To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 610
- compare with another revision
- download diff
- download tarball
- view history from revision 610
- Committer: Teddy Hogeborn
- Date: 2012-06-23 13:50:05 UTC
- Revision ID: teddy@recompile.se-20120623135005-t0wtkmlw0ymnr2kg
* mandos (Client.start_checker): Return True (retry later) if starting
checker failed. Check for ECHILD
from waitpid().
checker failed. Check for ECHILD
from waitpid().
- files removed:
- debian/upstream
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
46
43
import errno
44
import gnutls.crypto
47
45
import gnutls.connection
48
46
import gnutls.errors
49
47
import gnutls.library.functions
50
48
import gnutls.library.constants
51
49
import gnutls.library.types
52
try:
53
import ConfigParser as configparser
54
except ImportError:
55
import configparser
50
import ConfigParser as configparser
56
51
import sys
57
52
import re
58
53
import os
67
62
import struct
68
63
import fcntl
69
64
import functools
70
try:
71
import cPickle as pickle
72
except ImportError:
73
import pickle
65
import cPickle as pickle
74
66
import multiprocessing
75
67
import types
76
68
import binascii
77
69
import tempfile
78
70
import itertools
79
71
import collections
80
import codecs
81
72
82
73
import dbus
83
74
import dbus.service
84
try:
85
import gobject
86
except ImportError:
87
from gi.repository import GObject as gobject
75
import gobject
88
76
import avahi
89
77
from dbus.mainloop.glib import DBusGMainLoop
90
78
import ctypes
91
79
import ctypes.util
92
80
import xml.dom.minidom
93
81
import inspect
82
import GnuPGInterface
94
83
95
84
try:
96
85
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
100
89
except ImportError:
101
90
SO_BINDTODEVICE = None
102
91
103
if sys.version_info.major == 2:
104
str = unicode
105
106
version = "1.7.1"
92
version = "1.6.0"
107
93
stored_state_file = "clients.pickle"
108
94
109
95
logger = logging.getLogger()
110
syslogger = None
96
syslogger = (logging.handlers.SysLogHandler
97
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
98
address = str("/dev/log")))
111
99
112
100
try:
113
if_nametoindex = ctypes.cdll.LoadLibrary(
114
ctypes.util.find_library("c")).if_nametoindex
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
115
104
except (OSError, AttributeError):
116
117
105
def if_nametoindex(interface):
118
106
"Get an interface index the hard way, i.e. using fcntl()"
119
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
120
108
with contextlib.closing(socket.socket()) as s:
121
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
122
struct.pack(b"16s16x", interface))
123
interface_index = struct.unpack("I", ifreq[16:20])[0]
110
struct.pack(str("16s16x"),
111
interface))
112
interface_index = struct.unpack(str("I"),
113
ifreq[16:20])[0]
124
114
return interface_index
125
115
126
116
127
117
def initlogger(debug, level=logging.WARNING):
128
118
"""init logger and add loglevel"""
129
119
130
global syslogger
131
syslogger = (logging.handlers.SysLogHandler(
132
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
address = "/dev/log"))
134
120
syslogger.setFormatter(logging.Formatter
135
121
('Mandos [%(process)d]: %(levelname)s:'
136
122
' %(message)s'))
153
139
154
140
class PGPEngine(object):
155
141
"""A simple class for OpenPGP symmetric encryption & decryption"""
156
157
142
def __init__(self):
143
self.gnupg = GnuPGInterface.GnuPG()
158
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
159
self.gnupgargs = ['--batch',
160
'--home', self.tempdir,
161
'--force-mdc',
162
'--quiet',
163
'--no-use-agent']
145
self.gnupg = GnuPGInterface.GnuPG()
146
self.gnupg.options.meta_interactive = False
147
self.gnupg.options.homedir = self.tempdir
148
self.gnupg.options.extra_args.extend(['--force-mdc',
149
'--quiet',
150
'--no-use-agent'])
164
151
165
152
def __enter__(self):
166
153
return self
188
175
def password_encode(self, password):
189
176
# Passphrase can not be empty and can not contain newlines or
190
177
# NUL bytes. So we prefix it and hex encode it.
191
encoded = b"mandos" + binascii.hexlify(password)
192
if len(encoded) > 2048:
193
# GnuPG can't handle long passwords, so encode differently
194
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
195
.replace(b"\n", b"\\n")
196
.replace(b"\0", b"\\x00"))
197
return encoded
178
return b"mandos" + binascii.hexlify(password)
198
179
199
180
def encrypt(self, data, password):
200
passphrase = self.password_encode(password)
201
with tempfile.NamedTemporaryFile(
202
dir=self.tempdir) as passfile:
203
passfile.write(passphrase)
204
passfile.flush()
205
proc = subprocess.Popen(['gpg', '--symmetric',
206
'--passphrase-file',
207
passfile.name]
208
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
213
if proc.returncode != 0:
214
raise PGPError(err)
181
self.gnupg.passphrase = self.password_encode(password)
182
with open(os.devnull, "w") as devnull:
183
try:
184
proc = self.gnupg.run(['--symmetric'],
185
create_fhs=['stdin', 'stdout'],
186
attach_fhs={'stderr': devnull})
187
with contextlib.closing(proc.handles['stdin']) as f:
188
f.write(data)
189
with contextlib.closing(proc.handles['stdout']) as f:
190
ciphertext = f.read()
191
proc.wait()
192
except IOError as e:
193
raise PGPError(e)
194
self.gnupg.passphrase = None
215
195
return ciphertext
216
196
217
197
def decrypt(self, data, password):
218
passphrase = self.password_encode(password)
219
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
221
passfile.write(passphrase)
222
passfile.flush()
223
proc = subprocess.Popen(['gpg', '--decrypt',
224
'--passphrase-file',
225
passfile.name]
226
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
231
if proc.returncode != 0:
232
raise PGPError(err)
198
self.gnupg.passphrase = self.password_encode(password)
199
with open(os.devnull, "w") as devnull:
200
try:
201
proc = self.gnupg.run(['--decrypt'],
202
create_fhs=['stdin', 'stdout'],
203
attach_fhs={'stderr': devnull})
204
with contextlib.closing(proc.handles['stdin']) as f:
205
f.write(data)
206
with contextlib.closing(proc.handles['stdout']) as f:
207
decrypted_plaintext = f.read()
208
proc.wait()
209
except IOError as e:
210
raise PGPError(e)
211
self.gnupg.passphrase = None
233
212
return decrypted_plaintext
234
213
235
214
236
215
class AvahiError(Exception):
237
216
def __init__(self, value, *args, **kwargs):
238
217
self.value = value
239
return super(AvahiError, self).__init__(value, *args,
240
**kwargs)
241
218
super(AvahiError, self).__init__(value, *args, **kwargs)
219
def __unicode__(self):
220
return unicode(repr(self.value))
242
221
243
222
class AvahiServiceError(AvahiError):
244
223
pass
245
224
246
247
225
class AvahiGroupError(AvahiError):
248
226
pass
249
227
256
234
Used to optionally bind to the specified interface.
257
235
name: string; Example: 'Mandos'
258
236
type: string; Example: '_mandos._tcp'.
259
See <https://www.iana.org/assignments/service-names-port-numbers>
237
See <http://www.dns-sd.org/ServiceTypes.html>
260
238
port: integer; what port to announce
261
239
TXT: list of strings; TXT record for the service
262
240
domain: string; Domain to publish on, default to .local if empty.
269
247
bus: dbus.SystemBus()
270
248
"""
271
249
272
def __init__(self,
273
interface = avahi.IF_UNSPEC,
274
name = None,
275
servicetype = None,
276
port = None,
277
TXT = None,
278
domain = "",
279
host = "",
280
max_renames = 32768,
281
protocol = avahi.PROTO_UNSPEC,
282
bus = None):
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
253
protocol = avahi.PROTO_UNSPEC, bus = None):
283
254
self.interface = interface
284
255
self.name = name
285
256
self.type = servicetype
295
266
self.bus = bus
296
267
self.entry_group_state_changed_match = None
297
268
298
def rename(self, remove=True):
269
def rename(self):
299
270
"""Derived from the Avahi example code"""
300
271
if self.rename_count >= self.max_renames:
301
272
logger.critical("No suitable Zeroconf service name found"
302
273
" after %i retries, exiting.",
303
274
self.rename_count)
304
275
raise AvahiServiceError("Too many renames")
305
self.name = str(
306
self.server.GetAlternativeServiceName(self.name))
307
self.rename_count += 1
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
308
278
logger.info("Changing Zeroconf service name to %r ...",
309
279
self.name)
310
if remove:
311
self.remove()
280
self.remove()
312
281
try:
313
282
self.add()
314
283
except dbus.exceptions.DBusException as error:
315
if (error.get_dbus_name()
316
== "org.freedesktop.Avahi.CollisionError"):
317
logger.info("Local Zeroconf service name collision.")
318
return self.rename(remove=False)
319
else:
320
logger.critical("D-Bus Exception", exc_info=error)
321
self.cleanup()
322
os._exit(1)
284
logger.critical("D-Bus Exception", exc_info=error)
285
self.cleanup()
286
os._exit(1)
287
self.rename_count += 1
323
288
324
289
def remove(self):
325
290
"""Derived from the Avahi example code"""
363
328
self.rename()
364
329
elif state == avahi.ENTRY_GROUP_FAILURE:
365
330
logger.critical("Avahi: Error in group state changed %s",
366
str(error))
367
raise AvahiGroupError("State changed: {!s}".format(error))
331
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
368
334
369
335
def cleanup(self):
370
336
"""Derived from the Avahi example code"""
380
346
def server_state_changed(self, state, error=None):
381
347
"""Derived from the Avahi example code"""
382
348
logger.debug("Avahi server state change: %i", state)
383
bad_states = {
384
avahi.SERVER_INVALID: "Zeroconf server invalid",
385
avahi.SERVER_REGISTERING: None,
386
avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
avahi.SERVER_FAILURE: "Zeroconf server failure",
388
}
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
389
356
if state in bad_states:
390
357
if bad_states[state] is not None:
391
358
if error is None:
394
361
logger.error(bad_states[state] + ": %r", error)
395
362
self.cleanup()
396
363
elif state == avahi.SERVER_RUNNING:
397
try:
398
self.add()
399
except dbus.exceptions.DBusException as error:
400
if (error.get_dbus_name()
401
== "org.freedesktop.Avahi.CollisionError"):
402
logger.info("Local Zeroconf service name"
403
" collision.")
404
return self.rename(remove=False)
405
else:
406
logger.critical("D-Bus Exception", exc_info=error)
407
self.cleanup()
408
os._exit(1)
364
self.add()
409
365
else:
410
366
if error is None:
411
367
logger.debug("Unknown state: %r", state)
421
377
follow_name_owner_changes=True),
422
378
avahi.DBUS_INTERFACE_SERVER)
423
379
self.server.connect_to_signal("StateChanged",
424
self.server_state_changed)
380
self.server_state_changed)
425
381
self.server_state_changed(self.server.GetState())
426
382
427
383
428
384
class AvahiServiceToSyslog(AvahiService):
429
def rename(self, *args, **kwargs):
385
def rename(self):
430
386
"""Add the new name to the syslog messages"""
431
ret = AvahiService.rename(self, *args, **kwargs)
432
syslogger.setFormatter(logging.Formatter(
433
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
434
.format(self.name)))
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
435
392
return ret
436
393
437
def call_pipe(connection, # : multiprocessing.Connection
438
func, *args, **kwargs):
439
"""This function is meant to be called by multiprocessing.Process
440
441
This function runs func(*args, **kwargs), and writes the resulting
442
return value on the provided multiprocessing.Connection.
443
"""
444
connection.send(func(*args, **kwargs))
445
connection.close()
394
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
446
401
447
402
class Client(object):
448
403
"""A representation of a client host served by this server.
475
430
last_checker_status: integer between 0 and 255 reflecting exit
476
431
status of last checker. -1 reflects crashed
477
432
checker, -2 means no checker completed yet.
478
last_checker_signal: The signal which killed the last checker, if
479
last_checker_status is -1
480
433
last_enabled: datetime.datetime(); (UTC) or None
481
434
name: string; from the config file, used in log messages and
482
435
D-Bus identifiers
487
440
runtime_expansions: Allowed attributes for runtime expansion.
488
441
expires: datetime.datetime(); time (UTC) when a client will be
489
442
disabled, or None
490
server_settings: The server_settings dict from main()
491
443
"""
492
444
493
445
runtime_expansions = ("approval_delay", "approval_duration",
495
447
"fingerprint", "host", "interval",
496
448
"last_approval_request", "last_checked_ok",
497
449
"last_enabled", "name", "timeout")
498
client_defaults = {
499
"timeout": "PT5M",
500
"extended_timeout": "PT15M",
501
"interval": "PT2M",
502
"checker": "fping -q -- %%(host)s",
503
"host": "",
504
"approval_delay": "PT0S",
505
"approval_duration": "PT1S",
506
"approved_by_default": "True",
507
"enabled": "True",
508
}
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
453
"checker": "fping -q -- %%(host)s",
454
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
457
"approved_by_default": "True",
458
"enabled": "True",
459
}
460
461
def timeout_milliseconds(self):
462
"Return the 'timeout' attribute in milliseconds"
463
return timedelta_to_milliseconds(self.timeout)
464
465
def extended_timeout_milliseconds(self):
466
"Return the 'extended_timeout' attribute in milliseconds"
467
return timedelta_to_milliseconds(self.extended_timeout)
468
469
def interval_milliseconds(self):
470
"Return the 'interval' attribute in milliseconds"
471
return timedelta_to_milliseconds(self.interval)
472
473
def approval_delay_milliseconds(self):
474
return timedelta_to_milliseconds(self.approval_delay)
509
475
510
476
@staticmethod
511
477
def config_parser(config):
527
493
client["enabled"] = config.getboolean(client_name,
528
494
"enabled")
529
495
530
# Uppercase and remove spaces from fingerprint for later
531
# comparison purposes with return value from the
532
# fingerprint() function
533
496
client["fingerprint"] = (section["fingerprint"].upper()
534
497
.replace(" ", ""))
535
498
if "secret" in section:
540
503
"rb") as secfile:
541
504
client["secret"] = secfile.read()
542
505
else:
543
raise TypeError("No secret or secfile for section {}"
506
raise TypeError("No secret or secfile for section {0}"
544
507
.format(section))
545
508
client["timeout"] = string_to_delta(section["timeout"])
546
509
client["extended_timeout"] = string_to_delta(
557
520
558
521
return settings
559
522
560
def __init__(self, settings, name = None, server_settings=None):
523
def __init__(self, settings, name = None):
561
524
self.name = name
562
if server_settings is None:
563
server_settings = {}
564
self.server_settings = server_settings
565
525
# adding all client settings
566
for setting, value in settings.items():
526
for setting, value in settings.iteritems():
567
527
setattr(self, setting, value)
568
528
569
529
if self.enabled:
577
537
self.expires = None
578
538
579
539
logger.debug("Creating client %r", self.name)
540
# Uppercase and remove spaces from fingerprint for later
541
# comparison purposes with return value from the fingerprint()
542
# function
580
543
logger.debug(" Fingerprint: %s", self.fingerprint)
581
544
self.created = settings.get("created",
582
545
datetime.datetime.utcnow())
589
552
self.current_checker_command = None
590
553
self.approved = None
591
554
self.approvals_pending = 0
592
self.changedstate = multiprocessing_manager.Condition(
593
multiprocessing_manager.Lock())
594
self.client_structure = [attr
595
for attr in self.__dict__.iterkeys()
555
self.changedstate = (multiprocessing_manager
556
.Condition(multiprocessing_manager
557
.Lock()))
558
self.client_structure = [attr for attr in
559
self.__dict__.iterkeys()
596
560
if not attr.startswith("_")]
597
561
self.client_structure.append("client_structure")
598
562
599
for name, t in inspect.getmembers(
600
type(self), lambda obj: isinstance(obj, property)):
563
for name, t in inspect.getmembers(type(self),
564
lambda obj:
565
isinstance(obj,
566
property)):
601
567
if not name.startswith("_"):
602
568
self.client_structure.append(name)
603
569
645
611
# and every interval from then on.
646
612
if self.checker_initiator_tag is not None:
647
613
gobject.source_remove(self.checker_initiator_tag)
648
self.checker_initiator_tag = gobject.timeout_add(
649
int(self.interval.total_seconds() * 1000),
650
self.start_checker)
614
self.checker_initiator_tag = (gobject.timeout_add
615
(self.interval_milliseconds(),
616
self.start_checker))
651
617
# Schedule a disable() when 'timeout' has passed
652
618
if self.disable_initiator_tag is not None:
653
619
gobject.source_remove(self.disable_initiator_tag)
654
self.disable_initiator_tag = gobject.timeout_add(
655
int(self.timeout.total_seconds() * 1000), self.disable)
620
self.disable_initiator_tag = (gobject.timeout_add
621
(self.timeout_milliseconds(),
622
self.disable))
656
623
# Also start a new checker *right now*.
657
624
self.start_checker()
658
625
659
def checker_callback(self, source, condition, connection,
660
command):
626
def checker_callback(self, pid, condition, command):
661
627
"""The checker has completed, so take appropriate actions."""
662
628
self.checker_callback_tag = None
663
629
self.checker = None
664
# Read return code from connection (see call_pipe)
665
returncode = connection.recv()
666
connection.close()
667
668
if returncode >= 0:
669
self.last_checker_status = returncode
670
self.last_checker_signal = None
630
if os.WIFEXITED(condition):
631
self.last_checker_status = os.WEXITSTATUS(condition)
671
632
if self.last_checker_status == 0:
672
633
logger.info("Checker for %(name)s succeeded",
673
634
vars(self))
674
635
self.checked_ok()
675
636
else:
676
logger.info("Checker for %(name)s failed", vars(self))
637
logger.info("Checker for %(name)s failed",
638
vars(self))
677
639
else:
678
640
self.last_checker_status = -1
679
self.last_checker_signal = -returncode
680
641
logger.warning("Checker for %(name)s crashed?",
681
642
vars(self))
682
return False
683
643
684
644
def checked_ok(self):
685
645
"""Assert that the client has been seen, alive and well."""
686
646
self.last_checked_ok = datetime.datetime.utcnow()
687
647
self.last_checker_status = 0
688
self.last_checker_signal = None
689
648
self.bump_timeout()
690
649
691
650
def bump_timeout(self, timeout=None):
696
655
gobject.source_remove(self.disable_initiator_tag)
697
656
self.disable_initiator_tag = None
698
657
if getattr(self, "enabled", False):
699
self.disable_initiator_tag = gobject.timeout_add(
700
int(timeout.total_seconds() * 1000), self.disable)
658
self.disable_initiator_tag = (gobject.timeout_add
659
(timedelta_to_milliseconds
660
(timeout), self.disable))
701
661
self.expires = datetime.datetime.utcnow() + timeout
702
662
703
663
def need_approval(self):
717
677
# than 'timeout' for the client to be disabled, which is as it
718
678
# should be.
719
679
720
if self.checker is not None and not self.checker.is_alive():
721
logger.warning("Checker was not alive; joining")
722
self.checker.join()
723
self.checker = None
680
# If a checker exists, make sure it is not a zombie
681
try:
682
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
except (AttributeError, OSError) as error:
684
if (isinstance(error, OSError)
685
and error.errno != errno.ECHILD):
686
raise error
687
else:
688
if pid:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
724
693
# Start a new checker if needed
725
694
if self.checker is None:
726
695
# Escape attributes for the shell
727
escaped_attrs = {
728
attr: re.escape(str(getattr(self, attr)))
729
for attr in self.runtime_expansions }
696
escaped_attrs = dict(
697
(attr, re.escape(unicode(getattr(self, attr))))
698
for attr in
699
self.runtime_expansions)
730
700
try:
731
701
command = self.checker_command % escaped_attrs
732
702
except TypeError as error:
733
703
logger.error('Could not format string "%s"',
734
self.checker_command,
704
self.checker_command, exc_info=error)
705
return True # Try again later
706
self.current_checker_command = command
707
try:
708
logger.info("Starting checker %r for %s",
709
command, self.name)
710
# We don't need to redirect stdout and stderr, since
711
# in normal mode, that is already done by daemon(),
712
# and in debug mode we don't want to. (Stdin is
713
# always replaced by /dev/null.)
714
self.checker = subprocess.Popen(command,
715
close_fds=True,
716
shell=True, cwd="/")
717
except OSError as error:
718
logger.error("Failed to start subprocess",
735
719
exc_info=error)
736
return True # Try again later
737
self.current_checker_command = command
738
logger.info("Starting checker %r for %s", command,
739
self.name)
740
# We don't need to redirect stdout and stderr, since
741
# in normal mode, that is already done by daemon(),
742
# and in debug mode we don't want to. (Stdin is
743
# always replaced by /dev/null.)
744
# The exception is when not debugging but nevertheless
745
# running in the foreground; use the previously
746
# created wnull.
747
popen_args = { "close_fds": True,
748
"shell": True,
749
"cwd": "/" }
750
if (not self.server_settings["debug"]
751
and self.server_settings["foreground"]):
752
popen_args.update({"stdout": wnull,
753
"stderr": wnull })
754
pipe = multiprocessing.Pipe(duplex = False)
755
self.checker = multiprocessing.Process(
756
target = call_pipe,
757
args = (pipe[1], subprocess.call, command),
758
kwargs = popen_args)
759
self.checker.start()
760
self.checker_callback_tag = gobject.io_add_watch(
761
pipe[0].fileno(), gobject.IO_IN,
762
self.checker_callback, pipe[0], command)
720
return True
721
self.checker_callback_tag = (gobject.child_watch_add
722
(self.checker.pid,
723
self.checker_callback,
724
data=command))
725
# The checker may have completed before the gobject
726
# watch was added. Check for this.
727
try:
728
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
729
except OSError as error:
730
if error.errno == errno.ECHILD:
731
logger.error("Child process vanished", exc_info=error)
732
return True
733
raise
734
if pid:
735
gobject.source_remove(self.checker_callback_tag)
736
self.checker_callback(pid, status, command)
763
737
# Re-run this periodically if run by gobject.timeout_add
764
738
return True
765
739
771
745
if getattr(self, "checker", None) is None:
772
746
return
773
747
logger.debug("Stopping checker for %(name)s", vars(self))
774
self.checker.terminate()
748
try:
749
self.checker.terminate()
750
#time.sleep(0.5)
751
#if self.checker.poll() is None:
752
# self.checker.kill()
753
except OSError as error:
754
if error.errno != errno.ESRCH: # No such process
755
raise
775
756
self.checker = None
776
757
777
758
778
def dbus_service_property(dbus_interface,
779
signature="v",
780
access="readwrite",
781
byte_arrays=False):
759
def dbus_service_property(dbus_interface, signature="v",
760
access="readwrite", byte_arrays=False):
782
761
"""Decorators for marking methods of a DBusObjectWithProperties to
783
762
become properties on the D-Bus.
784
763
793
772
# "Set" method, so we fail early here:
794
773
if byte_arrays and signature != "ay":
795
774
raise ValueError("Byte arrays not supported for non-'ay'"
796
" signature {!r}".format(signature))
797
775
" signature {0!r}".format(signature))
798
776
def decorator(func):
799
777
func._dbus_is_property = True
800
778
func._dbus_interface = dbus_interface
805
783
func._dbus_name = func._dbus_name[:-14]
806
784
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
807
785
return func
808
809
786
return decorator
810
787
811
788
820
797
"org.freedesktop.DBus.Property.EmitsChangedSignal":
821
798
"false"}
822
799
"""
823
824
800
def decorator(func):
825
801
func._dbus_is_interface = True
826
802
func._dbus_interface = dbus_interface
827
803
func._dbus_name = dbus_interface
828
804
return func
829
830
805
return decorator
831
806
832
807
834
809
"""Decorator to annotate D-Bus methods, signals or properties
835
810
Usage:
836
811
837
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
838
"org.freedesktop.DBus.Property."
839
"EmitsChangedSignal": "false"})
840
812
@dbus_service_property("org.example.Interface", signature="b",
841
813
access="r")
814
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
815
"org.freedesktop.DBus.Property."
816
"EmitsChangedSignal": "false"})
842
817
def Property_dbus_property(self):
843
818
return dbus.Boolean(False)
844
845
See also the DBusObjectWithAnnotations class.
846
819
"""
847
848
820
def decorator(func):
849
821
func._dbus_annotations = annotations
850
822
return func
851
852
823
return decorator
853
824
854
825
855
826
class DBusPropertyException(dbus.exceptions.DBusException):
856
827
"""A base class for D-Bus property-related exceptions
857
828
"""
858
pass
829
def __unicode__(self):
830
return unicode(str(self))
859
831
860
832
861
833
class DBusPropertyAccessException(DBusPropertyException):
870
842
pass
871
843
872
844
873
class DBusObjectWithAnnotations(dbus.service.Object):
874
"""A D-Bus object with annotations.
845
class DBusObjectWithProperties(dbus.service.Object):
846
"""A D-Bus object with properties.
875
847
876
Classes inheriting from this can use the dbus_annotations
877
decorator to add annotations to methods or signals.
848
Classes inheriting from this can use the dbus_service_property
849
decorator to expose methods as D-Bus properties. It exposes the
850
standard Get(), Set(), and GetAll() methods on the D-Bus.
878
851
"""
879
852
880
853
@staticmethod
884
857
If called like _is_dbus_thing("method") it returns a function
885
858
suitable for use as predicate to inspect.getmembers().
886
859
"""
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
860
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
888
861
False)
889
862
890
863
def _get_all_dbus_things(self, thing):
891
864
"""Returns a generator of (name, attribute) pairs
892
865
"""
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
866
return ((getattr(athing.__get__(self), "_dbus_name",
867
name),
894
868
athing.__get__(self))
895
869
for cls in self.__class__.__mro__
896
870
for name, athing in
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
898
899
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
900
out_signature = "s",
901
path_keyword = 'object_path',
902
connection_keyword = 'connection')
903
def Introspect(self, object_path, connection):
904
"""Overloading of standard D-Bus method.
905
906
Inserts annotation tags on methods and signals.
907
"""
908
xmlstring = dbus.service.Object.Introspect(self, object_path,
909
connection)
910
try:
911
document = xml.dom.minidom.parseString(xmlstring)
912
913
for if_tag in document.getElementsByTagName("interface"):
914
# Add annotation tags
915
for typ in ("method", "signal"):
916
for tag in if_tag.getElementsByTagName(typ):
917
annots = dict()
918
for name, prop in (self.
919
_get_all_dbus_things(typ)):
920
if (name == tag.getAttribute("name")
921
and prop._dbus_interface
922
== if_tag.getAttribute("name")):
923
annots.update(getattr(
924
prop, "_dbus_annotations", {}))
925
for name, value in annots.items():
926
ann_tag = document.createElement(
927
"annotation")
928
ann_tag.setAttribute("name", name)
929
ann_tag.setAttribute("value", value)
930
tag.appendChild(ann_tag)
931
# Add interface annotation tags
932
for annotation, value in dict(
933
itertools.chain.from_iterable(
934
annotations().items()
935
for name, annotations
936
in self._get_all_dbus_things("interface")
937
if name == if_tag.getAttribute("name")
938
)).items():
939
ann_tag = document.createElement("annotation")
940
ann_tag.setAttribute("name", annotation)
941
ann_tag.setAttribute("value", value)
942
if_tag.appendChild(ann_tag)
943
# Fix argument name for the Introspect method itself
944
if (if_tag.getAttribute("name")
945
== dbus.INTROSPECTABLE_IFACE):
946
for cn in if_tag.getElementsByTagName("method"):
947
if cn.getAttribute("name") == "Introspect":
948
for arg in cn.getElementsByTagName("arg"):
949
if (arg.getAttribute("direction")
950
== "out"):
951
arg.setAttribute("name",
952
"xml_data")
953
xmlstring = document.toxml("utf-8")
954
document.unlink()
955
except (AttributeError, xml.dom.DOMException,
956
xml.parsers.expat.ExpatError) as error:
957
logger.error("Failed to override Introspection method",
958
exc_info=error)
959
return xmlstring
960
961
962
class DBusObjectWithProperties(DBusObjectWithAnnotations):
963
"""A D-Bus object with properties.
964
965
Classes inheriting from this can use the dbus_service_property
966
decorator to expose methods as D-Bus properties. It exposes the
967
standard Get(), Set(), and GetAll() methods on the D-Bus.
968
"""
871
inspect.getmembers(cls,
872
self._is_dbus_thing(thing)))
969
873
970
874
def _get_dbus_property(self, interface_name, property_name):
971
875
"""Returns a bound method if one exists which is a D-Bus
972
876
property with the specified name and interface.
973
877
"""
974
for cls in self.__class__.__mro__:
975
for name, value in inspect.getmembers(
976
cls, self._is_dbus_thing("property")):
878
for cls in self.__class__.__mro__:
879
for name, value in (inspect.getmembers
880
(cls,
881
self._is_dbus_thing("property"))):
977
882
if (value._dbus_name == property_name
978
883
and value._dbus_interface == interface_name):
979
884
return value.__get__(self)
980
885
981
886
# No such property
982
raise DBusPropertyNotFound("{}:{}.{}".format(
983
self.dbus_object_path, interface_name, property_name))
984
985
@classmethod
986
def _get_all_interface_names(cls):
987
"""Get a sequence of all interfaces supported by an object"""
988
return (name for name in set(getattr(getattr(x, attr),
989
"_dbus_interface", None)
990
for x in (inspect.getmro(cls))
991
for attr in dir(x))
992
if name is not None)
993
994
@dbus.service.method(dbus.PROPERTIES_IFACE,
995
in_signature="ss",
887
raise DBusPropertyNotFound(self.dbus_object_path + ":"
888
+ interface_name + "."
889
+ property_name)
890
891
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
996
892
out_signature="v")
997
893
def Get(self, interface_name, property_name):
998
894
"""Standard D-Bus property Get() method, see D-Bus standard.
1016
912
# The byte_arrays option is not supported yet on
1017
913
# signatures other than "ay".
1018
914
if prop._dbus_signature != "ay":
1019
raise ValueError("Byte arrays not supported for non-"
1020
"'ay' signature {!r}"
1021
.format(prop._dbus_signature))
915
raise ValueError
1022
916
value = dbus.ByteArray(b''.join(chr(byte)
1023
917
for byte in value))
1024
918
prop(value)
1025
919
1026
@dbus.service.method(dbus.PROPERTIES_IFACE,
1027
in_signature="s",
920
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1028
921
out_signature="a{sv}")
1029
922
def GetAll(self, interface_name):
1030
923
"""Standard D-Bus property GetAll() method, see D-Bus
1045
938
if not hasattr(value, "variant_level"):
1046
939
properties[name] = value
1047
940
continue
1048
properties[name] = type(value)(
1049
value, variant_level = value.variant_level + 1)
941
properties[name] = type(value)(value, variant_level=
942
value.variant_level+1)
1050
943
return dbus.Dictionary(properties, signature="sv")
1051
944
1052
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1053
def PropertiesChanged(self, interface_name, changed_properties,
1054
invalidated_properties):
1055
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1056
standard.
1057
"""
1058
pass
1059
1060
945
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1061
946
out_signature="s",
1062
947
path_keyword='object_path',
1066
951
1067
952
Inserts property tags and interface annotation tags.
1068
953
"""
1069
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1070
object_path,
1071
connection)
954
xmlstring = dbus.service.Object.Introspect(self, object_path,
955
connection)
1072
956
try:
1073
957
document = xml.dom.minidom.parseString(xmlstring)
1074
1075
958
def make_tag(document, name, prop):
1076
959
e = document.createElement("property")
1077
960
e.setAttribute("name", name)
1078
961
e.setAttribute("type", prop._dbus_signature)
1079
962
e.setAttribute("access", prop._dbus_access)
1080
963
return e
1081
1082
964
for if_tag in document.getElementsByTagName("interface"):
1083
965
# Add property tags
1084
966
for tag in (make_tag(document, name, prop)
1087
969
if prop._dbus_interface
1088
970
== if_tag.getAttribute("name")):
1089
971
if_tag.appendChild(tag)
1090
# Add annotation tags for properties
1091
for tag in if_tag.getElementsByTagName("property"):
1092
annots = dict()
1093
for name, prop in self._get_all_dbus_things(
1094
"property"):
1095
if (name == tag.getAttribute("name")
1096
and prop._dbus_interface
1097
== if_tag.getAttribute("name")):
1098
annots.update(getattr(
1099
prop, "_dbus_annotations", {}))
1100
for name, value in annots.items():
1101
ann_tag = document.createElement(
1102
"annotation")
1103
ann_tag.setAttribute("name", name)
1104
ann_tag.setAttribute("value", value)
1105
tag.appendChild(ann_tag)
972
# Add annotation tags
973
for typ in ("method", "signal", "property"):
974
for tag in if_tag.getElementsByTagName(typ):
975
annots = dict()
976
for name, prop in (self.
977
_get_all_dbus_things(typ)):
978
if (name == tag.getAttribute("name")
979
and prop._dbus_interface
980
== if_tag.getAttribute("name")):
981
annots.update(getattr
982
(prop,
983
"_dbus_annotations",
984
{}))
985
for name, value in annots.iteritems():
986
ann_tag = document.createElement(
987
"annotation")
988
ann_tag.setAttribute("name", name)
989
ann_tag.setAttribute("value", value)
990
tag.appendChild(ann_tag)
991
# Add interface annotation tags
992
for annotation, value in dict(
993
itertools.chain.from_iterable(
994
annotations().iteritems()
995
for name, annotations in
996
self._get_all_dbus_things("interface")
997
if name == if_tag.getAttribute("name")
998
)).iteritems():
999
ann_tag = document.createElement("annotation")
1000
ann_tag.setAttribute("name", annotation)
1001
ann_tag.setAttribute("value", value)
1002
if_tag.appendChild(ann_tag)
1106
1003
# Add the names to the return values for the
1107
1004
# "org.freedesktop.DBus.Properties" methods
1108
1005
if (if_tag.getAttribute("name")
1126
1023
exc_info=error)
1127
1024
return xmlstring
1128
1025
1129
try:
1130
dbus.OBJECT_MANAGER_IFACE
1131
except AttributeError:
1132
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1133
1134
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1135
"""A D-Bus object with an ObjectManager.
1136
1137
Classes inheriting from this exposes the standard
1138
GetManagedObjects call and the InterfacesAdded and
1139
InterfacesRemoved signals on the standard
1140
"org.freedesktop.DBus.ObjectManager" interface.
1141
1142
Note: No signals are sent automatically; they must be sent
1143
manually.
1144
"""
1145
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1146
out_signature = "a{oa{sa{sv}}}")
1147
def GetManagedObjects(self):
1148
"""This function must be overridden"""
1149
raise NotImplementedError()
1150
1151
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1152
signature = "oa{sa{sv}}")
1153
def InterfacesAdded(self, object_path, interfaces_and_properties):
1154
pass
1155
1156
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1157
def InterfacesRemoved(self, object_path, interfaces):
1158
pass
1159
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1164
def Introspect(self, object_path, connection):
1165
"""Overloading of standard D-Bus method.
1166
1167
Override return argument name of GetManagedObjects to be
1168
"objpath_interfaces_and_properties"
1169
"""
1170
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1171
object_path,
1172
connection)
1173
try:
1174
document = xml.dom.minidom.parseString(xmlstring)
1175
1176
for if_tag in document.getElementsByTagName("interface"):
1177
# Fix argument name for the GetManagedObjects method
1178
if (if_tag.getAttribute("name")
1179
== dbus.OBJECT_MANAGER_IFACE):
1180
for cn in if_tag.getElementsByTagName("method"):
1181
if (cn.getAttribute("name")
1182
== "GetManagedObjects"):
1183
for arg in cn.getElementsByTagName("arg"):
1184
if (arg.getAttribute("direction")
1185
== "out"):
1186
arg.setAttribute(
1187
"name",
1188
"objpath_interfaces"
1189
"_and_properties")
1190
xmlstring = document.toxml("utf-8")
1191
document.unlink()
1192
except (AttributeError, xml.dom.DOMException,
1193
xml.parsers.expat.ExpatError) as error:
1194
logger.error("Failed to override Introspection method",
1195
exc_info = error)
1196
return xmlstring
1197
1026
1198
1027
def datetime_to_dbus(dt, variant_level=0):
1199
1028
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1200
1029
if dt is None:
1201
1030
return dbus.String("", variant_level = variant_level)
1202
return dbus.String(dt.isoformat(), variant_level=variant_level)
1031
return dbus.String(dt.isoformat(),
1032
variant_level=variant_level)
1203
1033
1204
1034
1205
1035
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1225
1055
(from DBusObjectWithProperties) and interfaces (from the
1226
1056
dbus_interface_annotations decorator).
1227
1057
"""
1228
1229
1058
def wrapper(cls):
1230
1059
for orig_interface_name, alt_interface_name in (
1231
alt_interface_names.items()):
1060
alt_interface_names.iteritems()):
1232
1061
attr = {}
1233
1062
interface_names = set()
1234
1063
# Go though all attributes of the class
1236
1065
# Ignore non-D-Bus attributes, and D-Bus attributes
1237
1066
# with the wrong interface name
1238
1067
if (not hasattr(attribute, "_dbus_interface")
1239
or not attribute._dbus_interface.startswith(
1240
orig_interface_name)):
1068
or not attribute._dbus_interface
1069
.startswith(orig_interface_name)):
1241
1070
continue
1242
1071
# Create an alternate D-Bus interface name based on
1243
1072
# the current name
1244
alt_interface = attribute._dbus_interface.replace(
1245
orig_interface_name, alt_interface_name)
1073
alt_interface = (attribute._dbus_interface
1074
.replace(orig_interface_name,
1075
alt_interface_name))
1246
1076
interface_names.add(alt_interface)
1247
1077
# Is this a D-Bus signal?
1248
1078
if getattr(attribute, "_dbus_is_signal", False):
1249
if sys.version_info.major == 2:
1250
# Extract the original non-method undecorated
1251
# function by black magic
1252
nonmethod_func = (dict(
1079
# Extract the original non-method function by
1080
# black magic
1081
nonmethod_func = (dict(
1253
1082
zip(attribute.func_code.co_freevars,
1254
attribute.__closure__))
1255
["func"].cell_contents)
1256
else:
1257
nonmethod_func = attribute
1083
attribute.__closure__))["func"]
1084
.cell_contents)
1258
1085
# Create a new, but exactly alike, function
1259
1086
# object, and decorate it to be a new D-Bus signal
1260
1087
# with the alternate D-Bus interface name
1261
if sys.version_info.major == 2:
1262
new_function = types.FunctionType(
1263
nonmethod_func.func_code,
1264
nonmethod_func.func_globals,
1265
nonmethod_func.func_name,
1266
nonmethod_func.func_defaults,
1267
nonmethod_func.func_closure)
1268
else:
1269
new_function = types.FunctionType(
1270
nonmethod_func.__code__,
1271
nonmethod_func.__globals__,
1272
nonmethod_func.__name__,
1273
nonmethod_func.__defaults__,
1274
nonmethod_func.__closure__)
1275
new_function = (dbus.service.signal(
1276
alt_interface,
1277
attribute._dbus_signature)(new_function))
1088
new_function = (dbus.service.signal
1089
(alt_interface,
1090
attribute._dbus_signature)
1091
(types.FunctionType(
1092
nonmethod_func.func_code,
1093
nonmethod_func.func_globals,
1094
nonmethod_func.func_name,
1095
nonmethod_func.func_defaults,
1096
nonmethod_func.func_closure)))
1278
1097
# Copy annotations, if any
1279
1098
try:
1280
new_function._dbus_annotations = dict(
1281
attribute._dbus_annotations)
1099
new_function._dbus_annotations = (
1100
dict(attribute._dbus_annotations))
1282
1101
except AttributeError:
1283
1102
pass
1284
1103
# Define a creator of a function to call both the
1289
1108
"""This function is a scope container to pass
1290
1109
func1 and func2 to the "call_both" function
1291
1110
outside of its arguments"""
1292
1293
@functools.wraps(func2)
1294
1111
def call_both(*args, **kwargs):
1295
1112
"""This function will emit two D-Bus
1296
1113
signals by calling func1 and func2"""
1297
1114
func1(*args, **kwargs)
1298
1115
func2(*args, **kwargs)
1299
# Make wrapper function look like a D-Bus signal
1300
for name, attr in inspect.getmembers(func2):
1301
if name.startswith("_dbus_"):
1302
setattr(call_both, name, attr)
1303
1304
1116
return call_both
1305
1117
# Create the "call_both" function and add it to
1306
1118
# the class
1311
1123
# object. Decorate it to be a new D-Bus method
1312
1124
# with the alternate D-Bus interface name. Add it
1313
1125
# to the class.
1314
attr[attrname] = (
1315
dbus.service.method(
1316
alt_interface,
1317
attribute._dbus_in_signature,
1318
attribute._dbus_out_signature)
1319
(types.FunctionType(attribute.func_code,
1320
attribute.func_globals,
1321
attribute.func_name,
1322
attribute.func_defaults,
1323
attribute.func_closure)))
1126
attr[attrname] = (dbus.service.method
1127
(alt_interface,
1128
attribute._dbus_in_signature,
1129
attribute._dbus_out_signature)
1130
(types.FunctionType
1131
(attribute.func_code,
1132
attribute.func_globals,
1133
attribute.func_name,
1134
attribute.func_defaults,
1135
attribute.func_closure)))
1324
1136
# Copy annotations, if any
1325
1137
try:
1326
attr[attrname]._dbus_annotations = dict(
1327
attribute._dbus_annotations)
1138
attr[attrname]._dbus_annotations = (
1139
dict(attribute._dbus_annotations))
1328
1140
except AttributeError:
1329
1141
pass
1330
1142
# Is this a D-Bus property?
1333
1145
# object, and decorate it to be a new D-Bus
1334
1146
# property with the alternate D-Bus interface
1335
1147
# name. Add it to the class.
1336
attr[attrname] = (dbus_service_property(
1337
alt_interface, attribute._dbus_signature,
1338
attribute._dbus_access,
1339
attribute._dbus_get_args_options
1340
["byte_arrays"])
1341
(types.FunctionType(
1342
attribute.func_code,
1343
attribute.func_globals,
1344
attribute.func_name,
1345
attribute.func_defaults,
1346
attribute.func_closure)))
1148
attr[attrname] = (dbus_service_property
1149
(alt_interface,
1150
attribute._dbus_signature,
1151
attribute._dbus_access,
1152
attribute
1153
._dbus_get_args_options
1154
["byte_arrays"])
1155
(types.FunctionType
1156
(attribute.func_code,
1157
attribute.func_globals,
1158
attribute.func_name,
1159
attribute.func_defaults,
1160
attribute.func_closure)))
1347
1161
# Copy annotations, if any
1348
1162
try:
1349
attr[attrname]._dbus_annotations = dict(
1350
attribute._dbus_annotations)
1163
attr[attrname]._dbus_annotations = (
1164
dict(attribute._dbus_annotations))
1351
1165
except AttributeError:
1352
1166
pass
1353
1167
# Is this a D-Bus interface?
1356
1170
# object. Decorate it to be a new D-Bus interface
1357
1171
# with the alternate D-Bus interface name. Add it
1358
1172
# to the class.
1359
attr[attrname] = (
1360
dbus_interface_annotations(alt_interface)
1361
(types.FunctionType(attribute.func_code,
1362
attribute.func_globals,
1363
attribute.func_name,
1364
attribute.func_defaults,
1365
attribute.func_closure)))
1173
attr[attrname] = (dbus_interface_annotations
1174
(alt_interface)
1175
(types.FunctionType
1176
(attribute.func_code,
1177
attribute.func_globals,
1178
attribute.func_name,
1179
attribute.func_defaults,
1180
attribute.func_closure)))
1366
1181
if deprecate:
1367
1182
# Deprecate all alternate interfaces
1368
iname="_AlternateDBusNames_interface_annotation{}"
1183
iname="_AlternateDBusNames_interface_annotation{0}"
1369
1184
for interface_name in interface_names:
1370
1371
1185
@dbus_interface_annotations(interface_name)
1372
1186
def func(self):
1373
1187
return { "org.freedesktop.DBus.Deprecated":
1374
"true" }
1188
"true" }
1375
1189
# Find an unused name
1376
1190
for aname in (iname.format(i)
1377
1191
for i in itertools.count()):
1381
1195
if interface_names:
1382
1196
# Replace the class with a new subclass of it with
1383
1197
# methods, signals, etc. as created above.
1384
cls = type(b"{}Alternate".format(cls.__name__),
1385
(cls, ), attr)
1198
cls = type(b"{0}Alternate".format(cls.__name__),
1199
(cls,), attr)
1386
1200
return cls
1387
1388
1201
return wrapper
1389
1202
1390
1203
1391
1204
@alternate_dbus_interfaces({"se.recompile.Mandos":
1392
"se.bsnet.fukt.Mandos"})
1205
"se.bsnet.fukt.Mandos"})
1393
1206
class ClientDBus(Client, DBusObjectWithProperties):
1394
1207
"""A Client class using D-Bus
1395
1208
1399
1212
"""
1400
1213
1401
1214
runtime_expansions = (Client.runtime_expansions
1402
+ ("dbus_object_path", ))
1403
1404
_interface = "se.recompile.Mandos.Client"
1215
+ ("dbus_object_path",))
1405
1216
1406
1217
# dbus.service.Object doesn't use super(), so we can't either.
1407
1218
1410
1221
Client.__init__(self, *args, **kwargs)
1411
1222
# Only now, when this client is initialized, can it show up on
1412
1223
# the D-Bus
1413
client_object_name = str(self.name).translate(
1224
client_object_name = unicode(self.name).translate(
1414
1225
{ord("."): ord("_"),
1415
1226
ord("-"): ord("_")})
1416
self.dbus_object_path = dbus.ObjectPath(
1417
"/clients/" + client_object_name)
1227
self.dbus_object_path = (dbus.ObjectPath
1228
("/clients/" + client_object_name))
1418
1229
DBusObjectWithProperties.__init__(self, self.bus,
1419
1230
self.dbus_object_path)
1420
1231
1421
def notifychangeproperty(transform_func, dbus_name,
1422
type_func=lambda x: x,
1423
variant_level=1,
1424
invalidate_only=False,
1425
_interface=_interface):
1232
def notifychangeproperty(transform_func,
1233
dbus_name, type_func=lambda x: x,
1234
variant_level=1):
1426
1235
""" Modify a variable so that it's a property which announces
1427
1236
its changes to DBus.
1428
1237
1433
1242
to the D-Bus. Default: no transform
1434
1243
variant_level: D-Bus variant level. Default: 1
1435
1244
"""
1436
attrname = "_{}".format(dbus_name)
1437
1245
attrname = "_{0}".format(dbus_name)
1438
1246
def setter(self, value):
1439
1247
if hasattr(self, "dbus_object_path"):
1440
1248
if (not hasattr(self, attrname) or
1441
1249
type_func(getattr(self, attrname, None))
1442
1250
!= type_func(value)):
1443
if invalidate_only:
1444
self.PropertiesChanged(
1445
_interface, dbus.Dictionary(),
1446
dbus.Array((dbus_name, )))
1447
else:
1448
dbus_value = transform_func(
1449
type_func(value),
1450
variant_level = variant_level)
1451
self.PropertyChanged(dbus.String(dbus_name),
1452
dbus_value)
1453
self.PropertiesChanged(
1454
_interface,
1455
dbus.Dictionary({ dbus.String(dbus_name):
1456
dbus_value }),
1457
dbus.Array())
1251
dbus_value = transform_func(type_func(value),
1252
variant_level
1253
=variant_level)
1254
self.PropertyChanged(dbus.String(dbus_name),
1255
dbus_value)
1458
1256
setattr(self, attrname, value)
1459
1257
1460
1258
return property(lambda self: getattr(self, attrname), setter)
1466
1264
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1467
1265
last_enabled = notifychangeproperty(datetime_to_dbus,
1468
1266
"LastEnabled")
1469
checker = notifychangeproperty(
1470
dbus.Boolean, "CheckerRunning",
1471
type_func = lambda checker: checker is not None)
1267
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1268
type_func = lambda checker:
1269
checker is not None)
1472
1270
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1473
1271
"LastCheckedOK")
1474
1272
last_checker_status = notifychangeproperty(dbus.Int16,
1477
1275
datetime_to_dbus, "LastApprovalRequest")
1478
1276
approved_by_default = notifychangeproperty(dbus.Boolean,
1479
1277
"ApprovedByDefault")
1480
approval_delay = notifychangeproperty(
1481
dbus.UInt64, "ApprovalDelay",
1482
type_func = lambda td: td.total_seconds() * 1000)
1278
approval_delay = notifychangeproperty(dbus.UInt64,
1279
"ApprovalDelay",
1280
type_func =
1281
timedelta_to_milliseconds)
1483
1282
approval_duration = notifychangeproperty(
1484
1283
dbus.UInt64, "ApprovalDuration",
1485
type_func = lambda td: td.total_seconds() * 1000)
1284
type_func = timedelta_to_milliseconds)
1486
1285
host = notifychangeproperty(dbus.String, "Host")
1487
timeout = notifychangeproperty(
1488
dbus.UInt64, "Timeout",
1489
type_func = lambda td: td.total_seconds() * 1000)
1286
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1287
type_func =
1288
timedelta_to_milliseconds)
1490
1289
extended_timeout = notifychangeproperty(
1491
1290
dbus.UInt64, "ExtendedTimeout",
1492
type_func = lambda td: td.total_seconds() * 1000)
1493
interval = notifychangeproperty(
1494
dbus.UInt64, "Interval",
1495
type_func = lambda td: td.total_seconds() * 1000)
1291
type_func = timedelta_to_milliseconds)
1292
interval = notifychangeproperty(dbus.UInt64,
1293
"Interval",
1294
type_func =
1295
timedelta_to_milliseconds)
1496
1296
checker_command = notifychangeproperty(dbus.String, "Checker")
1497
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1498
invalidate_only=True)
1499
1297
1500
1298
del notifychangeproperty
1501
1299
1508
1306
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1509
1307
Client.__del__(self, *args, **kwargs)
1510
1308
1511
def checker_callback(self, source, condition,
1512
connection, command, *args, **kwargs):
1513
ret = Client.checker_callback(self, source, condition,
1514
connection, command, *args,
1515
**kwargs)
1516
exitstatus = self.last_checker_status
1517
if exitstatus >= 0:
1309
def checker_callback(self, pid, condition, command,
1310
*args, **kwargs):
1311
self.checker_callback_tag = None
1312
self.checker = None
1313
if os.WIFEXITED(condition):
1314
exitstatus = os.WEXITSTATUS(condition)
1518
1315
# Emit D-Bus signal
1519
1316
self.CheckerCompleted(dbus.Int16(exitstatus),
1520
# This is specific to GNU libC
1521
dbus.Int64(exitstatus << 8),
1317
dbus.Int64(condition),
1522
1318
dbus.String(command))
1523
1319
else:
1524
1320
# Emit D-Bus signal
1525
1321
self.CheckerCompleted(dbus.Int16(-1),
1526
dbus.Int64(
1527
# This is specific to GNU libC
1528
(exitstatus << 8)
1529
| self.last_checker_signal),
1322
dbus.Int64(condition),
1530
1323
dbus.String(command))
1531
return ret
1324
1325
return Client.checker_callback(self, pid, condition, command,
1326
*args, **kwargs)
1532
1327
1533
1328
def start_checker(self, *args, **kwargs):
1534
old_checker_pid = getattr(self.checker, "pid", None)
1329
old_checker = self.checker
1330
if self.checker is not None:
1331
old_checker_pid = self.checker.pid
1332
else:
1333
old_checker_pid = None
1535
1334
r = Client.start_checker(self, *args, **kwargs)
1536
1335
# Only if new checker process was started
1537
1336
if (self.checker is not None
1546
1345
1547
1346
def approve(self, value=True):
1548
1347
self.approved = value
1549
gobject.timeout_add(int(self.approval_duration.total_seconds()
1550
* 1000), self._reset_approved)
1348
gobject.timeout_add(timedelta_to_milliseconds
1349
(self.approval_duration),
1350
self._reset_approved)
1551
1351
self.send_changedstate()
1552
1352
1553
1353
## D-Bus methods, signals & properties
1354
_interface = "se.recompile.Mandos.Client"
1554
1355
1555
1356
## Interfaces
1556
1357
1358
@dbus_interface_annotations(_interface)
1359
def _foo(self):
1360
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1361
"false"}
1362
1557
1363
## Signals
1558
1364
1559
1365
# CheckerCompleted - signal
1569
1375
pass
1570
1376
1571
1377
# PropertyChanged - signal
1572
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1573
1378
@dbus.service.signal(_interface, signature="sv")
1574
1379
def PropertyChanged(self, property, value):
1575
1380
"D-Bus signal"
1609
1414
self.checked_ok()
1610
1415
1611
1416
# Enable - method
1612
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1613
1417
@dbus.service.method(_interface)
1614
1418
def Enable(self):
1615
1419
"D-Bus method"
1616
1420
self.enable()
1617
1421
1618
1422
# StartChecker - method
1619
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1620
1423
@dbus.service.method(_interface)
1621
1424
def StartChecker(self):
1622
1425
"D-Bus method"
1623
1426
self.start_checker()
1624
1427
1625
1428
# Disable - method
1626
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1627
1429
@dbus.service.method(_interface)
1628
1430
def Disable(self):
1629
1431
"D-Bus method"
1630
1432
self.disable()
1631
1433
1632
1434
# StopChecker - method
1633
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1634
1435
@dbus.service.method(_interface)
1635
1436
def StopChecker(self):
1636
1437
self.stop_checker()
1643
1444
return dbus.Boolean(bool(self.approvals_pending))
1644
1445
1645
1446
# ApprovedByDefault - property
1646
@dbus_service_property(_interface,
1647
signature="b",
1447
@dbus_service_property(_interface, signature="b",
1648
1448
access="readwrite")
1649
1449
def ApprovedByDefault_dbus_property(self, value=None):
1650
1450
if value is None: # get
1652
1452
self.approved_by_default = bool(value)
1653
1453
1654
1454
# ApprovalDelay - property
1655
@dbus_service_property(_interface,
1656
signature="t",
1455
@dbus_service_property(_interface, signature="t",
1657
1456
access="readwrite")
1658
1457
def ApprovalDelay_dbus_property(self, value=None):
1659
1458
if value is None: # get
1660
return dbus.UInt64(self.approval_delay.total_seconds()
1661
* 1000)
1459
return dbus.UInt64(self.approval_delay_milliseconds())
1662
1460
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1663
1461
1664
1462
# ApprovalDuration - property
1665
@dbus_service_property(_interface,
1666
signature="t",
1463
@dbus_service_property(_interface, signature="t",
1667
1464
access="readwrite")
1668
1465
def ApprovalDuration_dbus_property(self, value=None):
1669
1466
if value is None: # get
1670
return dbus.UInt64(self.approval_duration.total_seconds()
1671
* 1000)
1467
return dbus.UInt64(timedelta_to_milliseconds(
1468
self.approval_duration))
1672
1469
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1673
1470
1674
1471
# Name - property
1675
@dbus_annotations(
1676
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1677
1472
@dbus_service_property(_interface, signature="s", access="read")
1678
1473
def Name_dbus_property(self):
1679
1474
return dbus.String(self.name)
1680
1475
1681
1476
# Fingerprint - property
1682
@dbus_annotations(
1683
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1684
1477
@dbus_service_property(_interface, signature="s", access="read")
1685
1478
def Fingerprint_dbus_property(self):
1686
1479
return dbus.String(self.fingerprint)
1687
1480
1688
1481
# Host - property
1689
@dbus_service_property(_interface,
1690
signature="s",
1482
@dbus_service_property(_interface, signature="s",
1691
1483
access="readwrite")
1692
1484
def Host_dbus_property(self, value=None):
1693
1485
if value is None: # get
1694
1486
return dbus.String(self.host)
1695
self.host = str(value)
1487
self.host = unicode(value)
1696
1488
1697
1489
# Created - property
1698
@dbus_annotations(
1699
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1700
1490
@dbus_service_property(_interface, signature="s", access="read")
1701
1491
def Created_dbus_property(self):
1702
1492
return datetime_to_dbus(self.created)
1707
1497
return datetime_to_dbus(self.last_enabled)
1708
1498
1709
1499
# Enabled - property
1710
@dbus_service_property(_interface,
1711
signature="b",
1500
@dbus_service_property(_interface, signature="b",
1712
1501
access="readwrite")
1713
1502
def Enabled_dbus_property(self, value=None):
1714
1503
if value is None: # get
1719
1508
self.disable()
1720
1509
1721
1510
# LastCheckedOK - property
1722
@dbus_service_property(_interface,
1723
signature="s",
1511
@dbus_service_property(_interface, signature="s",
1724
1512
access="readwrite")
1725
1513
def LastCheckedOK_dbus_property(self, value=None):
1726
1514
if value is not None:
1729
1517
return datetime_to_dbus(self.last_checked_ok)
1730
1518
1731
1519
# LastCheckerStatus - property
1732
@dbus_service_property(_interface, signature="n", access="read")
1520
@dbus_service_property(_interface, signature="n",
1521
access="read")
1733
1522
def LastCheckerStatus_dbus_property(self):
1734
1523
return dbus.Int16(self.last_checker_status)
1735
1524
1744
1533
return datetime_to_dbus(self.last_approval_request)
1745
1534
1746
1535
# Timeout - property
1747
@dbus_service_property(_interface,
1748
signature="t",
1536
@dbus_service_property(_interface, signature="t",
1749
1537
access="readwrite")
1750
1538
def Timeout_dbus_property(self, value=None):
1751
1539
if value is None: # get
1752
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1540
return dbus.UInt64(self.timeout_milliseconds())
1753
1541
old_timeout = self.timeout
1754
1542
self.timeout = datetime.timedelta(0, 0, 0, value)
1755
1543
# Reschedule disabling
1764
1552
is None):
1765
1553
return
1766
1554
gobject.source_remove(self.disable_initiator_tag)
1767
self.disable_initiator_tag = gobject.timeout_add(
1768
int((self.expires - now).total_seconds() * 1000),
1769
self.disable)
1555
self.disable_initiator_tag = (
1556
gobject.timeout_add(
1557
timedelta_to_milliseconds(self.expires - now),
1558
self.disable))
1770
1559
1771
1560
# ExtendedTimeout - property
1772
@dbus_service_property(_interface,
1773
signature="t",
1561
@dbus_service_property(_interface, signature="t",
1774
1562
access="readwrite")
1775
1563
def ExtendedTimeout_dbus_property(self, value=None):
1776
1564
if value is None: # get
1777
return dbus.UInt64(self.extended_timeout.total_seconds()
1778
* 1000)
1565
return dbus.UInt64(self.extended_timeout_milliseconds())
1779
1566
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1780
1567
1781
1568
# Interval - property
1782
@dbus_service_property(_interface,
1783
signature="t",
1569
@dbus_service_property(_interface, signature="t",
1784
1570
access="readwrite")
1785
1571
def Interval_dbus_property(self, value=None):
1786
1572
if value is None: # get
1787
return dbus.UInt64(self.interval.total_seconds() * 1000)
1573
return dbus.UInt64(self.interval_milliseconds())
1788
1574
self.interval = datetime.timedelta(0, 0, 0, value)
1789
1575
if getattr(self, "checker_initiator_tag", None) is None:
1790
1576
return
1791
1577
if self.enabled:
1792
1578
# Reschedule checker run
1793
1579
gobject.source_remove(self.checker_initiator_tag)
1794
self.checker_initiator_tag = gobject.timeout_add(
1795
value, self.start_checker)
1796
self.start_checker() # Start one now, too
1580
self.checker_initiator_tag = (gobject.timeout_add
1581
(value, self.start_checker))
1582
self.start_checker() # Start one now, too
1797
1583
1798
1584
# Checker - property
1799
@dbus_service_property(_interface,
1800
signature="s",
1585
@dbus_service_property(_interface, signature="s",
1801
1586
access="readwrite")
1802
1587
def Checker_dbus_property(self, value=None):
1803
1588
if value is None: # get
1804
1589
return dbus.String(self.checker_command)
1805
self.checker_command = str(value)
1590
self.checker_command = unicode(value)
1806
1591
1807
1592
# CheckerRunning - property
1808
@dbus_service_property(_interface,
1809
signature="b",
1593
@dbus_service_property(_interface, signature="b",
1810
1594
access="readwrite")
1811
1595
def CheckerRunning_dbus_property(self, value=None):
1812
1596
if value is None: # get
1817
1601
self.stop_checker()
1818
1602
1819
1603
# ObjectPath - property
1820
@dbus_annotations(
1821
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
1822
"org.freedesktop.DBus.Deprecated": "true"})
1823
1604
@dbus_service_property(_interface, signature="o", access="read")
1824
1605
def ObjectPath_dbus_property(self):
1825
1606
return self.dbus_object_path # is already a dbus.ObjectPath
1826
1607
1827
1608
# Secret = property
1828
@dbus_annotations(
1829
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
1830
"invalidates"})
1831
@dbus_service_property(_interface,
1832
signature="ay",
1833
access="write",
1834
byte_arrays=True)
1609
@dbus_service_property(_interface, signature="ay",
1610
access="write", byte_arrays=True)
1835
1611
def Secret_dbus_property(self, value):
1836
self.secret = bytes(value)
1612
self.secret = str(value)
1837
1613
1838
1614
del _interface
1839
1615
1843
1619
self._pipe = child_pipe
1844
1620
self._pipe.send(('init', fpr, address))
1845
1621
if not self._pipe.recv():
1846
raise KeyError(fpr)
1622
raise KeyError()
1847
1623
1848
1624
def __getattribute__(self, name):
1849
1625
if name == '_pipe':
1853
1629
if data[0] == 'data':
1854
1630
return data[1]
1855
1631
if data[0] == 'function':
1856
1857
1632
def func(*args, **kwargs):
1858
1633
self._pipe.send(('funcall', name, args, kwargs))
1859
1634
return self._pipe.recv()[1]
1860
1861
1635
return func
1862
1636
1863
1637
def __setattr__(self, name, value):
1875
1649
def handle(self):
1876
1650
with contextlib.closing(self.server.child_pipe) as child_pipe:
1877
1651
logger.info("TCP connection from: %s",
1878
str(self.client_address))
1652
unicode(self.client_address))
1879
1653
logger.debug("Pipe FD: %d",
1880
1654
self.server.child_pipe.fileno())
1881
1655
1882
session = gnutls.connection.ClientSession(
1883
self.request, gnutls.connection.X509Credentials())
1656
session = (gnutls.connection
1657
.ClientSession(self.request,
1658
gnutls.connection
1659
.X509Credentials()))
1884
1660
1885
1661
# Note: gnutls.connection.X509Credentials is really a
1886
1662
# generic GnuTLS certificate credentials object so long as
1895
1671
priority = self.server.gnutls_priority
1896
1672
if priority is None:
1897
1673
priority = "NORMAL"
1898
gnutls.library.functions.gnutls_priority_set_direct(
1899
session._c_object, priority, None)
1674
(gnutls.library.functions
1675
.gnutls_priority_set_direct(session._c_object,
1676
priority, None))
1900
1677
1901
1678
# Start communication using the Mandos protocol
1902
1679
# Get protocol number
1904
1681
logger.debug("Protocol version: %r", line)
1905
1682
try:
1906
1683
if int(line.strip().split()[0]) > 1:
1907
raise RuntimeError(line)
1684
raise RuntimeError
1908
1685
except (ValueError, IndexError, RuntimeError) as error:
1909
1686
logger.error("Unknown protocol version: %s", error)
1910
1687
return
1922
1699
approval_required = False
1923
1700
try:
1924
1701
try:
1925
fpr = self.fingerprint(
1926
self.peer_certificate(session))
1702
fpr = self.fingerprint(self.peer_certificate
1703
(session))
1927
1704
except (TypeError,
1928
1705
gnutls.errors.GNUTLSError) as error:
1929
1706
logger.warning("Bad certificate: %s", error)
1944
1721
while True:
1945
1722
if not client.enabled:
1946
1723
logger.info("Client %s is disabled",
1947
client.name)
1724
client.name)
1948
1725
if self.server.use_dbus:
1949
1726
# Emit D-Bus signal
1950
1727
client.Rejected("Disabled")
1959
1736
if self.server.use_dbus:
1960
1737
# Emit D-Bus signal
1961
1738
client.NeedApproval(
1962
client.approval_delay.total_seconds()
1963
* 1000, client.approved_by_default)
1739
client.approval_delay_milliseconds(),
1740
client.approved_by_default)
1964
1741
else:
1965
1742
logger.warning("Client %s was not approved",
1966
1743
client.name)
1972
1749
#wait until timeout or approved
1973
1750
time = datetime.datetime.now()
1974
1751
client.changedstate.acquire()
1975
client.changedstate.wait(delay.total_seconds())
1752
client.changedstate.wait(
1753
float(timedelta_to_milliseconds(delay)
1754
/ 1000))
1976
1755
client.changedstate.release()
1977
1756
time2 = datetime.datetime.now()
1978
1757
if (time2 - time) >= delay:
1997
1776
logger.warning("gnutls send failed",
1998
1777
exc_info=error)
1999
1778
return
2000
logger.debug("Sent: %d, remaining: %d", sent,
2001
len(client.secret) - (sent_size
2002
+ sent))
1779
logger.debug("Sent: %d, remaining: %d",
1780
sent, len(client.secret)
1781
- (sent_size + sent))
2003
1782
sent_size += sent
2004
1783
2005
1784
logger.info("Sending secret to %s", client.name)
2022
1801
def peer_certificate(session):
2023
1802
"Return the peer's OpenPGP certificate as a bytestring"
2024
1803
# If not an OpenPGP certificate...
2025
if (gnutls.library.functions.gnutls_certificate_type_get(
2026
session._c_object)
1804
if (gnutls.library.functions
1805
.gnutls_certificate_type_get(session._c_object)
2027
1806
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
2028
1807
# ...do the normal thing
2029
1808
return session.peer_certificate
2043
1822
def fingerprint(openpgp):
2044
1823
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2045
1824
# New GnuTLS "datum" with the OpenPGP public key
2046
datum = gnutls.library.types.gnutls_datum_t(
2047
ctypes.cast(ctypes.c_char_p(openpgp),
2048
ctypes.POINTER(ctypes.c_ubyte)),
2049
ctypes.c_uint(len(openpgp)))
1825
datum = (gnutls.library.types
1826
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1827
ctypes.POINTER
1828
(ctypes.c_ubyte)),
1829
ctypes.c_uint(len(openpgp))))
2050
1830
# New empty GnuTLS certificate
2051
1831
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2052
gnutls.library.functions.gnutls_openpgp_crt_init(
2053
ctypes.byref(crt))
1832
(gnutls.library.functions
1833
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2054
1834
# Import the OpenPGP public key into the certificate
2055
gnutls.library.functions.gnutls_openpgp_crt_import(
2056
crt, ctypes.byref(datum),
2057
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1835
(gnutls.library.functions
1836
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1837
gnutls.library.constants
1838
.GNUTLS_OPENPGP_FMT_RAW))
2058
1839
# Verify the self signature in the key
2059
1840
crtverify = ctypes.c_uint()
2060
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2061
crt, 0, ctypes.byref(crtverify))
1841
(gnutls.library.functions
1842
.gnutls_openpgp_crt_verify_self(crt, 0,
1843
ctypes.byref(crtverify)))
2062
1844
if crtverify.value != 0:
2063
1845
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2064
raise gnutls.errors.CertificateSecurityError(
2065
"Verify failed")
1846
raise (gnutls.errors.CertificateSecurityError
1847
("Verify failed"))
2066
1848
# New buffer for the fingerprint
2067
1849
buf = ctypes.create_string_buffer(20)
2068
1850
buf_len = ctypes.c_size_t()
2069
1851
# Get the fingerprint from the certificate into the buffer
2070
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2071
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1852
(gnutls.library.functions
1853
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1854
ctypes.byref(buf_len)))
2072
1855
# Deinit the certificate
2073
1856
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2074
1857
# Convert the buffer to a Python bytestring
2080
1863
2081
1864
class MultiprocessingMixIn(object):
2082
1865
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2083
2084
1866
def sub_process_main(self, request, address):
2085
1867
try:
2086
1868
self.finish_request(request, address)
2098
1880
2099
1881
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2100
1882
""" adds a pipe to the MixIn """
2101
2102
1883
def process_request(self, request, client_address):
2103
1884
"""Overrides and wraps the original process_request().
2104
1885
2113
1894
2114
1895
def add_pipe(self, parent_pipe, proc):
2115
1896
"""Dummy function; override as necessary"""
2116
raise NotImplementedError()
1897
raise NotImplementedError
2117
1898
2118
1899
2119
1900
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2125
1906
interface: None or a network interface name (string)
2126
1907
use_ipv6: Boolean; to use IPv6 or not
2127
1908
"""
2128
2129
1909
def __init__(self, server_address, RequestHandlerClass,
2130
interface=None,
2131
use_ipv6=True,
2132
socketfd=None):
1910
interface=None, use_ipv6=True, socketfd=None):
2133
1911
"""If socketfd is set, use that file descriptor instead of
2134
1912
creating a new one with socket.socket().
2135
1913
"""
2176
1954
self.interface)
2177
1955
else:
2178
1956
try:
2179
self.socket.setsockopt(
2180
socket.SOL_SOCKET, SO_BINDTODEVICE,
2181
(self.interface + "\0").encode("utf-8"))
1957
self.socket.setsockopt(socket.SOL_SOCKET,
1958
SO_BINDTODEVICE,
1959
str(self.interface + '\0'))
2182
1960
except socket.error as error:
2183
1961
if error.errno == errno.EPERM:
2184
1962
logger.error("No permission to bind to"
2198
1976
if self.address_family == socket.AF_INET6:
2199
1977
any_address = "::" # in6addr_any
2200
1978
else:
2201
any_address = "0.0.0.0" # INADDR_ANY
1979
any_address = socket.INADDR_ANY
2202
1980
self.server_address = (any_address,
2203
1981
self.server_address[1])
2204
1982
elif not self.server_address[1]:
2205
self.server_address = (self.server_address[0], 0)
1983
self.server_address = (self.server_address[0],
1984
0)
2206
1985
# if self.interface:
2207
1986
# self.server_address = (self.server_address[0],
2208
1987
# 0, # port
2222
2001
2223
2002
Assumes a gobject.MainLoop event loop.
2224
2003
"""
2225
2226
2004
def __init__(self, server_address, RequestHandlerClass,
2227
interface=None,
2228
use_ipv6=True,
2229
clients=None,
2230
gnutls_priority=None,
2231
use_dbus=True,
2232
socketfd=None):
2005
interface=None, use_ipv6=True, clients=None,
2006
gnutls_priority=None, use_dbus=True, socketfd=None):
2233
2007
self.enabled = False
2234
2008
self.clients = clients
2235
2009
if self.clients is None:
2241
2015
interface = interface,
2242
2016
use_ipv6 = use_ipv6,
2243
2017
socketfd = socketfd)
2244
2245
2018
def server_activate(self):
2246
2019
if self.enabled:
2247
2020
return socketserver.TCPServer.server_activate(self)
2251
2024
2252
2025
def add_pipe(self, parent_pipe, proc):
2253
2026
# Call "handle_ipc" for both data and EOF events
2254
gobject.io_add_watch(
2255
parent_pipe.fileno(),
2256
gobject.IO_IN | gobject.IO_HUP,
2257
functools.partial(self.handle_ipc,
2258
parent_pipe = parent_pipe,
2259
proc = proc))
2027
gobject.io_add_watch(parent_pipe.fileno(),
2028
gobject.IO_IN | gobject.IO_HUP,
2029
functools.partial(self.handle_ipc,
2030
parent_pipe =
2031
parent_pipe,
2032
proc = proc))
2260
2033
2261
def handle_ipc(self, source, condition,
2262
parent_pipe=None,
2263
proc = None,
2264
client_object=None):
2034
def handle_ipc(self, source, condition, parent_pipe=None,
2035
proc = None, client_object=None):
2265
2036
# error, or the other end of multiprocessing.Pipe has closed
2266
2037
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2267
2038
# Wait for other process to exit
2290
2061
parent_pipe.send(False)
2291
2062
return False
2292
2063
2293
gobject.io_add_watch(
2294
parent_pipe.fileno(),
2295
gobject.IO_IN | gobject.IO_HUP,
2296
functools.partial(self.handle_ipc,
2297
parent_pipe = parent_pipe,
2298
proc = proc,
2299
client_object = client))
2064
gobject.io_add_watch(parent_pipe.fileno(),
2065
gobject.IO_IN | gobject.IO_HUP,
2066
functools.partial(self.handle_ipc,
2067
parent_pipe =
2068
parent_pipe,
2069
proc = proc,
2070
client_object =
2071
client))
2300
2072
parent_pipe.send(True)
2301
2073
# remove the old hook in favor of the new above hook on
2302
2074
# same fileno
2308
2080
2309
2081
parent_pipe.send(('data', getattr(client_object,
2310
2082
funcname)(*args,
2311
**kwargs)))
2083
**kwargs)))
2312
2084
2313
2085
if command == 'getattr':
2314
2086
attrname = request[1]
2315
if isinstance(client_object.__getattribute__(attrname),
2316
collections.Callable):
2317
parent_pipe.send(('function', ))
2087
if callable(client_object.__getattribute__(attrname)):
2088
parent_pipe.send(('function',))
2318
2089
else:
2319
parent_pipe.send((
2320
'data', client_object.__getattribute__(attrname)))
2090
parent_pipe.send(('data', client_object
2091
.__getattribute__(attrname)))
2321
2092
2322
2093
if command == 'setattr':
2323
2094
attrname = request[1]
2354
2125
# avoid excessive use of external libraries.
2355
2126
2356
2127
# New type for defining tokens, syntax, and semantics all-in-one
2357
Token = collections.namedtuple("Token", (
2358
"regexp", # To match token; if "value" is not None, must have
2359
# a "group" containing digits
2360
"value", # datetime.timedelta or None
2361
"followers")) # Tokens valid after this token
2128
Token = collections.namedtuple("Token",
2129
("regexp", # To match token; if
2130
# "value" is not None,
2131
# must have a "group"
2132
# containing digits
2133
"value", # datetime.timedelta or
2134
# None
2135
"followers")) # Tokens valid after
2136
# this token
2362
2137
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2363
2138
# the "duration" ABNF definition in RFC 3339, Appendix A.
2364
2139
token_end = Token(re.compile(r"$"), None, frozenset())
2365
2140
token_second = Token(re.compile(r"(\d+)S"),
2366
2141
datetime.timedelta(seconds=1),
2367
frozenset((token_end, )))
2142
frozenset((token_end,)))
2368
2143
token_minute = Token(re.compile(r"(\d+)M"),
2369
2144
datetime.timedelta(minutes=1),
2370
2145
frozenset((token_second, token_end)))
2386
2161
frozenset((token_month, token_end)))
2387
2162
token_week = Token(re.compile(r"(\d+)W"),
2388
2163
datetime.timedelta(weeks=1),
2389
frozenset((token_end, )))
2164
frozenset((token_end,)))
2390
2165
token_duration = Token(re.compile(r"P"), None,
2391
2166
frozenset((token_year, token_month,
2392
2167
token_day, token_time,
2393
token_week)))
2168
token_week))),
2394
2169
# Define starting values
2395
2170
value = datetime.timedelta() # Value so far
2396
2171
found_token = None
2397
followers = frozenset((token_duration, )) # Following valid tokens
2172
followers = frozenset(token_duration,) # Following valid tokens
2398
2173
s = duration # String left to parse
2399
2174
# Loop until end token is found
2400
2175
while found_token is not token_end:
2417
2192
break
2418
2193
else:
2419
2194
# No currently valid tokens were found
2420
raise ValueError("Invalid RFC 3339 duration: {!r}"
2421
.format(duration))
2195
raise ValueError("Invalid RFC 3339 duration")
2422
2196
# End token found
2423
2197
return value
2424
2198
2448
2222
timevalue = datetime.timedelta(0)
2449
2223
for s in interval.split():
2450
2224
try:
2451
suffix = s[-1]
2225
suffix = unicode(s[-1])
2452
2226
value = int(s[:-1])
2453
2227
if suffix == "d":
2454
2228
delta = datetime.timedelta(value)
2461
2235
elif suffix == "w":
2462
2236
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2463
2237
else:
2464
raise ValueError("Unknown suffix {!r}".format(suffix))
2465
except IndexError as e:
2238
raise ValueError("Unknown suffix {0!r}"
2239
.format(suffix))
2240
except (ValueError, IndexError) as e:
2466
2241
raise ValueError(*(e.args))
2467
2242
timevalue += delta
2468
2243
return timevalue
2484
2259
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2485
2260
if not stat.S_ISCHR(os.fstat(null).st_mode):
2486
2261
raise OSError(errno.ENODEV,
2487
"{} not a character device"
2262
"{0} not a character device"
2488
2263
.format(os.devnull))
2489
2264
os.dup2(null, sys.stdin.fileno())
2490
2265
os.dup2(null, sys.stdout.fileno())
2500
2275
2501
2276
parser = argparse.ArgumentParser()
2502
2277
parser.add_argument("-v", "--version", action="version",
2503
version = "%(prog)s {}".format(version),
2278
version = "%(prog)s {0}".format(version),
2504
2279
help="show version number and exit")
2505
2280
parser.add_argument("-i", "--interface", metavar="IF",
2506
2281
help="Bind to interface IF")
2512
2287
help="Run self-test")
2513
2288
parser.add_argument("--debug", action="store_true",
2514
2289
help="Debug mode; run in foreground and log"
2515
" to terminal", default=None)
2290
" to terminal")
2516
2291
parser.add_argument("--debuglevel", metavar="LEVEL",
2517
2292
help="Debug level for stdout output")
2518
2293
parser.add_argument("--priority", help="GnuTLS"
2525
2300
" files")
2526
2301
parser.add_argument("--no-dbus", action="store_false",
2527
2302
dest="use_dbus", help="Do not provide D-Bus"
2528
" system bus interface", default=None)
2303
" system bus interface")
2529
2304
parser.add_argument("--no-ipv6", action="store_false",
2530
dest="use_ipv6", help="Do not use IPv6",
2531
default=None)
2305
dest="use_ipv6", help="Do not use IPv6")
2532
2306
parser.add_argument("--no-restore", action="store_false",
2533
2307
dest="restore", help="Do not restore stored"
2534
" state", default=None)
2308
" state")
2535
2309
parser.add_argument("--socket", type=int,
2536
2310
help="Specify a file descriptor to a network"
2537
2311
" socket to use instead of creating one")
2538
2312
parser.add_argument("--statedir", metavar="DIR",
2539
2313
help="Directory to save/restore state in")
2540
2314
parser.add_argument("--foreground", action="store_true",
2541
help="Run in foreground", default=None)
2542
parser.add_argument("--no-zeroconf", action="store_false",
2543
dest="zeroconf", help="Do not use Zeroconf",
2544
default=None)
2315
help="Run in foreground")
2545
2316
2546
2317
options = parser.parse_args()
2547
2318
2548
2319
if options.check:
2549
2320
import doctest
2550
fail_count, test_count = doctest.testmod()
2551
sys.exit(os.EX_OK if fail_count == 0 else 1)
2321
doctest.testmod()
2322
sys.exit()
2552
2323
2553
2324
# Default values for config file for server-global settings
2554
2325
server_defaults = { "interface": "",
2556
2327
"port": "",
2557
2328
"debug": "False",
2558
2329
"priority":
2559
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2560
":+SIGN-DSA-SHA256",
2330
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2561
2331
"servicename": "Mandos",
2562
2332
"use_dbus": "True",
2563
2333
"use_ipv6": "True",
2566
2336
"socket": "",
2567
2337
"statedir": "/var/lib/mandos",
2568
2338
"foreground": "False",
2569
"zeroconf": "True",
2570
}
2339
}
2571
2340
2572
2341
# Parse config file for server-global settings
2573
2342
server_config = configparser.SafeConfigParser(server_defaults)
2574
2343
del server_defaults
2575
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2344
server_config.read(os.path.join(options.configdir,
2345
"mandos.conf"))
2576
2346
# Convert the SafeConfigParser object to a dict
2577
2347
server_settings = server_config.defaults()
2578
2348
# Use the appropriate methods on the non-string config options
2596
2366
# Override the settings from the config file with command line
2597
2367
# options, if set.
2598
2368
for option in ("interface", "address", "port", "debug",
2599
"priority", "servicename", "configdir", "use_dbus",
2600
"use_ipv6", "debuglevel", "restore", "statedir",
2601
"socket", "foreground", "zeroconf"):
2369
"priority", "servicename", "configdir",
2370
"use_dbus", "use_ipv6", "debuglevel", "restore",
2371
"statedir", "socket", "foreground"):
2602
2372
value = getattr(options, option)
2603
2373
if value is not None:
2604
2374
server_settings[option] = value
2605
2375
del options
2606
2376
# Force all strings to be unicode
2607
2377
for option in server_settings.keys():
2608
if isinstance(server_settings[option], bytes):
2609
server_settings[option] = (server_settings[option]
2610
.decode("utf-8"))
2611
# Force all boolean options to be boolean
2612
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2613
"foreground", "zeroconf"):
2614
server_settings[option] = bool(server_settings[option])
2378
if type(server_settings[option]) is str:
2379
server_settings[option] = unicode(server_settings[option])
2615
2380
# Debug implies foreground
2616
2381
if server_settings["debug"]:
2617
2382
server_settings["foreground"] = True
2619
2384
2620
2385
##################################################################
2621
2386
2622
if (not server_settings["zeroconf"]
2623
and not (server_settings["port"]
2624
or server_settings["socket"] != "")):
2625
parser.error("Needs port or socket to work without Zeroconf")
2626
2627
2387
# For convenience
2628
2388
debug = server_settings["debug"]
2629
2389
debuglevel = server_settings["debuglevel"]
2632
2392
stored_state_path = os.path.join(server_settings["statedir"],
2633
2393
stored_state_file)
2634
2394
foreground = server_settings["foreground"]
2635
zeroconf = server_settings["zeroconf"]
2636
2395
2637
2396
if debug:
2638
2397
initlogger(debug, logging.DEBUG)
2644
2403
initlogger(debug, level)
2645
2404
2646
2405
if server_settings["servicename"] != "Mandos":
2647
syslogger.setFormatter(
2648
logging.Formatter('Mandos ({}) [%(process)d]:'
2649
' %(levelname)s: %(message)s'.format(
2650
server_settings["servicename"])))
2406
syslogger.setFormatter(logging.Formatter
2407
('Mandos ({0}) [%(process)d]:'
2408
' %(levelname)s: %(message)s'
2409
.format(server_settings
2410
["servicename"])))
2651
2411
2652
2412
# Parse config file with clients
2653
2413
client_config = configparser.SafeConfigParser(Client
2658
2418
global mandos_dbus_service
2659
2419
mandos_dbus_service = None
2660
2420
2661
socketfd = None
2662
if server_settings["socket"] != "":
2663
socketfd = server_settings["socket"]
2664
tcp_server = MandosServer(
2665
(server_settings["address"], server_settings["port"]),
2666
ClientHandler,
2667
interface=(server_settings["interface"] or None),
2668
use_ipv6=use_ipv6,
2669
gnutls_priority=server_settings["priority"],
2670
use_dbus=use_dbus,
2671
socketfd=socketfd)
2421
tcp_server = MandosServer((server_settings["address"],
2422
server_settings["port"]),
2423
ClientHandler,
2424
interface=(server_settings["interface"]
2425
or None),
2426
use_ipv6=use_ipv6,
2427
gnutls_priority=
2428
server_settings["priority"],
2429
use_dbus=use_dbus,
2430
socketfd=(server_settings["socket"]
2431
or None))
2672
2432
if not foreground:
2673
pidfilename = "/run/mandos.pid"
2674
if not os.path.isdir("/run/."):
2675
pidfilename = "/var/run/mandos.pid"
2433
pidfilename = "/var/run/mandos.pid"
2676
2434
pidfile = None
2677
2435
try:
2678
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2436
pidfile = open(pidfilename, "w")
2679
2437
except IOError as e:
2680
2438
logger.error("Could not open file %r", pidfilename,
2681
2439
exc_info=e)
2695
2453
os.setuid(uid)
2696
2454
except OSError as error:
2697
2455
if error.errno != errno.EPERM:
2698
raise
2456
raise error
2699
2457
2700
2458
if debug:
2701
2459
# Enable all possible GnuTLS debugging
2708
2466
def debug_gnutls(level, string):
2709
2467
logger.debug("GnuTLS: %s", string[:-1])
2710
2468
2711
gnutls.library.functions.gnutls_global_set_log_function(
2712
debug_gnutls)
2469
(gnutls.library.functions
2470
.gnutls_global_set_log_function(debug_gnutls))
2713
2471
2714
2472
# Redirect stdin so all checkers get /dev/null
2715
2473
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2735
2493
if use_dbus:
2736
2494
try:
2737
2495
bus_name = dbus.service.BusName("se.recompile.Mandos",
2738
bus,
2739
do_not_queue=True)
2740
old_bus_name = dbus.service.BusName(
2741
"se.bsnet.fukt.Mandos", bus,
2742
do_not_queue=True)
2743
except dbus.exceptions.DBusException as e:
2496
bus, do_not_queue=True)
2497
old_bus_name = (dbus.service.BusName
2498
("se.bsnet.fukt.Mandos", bus,
2499
do_not_queue=True))
2500
except dbus.exceptions.NameExistsException as e:
2744
2501
logger.error("Disabling D-Bus:", exc_info=e)
2745
2502
use_dbus = False
2746
2503
server_settings["use_dbus"] = False
2747
2504
tcp_server.use_dbus = False
2748
if zeroconf:
2749
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2750
service = AvahiServiceToSyslog(
2751
name = server_settings["servicename"],
2752
servicetype = "_mandos._tcp",
2753
protocol = protocol,
2754
bus = bus)
2755
if server_settings["interface"]:
2756
service.interface = if_nametoindex(
2757
server_settings["interface"].encode("utf-8"))
2505
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2506
service = AvahiServiceToSyslog(name =
2507
server_settings["servicename"],
2508
servicetype = "_mandos._tcp",
2509
protocol = protocol, bus = bus)
2510
if server_settings["interface"]:
2511
service.interface = (if_nametoindex
2512
(str(server_settings["interface"])))
2758
2513
2759
2514
global multiprocessing_manager
2760
2515
multiprocessing_manager = multiprocessing.Manager()
2767
2522
old_client_settings = {}
2768
2523
clients_data = {}
2769
2524
2770
# This is used to redirect stdout and stderr for checker processes
2771
global wnull
2772
wnull = open(os.devnull, "w") # A writable /dev/null
2773
# Only used if server is running in foreground but not in debug
2774
# mode
2775
if debug or not foreground:
2776
wnull.close()
2777
2778
2525
# Get client data and settings from last running state.
2779
2526
if server_settings["restore"]:
2780
2527
try:
2781
2528
with open(stored_state_path, "rb") as stored_state:
2782
clients_data, old_client_settings = pickle.load(
2783
stored_state)
2529
clients_data, old_client_settings = (pickle.load
2530
(stored_state))
2784
2531
os.remove(stored_state_path)
2785
2532
except IOError as e:
2786
2533
if e.errno == errno.ENOENT:
2787
logger.warning("Could not load persistent state:"
2788
" {}".format(os.strerror(e.errno)))
2534
logger.warning("Could not load persistent state: {0}"
2535
.format(os.strerror(e.errno)))
2789
2536
else:
2790
2537
logger.critical("Could not load persistent state:",
2791
2538
exc_info=e)
2792
2539
raise
2793
2540
except EOFError as e:
2794
2541
logger.warning("Could not load persistent state: "
2795
"EOFError:",
2796
exc_info=e)
2542
"EOFError:", exc_info=e)
2797
2543
2798
2544
with PGPEngine() as pgp:
2799
for client_name, client in clients_data.items():
2800
# Skip removed clients
2801
if client_name not in client_settings:
2802
continue
2803
2545
for client_name, client in clients_data.iteritems():
2804
2546
# Decide which value to use after restoring saved state.
2805
2547
# We have three different values: Old config file,
2806
2548
# new config file, and saved state.
2811
2553
# For each value in new config, check if it
2812
2554
# differs from the old config value (Except for
2813
2555
# the "secret" attribute)
2814
if (name != "secret"
2815
and (value !=
2816
old_client_settings[client_name][name])):
2556
if (name != "secret" and
2557
value != old_client_settings[client_name]
2558
[name]):
2817
2559
client[name] = value
2818
2560
except KeyError:
2819
2561
pass
2820
2562
2821
2563
# Clients who has passed its expire date can still be
2822
# enabled if its last checker was successful. A Client
2564
# enabled if its last checker was successful. Clients
2823
2565
# whose checker succeeded before we stored its state is
2824
2566
# assumed to have successfully run all checkers during
2825
2567
# downtime.
2827
2569
if datetime.datetime.utcnow() >= client["expires"]:
2828
2570
if not client["last_checked_ok"]:
2829
2571
logger.warning(
2830
"disabling client {} - Client never "
2831
"performed a successful checker".format(
2832
client_name))
2572
"disabling client {0} - Client never "
2573
"performed a successful checker"
2574
.format(client_name))
2833
2575
client["enabled"] = False
2834
2576
elif client["last_checker_status"] != 0:
2835
2577
logger.warning(
2836
"disabling client {} - Client last"
2837
" checker failed with error code"
2838
" {}".format(
2839
client_name,
2840
client["last_checker_status"]))
2578
"disabling client {0} - Client "
2579
"last checker failed with error code {1}"
2580
.format(client_name,
2581
client["last_checker_status"]))
2841
2582
client["enabled"] = False
2842
2583
else:
2843
client["expires"] = (
2844
datetime.datetime.utcnow()
2845
+ client["timeout"])
2584
client["expires"] = (datetime.datetime
2585
.utcnow()
2586
+ client["timeout"])
2846
2587
logger.debug("Last checker succeeded,"
2847
" keeping {} enabled".format(
2848
client_name))
2588
" keeping {0} enabled"
2589
.format(client_name))
2849
2590
try:
2850
client["secret"] = pgp.decrypt(
2851
client["encrypted_secret"],
2852
client_settings[client_name]["secret"])
2591
client["secret"] = (
2592
pgp.decrypt(client["encrypted_secret"],
2593
client_settings[client_name]
2594
["secret"]))
2853
2595
except PGPError:
2854
2596
# If decryption fails, we use secret from new settings
2855
logger.debug("Failed to decrypt {} old secret".format(
2856
client_name))
2857
client["secret"] = (client_settings[client_name]
2858
["secret"])
2597
logger.debug("Failed to decrypt {0} old secret"
2598
.format(client_name))
2599
client["secret"] = (
2600
client_settings[client_name]["secret"])
2859
2601
2860
2602
# Add/remove clients based on new changes made to config
2861
2603
for client_name in (set(old_client_settings)
2866
2608
clients_data[client_name] = client_settings[client_name]
2867
2609
2868
2610
# Create all client objects
2869
for client_name, client in clients_data.items():
2611
for client_name, client in clients_data.iteritems():
2870
2612
tcp_server.clients[client_name] = client_class(
2871
name = client_name,
2872
settings = client,
2873
server_settings = server_settings)
2613
name = client_name, settings = client)
2874
2614
2875
2615
if not tcp_server.clients:
2876
2616
logger.warning("No clients defined")
2877
2617
2878
2618
if not foreground:
2879
2619
if pidfile is not None:
2880
pid = os.getpid()
2881
2620
try:
2882
2621
with pidfile:
2883
print(pid, file=pidfile)
2622
pid = os.getpid()
2623
pidfile.write(str(pid) + "\n".encode("utf-8"))
2884
2624
except IOError:
2885
2625
logger.error("Could not write to file %r with PID %d",
2886
2626
pidfilename, pid)
2891
2631
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2892
2632
2893
2633
if use_dbus:
2894
2895
@alternate_dbus_interfaces(
2896
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2897
class MandosDBusService(DBusObjectWithObjectManager):
2634
@alternate_dbus_interfaces({"se.recompile.Mandos":
2635
"se.bsnet.fukt.Mandos"})
2636
class MandosDBusService(DBusObjectWithProperties):
2898
2637
"""A D-Bus proxy object"""
2899
2900
2638
def __init__(self):
2901
2639
dbus.service.Object.__init__(self, bus, "/")
2902
2903
2640
_interface = "se.recompile.Mandos"
2904
2641
2642
@dbus_interface_annotations(_interface)
2643
def _foo(self):
2644
return { "org.freedesktop.DBus.Property"
2645
".EmitsChangedSignal":
2646
"false"}
2647
2905
2648
@dbus.service.signal(_interface, signature="o")
2906
2649
def ClientAdded(self, objpath):
2907
2650
"D-Bus signal"
2912
2655
"D-Bus signal"
2913
2656
pass
2914
2657
2915
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2916
"true"})
2917
2658
@dbus.service.signal(_interface, signature="os")
2918
2659
def ClientRemoved(self, objpath, name):
2919
2660
"D-Bus signal"
2920
2661
pass
2921
2662
2922
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2923
"true"})
2924
2663
@dbus.service.method(_interface, out_signature="ao")
2925
2664
def GetAllClients(self):
2926
2665
"D-Bus method"
2927
return dbus.Array(c.dbus_object_path for c in
2666
return dbus.Array(c.dbus_object_path
2667
for c in
2928
2668
tcp_server.clients.itervalues())
2929
2669
2930
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2931
"true"})
2932
2670
@dbus.service.method(_interface,
2933
2671
out_signature="a{oa{sv}}")
2934
2672
def GetAllClientsWithProperties(self):
2935
2673
"D-Bus method"
2936
2674
return dbus.Dictionary(
2937
{ c.dbus_object_path: c.GetAll(
2938
"se.recompile.Mandos.Client")
2939
for c in tcp_server.clients.itervalues() },
2675
((c.dbus_object_path, c.GetAll(""))
2676
for c in tcp_server.clients.itervalues()),
2940
2677
signature="oa{sv}")
2941
2678
2942
2679
@dbus.service.method(_interface, in_signature="o")
2946
2683
if c.dbus_object_path == object_path:
2947
2684
del tcp_server.clients[c.name]
2948
2685
c.remove_from_connection()
2949
# Don't signal the disabling
2686
# Don't signal anything except ClientRemoved
2950
2687
c.disable(quiet=True)
2951
# Emit D-Bus signal for removal
2952
self.client_removed_signal(c)
2688
# Emit D-Bus signal
2689
self.ClientRemoved(object_path, c.name)
2953
2690
return
2954
2691
raise KeyError(object_path)
2955
2692
2956
2693
del _interface
2957
2958
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
2959
out_signature = "a{oa{sa{sv}}}")
2960
def GetManagedObjects(self):
2961
"""D-Bus method"""
2962
return dbus.Dictionary(
2963
{ client.dbus_object_path:
2964
dbus.Dictionary(
2965
{ interface: client.GetAll(interface)
2966
for interface in
2967
client._get_all_interface_names()})
2968
for client in tcp_server.clients.values()})
2969
2970
def client_added_signal(self, client):
2971
"""Send the new standard signal and the old signal"""
2972
if use_dbus:
2973
# New standard signal
2974
self.InterfacesAdded(
2975
client.dbus_object_path,
2976
dbus.Dictionary(
2977
{ interface: client.GetAll(interface)
2978
for interface in
2979
client._get_all_interface_names()}))
2980
# Old signal
2981
self.ClientAdded(client.dbus_object_path)
2982
2983
def client_removed_signal(self, client):
2984
"""Send the new standard signal and the old signal"""
2985
if use_dbus:
2986
# New standard signal
2987
self.InterfacesRemoved(
2988
client.dbus_object_path,
2989
client._get_all_interface_names())
2990
# Old signal
2991
self.ClientRemoved(client.dbus_object_path,
2992
client.name)
2993
2694
2994
2695
mandos_dbus_service = MandosDBusService()
2995
2696
2996
2697
def cleanup():
2997
2698
"Cleanup function; run on exit"
2998
if zeroconf:
2999
service.cleanup()
2699
service.cleanup()
3000
2700
3001
2701
multiprocessing.active_children()
3002
wnull.close()
3003
2702
if not (tcp_server.clients or client_settings):
3004
2703
return
3005
2704
3016
2715
3017
2716
# A list of attributes that can not be pickled
3018
2717
# + secret.
3019
exclude = { "bus", "changedstate", "secret",
3020
"checker", "server_settings" }
3021
for name, typ in inspect.getmembers(dbus.service
3022
.Object):
2718
exclude = set(("bus", "changedstate", "secret",
2719
"checker"))
2720
for name, typ in (inspect.getmembers
2721
(dbus.service.Object)):
3023
2722
exclude.add(name)
3024
2723
3025
2724
client_dict["encrypted_secret"] = (client
3032
2731
del client_settings[client.name]["secret"]
3033
2732
3034
2733
try:
3035
with tempfile.NamedTemporaryFile(
3036
mode='wb',
3037
suffix=".pickle",
3038
prefix='clients-',
3039
dir=os.path.dirname(stored_state_path),
3040
delete=False) as stored_state:
2734
with (tempfile.NamedTemporaryFile
2735
(mode='wb', suffix=".pickle", prefix='clients-',
2736
dir=os.path.dirname(stored_state_path),
2737
delete=False)) as stored_state:
3041
2738
pickle.dump((clients, client_settings), stored_state)
3042
tempname = stored_state.name
2739
tempname=stored_state.name
3043
2740
os.rename(tempname, stored_state_path)
3044
2741
except (IOError, OSError) as e:
3045
2742
if not debug:
3048
2745
except NameError:
3049
2746
pass
3050
2747
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3051
logger.warning("Could not save persistent state: {}"
2748
logger.warning("Could not save persistent state: {0}"
3052
2749
.format(os.strerror(e.errno)))
3053
2750
else:
3054
2751
logger.warning("Could not save persistent state:",
3055
2752
exc_info=e)
3056
raise
2753
raise e
3057
2754
3058
2755
# Delete all clients, and settings from config
3059
2756
while tcp_server.clients:
3060
2757
name, client = tcp_server.clients.popitem()
3061
2758
if use_dbus:
3062
2759
client.remove_from_connection()
3063
# Don't signal the disabling
2760
# Don't signal anything except ClientRemoved
3064
2761
client.disable(quiet=True)
3065
# Emit D-Bus signal for removal
3066
2762
if use_dbus:
3067
mandos_dbus_service.client_removed_signal(client)
2763
# Emit D-Bus signal
2764
mandos_dbus_service.ClientRemoved(client
2765
.dbus_object_path,
2766
client.name)
3068
2767
client_settings.clear()
3069
2768
3070
2769
atexit.register(cleanup)
3071
2770
3072
2771
for client in tcp_server.clients.itervalues():
3073
2772
if use_dbus:
3074
# Emit D-Bus signal for adding
3075
mandos_dbus_service.client_added_signal(client)
2773
# Emit D-Bus signal
2774
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3076
2775
# Need to initiate checking of clients
3077
2776
if client.enabled:
3078
2777
client.init_checker()
3081
2780
tcp_server.server_activate()
3082
2781
3083
2782
# Find out what port we got
3084
if zeroconf:
3085
service.port = tcp_server.socket.getsockname()[1]
2783
service.port = tcp_server.socket.getsockname()[1]
3086
2784
if use_ipv6:
3087
2785
logger.info("Now listening on address %r, port %d,"
3088
2786
" flowinfo %d, scope_id %d",
3094
2792
#service.interface = tcp_server.socket.getsockname()[3]
3095
2793
3096
2794
try:
3097
if zeroconf:
3098
# From the Avahi example code
3099
try:
3100
service.activate()
3101
except dbus.exceptions.DBusException as error:
3102
logger.critical("D-Bus Exception", exc_info=error)
3103
cleanup()
3104
sys.exit(1)
3105
# End of Avahi example code
2795
# From the Avahi example code
2796
try:
2797
service.activate()
2798
except dbus.exceptions.DBusException as error:
2799
logger.critical("D-Bus Exception", exc_info=error)
2800
cleanup()
2801
sys.exit(1)
2802
# End of Avahi example code
3106
2803
3107
2804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3108
2805
lambda *args, **kwargs:
3123
2820
# Must run before the D-Bus bus name gets deregistered
3124
2821
cleanup()
3125
2822
3126
3127
2823
if __name__ == '__main__':
3128
2824
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0