To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 621
- compare with another revision
- download diff
- download tarball
- view history from revision 621
- Committer: Teddy Hogeborn
- Date: 2013-09-29 15:52:19 UTC
- Revision ID: teddy@recompile.se-20130929155219-rer4z6583z1qu7kj
* debian/mandos-client.README.Debian: Update Linux documentation link.
* mandos-keygen: Change default key and subkey type to RSA and default
key length to 4096 bits.
* mandos-keygen: Change default key and subkey type to RSA and default
key length to 4096 bits.
- files removed:
- debian/upstream
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python2.7
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
46
43
import errno
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
51
import sys
52
52
import re
53
53
import os
62
62
import struct
63
63
import fcntl
64
64
import functools
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
65
import cPickle as pickle
69
66
import multiprocessing
70
67
import types
71
68
import binascii
72
69
import tempfile
73
70
import itertools
74
71
import collections
75
import codecs
76
72
77
73
import dbus
78
74
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
75
import gobject
83
76
import avahi
84
77
from dbus.mainloop.glib import DBusGMainLoop
85
78
import ctypes
95
88
except ImportError:
96
89
SO_BINDTODEVICE = None
97
90
98
if sys.version_info.major == 2:
99
str = unicode
100
101
version = "1.7.1"
91
version = "1.6.0"
102
92
stored_state_file = "clients.pickle"
103
93
104
94
logger = logging.getLogger()
105
syslogger = None
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
106
98
107
99
try:
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
102
.if_nametoindex)
110
103
except (OSError, AttributeError):
111
112
104
def if_nametoindex(interface):
113
105
"Get an interface index the hard way, i.e. using fcntl()"
114
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
115
107
with contextlib.closing(socket.socket()) as s:
116
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
117
struct.pack(b"16s16x", interface))
118
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
119
113
return interface_index
120
114
121
115
122
116
def initlogger(debug, level=logging.WARNING):
123
117
"""init logger and add loglevel"""
124
118
125
global syslogger
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
129
119
syslogger.setFormatter(logging.Formatter
130
120
('Mandos [%(process)d]: %(levelname)s:'
131
121
' %(message)s'))
148
138
149
139
class PGPEngine(object):
150
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
152
141
def __init__(self):
153
142
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
143
self.gnupgargs = ['--batch',
183
172
def password_encode(self, password):
184
173
# Passphrase can not be empty and can not contain newlines or
185
174
# NUL bytes. So we prefix it and hex encode it.
186
encoded = b"mandos" + binascii.hexlify(password)
187
if len(encoded) > 2048:
188
# GnuPG can't handle long passwords, so encode differently
189
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
190
.replace(b"\n", b"\\n")
191
.replace(b"\0", b"\\x00"))
192
return encoded
175
return b"mandos" + binascii.hexlify(password)
193
176
194
177
def encrypt(self, data, password):
195
178
passphrase = self.password_encode(password)
196
with tempfile.NamedTemporaryFile(
197
dir=self.tempdir) as passfile:
179
with tempfile.NamedTemporaryFile(dir=self.tempdir
180
) as passfile:
198
181
passfile.write(passphrase)
199
182
passfile.flush()
200
183
proc = subprocess.Popen(['gpg', '--symmetric',
211
194
212
195
def decrypt(self, data, password):
213
196
passphrase = self.password_encode(password)
214
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
197
with tempfile.NamedTemporaryFile(dir = self.tempdir
198
) as passfile:
216
199
passfile.write(passphrase)
217
200
passfile.flush()
218
201
proc = subprocess.Popen(['gpg', '--decrypt',
222
205
stdin = subprocess.PIPE,
223
206
stdout = subprocess.PIPE,
224
207
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
208
decrypted_plaintext, err = proc.communicate(input
209
= data)
226
210
if proc.returncode != 0:
227
211
raise PGPError(err)
228
212
return decrypted_plaintext
231
215
class AvahiError(Exception):
232
216
def __init__(self, value, *args, **kwargs):
233
217
self.value = value
234
return super(AvahiError, self).__init__(value, *args,
235
**kwargs)
236
218
super(AvahiError, self).__init__(value, *args, **kwargs)
219
def __unicode__(self):
220
return unicode(repr(self.value))
237
221
238
222
class AvahiServiceError(AvahiError):
239
223
pass
240
224
241
242
225
class AvahiGroupError(AvahiError):
243
226
pass
244
227
264
247
bus: dbus.SystemBus()
265
248
"""
266
249
267
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
250
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
servicetype = None, port = None, TXT = None,
252
domain = "", host = "", max_renames = 32768,
253
protocol = avahi.PROTO_UNSPEC, bus = None):
278
254
self.interface = interface
279
255
self.name = name
280
256
self.type = servicetype
290
266
self.bus = bus
291
267
self.entry_group_state_changed_match = None
292
268
293
def rename(self, remove=True):
269
def rename(self):
294
270
"""Derived from the Avahi example code"""
295
271
if self.rename_count >= self.max_renames:
296
272
logger.critical("No suitable Zeroconf service name found"
297
273
" after %i retries, exiting.",
298
274
self.rename_count)
299
275
raise AvahiServiceError("Too many renames")
300
self.name = str(
301
self.server.GetAlternativeServiceName(self.name))
302
self.rename_count += 1
276
self.name = unicode(self.server
277
.GetAlternativeServiceName(self.name))
303
278
logger.info("Changing Zeroconf service name to %r ...",
304
279
self.name)
305
if remove:
306
self.remove()
280
self.remove()
307
281
try:
308
282
self.add()
309
283
except dbus.exceptions.DBusException as error:
310
if (error.get_dbus_name()
311
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
313
return self.rename(remove=False)
314
else:
315
logger.critical("D-Bus Exception", exc_info=error)
316
self.cleanup()
317
os._exit(1)
284
logger.critical("D-Bus Exception", exc_info=error)
285
self.cleanup()
286
os._exit(1)
287
self.rename_count += 1
318
288
319
289
def remove(self):
320
290
"""Derived from the Avahi example code"""
358
328
self.rename()
359
329
elif state == avahi.ENTRY_GROUP_FAILURE:
360
330
logger.critical("Avahi: Error in group state changed %s",
361
str(error))
362
raise AvahiGroupError("State changed: {!s}".format(error))
331
unicode(error))
332
raise AvahiGroupError("State changed: {0!s}"
333
.format(error))
363
334
364
335
def cleanup(self):
365
336
"""Derived from the Avahi example code"""
375
346
def server_state_changed(self, state, error=None):
376
347
"""Derived from the Avahi example code"""
377
348
logger.debug("Avahi server state change: %i", state)
378
bad_states = {
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
383
}
349
bad_states = { avahi.SERVER_INVALID:
350
"Zeroconf server invalid",
351
avahi.SERVER_REGISTERING: None,
352
avahi.SERVER_COLLISION:
353
"Zeroconf server name collision",
354
avahi.SERVER_FAILURE:
355
"Zeroconf server failure" }
384
356
if state in bad_states:
385
357
if bad_states[state] is not None:
386
358
if error is None:
389
361
logger.error(bad_states[state] + ": %r", error)
390
362
self.cleanup()
391
363
elif state == avahi.SERVER_RUNNING:
392
try:
393
self.add()
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
398
" collision.")
399
return self.rename(remove=False)
400
else:
401
logger.critical("D-Bus Exception", exc_info=error)
402
self.cleanup()
403
os._exit(1)
364
self.add()
404
365
else:
405
366
if error is None:
406
367
logger.debug("Unknown state: %r", state)
416
377
follow_name_owner_changes=True),
417
378
avahi.DBUS_INTERFACE_SERVER)
418
379
self.server.connect_to_signal("StateChanged",
419
self.server_state_changed)
380
self.server_state_changed)
420
381
self.server_state_changed(self.server.GetState())
421
382
422
383
423
384
class AvahiServiceToSyslog(AvahiService):
424
def rename(self, *args, **kwargs):
385
def rename(self):
425
386
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
.format(self.name)))
387
ret = AvahiService.rename(self)
388
syslogger.setFormatter(logging.Formatter
389
('Mandos ({0}) [%(process)d]:'
390
' %(levelname)s: %(message)s'
391
.format(self.name)))
430
392
return ret
431
393
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
450
451
# Constants
452
E_SUCCESS = 0
453
E_INTERRUPTED = -52
454
E_AGAIN = -28
455
CRT_OPENPGP = 2
456
CLIENT = 2
457
SHUT_RDWR = 0
458
CRD_CERTIFICATE = 1
459
E_NO_CERTIFICATE_FOUND = -49
460
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
462
# Types
463
class session_int(ctypes.Structure):
464
_fields_ = []
465
session_t = ctypes.POINTER(session_int)
466
class certificate_credentials_st(ctypes.Structure):
467
_fields_ = []
468
certificate_credentials_t = ctypes.POINTER(
469
certificate_credentials_st)
470
certificate_type_t = ctypes.c_int
471
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
475
_fields_ = []
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
480
transport_ptr_t = ctypes.c_void_p
481
close_request_t = ctypes.c_int
482
483
# Exceptions
484
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
490
# Default usage is by a message string, but if a return
491
# code is passed, convert it to a string with
492
# gnutls.strerror()
493
self.code = code
494
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
497
message, *args)
498
499
class CertificateSecurityError(Error):
500
pass
501
502
# Classes
503
class Credentials(object):
504
def __init__(self):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
508
self.type = gnutls.CRD_CERTIFICATE
509
510
def __del__(self):
511
gnutls.certificate_free_credentials(self._c_object)
512
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
520
True)
521
self.socket = socket
522
if credentials is None:
523
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
526
ctypes.c_void_p))
527
self.credentials = credentials
528
529
def __del__(self):
530
gnutls.deinit(self._c_object)
531
532
def handshake(self):
533
return gnutls.handshake(self._c_object)
534
535
def send(self, data):
536
data = bytes(data)
537
data_len = len(data)
538
while data_len > 0:
539
data_len -= gnutls.record_send(self._c_object,
540
data[-data_len:],
541
data_len)
542
543
def bye(self):
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
545
546
# Error handling functions
547
def _error_code(result):
548
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
550
if result >= 0:
551
return result
552
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
555
556
def _retry_on_error(result, func, arguments):
557
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
559
while result < 0:
560
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
return _error_code(result)
562
result = func(*arguments)
563
return result
564
565
# Unless otherwise indicated, the function declarations below are
566
# all from the gnutls/gnutls.h C header file.
567
568
# Functions
569
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
ctypes.POINTER(ctypes.c_char_p)]
572
priority_set_direct.restype = _error_code
573
574
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
init.restype = _error_code
577
578
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
580
set_default_priority.restype = _error_code
581
582
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
584
ctypes.c_size_t]
585
record_send.restype = ctypes.c_ssize_t
586
record_send.errcheck = _retry_on_error
587
588
certificate_allocate_credentials = (
589
_library.gnutls_certificate_allocate_credentials)
590
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
592
certificate_allocate_credentials.restype = _error_code
593
594
certificate_free_credentials = (
595
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
597
certificate_free_credentials.restype = None
598
599
handshake_set_private_extensions = (
600
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
602
ctypes.c_int]
603
handshake_set_private_extensions.restype = None
604
605
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
607
ctypes.c_void_p]
608
credentials_set.restype = _error_code
609
610
strerror = _library.gnutls_strerror
611
strerror.argtypes = [ctypes.c_int]
612
strerror.restype = ctypes.c_char_p
613
614
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
616
certificate_type_get.restype = _error_code
617
618
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
620
ctypes.POINTER(ctypes.c_uint)]
621
certificate_get_peers.restype = ctypes.POINTER(datum_t)
622
623
global_set_log_level = _library.gnutls_global_set_log_level
624
global_set_log_level.argtypes = [ctypes.c_int]
625
global_set_log_level.restype = None
626
627
global_set_log_function = _library.gnutls_global_set_log_function
628
global_set_log_function.argtypes = [log_func]
629
global_set_log_function.restype = None
630
631
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
633
deinit.restype = None
634
635
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
638
handshake.errcheck = _retry_on_error
639
640
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
transport_set_ptr.restype = None
643
644
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
647
bye.errcheck = _retry_on_error
648
649
check_version = _library.gnutls_check_version
650
check_version.argtypes = [ctypes.c_char_p]
651
check_version.restype = ctypes.c_char_p
652
653
# All the function declarations below are from gnutls/openpgp.h
654
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
658
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
662
openpgp_crt_fmt_t]
663
openpgp_crt_import.restype = _error_code
664
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
669
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
673
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
677
ctypes.c_void_p,
678
ctypes.POINTER(
679
ctypes.c_size_t)]
680
openpgp_crt_get_fingerprint.restype = _error_code
681
682
# Remove non-public functions
683
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
685
gnutls = GnuTLS()
686
687
def call_pipe(connection, # : multiprocessing.Connection
688
func, *args, **kwargs):
689
"""This function is meant to be called by multiprocessing.Process
690
691
This function runs func(*args, **kwargs), and writes the resulting
692
return value on the provided multiprocessing.Connection.
693
"""
694
connection.send(func(*args, **kwargs))
695
connection.close()
394
395
def timedelta_to_milliseconds(td):
396
"Convert a datetime.timedelta() to milliseconds"
397
return ((td.days * 24 * 60 * 60 * 1000)
398
+ (td.seconds * 1000)
399
+ (td.microseconds // 1000))
400
696
401
697
402
class Client(object):
698
403
"""A representation of a client host served by this server.
725
430
last_checker_status: integer between 0 and 255 reflecting exit
726
431
status of last checker. -1 reflects crashed
727
432
checker, -2 means no checker completed yet.
728
last_checker_signal: The signal which killed the last checker, if
729
last_checker_status is -1
730
433
last_enabled: datetime.datetime(); (UTC) or None
731
434
name: string; from the config file, used in log messages and
732
435
D-Bus identifiers
745
448
"fingerprint", "host", "interval",
746
449
"last_approval_request", "last_checked_ok",
747
450
"last_enabled", "name", "timeout")
748
client_defaults = {
749
"timeout": "PT5M",
750
"extended_timeout": "PT15M",
751
"interval": "PT2M",
752
"checker": "fping -q -- %%(host)s",
753
"host": "",
754
"approval_delay": "PT0S",
755
"approval_duration": "PT1S",
756
"approved_by_default": "True",
757
"enabled": "True",
758
}
451
client_defaults = { "timeout": "PT5M",
452
"extended_timeout": "PT15M",
453
"interval": "PT2M",
454
"checker": "fping -q -- %%(host)s",
455
"host": "",
456
"approval_delay": "PT0S",
457
"approval_duration": "PT1S",
458
"approved_by_default": "True",
459
"enabled": "True",
460
}
461
462
def timeout_milliseconds(self):
463
"Return the 'timeout' attribute in milliseconds"
464
return timedelta_to_milliseconds(self.timeout)
465
466
def extended_timeout_milliseconds(self):
467
"Return the 'extended_timeout' attribute in milliseconds"
468
return timedelta_to_milliseconds(self.extended_timeout)
469
470
def interval_milliseconds(self):
471
"Return the 'interval' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.interval)
473
474
def approval_delay_milliseconds(self):
475
return timedelta_to_milliseconds(self.approval_delay)
759
476
760
477
@staticmethod
761
478
def config_parser(config):
777
494
client["enabled"] = config.getboolean(client_name,
778
495
"enabled")
779
496
780
# Uppercase and remove spaces from fingerprint for later
781
# comparison purposes with return value from the
782
# fingerprint() function
783
497
client["fingerprint"] = (section["fingerprint"].upper()
784
498
.replace(" ", ""))
785
499
if "secret" in section:
790
504
"rb") as secfile:
791
505
client["secret"] = secfile.read()
792
506
else:
793
raise TypeError("No secret or secfile for section {}"
507
raise TypeError("No secret or secfile for section {0}"
794
508
.format(section))
795
509
client["timeout"] = string_to_delta(section["timeout"])
796
510
client["extended_timeout"] = string_to_delta(
813
527
server_settings = {}
814
528
self.server_settings = server_settings
815
529
# adding all client settings
816
for setting, value in settings.items():
530
for setting, value in settings.iteritems():
817
531
setattr(self, setting, value)
818
532
819
533
if self.enabled:
827
541
self.expires = None
828
542
829
543
logger.debug("Creating client %r", self.name)
544
# Uppercase and remove spaces from fingerprint for later
545
# comparison purposes with return value from the fingerprint()
546
# function
830
547
logger.debug(" Fingerprint: %s", self.fingerprint)
831
548
self.created = settings.get("created",
832
549
datetime.datetime.utcnow())
839
556
self.current_checker_command = None
840
557
self.approved = None
841
558
self.approvals_pending = 0
842
self.changedstate = multiprocessing_manager.Condition(
843
multiprocessing_manager.Lock())
844
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
559
self.changedstate = (multiprocessing_manager
560
.Condition(multiprocessing_manager
561
.Lock()))
562
self.client_structure = [attr for attr in
563
self.__dict__.iterkeys()
846
564
if not attr.startswith("_")]
847
565
self.client_structure.append("client_structure")
848
566
849
for name, t in inspect.getmembers(
850
type(self), lambda obj: isinstance(obj, property)):
567
for name, t in inspect.getmembers(type(self),
568
lambda obj:
569
isinstance(obj,
570
property)):
851
571
if not name.startswith("_"):
852
572
self.client_structure.append(name)
853
573
895
615
# and every interval from then on.
896
616
if self.checker_initiator_tag is not None:
897
617
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
900
self.start_checker)
618
self.checker_initiator_tag = (gobject.timeout_add
619
(self.interval_milliseconds(),
620
self.start_checker))
901
621
# Schedule a disable() when 'timeout' has passed
902
622
if self.disable_initiator_tag is not None:
903
623
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
624
self.disable_initiator_tag = (gobject.timeout_add
625
(self.timeout_milliseconds(),
626
self.disable))
906
627
# Also start a new checker *right now*.
907
628
self.start_checker()
908
629
909
def checker_callback(self, source, condition, connection,
910
command):
630
def checker_callback(self, pid, condition, command):
911
631
"""The checker has completed, so take appropriate actions."""
912
632
self.checker_callback_tag = None
913
633
self.checker = None
914
# Read return code from connection (see call_pipe)
915
returncode = connection.recv()
916
connection.close()
917
918
if returncode >= 0:
919
self.last_checker_status = returncode
920
self.last_checker_signal = None
634
if os.WIFEXITED(condition):
635
self.last_checker_status = os.WEXITSTATUS(condition)
921
636
if self.last_checker_status == 0:
922
637
logger.info("Checker for %(name)s succeeded",
923
638
vars(self))
924
639
self.checked_ok()
925
640
else:
926
logger.info("Checker for %(name)s failed", vars(self))
641
logger.info("Checker for %(name)s failed",
642
vars(self))
927
643
else:
928
644
self.last_checker_status = -1
929
self.last_checker_signal = -returncode
930
645
logger.warning("Checker for %(name)s crashed?",
931
646
vars(self))
932
return False
933
647
934
648
def checked_ok(self):
935
649
"""Assert that the client has been seen, alive and well."""
936
650
self.last_checked_ok = datetime.datetime.utcnow()
937
651
self.last_checker_status = 0
938
self.last_checker_signal = None
939
652
self.bump_timeout()
940
653
941
654
def bump_timeout(self, timeout=None):
946
659
gobject.source_remove(self.disable_initiator_tag)
947
660
self.disable_initiator_tag = None
948
661
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
950
int(timeout.total_seconds() * 1000), self.disable)
662
self.disable_initiator_tag = (gobject.timeout_add
663
(timedelta_to_milliseconds
664
(timeout), self.disable))
951
665
self.expires = datetime.datetime.utcnow() + timeout
952
666
953
667
def need_approval(self):
967
681
# than 'timeout' for the client to be disabled, which is as it
968
682
# should be.
969
683
970
if self.checker is not None and not self.checker.is_alive():
971
logger.warning("Checker was not alive; joining")
972
self.checker.join()
973
self.checker = None
684
# If a checker exists, make sure it is not a zombie
685
try:
686
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
687
except (AttributeError, OSError) as error:
688
if (isinstance(error, OSError)
689
and error.errno != errno.ECHILD):
690
raise error
691
else:
692
if pid:
693
logger.warning("Checker was a zombie")
694
gobject.source_remove(self.checker_callback_tag)
695
self.checker_callback(pid, status,
696
self.current_checker_command)
974
697
# Start a new checker if needed
975
698
if self.checker is None:
976
699
# Escape attributes for the shell
977
escaped_attrs = {
978
attr: re.escape(str(getattr(self, attr)))
979
for attr in self.runtime_expansions }
700
escaped_attrs = dict(
701
(attr, re.escape(unicode(getattr(self, attr))))
702
for attr in
703
self.runtime_expansions)
980
704
try:
981
705
command = self.checker_command % escaped_attrs
982
706
except TypeError as error:
983
707
logger.error('Could not format string "%s"',
984
self.checker_command,
708
self.checker_command, exc_info=error)
709
return True # Try again later
710
self.current_checker_command = command
711
try:
712
logger.info("Starting checker %r for %s",
713
command, self.name)
714
# We don't need to redirect stdout and stderr, since
715
# in normal mode, that is already done by daemon(),
716
# and in debug mode we don't want to. (Stdin is
717
# always replaced by /dev/null.)
718
# The exception is when not debugging but nevertheless
719
# running in the foreground; use the previously
720
# created wnull.
721
popen_args = {}
722
if (not self.server_settings["debug"]
723
and self.server_settings["foreground"]):
724
popen_args.update({"stdout": wnull,
725
"stderr": wnull })
726
self.checker = subprocess.Popen(command,
727
close_fds=True,
728
shell=True, cwd="/",
729
**popen_args)
730
except OSError as error:
731
logger.error("Failed to start subprocess",
985
732
exc_info=error)
986
return True # Try again later
987
self.current_checker_command = command
988
logger.info("Starting checker %r for %s", command,
989
self.name)
990
# We don't need to redirect stdout and stderr, since
991
# in normal mode, that is already done by daemon(),
992
# and in debug mode we don't want to. (Stdin is
993
# always replaced by /dev/null.)
994
# The exception is when not debugging but nevertheless
995
# running in the foreground; use the previously
996
# created wnull.
997
popen_args = { "close_fds": True,
998
"shell": True,
999
"cwd": "/" }
1000
if (not self.server_settings["debug"]
1001
and self.server_settings["foreground"]):
1002
popen_args.update({"stdout": wnull,
1003
"stderr": wnull })
1004
pipe = multiprocessing.Pipe(duplex = False)
1005
self.checker = multiprocessing.Process(
1006
target = call_pipe,
1007
args = (pipe[1], subprocess.call, command),
1008
kwargs = popen_args)
1009
self.checker.start()
1010
self.checker_callback_tag = gobject.io_add_watch(
1011
pipe[0].fileno(), gobject.IO_IN,
1012
self.checker_callback, pipe[0], command)
733
return True
734
self.checker_callback_tag = (gobject.child_watch_add
735
(self.checker.pid,
736
self.checker_callback,
737
data=command))
738
# The checker may have completed before the gobject
739
# watch was added. Check for this.
740
try:
741
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
742
except OSError as error:
743
if error.errno == errno.ECHILD:
744
# This should never happen
745
logger.error("Child process vanished",
746
exc_info=error)
747
return True
748
raise
749
if pid:
750
gobject.source_remove(self.checker_callback_tag)
751
self.checker_callback(pid, status, command)
1013
752
# Re-run this periodically if run by gobject.timeout_add
1014
753
return True
1015
754
1021
760
if getattr(self, "checker", None) is None:
1022
761
return
1023
762
logger.debug("Stopping checker for %(name)s", vars(self))
1024
self.checker.terminate()
763
try:
764
self.checker.terminate()
765
#time.sleep(0.5)
766
#if self.checker.poll() is None:
767
# self.checker.kill()
768
except OSError as error:
769
if error.errno != errno.ESRCH: # No such process
770
raise
1025
771
self.checker = None
1026
772
1027
773
1028
def dbus_service_property(dbus_interface,
1029
signature="v",
1030
access="readwrite",
1031
byte_arrays=False):
774
def dbus_service_property(dbus_interface, signature="v",
775
access="readwrite", byte_arrays=False):
1032
776
"""Decorators for marking methods of a DBusObjectWithProperties to
1033
777
become properties on the D-Bus.
1034
778
1043
787
# "Set" method, so we fail early here:
1044
788
if byte_arrays and signature != "ay":
1045
789
raise ValueError("Byte arrays not supported for non-'ay'"
1046
" signature {!r}".format(signature))
1047
790
" signature {0!r}".format(signature))
1048
791
def decorator(func):
1049
792
func._dbus_is_property = True
1050
793
func._dbus_interface = dbus_interface
1055
798
func._dbus_name = func._dbus_name[:-14]
1056
799
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1057
800
return func
1058
1059
801
return decorator
1060
802
1061
803
1070
812
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1071
813
"false"}
1072
814
"""
1073
1074
815
def decorator(func):
1075
816
func._dbus_is_interface = True
1076
817
func._dbus_interface = dbus_interface
1077
818
func._dbus_name = dbus_interface
1078
819
return func
1079
1080
820
return decorator
1081
821
1082
822
1084
824
"""Decorator to annotate D-Bus methods, signals or properties
1085
825
Usage:
1086
826
1087
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1088
"org.freedesktop.DBus.Property."
1089
"EmitsChangedSignal": "false"})
1090
827
@dbus_service_property("org.example.Interface", signature="b",
1091
828
access="r")
829
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
830
"org.freedesktop.DBus.Property."
831
"EmitsChangedSignal": "false"})
1092
832
def Property_dbus_property(self):
1093
833
return dbus.Boolean(False)
1094
1095
See also the DBusObjectWithAnnotations class.
1096
834
"""
1097
1098
835
def decorator(func):
1099
836
func._dbus_annotations = annotations
1100
837
return func
1101
1102
838
return decorator
1103
839
1104
840
1105
841
class DBusPropertyException(dbus.exceptions.DBusException):
1106
842
"""A base class for D-Bus property-related exceptions
1107
843
"""
1108
pass
844
def __unicode__(self):
845
return unicode(str(self))
1109
846
1110
847
1111
848
class DBusPropertyAccessException(DBusPropertyException):
1120
857
pass
1121
858
1122
859
1123
class DBusObjectWithAnnotations(dbus.service.Object):
1124
"""A D-Bus object with annotations.
860
class DBusObjectWithProperties(dbus.service.Object):
861
"""A D-Bus object with properties.
1125
862
1126
Classes inheriting from this can use the dbus_annotations
1127
decorator to add annotations to methods or signals.
863
Classes inheriting from this can use the dbus_service_property
864
decorator to expose methods as D-Bus properties. It exposes the
865
standard Get(), Set(), and GetAll() methods on the D-Bus.
1128
866
"""
1129
867
1130
868
@staticmethod
1134
872
If called like _is_dbus_thing("method") it returns a function
1135
873
suitable for use as predicate to inspect.getmembers().
1136
874
"""
1137
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
875
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1138
876
False)
1139
877
1140
878
def _get_all_dbus_things(self, thing):
1141
879
"""Returns a generator of (name, attribute) pairs
1142
880
"""
1143
return ((getattr(athing.__get__(self), "_dbus_name", name),
881
return ((getattr(athing.__get__(self), "_dbus_name",
882
name),
1144
883
athing.__get__(self))
1145
884
for cls in self.__class__.__mro__
1146
885
for name, athing in
1147
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1148
1149
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1150
out_signature = "s",
1151
path_keyword = 'object_path',
1152
connection_keyword = 'connection')
1153
def Introspect(self, object_path, connection):
1154
"""Overloading of standard D-Bus method.
1155
1156
Inserts annotation tags on methods and signals.
1157
"""
1158
xmlstring = dbus.service.Object.Introspect(self, object_path,
1159
connection)
1160
try:
1161
document = xml.dom.minidom.parseString(xmlstring)
1162
1163
for if_tag in document.getElementsByTagName("interface"):
1164
# Add annotation tags
1165
for typ in ("method", "signal"):
1166
for tag in if_tag.getElementsByTagName(typ):
1167
annots = dict()
1168
for name, prop in (self.
1169
_get_all_dbus_things(typ)):
1170
if (name == tag.getAttribute("name")
1171
and prop._dbus_interface
1172
== if_tag.getAttribute("name")):
1173
annots.update(getattr(
1174
prop, "_dbus_annotations", {}))
1175
for name, value in annots.items():
1176
ann_tag = document.createElement(
1177
"annotation")
1178
ann_tag.setAttribute("name", name)
1179
ann_tag.setAttribute("value", value)
1180
tag.appendChild(ann_tag)
1181
# Add interface annotation tags
1182
for annotation, value in dict(
1183
itertools.chain.from_iterable(
1184
annotations().items()
1185
for name, annotations
1186
in self._get_all_dbus_things("interface")
1187
if name == if_tag.getAttribute("name")
1188
)).items():
1189
ann_tag = document.createElement("annotation")
1190
ann_tag.setAttribute("name", annotation)
1191
ann_tag.setAttribute("value", value)
1192
if_tag.appendChild(ann_tag)
1193
# Fix argument name for the Introspect method itself
1194
if (if_tag.getAttribute("name")
1195
== dbus.INTROSPECTABLE_IFACE):
1196
for cn in if_tag.getElementsByTagName("method"):
1197
if cn.getAttribute("name") == "Introspect":
1198
for arg in cn.getElementsByTagName("arg"):
1199
if (arg.getAttribute("direction")
1200
== "out"):
1201
arg.setAttribute("name",
1202
"xml_data")
1203
xmlstring = document.toxml("utf-8")
1204
document.unlink()
1205
except (AttributeError, xml.dom.DOMException,
1206
xml.parsers.expat.ExpatError) as error:
1207
logger.error("Failed to override Introspection method",
1208
exc_info=error)
1209
return xmlstring
1210
1211
1212
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1213
"""A D-Bus object with properties.
1214
1215
Classes inheriting from this can use the dbus_service_property
1216
decorator to expose methods as D-Bus properties. It exposes the
1217
standard Get(), Set(), and GetAll() methods on the D-Bus.
1218
"""
886
inspect.getmembers(cls,
887
self._is_dbus_thing(thing)))
1219
888
1220
889
def _get_dbus_property(self, interface_name, property_name):
1221
890
"""Returns a bound method if one exists which is a D-Bus
1222
891
property with the specified name and interface.
1223
892
"""
1224
for cls in self.__class__.__mro__:
1225
for name, value in inspect.getmembers(
1226
cls, self._is_dbus_thing("property")):
893
for cls in self.__class__.__mro__:
894
for name, value in (inspect.getmembers
895
(cls,
896
self._is_dbus_thing("property"))):
1227
897
if (value._dbus_name == property_name
1228
898
and value._dbus_interface == interface_name):
1229
899
return value.__get__(self)
1230
900
1231
901
# No such property
1232
raise DBusPropertyNotFound("{}:{}.{}".format(
1233
self.dbus_object_path, interface_name, property_name))
1234
1235
@classmethod
1236
def _get_all_interface_names(cls):
1237
"""Get a sequence of all interfaces supported by an object"""
1238
return (name for name in set(getattr(getattr(x, attr),
1239
"_dbus_interface", None)
1240
for x in (inspect.getmro(cls))
1241
for attr in dir(x))
1242
if name is not None)
1243
1244
@dbus.service.method(dbus.PROPERTIES_IFACE,
1245
in_signature="ss",
902
raise DBusPropertyNotFound(self.dbus_object_path + ":"
903
+ interface_name + "."
904
+ property_name)
905
906
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1246
907
out_signature="v")
1247
908
def Get(self, interface_name, property_name):
1248
909
"""Standard D-Bus property Get() method, see D-Bus standard.
1266
927
# The byte_arrays option is not supported yet on
1267
928
# signatures other than "ay".
1268
929
if prop._dbus_signature != "ay":
1269
raise ValueError("Byte arrays not supported for non-"
1270
"'ay' signature {!r}"
1271
.format(prop._dbus_signature))
930
raise ValueError
1272
931
value = dbus.ByteArray(b''.join(chr(byte)
1273
932
for byte in value))
1274
933
prop(value)
1275
934
1276
@dbus.service.method(dbus.PROPERTIES_IFACE,
1277
in_signature="s",
935
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1278
936
out_signature="a{sv}")
1279
937
def GetAll(self, interface_name):
1280
938
"""Standard D-Bus property GetAll() method, see D-Bus
1295
953
if not hasattr(value, "variant_level"):
1296
954
properties[name] = value
1297
955
continue
1298
properties[name] = type(value)(
1299
value, variant_level = value.variant_level + 1)
956
properties[name] = type(value)(value, variant_level=
957
value.variant_level+1)
1300
958
return dbus.Dictionary(properties, signature="sv")
1301
959
1302
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1303
def PropertiesChanged(self, interface_name, changed_properties,
1304
invalidated_properties):
1305
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1306
standard.
1307
"""
1308
pass
1309
1310
960
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1311
961
out_signature="s",
1312
962
path_keyword='object_path',
1316
966
1317
967
Inserts property tags and interface annotation tags.
1318
968
"""
1319
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1320
object_path,
1321
connection)
969
xmlstring = dbus.service.Object.Introspect(self, object_path,
970
connection)
1322
971
try:
1323
972
document = xml.dom.minidom.parseString(xmlstring)
1324
1325
973
def make_tag(document, name, prop):
1326
974
e = document.createElement("property")
1327
975
e.setAttribute("name", name)
1328
976
e.setAttribute("type", prop._dbus_signature)
1329
977
e.setAttribute("access", prop._dbus_access)
1330
978
return e
1331
1332
979
for if_tag in document.getElementsByTagName("interface"):
1333
980
# Add property tags
1334
981
for tag in (make_tag(document, name, prop)
1337
984
if prop._dbus_interface
1338
985
== if_tag.getAttribute("name")):
1339
986
if_tag.appendChild(tag)
1340
# Add annotation tags for properties
1341
for tag in if_tag.getElementsByTagName("property"):
1342
annots = dict()
1343
for name, prop in self._get_all_dbus_things(
1344
"property"):
1345
if (name == tag.getAttribute("name")
1346
and prop._dbus_interface
1347
== if_tag.getAttribute("name")):
1348
annots.update(getattr(
1349
prop, "_dbus_annotations", {}))
1350
for name, value in annots.items():
1351
ann_tag = document.createElement(
1352
"annotation")
1353
ann_tag.setAttribute("name", name)
1354
ann_tag.setAttribute("value", value)
1355
tag.appendChild(ann_tag)
987
# Add annotation tags
988
for typ in ("method", "signal", "property"):
989
for tag in if_tag.getElementsByTagName(typ):
990
annots = dict()
991
for name, prop in (self.
992
_get_all_dbus_things(typ)):
993
if (name == tag.getAttribute("name")
994
and prop._dbus_interface
995
== if_tag.getAttribute("name")):
996
annots.update(getattr
997
(prop,
998
"_dbus_annotations",
999
{}))
1000
for name, value in annots.iteritems():
1001
ann_tag = document.createElement(
1002
"annotation")
1003
ann_tag.setAttribute("name", name)
1004
ann_tag.setAttribute("value", value)
1005
tag.appendChild(ann_tag)
1006
# Add interface annotation tags
1007
for annotation, value in dict(
1008
itertools.chain.from_iterable(
1009
annotations().iteritems()
1010
for name, annotations in
1011
self._get_all_dbus_things("interface")
1012
if name == if_tag.getAttribute("name")
1013
)).iteritems():
1014
ann_tag = document.createElement("annotation")
1015
ann_tag.setAttribute("name", annotation)
1016
ann_tag.setAttribute("value", value)
1017
if_tag.appendChild(ann_tag)
1356
1018
# Add the names to the return values for the
1357
1019
# "org.freedesktop.DBus.Properties" methods
1358
1020
if (if_tag.getAttribute("name")
1376
1038
exc_info=error)
1377
1039
return xmlstring
1378
1040
1379
try:
1380
dbus.OBJECT_MANAGER_IFACE
1381
except AttributeError:
1382
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1383
1384
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
"""A D-Bus object with an ObjectManager.
1386
1387
Classes inheriting from this exposes the standard
1388
GetManagedObjects call and the InterfacesAdded and
1389
InterfacesRemoved signals on the standard
1390
"org.freedesktop.DBus.ObjectManager" interface.
1391
1392
Note: No signals are sent automatically; they must be sent
1393
manually.
1394
"""
1395
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1397
def GetManagedObjects(self):
1398
"""This function must be overridden"""
1399
raise NotImplementedError()
1400
1401
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1403
def InterfacesAdded(self, object_path, interfaces_and_properties):
1404
pass
1405
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1407
def InterfacesRemoved(self, object_path, interfaces):
1408
pass
1409
1410
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1414
def Introspect(self, object_path, connection):
1415
"""Overloading of standard D-Bus method.
1416
1417
Override return argument name of GetManagedObjects to be
1418
"objpath_interfaces_and_properties"
1419
"""
1420
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1421
object_path,
1422
connection)
1423
try:
1424
document = xml.dom.minidom.parseString(xmlstring)
1425
1426
for if_tag in document.getElementsByTagName("interface"):
1427
# Fix argument name for the GetManagedObjects method
1428
if (if_tag.getAttribute("name")
1429
== dbus.OBJECT_MANAGER_IFACE):
1430
for cn in if_tag.getElementsByTagName("method"):
1431
if (cn.getAttribute("name")
1432
== "GetManagedObjects"):
1433
for arg in cn.getElementsByTagName("arg"):
1434
if (arg.getAttribute("direction")
1435
== "out"):
1436
arg.setAttribute(
1437
"name",
1438
"objpath_interfaces"
1439
"_and_properties")
1440
xmlstring = document.toxml("utf-8")
1441
document.unlink()
1442
except (AttributeError, xml.dom.DOMException,
1443
xml.parsers.expat.ExpatError) as error:
1444
logger.error("Failed to override Introspection method",
1445
exc_info = error)
1446
return xmlstring
1447
1041
1448
1042
def datetime_to_dbus(dt, variant_level=0):
1449
1043
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1450
1044
if dt is None:
1451
1045
return dbus.String("", variant_level = variant_level)
1452
return dbus.String(dt.isoformat(), variant_level=variant_level)
1046
return dbus.String(dt.isoformat(),
1047
variant_level=variant_level)
1453
1048
1454
1049
1455
1050
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1475
1070
(from DBusObjectWithProperties) and interfaces (from the
1476
1071
dbus_interface_annotations decorator).
1477
1072
"""
1478
1479
1073
def wrapper(cls):
1480
1074
for orig_interface_name, alt_interface_name in (
1481
alt_interface_names.items()):
1075
alt_interface_names.iteritems()):
1482
1076
attr = {}
1483
1077
interface_names = set()
1484
1078
# Go though all attributes of the class
1486
1080
# Ignore non-D-Bus attributes, and D-Bus attributes
1487
1081
# with the wrong interface name
1488
1082
if (not hasattr(attribute, "_dbus_interface")
1489
or not attribute._dbus_interface.startswith(
1490
orig_interface_name)):
1083
or not attribute._dbus_interface
1084
.startswith(orig_interface_name)):
1491
1085
continue
1492
1086
# Create an alternate D-Bus interface name based on
1493
1087
# the current name
1494
alt_interface = attribute._dbus_interface.replace(
1495
orig_interface_name, alt_interface_name)
1088
alt_interface = (attribute._dbus_interface
1089
.replace(orig_interface_name,
1090
alt_interface_name))
1496
1091
interface_names.add(alt_interface)
1497
1092
# Is this a D-Bus signal?
1498
1093
if getattr(attribute, "_dbus_is_signal", False):
1499
if sys.version_info.major == 2:
1500
# Extract the original non-method undecorated
1501
# function by black magic
1502
nonmethod_func = (dict(
1094
# Extract the original non-method undecorated
1095
# function by black magic
1096
nonmethod_func = (dict(
1503
1097
zip(attribute.func_code.co_freevars,
1504
attribute.__closure__))
1505
["func"].cell_contents)
1506
else:
1507
nonmethod_func = attribute
1098
attribute.__closure__))["func"]
1099
.cell_contents)
1508
1100
# Create a new, but exactly alike, function
1509
1101
# object, and decorate it to be a new D-Bus signal
1510
1102
# with the alternate D-Bus interface name
1511
if sys.version_info.major == 2:
1512
new_function = types.FunctionType(
1513
nonmethod_func.func_code,
1514
nonmethod_func.func_globals,
1515
nonmethod_func.func_name,
1516
nonmethod_func.func_defaults,
1517
nonmethod_func.func_closure)
1518
else:
1519
new_function = types.FunctionType(
1520
nonmethod_func.__code__,
1521
nonmethod_func.__globals__,
1522
nonmethod_func.__name__,
1523
nonmethod_func.__defaults__,
1524
nonmethod_func.__closure__)
1525
new_function = (dbus.service.signal(
1526
alt_interface,
1527
attribute._dbus_signature)(new_function))
1103
new_function = (dbus.service.signal
1104
(alt_interface,
1105
attribute._dbus_signature)
1106
(types.FunctionType(
1107
nonmethod_func.func_code,
1108
nonmethod_func.func_globals,
1109
nonmethod_func.func_name,
1110
nonmethod_func.func_defaults,
1111
nonmethod_func.func_closure)))
1528
1112
# Copy annotations, if any
1529
1113
try:
1530
new_function._dbus_annotations = dict(
1531
attribute._dbus_annotations)
1114
new_function._dbus_annotations = (
1115
dict(attribute._dbus_annotations))
1532
1116
except AttributeError:
1533
1117
pass
1534
1118
# Define a creator of a function to call both the
1539
1123
"""This function is a scope container to pass
1540
1124
func1 and func2 to the "call_both" function
1541
1125
outside of its arguments"""
1542
1543
@functools.wraps(func2)
1544
1126
def call_both(*args, **kwargs):
1545
1127
"""This function will emit two D-Bus
1546
1128
signals by calling func1 and func2"""
1547
1129
func1(*args, **kwargs)
1548
1130
func2(*args, **kwargs)
1549
# Make wrapper function look like a D-Bus signal
1550
for name, attr in inspect.getmembers(func2):
1551
if name.startswith("_dbus_"):
1552
setattr(call_both, name, attr)
1553
1554
1131
return call_both
1555
1132
# Create the "call_both" function and add it to
1556
1133
# the class
1561
1138
# object. Decorate it to be a new D-Bus method
1562
1139
# with the alternate D-Bus interface name. Add it
1563
1140
# to the class.
1564
attr[attrname] = (
1565
dbus.service.method(
1566
alt_interface,
1567
attribute._dbus_in_signature,
1568
attribute._dbus_out_signature)
1569
(types.FunctionType(attribute.func_code,
1570
attribute.func_globals,
1571
attribute.func_name,
1572
attribute.func_defaults,
1573
attribute.func_closure)))
1141
attr[attrname] = (dbus.service.method
1142
(alt_interface,
1143
attribute._dbus_in_signature,
1144
attribute._dbus_out_signature)
1145
(types.FunctionType
1146
(attribute.func_code,
1147
attribute.func_globals,
1148
attribute.func_name,
1149
attribute.func_defaults,
1150
attribute.func_closure)))
1574
1151
# Copy annotations, if any
1575
1152
try:
1576
attr[attrname]._dbus_annotations = dict(
1577
attribute._dbus_annotations)
1153
attr[attrname]._dbus_annotations = (
1154
dict(attribute._dbus_annotations))
1578
1155
except AttributeError:
1579
1156
pass
1580
1157
# Is this a D-Bus property?
1583
1160
# object, and decorate it to be a new D-Bus
1584
1161
# property with the alternate D-Bus interface
1585
1162
# name. Add it to the class.
1586
attr[attrname] = (dbus_service_property(
1587
alt_interface, attribute._dbus_signature,
1588
attribute._dbus_access,
1589
attribute._dbus_get_args_options
1590
["byte_arrays"])
1591
(types.FunctionType(
1592
attribute.func_code,
1593
attribute.func_globals,
1594
attribute.func_name,
1595
attribute.func_defaults,
1596
attribute.func_closure)))
1163
attr[attrname] = (dbus_service_property
1164
(alt_interface,
1165
attribute._dbus_signature,
1166
attribute._dbus_access,
1167
attribute
1168
._dbus_get_args_options
1169
["byte_arrays"])
1170
(types.FunctionType
1171
(attribute.func_code,
1172
attribute.func_globals,
1173
attribute.func_name,
1174
attribute.func_defaults,
1175
attribute.func_closure)))
1597
1176
# Copy annotations, if any
1598
1177
try:
1599
attr[attrname]._dbus_annotations = dict(
1600
attribute._dbus_annotations)
1178
attr[attrname]._dbus_annotations = (
1179
dict(attribute._dbus_annotations))
1601
1180
except AttributeError:
1602
1181
pass
1603
1182
# Is this a D-Bus interface?
1606
1185
# object. Decorate it to be a new D-Bus interface
1607
1186
# with the alternate D-Bus interface name. Add it
1608
1187
# to the class.
1609
attr[attrname] = (
1610
dbus_interface_annotations(alt_interface)
1611
(types.FunctionType(attribute.func_code,
1612
attribute.func_globals,
1613
attribute.func_name,
1614
attribute.func_defaults,
1615
attribute.func_closure)))
1188
attr[attrname] = (dbus_interface_annotations
1189
(alt_interface)
1190
(types.FunctionType
1191
(attribute.func_code,
1192
attribute.func_globals,
1193
attribute.func_name,
1194
attribute.func_defaults,
1195
attribute.func_closure)))
1616
1196
if deprecate:
1617
1197
# Deprecate all alternate interfaces
1618
iname="_AlternateDBusNames_interface_annotation{}"
1198
iname="_AlternateDBusNames_interface_annotation{0}"
1619
1199
for interface_name in interface_names:
1620
1621
1200
@dbus_interface_annotations(interface_name)
1622
1201
def func(self):
1623
1202
return { "org.freedesktop.DBus.Deprecated":
1624
"true" }
1203
"true" }
1625
1204
# Find an unused name
1626
1205
for aname in (iname.format(i)
1627
1206
for i in itertools.count()):
1631
1210
if interface_names:
1632
1211
# Replace the class with a new subclass of it with
1633
1212
# methods, signals, etc. as created above.
1634
cls = type(b"{}Alternate".format(cls.__name__),
1635
(cls, ), attr)
1213
cls = type(b"{0}Alternate".format(cls.__name__),
1214
(cls,), attr)
1636
1215
return cls
1637
1638
1216
return wrapper
1639
1217
1640
1218
1641
1219
@alternate_dbus_interfaces({"se.recompile.Mandos":
1642
"se.bsnet.fukt.Mandos"})
1220
"se.bsnet.fukt.Mandos"})
1643
1221
class ClientDBus(Client, DBusObjectWithProperties):
1644
1222
"""A Client class using D-Bus
1645
1223
1649
1227
"""
1650
1228
1651
1229
runtime_expansions = (Client.runtime_expansions
1652
+ ("dbus_object_path", ))
1653
1654
_interface = "se.recompile.Mandos.Client"
1230
+ ("dbus_object_path",))
1655
1231
1656
1232
# dbus.service.Object doesn't use super(), so we can't either.
1657
1233
1660
1236
Client.__init__(self, *args, **kwargs)
1661
1237
# Only now, when this client is initialized, can it show up on
1662
1238
# the D-Bus
1663
client_object_name = str(self.name).translate(
1239
client_object_name = unicode(self.name).translate(
1664
1240
{ord("."): ord("_"),
1665
1241
ord("-"): ord("_")})
1666
self.dbus_object_path = dbus.ObjectPath(
1667
"/clients/" + client_object_name)
1242
self.dbus_object_path = (dbus.ObjectPath
1243
("/clients/" + client_object_name))
1668
1244
DBusObjectWithProperties.__init__(self, self.bus,
1669
1245
self.dbus_object_path)
1670
1246
1671
def notifychangeproperty(transform_func, dbus_name,
1672
type_func=lambda x: x,
1673
variant_level=1,
1674
invalidate_only=False,
1675
_interface=_interface):
1247
def notifychangeproperty(transform_func,
1248
dbus_name, type_func=lambda x: x,
1249
variant_level=1):
1676
1250
""" Modify a variable so that it's a property which announces
1677
1251
its changes to DBus.
1678
1252
1683
1257
to the D-Bus. Default: no transform
1684
1258
variant_level: D-Bus variant level. Default: 1
1685
1259
"""
1686
attrname = "_{}".format(dbus_name)
1687
1260
attrname = "_{0}".format(dbus_name)
1688
1261
def setter(self, value):
1689
1262
if hasattr(self, "dbus_object_path"):
1690
1263
if (not hasattr(self, attrname) or
1691
1264
type_func(getattr(self, attrname, None))
1692
1265
!= type_func(value)):
1693
if invalidate_only:
1694
self.PropertiesChanged(
1695
_interface, dbus.Dictionary(),
1696
dbus.Array((dbus_name, )))
1697
else:
1698
dbus_value = transform_func(
1699
type_func(value),
1700
variant_level = variant_level)
1701
self.PropertyChanged(dbus.String(dbus_name),
1702
dbus_value)
1703
self.PropertiesChanged(
1704
_interface,
1705
dbus.Dictionary({ dbus.String(dbus_name):
1706
dbus_value }),
1707
dbus.Array())
1266
dbus_value = transform_func(type_func(value),
1267
variant_level
1268
=variant_level)
1269
self.PropertyChanged(dbus.String(dbus_name),
1270
dbus_value)
1708
1271
setattr(self, attrname, value)
1709
1272
1710
1273
return property(lambda self: getattr(self, attrname), setter)
1716
1279
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1717
1280
last_enabled = notifychangeproperty(datetime_to_dbus,
1718
1281
"LastEnabled")
1719
checker = notifychangeproperty(
1720
dbus.Boolean, "CheckerRunning",
1721
type_func = lambda checker: checker is not None)
1282
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1283
type_func = lambda checker:
1284
checker is not None)
1722
1285
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1723
1286
"LastCheckedOK")
1724
1287
last_checker_status = notifychangeproperty(dbus.Int16,
1727
1290
datetime_to_dbus, "LastApprovalRequest")
1728
1291
approved_by_default = notifychangeproperty(dbus.Boolean,
1729
1292
"ApprovedByDefault")
1730
approval_delay = notifychangeproperty(
1731
dbus.UInt64, "ApprovalDelay",
1732
type_func = lambda td: td.total_seconds() * 1000)
1293
approval_delay = notifychangeproperty(dbus.UInt64,
1294
"ApprovalDelay",
1295
type_func =
1296
timedelta_to_milliseconds)
1733
1297
approval_duration = notifychangeproperty(
1734
1298
dbus.UInt64, "ApprovalDuration",
1735
type_func = lambda td: td.total_seconds() * 1000)
1299
type_func = timedelta_to_milliseconds)
1736
1300
host = notifychangeproperty(dbus.String, "Host")
1737
timeout = notifychangeproperty(
1738
dbus.UInt64, "Timeout",
1739
type_func = lambda td: td.total_seconds() * 1000)
1301
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1302
type_func =
1303
timedelta_to_milliseconds)
1740
1304
extended_timeout = notifychangeproperty(
1741
1305
dbus.UInt64, "ExtendedTimeout",
1742
type_func = lambda td: td.total_seconds() * 1000)
1743
interval = notifychangeproperty(
1744
dbus.UInt64, "Interval",
1745
type_func = lambda td: td.total_seconds() * 1000)
1306
type_func = timedelta_to_milliseconds)
1307
interval = notifychangeproperty(dbus.UInt64,
1308
"Interval",
1309
type_func =
1310
timedelta_to_milliseconds)
1746
1311
checker_command = notifychangeproperty(dbus.String, "Checker")
1747
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1748
invalidate_only=True)
1749
1312
1750
1313
del notifychangeproperty
1751
1314
1758
1321
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1759
1322
Client.__del__(self, *args, **kwargs)
1760
1323
1761
def checker_callback(self, source, condition,
1762
connection, command, *args, **kwargs):
1763
ret = Client.checker_callback(self, source, condition,
1764
connection, command, *args,
1765
**kwargs)
1766
exitstatus = self.last_checker_status
1767
if exitstatus >= 0:
1324
def checker_callback(self, pid, condition, command,
1325
*args, **kwargs):
1326
self.checker_callback_tag = None
1327
self.checker = None
1328
if os.WIFEXITED(condition):
1329
exitstatus = os.WEXITSTATUS(condition)
1768
1330
# Emit D-Bus signal
1769
1331
self.CheckerCompleted(dbus.Int16(exitstatus),
1770
# This is specific to GNU libC
1771
dbus.Int64(exitstatus << 8),
1332
dbus.Int64(condition),
1772
1333
dbus.String(command))
1773
1334
else:
1774
1335
# Emit D-Bus signal
1775
1336
self.CheckerCompleted(dbus.Int16(-1),
1776
dbus.Int64(
1777
# This is specific to GNU libC
1778
(exitstatus << 8)
1779
| self.last_checker_signal),
1337
dbus.Int64(condition),
1780
1338
dbus.String(command))
1781
return ret
1339
1340
return Client.checker_callback(self, pid, condition, command,
1341
*args, **kwargs)
1782
1342
1783
1343
def start_checker(self, *args, **kwargs):
1784
old_checker_pid = getattr(self.checker, "pid", None)
1344
old_checker = self.checker
1345
if self.checker is not None:
1346
old_checker_pid = self.checker.pid
1347
else:
1348
old_checker_pid = None
1785
1349
r = Client.start_checker(self, *args, **kwargs)
1786
1350
# Only if new checker process was started
1787
1351
if (self.checker is not None
1796
1360
1797
1361
def approve(self, value=True):
1798
1362
self.approved = value
1799
gobject.timeout_add(int(self.approval_duration.total_seconds()
1800
* 1000), self._reset_approved)
1363
gobject.timeout_add(timedelta_to_milliseconds
1364
(self.approval_duration),
1365
self._reset_approved)
1801
1366
self.send_changedstate()
1802
1367
1803
1368
## D-Bus methods, signals & properties
1369
_interface = "se.recompile.Mandos.Client"
1804
1370
1805
1371
## Interfaces
1806
1372
1373
@dbus_interface_annotations(_interface)
1374
def _foo(self):
1375
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1376
"false"}
1377
1807
1378
## Signals
1808
1379
1809
1380
# CheckerCompleted - signal
1819
1390
pass
1820
1391
1821
1392
# PropertyChanged - signal
1822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1823
1393
@dbus.service.signal(_interface, signature="sv")
1824
1394
def PropertyChanged(self, property, value):
1825
1395
"D-Bus signal"
1859
1429
self.checked_ok()
1860
1430
1861
1431
# Enable - method
1862
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1863
1432
@dbus.service.method(_interface)
1864
1433
def Enable(self):
1865
1434
"D-Bus method"
1866
1435
self.enable()
1867
1436
1868
1437
# StartChecker - method
1869
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1870
1438
@dbus.service.method(_interface)
1871
1439
def StartChecker(self):
1872
1440
"D-Bus method"
1873
1441
self.start_checker()
1874
1442
1875
1443
# Disable - method
1876
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1877
1444
@dbus.service.method(_interface)
1878
1445
def Disable(self):
1879
1446
"D-Bus method"
1880
1447
self.disable()
1881
1448
1882
1449
# StopChecker - method
1883
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1884
1450
@dbus.service.method(_interface)
1885
1451
def StopChecker(self):
1886
1452
self.stop_checker()
1893
1459
return dbus.Boolean(bool(self.approvals_pending))
1894
1460
1895
1461
# ApprovedByDefault - property
1896
@dbus_service_property(_interface,
1897
signature="b",
1462
@dbus_service_property(_interface, signature="b",
1898
1463
access="readwrite")
1899
1464
def ApprovedByDefault_dbus_property(self, value=None):
1900
1465
if value is None: # get
1902
1467
self.approved_by_default = bool(value)
1903
1468
1904
1469
# ApprovalDelay - property
1905
@dbus_service_property(_interface,
1906
signature="t",
1470
@dbus_service_property(_interface, signature="t",
1907
1471
access="readwrite")
1908
1472
def ApprovalDelay_dbus_property(self, value=None):
1909
1473
if value is None: # get
1910
return dbus.UInt64(self.approval_delay.total_seconds()
1911
* 1000)
1474
return dbus.UInt64(self.approval_delay_milliseconds())
1912
1475
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1913
1476
1914
1477
# ApprovalDuration - property
1915
@dbus_service_property(_interface,
1916
signature="t",
1478
@dbus_service_property(_interface, signature="t",
1917
1479
access="readwrite")
1918
1480
def ApprovalDuration_dbus_property(self, value=None):
1919
1481
if value is None: # get
1920
return dbus.UInt64(self.approval_duration.total_seconds()
1921
* 1000)
1482
return dbus.UInt64(timedelta_to_milliseconds(
1483
self.approval_duration))
1922
1484
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1923
1485
1924
1486
# Name - property
1925
@dbus_annotations(
1926
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1927
1487
@dbus_service_property(_interface, signature="s", access="read")
1928
1488
def Name_dbus_property(self):
1929
1489
return dbus.String(self.name)
1930
1490
1931
1491
# Fingerprint - property
1932
@dbus_annotations(
1933
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1934
1492
@dbus_service_property(_interface, signature="s", access="read")
1935
1493
def Fingerprint_dbus_property(self):
1936
1494
return dbus.String(self.fingerprint)
1937
1495
1938
1496
# Host - property
1939
@dbus_service_property(_interface,
1940
signature="s",
1497
@dbus_service_property(_interface, signature="s",
1941
1498
access="readwrite")
1942
1499
def Host_dbus_property(self, value=None):
1943
1500
if value is None: # get
1944
1501
return dbus.String(self.host)
1945
self.host = str(value)
1502
self.host = unicode(value)
1946
1503
1947
1504
# Created - property
1948
@dbus_annotations(
1949
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1950
1505
@dbus_service_property(_interface, signature="s", access="read")
1951
1506
def Created_dbus_property(self):
1952
1507
return datetime_to_dbus(self.created)
1957
1512
return datetime_to_dbus(self.last_enabled)
1958
1513
1959
1514
# Enabled - property
1960
@dbus_service_property(_interface,
1961
signature="b",
1515
@dbus_service_property(_interface, signature="b",
1962
1516
access="readwrite")
1963
1517
def Enabled_dbus_property(self, value=None):
1964
1518
if value is None: # get
1969
1523
self.disable()
1970
1524
1971
1525
# LastCheckedOK - property
1972
@dbus_service_property(_interface,
1973
signature="s",
1526
@dbus_service_property(_interface, signature="s",
1974
1527
access="readwrite")
1975
1528
def LastCheckedOK_dbus_property(self, value=None):
1976
1529
if value is not None:
1979
1532
return datetime_to_dbus(self.last_checked_ok)
1980
1533
1981
1534
# LastCheckerStatus - property
1982
@dbus_service_property(_interface, signature="n", access="read")
1535
@dbus_service_property(_interface, signature="n",
1536
access="read")
1983
1537
def LastCheckerStatus_dbus_property(self):
1984
1538
return dbus.Int16(self.last_checker_status)
1985
1539
1994
1548
return datetime_to_dbus(self.last_approval_request)
1995
1549
1996
1550
# Timeout - property
1997
@dbus_service_property(_interface,
1998
signature="t",
1551
@dbus_service_property(_interface, signature="t",
1999
1552
access="readwrite")
2000
1553
def Timeout_dbus_property(self, value=None):
2001
1554
if value is None: # get
2002
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1555
return dbus.UInt64(self.timeout_milliseconds())
2003
1556
old_timeout = self.timeout
2004
1557
self.timeout = datetime.timedelta(0, 0, 0, value)
2005
1558
# Reschedule disabling
2014
1567
is None):
2015
1568
return
2016
1569
gobject.source_remove(self.disable_initiator_tag)
2017
self.disable_initiator_tag = gobject.timeout_add(
2018
int((self.expires - now).total_seconds() * 1000),
2019
self.disable)
1570
self.disable_initiator_tag = (
1571
gobject.timeout_add(
1572
timedelta_to_milliseconds(self.expires - now),
1573
self.disable))
2020
1574
2021
1575
# ExtendedTimeout - property
2022
@dbus_service_property(_interface,
2023
signature="t",
1576
@dbus_service_property(_interface, signature="t",
2024
1577
access="readwrite")
2025
1578
def ExtendedTimeout_dbus_property(self, value=None):
2026
1579
if value is None: # get
2027
return dbus.UInt64(self.extended_timeout.total_seconds()
2028
* 1000)
1580
return dbus.UInt64(self.extended_timeout_milliseconds())
2029
1581
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2030
1582
2031
1583
# Interval - property
2032
@dbus_service_property(_interface,
2033
signature="t",
1584
@dbus_service_property(_interface, signature="t",
2034
1585
access="readwrite")
2035
1586
def Interval_dbus_property(self, value=None):
2036
1587
if value is None: # get
2037
return dbus.UInt64(self.interval.total_seconds() * 1000)
1588
return dbus.UInt64(self.interval_milliseconds())
2038
1589
self.interval = datetime.timedelta(0, 0, 0, value)
2039
1590
if getattr(self, "checker_initiator_tag", None) is None:
2040
1591
return
2041
1592
if self.enabled:
2042
1593
# Reschedule checker run
2043
1594
gobject.source_remove(self.checker_initiator_tag)
2044
self.checker_initiator_tag = gobject.timeout_add(
2045
value, self.start_checker)
2046
self.start_checker() # Start one now, too
1595
self.checker_initiator_tag = (gobject.timeout_add
1596
(value, self.start_checker))
1597
self.start_checker() # Start one now, too
2047
1598
2048
1599
# Checker - property
2049
@dbus_service_property(_interface,
2050
signature="s",
1600
@dbus_service_property(_interface, signature="s",
2051
1601
access="readwrite")
2052
1602
def Checker_dbus_property(self, value=None):
2053
1603
if value is None: # get
2054
1604
return dbus.String(self.checker_command)
2055
self.checker_command = str(value)
1605
self.checker_command = unicode(value)
2056
1606
2057
1607
# CheckerRunning - property
2058
@dbus_service_property(_interface,
2059
signature="b",
1608
@dbus_service_property(_interface, signature="b",
2060
1609
access="readwrite")
2061
1610
def CheckerRunning_dbus_property(self, value=None):
2062
1611
if value is None: # get
2067
1616
self.stop_checker()
2068
1617
2069
1618
# ObjectPath - property
2070
@dbus_annotations(
2071
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2072
"org.freedesktop.DBus.Deprecated": "true"})
2073
1619
@dbus_service_property(_interface, signature="o", access="read")
2074
1620
def ObjectPath_dbus_property(self):
2075
1621
return self.dbus_object_path # is already a dbus.ObjectPath
2076
1622
2077
1623
# Secret = property
2078
@dbus_annotations(
2079
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2080
"invalidates"})
2081
@dbus_service_property(_interface,
2082
signature="ay",
2083
access="write",
2084
byte_arrays=True)
1624
@dbus_service_property(_interface, signature="ay",
1625
access="write", byte_arrays=True)
2085
1626
def Secret_dbus_property(self, value):
2086
self.secret = bytes(value)
1627
self.secret = str(value)
2087
1628
2088
1629
del _interface
2089
1630
2093
1634
self._pipe = child_pipe
2094
1635
self._pipe.send(('init', fpr, address))
2095
1636
if not self._pipe.recv():
2096
raise KeyError(fpr)
1637
raise KeyError()
2097
1638
2098
1639
def __getattribute__(self, name):
2099
1640
if name == '_pipe':
2103
1644
if data[0] == 'data':
2104
1645
return data[1]
2105
1646
if data[0] == 'function':
2106
2107
1647
def func(*args, **kwargs):
2108
1648
self._pipe.send(('funcall', name, args, kwargs))
2109
1649
return self._pipe.recv()[1]
2110
2111
1650
return func
2112
1651
2113
1652
def __setattr__(self, name, value):
2125
1664
def handle(self):
2126
1665
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
1666
logger.info("TCP connection from: %s",
2128
str(self.client_address))
1667
unicode(self.client_address))
2129
1668
logger.debug("Pipe FD: %d",
2130
1669
self.server.child_pipe.fileno())
2131
1670
2132
session = gnutls.ClientSession(self.request)
1671
session = (gnutls.connection
1672
.ClientSession(self.request,
1673
gnutls.connection
1674
.X509Credentials()))
1675
1676
# Note: gnutls.connection.X509Credentials is really a
1677
# generic GnuTLS certificate credentials object so long as
1678
# no X.509 keys are added to it. Therefore, we can use it
1679
# here despite using OpenPGP certificates.
2133
1680
2134
1681
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
1682
# "+AES-256-CBC", "+SHA1",
2139
1686
priority = self.server.gnutls_priority
2140
1687
if priority is None:
2141
1688
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2143
None)
1689
(gnutls.library.functions
1690
.gnutls_priority_set_direct(session._c_object,
1691
priority, None))
2144
1692
2145
1693
# Start communication using the Mandos protocol
2146
1694
# Get protocol number
2148
1696
logger.debug("Protocol version: %r", line)
2149
1697
try:
2150
1698
if int(line.strip().split()[0]) > 1:
2151
raise RuntimeError(line)
1699
raise RuntimeError
2152
1700
except (ValueError, IndexError, RuntimeError) as error:
2153
1701
logger.error("Unknown protocol version: %s", error)
2154
1702
return
2156
1704
# Start GnuTLS connection
2157
1705
try:
2158
1706
session.handshake()
2159
except gnutls.Error as error:
1707
except gnutls.errors.GNUTLSError as error:
2160
1708
logger.warning("Handshake failed: %s", error)
2161
1709
# Do not run session.bye() here: the session is not
2162
1710
# established. Just abandon the request.
2166
1714
approval_required = False
2167
1715
try:
2168
1716
try:
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
1717
fpr = self.fingerprint(self.peer_certificate
1718
(session))
1719
except (TypeError,
1720
gnutls.errors.GNUTLSError) as error:
2172
1721
logger.warning("Bad certificate: %s", error)
2173
1722
return
2174
1723
logger.debug("Fingerprint: %s", fpr)
2187
1736
while True:
2188
1737
if not client.enabled:
2189
1738
logger.info("Client %s is disabled",
2190
client.name)
1739
client.name)
2191
1740
if self.server.use_dbus:
2192
1741
# Emit D-Bus signal
2193
1742
client.Rejected("Disabled")
2202
1751
if self.server.use_dbus:
2203
1752
# Emit D-Bus signal
2204
1753
client.NeedApproval(
2205
client.approval_delay.total_seconds()
2206
* 1000, client.approved_by_default)
1754
client.approval_delay_milliseconds(),
1755
client.approved_by_default)
2207
1756
else:
2208
1757
logger.warning("Client %s was not approved",
2209
1758
client.name)
2215
1764
#wait until timeout or approved
2216
1765
time = datetime.datetime.now()
2217
1766
client.changedstate.acquire()
2218
client.changedstate.wait(delay.total_seconds())
1767
client.changedstate.wait(
1768
float(timedelta_to_milliseconds(delay)
1769
/ 1000))
2219
1770
client.changedstate.release()
2220
1771
time2 = datetime.datetime.now()
2221
1772
if (time2 - time) >= delay:
2232
1783
else:
2233
1784
delay -= time2 - time
2234
1785
2235
try:
2236
session.send(client.secret)
2237
except gnutls.Error as error:
2238
logger.warning("gnutls send failed",
2239
exc_info = error)
2240
return
1786
sent_size = 0
1787
while sent_size < len(client.secret):
1788
try:
1789
sent = session.send(client.secret[sent_size:])
1790
except gnutls.errors.GNUTLSError as error:
1791
logger.warning("gnutls send failed",
1792
exc_info=error)
1793
return
1794
logger.debug("Sent: %d, remaining: %d",
1795
sent, len(client.secret)
1796
- (sent_size + sent))
1797
sent_size += sent
2241
1798
2242
1799
logger.info("Sending secret to %s", client.name)
2243
1800
# bump the timeout using extended_timeout
2251
1808
client.approvals_pending -= 1
2252
1809
try:
2253
1810
session.bye()
2254
except gnutls.Error as error:
1811
except gnutls.errors.GNUTLSError as error:
2255
1812
logger.warning("GnuTLS bye failed",
2256
1813
exc_info=error)
2257
1814
2259
1816
def peer_certificate(session):
2260
1817
"Return the peer's OpenPGP certificate as a bytestring"
2261
1818
# If not an OpenPGP certificate...
2262
if (gnutls.certificate_type_get(session._c_object)
2263
!= gnutls.CRT_OPENPGP):
2264
# ...return invalid data
2265
return b""
1819
if (gnutls.library.functions
1820
.gnutls_certificate_type_get(session._c_object)
1821
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1822
# ...do the normal thing
1823
return session.peer_certificate
2266
1824
list_size = ctypes.c_uint(1)
2267
cert_list = (gnutls.certificate_get_peers
1825
cert_list = (gnutls.library.functions
1826
.gnutls_certificate_get_peers
2268
1827
(session._c_object, ctypes.byref(list_size)))
2269
1828
if not bool(cert_list) and list_size.value != 0:
2270
raise gnutls.Error("error getting peer certificate")
1829
raise gnutls.errors.GNUTLSError("error getting peer"
1830
" certificate")
2271
1831
if list_size.value == 0:
2272
1832
return None
2273
1833
cert = cert_list[0]
2277
1837
def fingerprint(openpgp):
2278
1838
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2279
1839
# New GnuTLS "datum" with the OpenPGP public key
2280
datum = gnutls.datum_t(
2281
ctypes.cast(ctypes.c_char_p(openpgp),
2282
ctypes.POINTER(ctypes.c_ubyte)),
2283
ctypes.c_uint(len(openpgp)))
1840
datum = (gnutls.library.types
1841
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1842
ctypes.POINTER
1843
(ctypes.c_ubyte)),
1844
ctypes.c_uint(len(openpgp))))
2284
1845
# New empty GnuTLS certificate
2285
crt = gnutls.openpgp_crt_t()
2286
gnutls.openpgp_crt_init(ctypes.byref(crt))
1846
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1847
(gnutls.library.functions
1848
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2287
1849
# Import the OpenPGP public key into the certificate
2288
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2289
gnutls.OPENPGP_FMT_RAW)
1850
(gnutls.library.functions
1851
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1852
gnutls.library.constants
1853
.GNUTLS_OPENPGP_FMT_RAW))
2290
1854
# Verify the self signature in the key
2291
1855
crtverify = ctypes.c_uint()
2292
gnutls.openpgp_crt_verify_self(crt, 0,
2293
ctypes.byref(crtverify))
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_verify_self(crt, 0,
1858
ctypes.byref(crtverify)))
2294
1859
if crtverify.value != 0:
2295
gnutls.openpgp_crt_deinit(crt)
2296
raise gnutls.CertificateSecurityError("Verify failed")
1860
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1861
raise (gnutls.errors.CertificateSecurityError
1862
("Verify failed"))
2297
1863
# New buffer for the fingerprint
2298
1864
buf = ctypes.create_string_buffer(20)
2299
1865
buf_len = ctypes.c_size_t()
2300
1866
# Get the fingerprint from the certificate into the buffer
2301
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2302
ctypes.byref(buf_len))
1867
(gnutls.library.functions
1868
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1869
ctypes.byref(buf_len)))
2303
1870
# Deinit the certificate
2304
gnutls.openpgp_crt_deinit(crt)
1871
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2305
1872
# Convert the buffer to a Python bytestring
2306
1873
fpr = ctypes.string_at(buf, buf_len.value)
2307
1874
# Convert the bytestring to hexadecimal notation
2311
1878
2312
1879
class MultiprocessingMixIn(object):
2313
1880
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2314
2315
1881
def sub_process_main(self, request, address):
2316
1882
try:
2317
1883
self.finish_request(request, address)
2329
1895
2330
1896
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2331
1897
""" adds a pipe to the MixIn """
2332
2333
1898
def process_request(self, request, client_address):
2334
1899
"""Overrides and wraps the original process_request().
2335
1900
2344
1909
2345
1910
def add_pipe(self, parent_pipe, proc):
2346
1911
"""Dummy function; override as necessary"""
2347
raise NotImplementedError()
1912
raise NotImplementedError
2348
1913
2349
1914
2350
1915
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2356
1921
interface: None or a network interface name (string)
2357
1922
use_ipv6: Boolean; to use IPv6 or not
2358
1923
"""
2359
2360
1924
def __init__(self, server_address, RequestHandlerClass,
2361
interface=None,
2362
use_ipv6=True,
2363
socketfd=None):
1925
interface=None, use_ipv6=True, socketfd=None):
2364
1926
"""If socketfd is set, use that file descriptor instead of
2365
1927
creating a new one with socket.socket().
2366
1928
"""
2407
1969
self.interface)
2408
1970
else:
2409
1971
try:
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
1972
self.socket.setsockopt(socket.SOL_SOCKET,
1973
SO_BINDTODEVICE,
1974
str(self.interface + '\0'))
2413
1975
except socket.error as error:
2414
1976
if error.errno == errno.EPERM:
2415
1977
logger.error("No permission to bind to"
2433
1995
self.server_address = (any_address,
2434
1996
self.server_address[1])
2435
1997
elif not self.server_address[1]:
2436
self.server_address = (self.server_address[0], 0)
1998
self.server_address = (self.server_address[0],
1999
0)
2437
2000
# if self.interface:
2438
2001
# self.server_address = (self.server_address[0],
2439
2002
# 0, # port
2453
2016
2454
2017
Assumes a gobject.MainLoop event loop.
2455
2018
"""
2456
2457
2019
def __init__(self, server_address, RequestHandlerClass,
2458
interface=None,
2459
use_ipv6=True,
2460
clients=None,
2461
gnutls_priority=None,
2462
use_dbus=True,
2463
socketfd=None):
2020
interface=None, use_ipv6=True, clients=None,
2021
gnutls_priority=None, use_dbus=True, socketfd=None):
2464
2022
self.enabled = False
2465
2023
self.clients = clients
2466
2024
if self.clients is None:
2472
2030
interface = interface,
2473
2031
use_ipv6 = use_ipv6,
2474
2032
socketfd = socketfd)
2475
2476
2033
def server_activate(self):
2477
2034
if self.enabled:
2478
2035
return socketserver.TCPServer.server_activate(self)
2482
2039
2483
2040
def add_pipe(self, parent_pipe, proc):
2484
2041
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2488
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2490
proc = proc))
2042
gobject.io_add_watch(parent_pipe.fileno(),
2043
gobject.IO_IN | gobject.IO_HUP,
2044
functools.partial(self.handle_ipc,
2045
parent_pipe =
2046
parent_pipe,
2047
proc = proc))
2491
2048
2492
def handle_ipc(self, source, condition,
2493
parent_pipe=None,
2494
proc = None,
2495
client_object=None):
2049
def handle_ipc(self, source, condition, parent_pipe=None,
2050
proc = None, client_object=None):
2496
2051
# error, or the other end of multiprocessing.Pipe has closed
2497
2052
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2498
2053
# Wait for other process to exit
2521
2076
parent_pipe.send(False)
2522
2077
return False
2523
2078
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2527
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2529
proc = proc,
2530
client_object = client))
2079
gobject.io_add_watch(parent_pipe.fileno(),
2080
gobject.IO_IN | gobject.IO_HUP,
2081
functools.partial(self.handle_ipc,
2082
parent_pipe =
2083
parent_pipe,
2084
proc = proc,
2085
client_object =
2086
client))
2531
2087
parent_pipe.send(True)
2532
2088
# remove the old hook in favor of the new above hook on
2533
2089
# same fileno
2539
2095
2540
2096
parent_pipe.send(('data', getattr(client_object,
2541
2097
funcname)(*args,
2542
**kwargs)))
2098
**kwargs)))
2543
2099
2544
2100
if command == 'getattr':
2545
2101
attrname = request[1]
2546
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
2102
if callable(client_object.__getattribute__(attrname)):
2103
parent_pipe.send(('function',))
2549
2104
else:
2550
parent_pipe.send((
2551
'data', client_object.__getattribute__(attrname)))
2105
parent_pipe.send(('data', client_object
2106
.__getattribute__(attrname)))
2552
2107
2553
2108
if command == 'setattr':
2554
2109
attrname = request[1]
2585
2140
# avoid excessive use of external libraries.
2586
2141
2587
2142
# New type for defining tokens, syntax, and semantics all-in-one
2588
Token = collections.namedtuple("Token", (
2589
"regexp", # To match token; if "value" is not None, must have
2590
# a "group" containing digits
2591
"value", # datetime.timedelta or None
2592
"followers")) # Tokens valid after this token
2143
Token = collections.namedtuple("Token",
2144
("regexp", # To match token; if
2145
# "value" is not None,
2146
# must have a "group"
2147
# containing digits
2148
"value", # datetime.timedelta or
2149
# None
2150
"followers")) # Tokens valid after
2151
# this token
2593
2152
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2594
2153
# the "duration" ABNF definition in RFC 3339, Appendix A.
2595
2154
token_end = Token(re.compile(r"$"), None, frozenset())
2596
2155
token_second = Token(re.compile(r"(\d+)S"),
2597
2156
datetime.timedelta(seconds=1),
2598
frozenset((token_end, )))
2157
frozenset((token_end,)))
2599
2158
token_minute = Token(re.compile(r"(\d+)M"),
2600
2159
datetime.timedelta(minutes=1),
2601
2160
frozenset((token_second, token_end)))
2617
2176
frozenset((token_month, token_end)))
2618
2177
token_week = Token(re.compile(r"(\d+)W"),
2619
2178
datetime.timedelta(weeks=1),
2620
frozenset((token_end, )))
2179
frozenset((token_end,)))
2621
2180
token_duration = Token(re.compile(r"P"), None,
2622
2181
frozenset((token_year, token_month,
2623
2182
token_day, token_time,
2624
token_week)))
2183
token_week))),
2625
2184
# Define starting values
2626
2185
value = datetime.timedelta() # Value so far
2627
2186
found_token = None
2628
followers = frozenset((token_duration, )) # Following valid tokens
2187
followers = frozenset(token_duration,) # Following valid tokens
2629
2188
s = duration # String left to parse
2630
2189
# Loop until end token is found
2631
2190
while found_token is not token_end:
2648
2207
break
2649
2208
else:
2650
2209
# No currently valid tokens were found
2651
raise ValueError("Invalid RFC 3339 duration: {!r}"
2652
.format(duration))
2210
raise ValueError("Invalid RFC 3339 duration")
2653
2211
# End token found
2654
2212
return value
2655
2213
2679
2237
timevalue = datetime.timedelta(0)
2680
2238
for s in interval.split():
2681
2239
try:
2682
suffix = s[-1]
2240
suffix = unicode(s[-1])
2683
2241
value = int(s[:-1])
2684
2242
if suffix == "d":
2685
2243
delta = datetime.timedelta(value)
2692
2250
elif suffix == "w":
2693
2251
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2694
2252
else:
2695
raise ValueError("Unknown suffix {!r}".format(suffix))
2696
except IndexError as e:
2253
raise ValueError("Unknown suffix {0!r}"
2254
.format(suffix))
2255
except (ValueError, IndexError) as e:
2697
2256
raise ValueError(*(e.args))
2698
2257
timevalue += delta
2699
2258
return timevalue
2715
2274
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2716
2275
if not stat.S_ISCHR(os.fstat(null).st_mode):
2717
2276
raise OSError(errno.ENODEV,
2718
"{} not a character device"
2277
"{0} not a character device"
2719
2278
.format(os.devnull))
2720
2279
os.dup2(null, sys.stdin.fileno())
2721
2280
os.dup2(null, sys.stdout.fileno())
2731
2290
2732
2291
parser = argparse.ArgumentParser()
2733
2292
parser.add_argument("-v", "--version", action="version",
2734
version = "%(prog)s {}".format(version),
2293
version = "%(prog)s {0}".format(version),
2735
2294
help="show version number and exit")
2736
2295
parser.add_argument("-i", "--interface", metavar="IF",
2737
2296
help="Bind to interface IF")
2770
2329
help="Directory to save/restore state in")
2771
2330
parser.add_argument("--foreground", action="store_true",
2772
2331
help="Run in foreground", default=None)
2773
parser.add_argument("--no-zeroconf", action="store_false",
2774
dest="zeroconf", help="Do not use Zeroconf",
2775
default=None)
2776
2332
2777
2333
options = parser.parse_args()
2778
2334
2779
2335
if options.check:
2780
2336
import doctest
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2337
doctest.testmod()
2338
sys.exit()
2783
2339
2784
2340
# Default values for config file for server-global settings
2785
2341
server_defaults = { "interface": "",
2787
2343
"port": "",
2788
2344
"debug": "False",
2789
2345
"priority":
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2346
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",
2792
2347
"servicename": "Mandos",
2793
2348
"use_dbus": "True",
2794
2349
"use_ipv6": "True",
2797
2352
"socket": "",
2798
2353
"statedir": "/var/lib/mandos",
2799
2354
"foreground": "False",
2800
"zeroconf": "True",
2801
}
2355
}
2802
2356
2803
2357
# Parse config file for server-global settings
2804
2358
server_config = configparser.SafeConfigParser(server_defaults)
2805
2359
del server_defaults
2806
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2360
server_config.read(os.path.join(options.configdir,
2361
"mandos.conf"))
2807
2362
# Convert the SafeConfigParser object to a dict
2808
2363
server_settings = server_config.defaults()
2809
2364
# Use the appropriate methods on the non-string config options
2827
2382
# Override the settings from the config file with command line
2828
2383
# options, if set.
2829
2384
for option in ("interface", "address", "port", "debug",
2830
"priority", "servicename", "configdir", "use_dbus",
2831
"use_ipv6", "debuglevel", "restore", "statedir",
2832
"socket", "foreground", "zeroconf"):
2385
"priority", "servicename", "configdir",
2386
"use_dbus", "use_ipv6", "debuglevel", "restore",
2387
"statedir", "socket", "foreground"):
2833
2388
value = getattr(options, option)
2834
2389
if value is not None:
2835
2390
server_settings[option] = value
2836
2391
del options
2837
2392
# Force all strings to be unicode
2838
2393
for option in server_settings.keys():
2839
if isinstance(server_settings[option], bytes):
2840
server_settings[option] = (server_settings[option]
2841
.decode("utf-8"))
2394
if type(server_settings[option]) is str:
2395
server_settings[option] = unicode(server_settings[option])
2842
2396
# Force all boolean options to be boolean
2843
2397
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2844
"foreground", "zeroconf"):
2398
"foreground"):
2845
2399
server_settings[option] = bool(server_settings[option])
2846
2400
# Debug implies foreground
2847
2401
if server_settings["debug"]:
2850
2404
2851
2405
##################################################################
2852
2406
2853
if (not server_settings["zeroconf"]
2854
and not (server_settings["port"]
2855
or server_settings["socket"] != "")):
2856
parser.error("Needs port or socket to work without Zeroconf")
2857
2858
2407
# For convenience
2859
2408
debug = server_settings["debug"]
2860
2409
debuglevel = server_settings["debuglevel"]
2863
2412
stored_state_path = os.path.join(server_settings["statedir"],
2864
2413
stored_state_file)
2865
2414
foreground = server_settings["foreground"]
2866
zeroconf = server_settings["zeroconf"]
2867
2415
2868
2416
if debug:
2869
2417
initlogger(debug, logging.DEBUG)
2875
2423
initlogger(debug, level)
2876
2424
2877
2425
if server_settings["servicename"] != "Mandos":
2878
syslogger.setFormatter(
2879
logging.Formatter('Mandos ({}) [%(process)d]:'
2880
' %(levelname)s: %(message)s'.format(
2881
server_settings["servicename"])))
2426
syslogger.setFormatter(logging.Formatter
2427
('Mandos ({0}) [%(process)d]:'
2428
' %(levelname)s: %(message)s'
2429
.format(server_settings
2430
["servicename"])))
2882
2431
2883
2432
# Parse config file with clients
2884
2433
client_config = configparser.SafeConfigParser(Client
2889
2438
global mandos_dbus_service
2890
2439
mandos_dbus_service = None
2891
2440
2892
socketfd = None
2893
if server_settings["socket"] != "":
2894
socketfd = server_settings["socket"]
2895
tcp_server = MandosServer(
2896
(server_settings["address"], server_settings["port"]),
2897
ClientHandler,
2898
interface=(server_settings["interface"] or None),
2899
use_ipv6=use_ipv6,
2900
gnutls_priority=server_settings["priority"],
2901
use_dbus=use_dbus,
2902
socketfd=socketfd)
2441
tcp_server = MandosServer((server_settings["address"],
2442
server_settings["port"]),
2443
ClientHandler,
2444
interface=(server_settings["interface"]
2445
or None),
2446
use_ipv6=use_ipv6,
2447
gnutls_priority=
2448
server_settings["priority"],
2449
use_dbus=use_dbus,
2450
socketfd=(server_settings["socket"]
2451
or None))
2903
2452
if not foreground:
2904
pidfilename = "/run/mandos.pid"
2905
if not os.path.isdir("/run/."):
2906
pidfilename = "/var/run/mandos.pid"
2453
pidfilename = "/var/run/mandos.pid"
2907
2454
pidfile = None
2908
2455
try:
2909
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2456
pidfile = open(pidfilename, "w")
2910
2457
except IOError as e:
2911
2458
logger.error("Could not open file %r", pidfilename,
2912
2459
exc_info=e)
2926
2473
os.setuid(uid)
2927
2474
except OSError as error:
2928
2475
if error.errno != errno.EPERM:
2929
raise
2476
raise error
2930
2477
2931
2478
if debug:
2932
2479
# Enable all possible GnuTLS debugging
2933
2480
2934
2481
# "Use a log level over 10 to enable all debugging options."
2935
2482
# - GnuTLS manual
2936
gnutls.global_set_log_level(11)
2483
gnutls.library.functions.gnutls_global_set_log_level(11)
2937
2484
2938
@gnutls.log_func
2485
@gnutls.library.types.gnutls_log_func
2939
2486
def debug_gnutls(level, string):
2940
2487
logger.debug("GnuTLS: %s", string[:-1])
2941
2488
2942
gnutls.global_set_log_function(debug_gnutls)
2489
(gnutls.library.functions
2490
.gnutls_global_set_log_function(debug_gnutls))
2943
2491
2944
2492
# Redirect stdin so all checkers get /dev/null
2945
2493
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2965
2513
if use_dbus:
2966
2514
try:
2967
2515
bus_name = dbus.service.BusName("se.recompile.Mandos",
2968
bus,
2969
do_not_queue=True)
2970
old_bus_name = dbus.service.BusName(
2971
"se.bsnet.fukt.Mandos", bus,
2972
do_not_queue=True)
2973
except dbus.exceptions.DBusException as e:
2516
bus, do_not_queue=True)
2517
old_bus_name = (dbus.service.BusName
2518
("se.bsnet.fukt.Mandos", bus,
2519
do_not_queue=True))
2520
except dbus.exceptions.NameExistsException as e:
2974
2521
logger.error("Disabling D-Bus:", exc_info=e)
2975
2522
use_dbus = False
2976
2523
server_settings["use_dbus"] = False
2977
2524
tcp_server.use_dbus = False
2978
if zeroconf:
2979
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
2984
bus = bus)
2985
if server_settings["interface"]:
2986
service.interface = if_nametoindex(
2987
server_settings["interface"].encode("utf-8"))
2525
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2526
service = AvahiServiceToSyslog(name =
2527
server_settings["servicename"],
2528
servicetype = "_mandos._tcp",
2529
protocol = protocol, bus = bus)
2530
if server_settings["interface"]:
2531
service.interface = (if_nametoindex
2532
(str(server_settings["interface"])))
2988
2533
2989
2534
global multiprocessing_manager
2990
2535
multiprocessing_manager = multiprocessing.Manager()
3009
2554
if server_settings["restore"]:
3010
2555
try:
3011
2556
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3013
stored_state)
2557
clients_data, old_client_settings = (pickle.load
2558
(stored_state))
3014
2559
os.remove(stored_state_path)
3015
2560
except IOError as e:
3016
2561
if e.errno == errno.ENOENT:
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
2562
logger.warning("Could not load persistent state: {0}"
2563
.format(os.strerror(e.errno)))
3019
2564
else:
3020
2565
logger.critical("Could not load persistent state:",
3021
2566
exc_info=e)
3022
2567
raise
3023
2568
except EOFError as e:
3024
2569
logger.warning("Could not load persistent state: "
3025
"EOFError:",
3026
exc_info=e)
2570
"EOFError:", exc_info=e)
3027
2571
3028
2572
with PGPEngine() as pgp:
3029
for client_name, client in clients_data.items():
2573
for client_name, client in clients_data.iteritems():
3030
2574
# Skip removed clients
3031
2575
if client_name not in client_settings:
3032
2576
continue
3041
2585
# For each value in new config, check if it
3042
2586
# differs from the old config value (Except for
3043
2587
# the "secret" attribute)
3044
if (name != "secret"
3045
and (value !=
3046
old_client_settings[client_name][name])):
2588
if (name != "secret" and
2589
value != old_client_settings[client_name]
2590
[name]):
3047
2591
client[name] = value
3048
2592
except KeyError:
3049
2593
pass
3050
2594
3051
2595
# Clients who has passed its expire date can still be
3052
# enabled if its last checker was successful. A Client
2596
# enabled if its last checker was successful. Clients
3053
2597
# whose checker succeeded before we stored its state is
3054
2598
# assumed to have successfully run all checkers during
3055
2599
# downtime.
3057
2601
if datetime.datetime.utcnow() >= client["expires"]:
3058
2602
if not client["last_checked_ok"]:
3059
2603
logger.warning(
3060
"disabling client {} - Client never "
3061
"performed a successful checker".format(
3062
client_name))
2604
"disabling client {0} - Client never "
2605
"performed a successful checker"
2606
.format(client_name))
3063
2607
client["enabled"] = False
3064
2608
elif client["last_checker_status"] != 0:
3065
2609
logger.warning(
3066
"disabling client {} - Client last"
3067
" checker failed with error code"
3068
" {}".format(
3069
client_name,
3070
client["last_checker_status"]))
2610
"disabling client {0} - Client "
2611
"last checker failed with error code {1}"
2612
.format(client_name,
2613
client["last_checker_status"]))
3071
2614
client["enabled"] = False
3072
2615
else:
3073
client["expires"] = (
3074
datetime.datetime.utcnow()
3075
+ client["timeout"])
2616
client["expires"] = (datetime.datetime
2617
.utcnow()
2618
+ client["timeout"])
3076
2619
logger.debug("Last checker succeeded,"
3077
" keeping {} enabled".format(
3078
client_name))
2620
" keeping {0} enabled"
2621
.format(client_name))
3079
2622
try:
3080
client["secret"] = pgp.decrypt(
3081
client["encrypted_secret"],
3082
client_settings[client_name]["secret"])
2623
client["secret"] = (
2624
pgp.decrypt(client["encrypted_secret"],
2625
client_settings[client_name]
2626
["secret"]))
3083
2627
except PGPError:
3084
2628
# If decryption fails, we use secret from new settings
3085
logger.debug("Failed to decrypt {} old secret".format(
3086
client_name))
3087
client["secret"] = (client_settings[client_name]
3088
["secret"])
2629
logger.debug("Failed to decrypt {0} old secret"
2630
.format(client_name))
2631
client["secret"] = (
2632
client_settings[client_name]["secret"])
3089
2633
3090
2634
# Add/remove clients based on new changes made to config
3091
2635
for client_name in (set(old_client_settings)
3096
2640
clients_data[client_name] = client_settings[client_name]
3097
2641
3098
2642
# Create all client objects
3099
for client_name, client in clients_data.items():
2643
for client_name, client in clients_data.iteritems():
3100
2644
tcp_server.clients[client_name] = client_class(
3101
name = client_name,
3102
settings = client,
2645
name = client_name, settings = client,
3103
2646
server_settings = server_settings)
3104
2647
3105
2648
if not tcp_server.clients:
3107
2650
3108
2651
if not foreground:
3109
2652
if pidfile is not None:
3110
pid = os.getpid()
3111
2653
try:
3112
2654
with pidfile:
3113
print(pid, file=pidfile)
2655
pid = os.getpid()
2656
pidfile.write(str(pid) + "\n".encode("utf-8"))
3114
2657
except IOError:
3115
2658
logger.error("Could not write to file %r with PID %d",
3116
2659
pidfilename, pid)
3121
2664
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3122
2665
3123
2666
if use_dbus:
3124
3125
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3127
class MandosDBusService(DBusObjectWithObjectManager):
2667
@alternate_dbus_interfaces({"se.recompile.Mandos":
2668
"se.bsnet.fukt.Mandos"})
2669
class MandosDBusService(DBusObjectWithProperties):
3128
2670
"""A D-Bus proxy object"""
3129
3130
2671
def __init__(self):
3131
2672
dbus.service.Object.__init__(self, bus, "/")
3132
3133
2673
_interface = "se.recompile.Mandos"
3134
2674
2675
@dbus_interface_annotations(_interface)
2676
def _foo(self):
2677
return { "org.freedesktop.DBus.Property"
2678
".EmitsChangedSignal":
2679
"false"}
2680
3135
2681
@dbus.service.signal(_interface, signature="o")
3136
2682
def ClientAdded(self, objpath):
3137
2683
"D-Bus signal"
3142
2688
"D-Bus signal"
3143
2689
pass
3144
2690
3145
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3146
"true"})
3147
2691
@dbus.service.signal(_interface, signature="os")
3148
2692
def ClientRemoved(self, objpath, name):
3149
2693
"D-Bus signal"
3150
2694
pass
3151
2695
3152
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3153
"true"})
3154
2696
@dbus.service.method(_interface, out_signature="ao")
3155
2697
def GetAllClients(self):
3156
2698
"D-Bus method"
3157
return dbus.Array(c.dbus_object_path for c in
2699
return dbus.Array(c.dbus_object_path
2700
for c in
3158
2701
tcp_server.clients.itervalues())
3159
2702
3160
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3161
"true"})
3162
2703
@dbus.service.method(_interface,
3163
2704
out_signature="a{oa{sv}}")
3164
2705
def GetAllClientsWithProperties(self):
3165
2706
"D-Bus method"
3166
2707
return dbus.Dictionary(
3167
{ c.dbus_object_path: c.GetAll(
3168
"se.recompile.Mandos.Client")
3169
for c in tcp_server.clients.itervalues() },
2708
((c.dbus_object_path, c.GetAll(""))
2709
for c in tcp_server.clients.itervalues()),
3170
2710
signature="oa{sv}")
3171
2711
3172
2712
@dbus.service.method(_interface, in_signature="o")
3176
2716
if c.dbus_object_path == object_path:
3177
2717
del tcp_server.clients[c.name]
3178
2718
c.remove_from_connection()
3179
# Don't signal the disabling
2719
# Don't signal anything except ClientRemoved
3180
2720
c.disable(quiet=True)
3181
# Emit D-Bus signal for removal
3182
self.client_removed_signal(c)
2721
# Emit D-Bus signal
2722
self.ClientRemoved(object_path, c.name)
3183
2723
return
3184
2724
raise KeyError(object_path)
3185
2725
3186
2726
del _interface
3187
3188
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3189
out_signature = "a{oa{sa{sv}}}")
3190
def GetManagedObjects(self):
3191
"""D-Bus method"""
3192
return dbus.Dictionary(
3193
{ client.dbus_object_path:
3194
dbus.Dictionary(
3195
{ interface: client.GetAll(interface)
3196
for interface in
3197
client._get_all_interface_names()})
3198
for client in tcp_server.clients.values()})
3199
3200
def client_added_signal(self, client):
3201
"""Send the new standard signal and the old signal"""
3202
if use_dbus:
3203
# New standard signal
3204
self.InterfacesAdded(
3205
client.dbus_object_path,
3206
dbus.Dictionary(
3207
{ interface: client.GetAll(interface)
3208
for interface in
3209
client._get_all_interface_names()}))
3210
# Old signal
3211
self.ClientAdded(client.dbus_object_path)
3212
3213
def client_removed_signal(self, client):
3214
"""Send the new standard signal and the old signal"""
3215
if use_dbus:
3216
# New standard signal
3217
self.InterfacesRemoved(
3218
client.dbus_object_path,
3219
client._get_all_interface_names())
3220
# Old signal
3221
self.ClientRemoved(client.dbus_object_path,
3222
client.name)
3223
2727
3224
2728
mandos_dbus_service = MandosDBusService()
3225
2729
3226
2730
def cleanup():
3227
2731
"Cleanup function; run on exit"
3228
if zeroconf:
3229
service.cleanup()
2732
service.cleanup()
3230
2733
3231
2734
multiprocessing.active_children()
3232
2735
wnull.close()
3246
2749
3247
2750
# A list of attributes that can not be pickled
3248
2751
# + secret.
3249
exclude = { "bus", "changedstate", "secret",
3250
"checker", "server_settings" }
3251
for name, typ in inspect.getmembers(dbus.service
3252
.Object):
2752
exclude = set(("bus", "changedstate", "secret",
2753
"checker", "server_settings"))
2754
for name, typ in (inspect.getmembers
2755
(dbus.service.Object)):
3253
2756
exclude.add(name)
3254
2757
3255
2758
client_dict["encrypted_secret"] = (client
3262
2765
del client_settings[client.name]["secret"]
3263
2766
3264
2767
try:
3265
with tempfile.NamedTemporaryFile(
3266
mode='wb',
3267
suffix=".pickle",
3268
prefix='clients-',
3269
dir=os.path.dirname(stored_state_path),
3270
delete=False) as stored_state:
2768
with (tempfile.NamedTemporaryFile
2769
(mode='wb', suffix=".pickle", prefix='clients-',
2770
dir=os.path.dirname(stored_state_path),
2771
delete=False)) as stored_state:
3271
2772
pickle.dump((clients, client_settings), stored_state)
3272
tempname = stored_state.name
2773
tempname=stored_state.name
3273
2774
os.rename(tempname, stored_state_path)
3274
2775
except (IOError, OSError) as e:
3275
2776
if not debug:
3278
2779
except NameError:
3279
2780
pass
3280
2781
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3281
logger.warning("Could not save persistent state: {}"
2782
logger.warning("Could not save persistent state: {0}"
3282
2783
.format(os.strerror(e.errno)))
3283
2784
else:
3284
2785
logger.warning("Could not save persistent state:",
3285
2786
exc_info=e)
3286
raise
2787
raise e
3287
2788
3288
2789
# Delete all clients, and settings from config
3289
2790
while tcp_server.clients:
3290
2791
name, client = tcp_server.clients.popitem()
3291
2792
if use_dbus:
3292
2793
client.remove_from_connection()
3293
# Don't signal the disabling
2794
# Don't signal anything except ClientRemoved
3294
2795
client.disable(quiet=True)
3295
# Emit D-Bus signal for removal
3296
2796
if use_dbus:
3297
mandos_dbus_service.client_removed_signal(client)
2797
# Emit D-Bus signal
2798
mandos_dbus_service.ClientRemoved(client
2799
.dbus_object_path,
2800
client.name)
3298
2801
client_settings.clear()
3299
2802
3300
2803
atexit.register(cleanup)
3301
2804
3302
2805
for client in tcp_server.clients.itervalues():
3303
2806
if use_dbus:
3304
# Emit D-Bus signal for adding
3305
mandos_dbus_service.client_added_signal(client)
2807
# Emit D-Bus signal
2808
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3306
2809
# Need to initiate checking of clients
3307
2810
if client.enabled:
3308
2811
client.init_checker()
3311
2814
tcp_server.server_activate()
3312
2815
3313
2816
# Find out what port we got
3314
if zeroconf:
3315
service.port = tcp_server.socket.getsockname()[1]
2817
service.port = tcp_server.socket.getsockname()[1]
3316
2818
if use_ipv6:
3317
2819
logger.info("Now listening on address %r, port %d,"
3318
2820
" flowinfo %d, scope_id %d",
3324
2826
#service.interface = tcp_server.socket.getsockname()[3]
3325
2827
3326
2828
try:
3327
if zeroconf:
3328
# From the Avahi example code
3329
try:
3330
service.activate()
3331
except dbus.exceptions.DBusException as error:
3332
logger.critical("D-Bus Exception", exc_info=error)
3333
cleanup()
3334
sys.exit(1)
3335
# End of Avahi example code
2829
# From the Avahi example code
2830
try:
2831
service.activate()
2832
except dbus.exceptions.DBusException as error:
2833
logger.critical("D-Bus Exception", exc_info=error)
2834
cleanup()
2835
sys.exit(1)
2836
# End of Avahi example code
3336
2837
3337
2838
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
2839
lambda *args, **kwargs:
3353
2854
# Must run before the D-Bus bus name gets deregistered
3354
2855
cleanup()
3355
2856
3356
3357
2857
if __name__ == '__main__':
3358
2858
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0