile(r"(\d+)M"),
2383
datetime.timedelta(weeks=4),
2384
frozenset((token_day, token_end)))
2385
token_year = Token(re.compile(r"(\d+)Y"),
2386
datetime.timedelta(weeks=52),
2387
frozenset((token_month, token_end)))
2388
token_week = Token(re.compile(r"(\d+)W"),
2389
datetime.timedelta(weeks=1),
2390
frozenset((token_end, )))
2391
token_duration = Token(re.compile(r"P"), None,
2392
frozenset((token_year, token_month,
2393
token_day, token_time,
2395
# Define starting values
2396
value = datetime.timedelta() # Value so far
2398
followers = frozenset((token_duration, )) # Following valid tokens
2399
s = duration # String left to parse
2400
# Loop until end token is found
2401
while found_token is not token_end:
2402
# Search for any currently valid tokens
2403
for token in followers:
2404
match = token.regexp.match(s)
2405
if match is not None:
2407
if token.value is not None:
2408
# Value found, parse digits
2409
factor = int(match.group(1), 10)
2410
# Add to value so far
2411
value += factor * token.value
2412
# Strip token from string
2413
s = token.regexp.sub("", s, 1)
2416
# Set valid next tokens
2417
followers = found_token.followers
2420
# No currently valid tokens were found
2421
raise ValueError("Invalid RFC 3339 duration: {!r}"
2427
2065
def string_to_delta(interval):
2428
2066
"""Parse a string and return a datetime.timedelta
2527
2160
parser.add_argument("--no-dbus", action="store_false",
2528
2161
dest="use_dbus", help="Do not provide D-Bus"
2529
" system bus interface", default=None)
2162
" system bus interface")
2530
2163
parser.add_argument("--no-ipv6", action="store_false",
2531
dest="use_ipv6", help="Do not use IPv6",
2164
dest="use_ipv6", help="Do not use IPv6")
2533
2165
parser.add_argument("--no-restore", action="store_false",
2534
2166
dest="restore", help="Do not restore stored"
2535
" state", default=None)
2536
parser.add_argument("--socket", type=int,
2537
help="Specify a file descriptor to a network"
2538
" socket to use instead of creating one")
2539
2168
parser.add_argument("--statedir", metavar="DIR",
2540
2169
help="Directory to save/restore state in")
2541
parser.add_argument("--foreground", action="store_true",
2542
help="Run in foreground", default=None)
2543
parser.add_argument("--no-zeroconf", action="store_false",
2544
dest="zeroconf", help="Do not use Zeroconf",
2547
2171
options = parser.parse_args()
2549
2173
if options.check:
2551
fail_count, test_count = doctest.testmod()
2552
sys.exit(os.EX_OK if fail_count == 0 else 1)
2554
2178
# Default values for config file for server-global settings
2555
2179
server_defaults = { "interface": "",
2558
2182
"debug": "False",
2560
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2561
":+SIGN-DSA-SHA256",
2184
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2562
2185
"servicename": "Mandos",
2563
2186
"use_dbus": "True",
2564
2187
"use_ipv6": "True",
2565
2188
"debuglevel": "",
2566
2189
"restore": "True",
2568
"statedir": "/var/lib/mandos",
2569
"foreground": "False",
2190
"statedir": "/var/lib/mandos"
2573
2193
# Parse config file for server-global settings
2574
2194
server_config = configparser.SafeConfigParser(server_defaults)
2575
2195
del server_defaults
2576
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2196
server_config.read(os.path.join(options.configdir,
2577
2198
# Convert the SafeConfigParser object to a dict
2578
2199
server_settings = server_config.defaults()
2579
2200
# Use the appropriate methods on the non-string config options
2580
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2201
for option in ("debug", "use_dbus", "use_ipv6"):
2581
2202
server_settings[option] = server_config.getboolean("DEFAULT",
2583
2204
if server_settings["port"]:
2584
2205
server_settings["port"] = server_config.getint("DEFAULT",
2586
if server_settings["socket"]:
2587
server_settings["socket"] = server_config.getint("DEFAULT",
2589
# Later, stdin will, and stdout and stderr might, be dup'ed
2590
# over with an opened os.devnull. But we don't want this to
2591
# happen with a supplied network socket.
2592
if 0 <= server_settings["socket"] <= 2:
2593
server_settings["socket"] = os.dup(server_settings
2595
2207
del server_config
2597
2209
# Override the settings from the config file with command line
2598
2210
# options, if set.
2599
2211
for option in ("interface", "address", "port", "debug",
2600
"priority", "servicename", "configdir", "use_dbus",
2601
"use_ipv6", "debuglevel", "restore", "statedir",
2602
"socket", "foreground", "zeroconf"):
2212
"priority", "servicename", "configdir",
2213
"use_dbus", "use_ipv6", "debuglevel", "restore",
2603
2215
value = getattr(options, option)
2604
2216
if value is not None:
2605
2217
server_settings[option] = value
2607
2219
# Force all strings to be unicode
2608
2220
for option in server_settings.keys():
2609
if isinstance(server_settings[option], bytes):
2610
server_settings[option] = (server_settings[option]
2612
# Force all boolean options to be boolean
2613
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2614
"foreground", "zeroconf"):
2615
server_settings[option] = bool(server_settings[option])
2616
# Debug implies foreground
2617
if server_settings["debug"]:
2618
server_settings["foreground"] = True
2221
if type(server_settings[option]) is str:
2222
server_settings[option] = unicode(server_settings[option])
2619
2223
# Now we have our good server settings in "server_settings"
2621
2225
##################################################################
2623
if (not server_settings["zeroconf"]
2624
and not (server_settings["port"]
2625
or server_settings["socket"] != "")):
2626
parser.error("Needs port or socket to work without Zeroconf")
2628
2227
# For convenience
2629
2228
debug = server_settings["debug"]
2630
2229
debuglevel = server_settings["debuglevel"]
2659
2257
global mandos_dbus_service
2660
2258
mandos_dbus_service = None
2663
if server_settings["socket"] != "":
2664
socketfd = server_settings["socket"]
2665
tcp_server = MandosServer(
2666
(server_settings["address"], server_settings["port"]),
2668
interface=(server_settings["interface"] or None),
2670
gnutls_priority=server_settings["priority"],
2674
pidfilename = "/run/mandos.pid"
2675
if not os.path.isdir("/run/."):
2676
pidfilename = "/var/run/mandos.pid"
2260
tcp_server = MandosServer((server_settings["address"],
2261
server_settings["port"]),
2263
interface=(server_settings["interface"]
2267
server_settings["priority"],
2270
pidfilename = "/var/run/mandos.pid"
2679
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2272
pidfile = open(pidfilename, "w")
2680
2273
except IOError as e:
2681
2274
logger.error("Could not open file %r", pidfilename,
2738
2329
bus_name = dbus.service.BusName("se.recompile.Mandos",
2741
old_bus_name = dbus.service.BusName(
2742
"se.bsnet.fukt.Mandos", bus,
2744
except dbus.exceptions.DBusException as e:
2330
bus, do_not_queue=True)
2331
old_bus_name = (dbus.service.BusName
2332
("se.bsnet.fukt.Mandos", bus,
2334
except dbus.exceptions.NameExistsException as e:
2745
2335
logger.error("Disabling D-Bus:", exc_info=e)
2746
2336
use_dbus = False
2747
2337
server_settings["use_dbus"] = False
2748
2338
tcp_server.use_dbus = False
2750
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2751
service = AvahiServiceToSyslog(
2752
name = server_settings["servicename"],
2753
servicetype = "_mandos._tcp",
2754
protocol = protocol,
2756
if server_settings["interface"]:
2757
service.interface = if_nametoindex(
2758
server_settings["interface"].encode("utf-8"))
2339
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2340
service = AvahiServiceToSyslog(name =
2341
server_settings["servicename"],
2342
servicetype = "_mandos._tcp",
2343
protocol = protocol, bus = bus)
2344
if server_settings["interface"]:
2345
service.interface = (if_nametoindex
2346
(str(server_settings["interface"])))
2760
2348
global multiprocessing_manager
2761
2349
multiprocessing_manager = multiprocessing.Manager()
2768
2356
old_client_settings = {}
2769
2357
clients_data = {}
2771
# This is used to redirect stdout and stderr for checker processes
2773
wnull = open(os.devnull, "w") # A writable /dev/null
2774
# Only used if server is running in foreground but not in debug
2776
if debug or not foreground:
2779
2359
# Get client data and settings from last running state.
2780
2360
if server_settings["restore"]:
2782
2362
with open(stored_state_path, "rb") as stored_state:
2783
clients_data, old_client_settings = pickle.load(
2363
clients_data, old_client_settings = (pickle.load
2785
2365
os.remove(stored_state_path)
2786
2366
except IOError as e:
2787
2367
if e.errno == errno.ENOENT:
2788
logger.warning("Could not load persistent state:"
2789
" {}".format(os.strerror(e.errno)))
2368
logger.warning("Could not load persistent state: {0}"
2369
.format(os.strerror(e.errno)))
2791
2371
logger.critical("Could not load persistent state:",
2794
2374
except EOFError as e:
2795
2375
logger.warning("Could not load persistent state: "
2376
"EOFError:", exc_info=e)
2799
2378
with PGPEngine() as pgp:
2800
for client_name, client in clients_data.items():
2801
# Skip removed clients
2802
if client_name not in client_settings:
2379
for client_name, client in clients_data.iteritems():
2805
2380
# Decide which value to use after restoring saved state.
2806
2381
# We have three different values: Old config file,
2807
2382
# new config file, and saved state.
2828
2403
if datetime.datetime.utcnow() >= client["expires"]:
2829
2404
if not client["last_checked_ok"]:
2830
2405
logger.warning(
2831
"disabling client {} - Client never "
2832
"performed a successful checker".format(
2406
"disabling client {0} - Client never "
2407
"performed a successful checker"
2408
.format(client_name))
2834
2409
client["enabled"] = False
2835
2410
elif client["last_checker_status"] != 0:
2836
2411
logger.warning(
2837
"disabling client {} - Client last"
2838
" checker failed with error code"
2841
client["last_checker_status"]))
2412
"disabling client {0} - Client "
2413
"last checker failed with error code {1}"
2414
.format(client_name,
2415
client["last_checker_status"]))
2842
2416
client["enabled"] = False
2844
client["expires"] = (
2845
datetime.datetime.utcnow()
2846
+ client["timeout"])
2418
client["expires"] = (datetime.datetime
2420
+ client["timeout"])
2847
2421
logger.debug("Last checker succeeded,"
2848
" keeping {} enabled".format(
2422
" keeping {0} enabled"
2423
.format(client_name))
2851
client["secret"] = pgp.decrypt(
2852
client["encrypted_secret"],
2853
client_settings[client_name]["secret"])
2425
client["secret"] = (
2426
pgp.decrypt(client["encrypted_secret"],
2427
client_settings[client_name]
2854
2429
except PGPError:
2855
2430
# If decryption fails, we use secret from new settings
2856
logger.debug("Failed to decrypt {} old secret".format(
2858
client["secret"] = (client_settings[client_name]
2431
logger.debug("Failed to decrypt {0} old secret"
2432
.format(client_name))
2433
client["secret"] = (
2434
client_settings[client_name]["secret"])
2861
2436
# Add/remove clients based on new changes made to config
2862
2437
for client_name in (set(old_client_settings)
2867
2442
clients_data[client_name] = client_settings[client_name]
2869
2444
# Create all client objects
2870
for client_name, client in clients_data.items():
2445
for client_name, client in clients_data.iteritems():
2871
2446
tcp_server.clients[client_name] = client_class(
2874
server_settings = server_settings)
2447
name = client_name, settings = client)
2876
2449
if not tcp_server.clients:
2877
2450
logger.warning("No clients defined")
2880
if pidfile is not None:
2884
print(pid, file=pidfile)
2886
logger.error("Could not write to file %r with PID %d",
2456
pidfile.write(str(pid) + "\n".encode("utf-8"))
2459
logger.error("Could not write to file %r with PID %d",
2462
# "pidfile" was never created
2889
2464
del pidfilename
2891
2466
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2892
2467
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2896
@alternate_dbus_interfaces(
2897
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2898
class MandosDBusService(DBusObjectWithObjectManager):
2470
@alternate_dbus_interfaces({"se.recompile.Mandos":
2471
"se.bsnet.fukt.Mandos"})
2472
class MandosDBusService(DBusObjectWithProperties):
2899
2473
"""A D-Bus proxy object"""
2901
2474
def __init__(self):
2902
2475
dbus.service.Object.__init__(self, bus, "/")
2904
2476
_interface = "se.recompile.Mandos"
2478
@dbus_interface_annotations(_interface)
2480
return { "org.freedesktop.DBus.Property"
2481
".EmitsChangedSignal":
2906
2484
@dbus.service.signal(_interface, signature="o")
2907
2485
def ClientAdded(self, objpath):
2916
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2918
2494
@dbus.service.signal(_interface, signature="os")
2919
2495
def ClientRemoved(self, objpath, name):
2923
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2925
2499
@dbus.service.method(_interface, out_signature="ao")
2926
2500
def GetAllClients(self):
2928
return dbus.Array(c.dbus_object_path for c in
2502
return dbus.Array(c.dbus_object_path
2929
2504
tcp_server.clients.itervalues())
2931
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2933
2506
@dbus.service.method(_interface,
2934
2507
out_signature="a{oa{sv}}")
2935
2508
def GetAllClientsWithProperties(self):
2937
2510
return dbus.Dictionary(
2938
{ c.dbus_object_path: c.GetAll(
2939
"se.recompile.Mandos.Client")
2940
for c in tcp_server.clients.itervalues() },
2511
((c.dbus_object_path, c.GetAll(""))
2512
for c in tcp_server.clients.itervalues()),
2941
2513
signature="oa{sv}")
2943
2515
@dbus.service.method(_interface, in_signature="o")
2947
2519
if c.dbus_object_path == object_path:
2948
2520
del tcp_server.clients[c.name]
2949
2521
c.remove_from_connection()
2950
# Don't signal the disabling
2522
# Don't signal anything except ClientRemoved
2951
2523
c.disable(quiet=True)
2952
# Emit D-Bus signal for removal
2953
self.client_removed_signal(c)
2525
self.ClientRemoved(object_path, c.name)
2955
2527
raise KeyError(object_path)
2959
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
2960
out_signature = "a{oa{sa{sv}}}")
2961
def GetManagedObjects(self):
2963
return dbus.Dictionary(
2964
{ client.dbus_object_path:
2966
{ interface: client.GetAll(interface)
2968
client._get_all_interface_names()})
2969
for client in tcp_server.clients.values()})
2971
def client_added_signal(self, client):
2972
"""Send the new standard signal and the old signal"""
2974
# New standard signal
2975
self.InterfacesAdded(
2976
client.dbus_object_path,
2978
{ interface: client.GetAll(interface)
2980
client._get_all_interface_names()}))
2982
self.ClientAdded(client.dbus_object_path)
2984
def client_removed_signal(self, client):
2985
"""Send the new standard signal and the old signal"""
2987
# New standard signal
2988
self.InterfacesRemoved(
2989
client.dbus_object_path,
2990
client._get_all_interface_names())
2992
self.ClientRemoved(client.dbus_object_path,
2995
2531
mandos_dbus_service = MandosDBusService()
2998
2534
"Cleanup function; run on exit"
3002
2537
multiprocessing.active_children()
3004
2538
if not (tcp_server.clients or client_settings):
3033
2567
del client_settings[client.name]["secret"]
3036
with tempfile.NamedTemporaryFile(
3040
dir=os.path.dirname(stored_state_path),
3041
delete=False) as stored_state:
2570
with (tempfile.NamedTemporaryFile
2571
(mode='wb', suffix=".pickle", prefix='clients-',
2572
dir=os.path.dirname(stored_state_path),
2573
delete=False)) as stored_state:
3042
2574
pickle.dump((clients, client_settings), stored_state)
3043
tempname = stored_state.name
2575
tempname=stored_state.name
3044
2576
os.rename(tempname, stored_state_path)
3045
2577
except (IOError, OSError) as e:
3049
2581
except NameError:
3051
2583
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3052
logger.warning("Could not save persistent state: {}"
2584
logger.warning("Could not save persistent state: {0}"
3053
2585
.format(os.strerror(e.errno)))
3055
2587
logger.warning("Could not save persistent state:",
3059
2591
# Delete all clients, and settings from config
3060
2592
while tcp_server.clients:
3061
2593
name, client = tcp_server.clients.popitem()
3063
2595
client.remove_from_connection()
3064
# Don't signal the disabling
2596
# Don't signal anything except ClientRemoved
3065
2597
client.disable(quiet=True)
3066
# Emit D-Bus signal for removal
3067
mandos_dbus_service.client_removed_signal(client)
2600
mandos_dbus_service.ClientRemoved(client
3068
2603
client_settings.clear()
3070
2605
atexit.register(cleanup)
3072
2607
for client in tcp_server.clients.itervalues():
3074
# Emit D-Bus signal for adding
3075
mandos_dbus_service.client_added_signal(client)
2610
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3076
2611
# Need to initiate checking of clients
3077
2612
if client.enabled:
3078
2613
client.init_checker()