To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 694
- compare with another revision
- download diff
- download tarball
- view history from revision 694
- Committer: Teddy Hogeborn
- Date: 2014-06-08 00:13:06 UTC
- Revision ID: teddy@recompile.se-20140608001306-ums93iqhkvztj7u1
Make mandos-client use unlinkat() instead of remove().
* plugins.d/mandos-client.d (main): Replace remove() with unlinkat().
* plugins.d/mandos-client.d (main): Replace remove() with unlinkat().
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
try:
43
import SocketServer as socketserver
44
except ImportError:
45
import socketserver
39
import SocketServer as socketserver
46
40
import socket
47
41
import argparse
48
42
import datetime
49
43
import errno
50
try:
51
import ConfigParser as configparser
52
except ImportError:
53
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
54
51
import sys
55
52
import re
56
53
import os
65
62
import struct
66
63
import fcntl
67
64
import functools
68
try:
69
import cPickle as pickle
70
except ImportError:
71
import pickle
65
import cPickle as pickle
72
66
import multiprocessing
73
67
import types
74
68
import binascii
75
69
import tempfile
76
70
import itertools
77
71
import collections
78
import codecs
79
72
80
73
import dbus
81
74
import dbus.service
82
from gi.repository import GLib
75
import gobject
76
import avahi
83
77
from dbus.mainloop.glib import DBusGMainLoop
84
78
import ctypes
85
79
import ctypes.util
94
88
except ImportError:
95
89
SO_BINDTODEVICE = None
96
90
97
if sys.version_info.major == 2:
98
str = unicode
99
100
version = "1.7.7"
91
version = "1.6.5"
101
92
stored_state_file = "clients.pickle"
102
93
103
94
logger = logging.getLogger()
104
95
syslogger = None
105
96
106
97
try:
107
if_nametoindex = ctypes.cdll.LoadLibrary(
108
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
109
101
except (OSError, AttributeError):
110
111
102
def if_nametoindex(interface):
112
103
"Get an interface index the hard way, i.e. using fcntl()"
113
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
114
105
with contextlib.closing(socket.socket()) as s:
115
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
116
struct.pack(b"16s16x", interface))
117
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
118
111
return interface_index
119
112
120
113
121
def copy_function(func):
122
"""Make a copy of a function"""
123
if sys.version_info.major == 2:
124
return types.FunctionType(func.func_code,
125
func.func_globals,
126
func.func_name,
127
func.func_defaults,
128
func.func_closure)
129
else:
130
return types.FunctionType(func.__code__,
131
func.__globals__,
132
func.__name__,
133
func.__defaults__,
134
func.__closure__)
135
136
137
114
def initlogger(debug, level=logging.WARNING):
138
115
"""init logger and add loglevel"""
139
116
140
global syslogger
141
syslogger = (logging.handlers.SysLogHandler(
142
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
143
address = "/dev/log"))
117
syslogger = (logging.handlers.SysLogHandler
118
(facility =
119
logging.handlers.SysLogHandler.LOG_DAEMON,
120
address = str("/dev/log")))
144
121
syslogger.setFormatter(logging.Formatter
145
122
('Mandos [%(process)d]: %(levelname)s:'
146
123
' %(message)s'))
163
140
164
141
class PGPEngine(object):
165
142
"""A simple class for OpenPGP symmetric encryption & decryption"""
166
167
143
def __init__(self):
168
144
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
169
self.gpg = "gpg"
170
try:
171
output = subprocess.check_output(["gpgconf"])
172
for line in output.splitlines():
173
name, text, path = line.split(b":")
174
if name == "gpg":
175
self.gpg = path
176
break
177
except OSError as e:
178
if e.errno != errno.ENOENT:
179
raise
180
145
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
146
'--home', self.tempdir,
182
147
'--force-mdc',
183
'--quiet']
184
# Only GPG version 1 has the --no-use-agent option.
185
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
186
self.gnupgargs.append("--no-use-agent")
148
'--quiet',
149
'--no-use-agent']
187
150
188
151
def __enter__(self):
189
152
return self
221
184
222
185
def encrypt(self, data, password):
223
186
passphrase = self.password_encode(password)
224
with tempfile.NamedTemporaryFile(
225
dir=self.tempdir) as passfile:
187
with tempfile.NamedTemporaryFile(dir=self.tempdir
188
) as passfile:
226
189
passfile.write(passphrase)
227
190
passfile.flush()
228
proc = subprocess.Popen([self.gpg, '--symmetric',
191
proc = subprocess.Popen(['gpg', '--symmetric',
229
192
'--passphrase-file',
230
193
passfile.name]
231
194
+ self.gnupgargs,
239
202
240
203
def decrypt(self, data, password):
241
204
passphrase = self.password_encode(password)
242
with tempfile.NamedTemporaryFile(
243
dir = self.tempdir) as passfile:
205
with tempfile.NamedTemporaryFile(dir = self.tempdir
206
) as passfile:
244
207
passfile.write(passphrase)
245
208
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--decrypt',
209
proc = subprocess.Popen(['gpg', '--decrypt',
247
210
'--passphrase-file',
248
211
passfile.name]
249
212
+ self.gnupgargs,
250
213
stdin = subprocess.PIPE,
251
214
stdout = subprocess.PIPE,
252
215
stderr = subprocess.PIPE)
253
decrypted_plaintext, err = proc.communicate(input = data)
216
decrypted_plaintext, err = proc.communicate(input
217
= data)
254
218
if proc.returncode != 0:
255
219
raise PGPError(err)
256
220
return decrypted_plaintext
257
221
258
# Pretend that we have an Avahi module
259
class Avahi(object):
260
"""This isn't so much a class as it is a module-like namespace.
261
It is instantiated once, and simulates having an Avahi module."""
262
IF_UNSPEC = -1 # avahi-common/address.h
263
PROTO_UNSPEC = -1 # avahi-common/address.h
264
PROTO_INET = 0 # avahi-common/address.h
265
PROTO_INET6 = 1 # avahi-common/address.h
266
DBUS_NAME = "org.freedesktop.Avahi"
267
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
268
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
269
DBUS_PATH_SERVER = "/"
270
def string_array_to_txt_array(self, t):
271
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
272
for s in t), signature="ay")
273
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
274
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
275
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
276
SERVER_INVALID = 0 # avahi-common/defs.h
277
SERVER_REGISTERING = 1 # avahi-common/defs.h
278
SERVER_RUNNING = 2 # avahi-common/defs.h
279
SERVER_COLLISION = 3 # avahi-common/defs.h
280
SERVER_FAILURE = 4 # avahi-common/defs.h
281
avahi = Avahi()
282
222
283
223
class AvahiError(Exception):
284
224
def __init__(self, value, *args, **kwargs):
285
225
self.value = value
286
return super(AvahiError, self).__init__(value, *args,
287
**kwargs)
288
226
super(AvahiError, self).__init__(value, *args, **kwargs)
227
def __unicode__(self):
228
return unicode(repr(self.value))
289
229
290
230
class AvahiServiceError(AvahiError):
291
231
pass
292
232
293
294
233
class AvahiGroupError(AvahiError):
295
234
pass
296
235
316
255
bus: dbus.SystemBus()
317
256
"""
318
257
319
def __init__(self,
320
interface = avahi.IF_UNSPEC,
321
name = None,
322
servicetype = None,
323
port = None,
324
TXT = None,
325
domain = "",
326
host = "",
327
max_renames = 32768,
328
protocol = avahi.PROTO_UNSPEC,
329
bus = None):
258
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
259
servicetype = None, port = None, TXT = None,
260
domain = "", host = "", max_renames = 32768,
261
protocol = avahi.PROTO_UNSPEC, bus = None):
330
262
self.interface = interface
331
263
self.name = name
332
264
self.type = servicetype
342
274
self.bus = bus
343
275
self.entry_group_state_changed_match = None
344
276
345
def rename(self, remove=True):
277
def rename(self):
346
278
"""Derived from the Avahi example code"""
347
279
if self.rename_count >= self.max_renames:
348
280
logger.critical("No suitable Zeroconf service name found"
349
281
" after %i retries, exiting.",
350
282
self.rename_count)
351
283
raise AvahiServiceError("Too many renames")
352
self.name = str(
353
self.server.GetAlternativeServiceName(self.name))
354
self.rename_count += 1
284
self.name = unicode(self.server
285
.GetAlternativeServiceName(self.name))
355
286
logger.info("Changing Zeroconf service name to %r ...",
356
287
self.name)
357
if remove:
358
self.remove()
288
self.remove()
359
289
try:
360
290
self.add()
361
291
except dbus.exceptions.DBusException as error:
362
if (error.get_dbus_name()
363
== "org.freedesktop.Avahi.CollisionError"):
364
logger.info("Local Zeroconf service name collision.")
365
return self.rename(remove=False)
366
else:
367
logger.critical("D-Bus Exception", exc_info=error)
368
self.cleanup()
369
os._exit(1)
292
logger.critical("D-Bus Exception", exc_info=error)
293
self.cleanup()
294
os._exit(1)
295
self.rename_count += 1
370
296
371
297
def remove(self):
372
298
"""Derived from the Avahi example code"""
410
336
self.rename()
411
337
elif state == avahi.ENTRY_GROUP_FAILURE:
412
338
logger.critical("Avahi: Error in group state changed %s",
413
str(error))
414
raise AvahiGroupError("State changed: {!s}".format(error))
339
unicode(error))
340
raise AvahiGroupError("State changed: {0!s}"
341
.format(error))
415
342
416
343
def cleanup(self):
417
344
"""Derived from the Avahi example code"""
427
354
def server_state_changed(self, state, error=None):
428
355
"""Derived from the Avahi example code"""
429
356
logger.debug("Avahi server state change: %i", state)
430
bad_states = {
431
avahi.SERVER_INVALID: "Zeroconf server invalid",
432
avahi.SERVER_REGISTERING: None,
433
avahi.SERVER_COLLISION: "Zeroconf server name collision",
434
avahi.SERVER_FAILURE: "Zeroconf server failure",
435
}
357
bad_states = { avahi.SERVER_INVALID:
358
"Zeroconf server invalid",
359
avahi.SERVER_REGISTERING: None,
360
avahi.SERVER_COLLISION:
361
"Zeroconf server name collision",
362
avahi.SERVER_FAILURE:
363
"Zeroconf server failure" }
436
364
if state in bad_states:
437
365
if bad_states[state] is not None:
438
366
if error is None:
441
369
logger.error(bad_states[state] + ": %r", error)
442
370
self.cleanup()
443
371
elif state == avahi.SERVER_RUNNING:
444
try:
445
self.add()
446
except dbus.exceptions.DBusException as error:
447
if (error.get_dbus_name()
448
== "org.freedesktop.Avahi.CollisionError"):
449
logger.info("Local Zeroconf service name"
450
" collision.")
451
return self.rename(remove=False)
452
else:
453
logger.critical("D-Bus Exception", exc_info=error)
454
self.cleanup()
455
os._exit(1)
372
self.add()
456
373
else:
457
374
if error is None:
458
375
logger.debug("Unknown state: %r", state)
468
385
follow_name_owner_changes=True),
469
386
avahi.DBUS_INTERFACE_SERVER)
470
387
self.server.connect_to_signal("StateChanged",
471
self.server_state_changed)
388
self.server_state_changed)
472
389
self.server_state_changed(self.server.GetState())
473
390
474
391
475
392
class AvahiServiceToSyslog(AvahiService):
476
def rename(self, *args, **kwargs):
393
def rename(self):
477
394
"""Add the new name to the syslog messages"""
478
ret = AvahiService.rename(self, *args, **kwargs)
479
syslogger.setFormatter(logging.Formatter(
480
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
481
.format(self.name)))
395
ret = AvahiService.rename(self)
396
syslogger.setFormatter(logging.Formatter
397
('Mandos ({0}) [%(process)d]:'
398
' %(levelname)s: %(message)s'
399
.format(self.name)))
482
400
return ret
483
401
484
# Pretend that we have a GnuTLS module
485
class GnuTLS(object):
486
"""This isn't so much a class as it is a module-like namespace.
487
It is instantiated once, and simulates having a GnuTLS module."""
488
489
_library = ctypes.cdll.LoadLibrary(
490
ctypes.util.find_library("gnutls"))
491
_need_version = b"3.3.0"
492
def __init__(self):
493
# Need to use class name "GnuTLS" here, since this method is
494
# called before the assignment to the "gnutls" global variable
495
# happens.
496
if GnuTLS.check_version(self._need_version) is None:
497
raise GnuTLS.Error("Needs GnuTLS {} or later"
498
.format(self._need_version))
499
500
# Unless otherwise indicated, the constants and types below are
501
# all from the gnutls/gnutls.h C header file.
502
503
# Constants
504
E_SUCCESS = 0
505
E_INTERRUPTED = -52
506
E_AGAIN = -28
507
CRT_OPENPGP = 2
508
CLIENT = 2
509
SHUT_RDWR = 0
510
CRD_CERTIFICATE = 1
511
E_NO_CERTIFICATE_FOUND = -49
512
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
513
514
# Types
515
class session_int(ctypes.Structure):
516
_fields_ = []
517
session_t = ctypes.POINTER(session_int)
518
class certificate_credentials_st(ctypes.Structure):
519
_fields_ = []
520
certificate_credentials_t = ctypes.POINTER(
521
certificate_credentials_st)
522
certificate_type_t = ctypes.c_int
523
class datum_t(ctypes.Structure):
524
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
525
('size', ctypes.c_uint)]
526
class openpgp_crt_int(ctypes.Structure):
527
_fields_ = []
528
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
529
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
531
credentials_type_t = ctypes.c_int
532
transport_ptr_t = ctypes.c_void_p
533
close_request_t = ctypes.c_int
534
535
# Exceptions
536
class Error(Exception):
537
# We need to use the class name "GnuTLS" here, since this
538
# exception might be raised from within GnuTLS.__init__,
539
# which is called before the assignment to the "gnutls"
540
# global variable has happened.
541
def __init__(self, message = None, code = None, args=()):
542
# Default usage is by a message string, but if a return
543
# code is passed, convert it to a string with
544
# gnutls.strerror()
545
self.code = code
546
if message is None and code is not None:
547
message = GnuTLS.strerror(code)
548
return super(GnuTLS.Error, self).__init__(
549
message, *args)
550
551
class CertificateSecurityError(Error):
552
pass
553
554
# Classes
555
class Credentials(object):
556
def __init__(self):
557
self._c_object = gnutls.certificate_credentials_t()
558
gnutls.certificate_allocate_credentials(
559
ctypes.byref(self._c_object))
560
self.type = gnutls.CRD_CERTIFICATE
561
562
def __del__(self):
563
gnutls.certificate_free_credentials(self._c_object)
564
565
class ClientSession(object):
566
def __init__(self, socket, credentials = None):
567
self._c_object = gnutls.session_t()
568
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
569
gnutls.set_default_priority(self._c_object)
570
gnutls.transport_set_ptr(self._c_object, socket.fileno())
571
gnutls.handshake_set_private_extensions(self._c_object,
572
True)
573
self.socket = socket
574
if credentials is None:
575
credentials = gnutls.Credentials()
576
gnutls.credentials_set(self._c_object, credentials.type,
577
ctypes.cast(credentials._c_object,
578
ctypes.c_void_p))
579
self.credentials = credentials
580
581
def __del__(self):
582
gnutls.deinit(self._c_object)
583
584
def handshake(self):
585
return gnutls.handshake(self._c_object)
586
587
def send(self, data):
588
data = bytes(data)
589
data_len = len(data)
590
while data_len > 0:
591
data_len -= gnutls.record_send(self._c_object,
592
data[-data_len:],
593
data_len)
594
595
def bye(self):
596
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
597
598
# Error handling functions
599
def _error_code(result):
600
"""A function to raise exceptions on errors, suitable
601
for the 'restype' attribute on ctypes functions"""
602
if result >= 0:
603
return result
604
if result == gnutls.E_NO_CERTIFICATE_FOUND:
605
raise gnutls.CertificateSecurityError(code = result)
606
raise gnutls.Error(code = result)
607
608
def _retry_on_error(result, func, arguments):
609
"""A function to retry on some errors, suitable
610
for the 'errcheck' attribute on ctypes functions"""
611
while result < 0:
612
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
613
return _error_code(result)
614
result = func(*arguments)
615
return result
616
617
# Unless otherwise indicated, the function declarations below are
618
# all from the gnutls/gnutls.h C header file.
619
620
# Functions
621
priority_set_direct = _library.gnutls_priority_set_direct
622
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
623
ctypes.POINTER(ctypes.c_char_p)]
624
priority_set_direct.restype = _error_code
625
626
init = _library.gnutls_init
627
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
628
init.restype = _error_code
629
630
set_default_priority = _library.gnutls_set_default_priority
631
set_default_priority.argtypes = [session_t]
632
set_default_priority.restype = _error_code
633
634
record_send = _library.gnutls_record_send
635
record_send.argtypes = [session_t, ctypes.c_void_p,
636
ctypes.c_size_t]
637
record_send.restype = ctypes.c_ssize_t
638
record_send.errcheck = _retry_on_error
639
640
certificate_allocate_credentials = (
641
_library.gnutls_certificate_allocate_credentials)
642
certificate_allocate_credentials.argtypes = [
643
ctypes.POINTER(certificate_credentials_t)]
644
certificate_allocate_credentials.restype = _error_code
645
646
certificate_free_credentials = (
647
_library.gnutls_certificate_free_credentials)
648
certificate_free_credentials.argtypes = [certificate_credentials_t]
649
certificate_free_credentials.restype = None
650
651
handshake_set_private_extensions = (
652
_library.gnutls_handshake_set_private_extensions)
653
handshake_set_private_extensions.argtypes = [session_t,
654
ctypes.c_int]
655
handshake_set_private_extensions.restype = None
656
657
credentials_set = _library.gnutls_credentials_set
658
credentials_set.argtypes = [session_t, credentials_type_t,
659
ctypes.c_void_p]
660
credentials_set.restype = _error_code
661
662
strerror = _library.gnutls_strerror
663
strerror.argtypes = [ctypes.c_int]
664
strerror.restype = ctypes.c_char_p
665
666
certificate_type_get = _library.gnutls_certificate_type_get
667
certificate_type_get.argtypes = [session_t]
668
certificate_type_get.restype = _error_code
669
670
certificate_get_peers = _library.gnutls_certificate_get_peers
671
certificate_get_peers.argtypes = [session_t,
672
ctypes.POINTER(ctypes.c_uint)]
673
certificate_get_peers.restype = ctypes.POINTER(datum_t)
674
675
global_set_log_level = _library.gnutls_global_set_log_level
676
global_set_log_level.argtypes = [ctypes.c_int]
677
global_set_log_level.restype = None
678
679
global_set_log_function = _library.gnutls_global_set_log_function
680
global_set_log_function.argtypes = [log_func]
681
global_set_log_function.restype = None
682
683
deinit = _library.gnutls_deinit
684
deinit.argtypes = [session_t]
685
deinit.restype = None
686
687
handshake = _library.gnutls_handshake
688
handshake.argtypes = [session_t]
689
handshake.restype = _error_code
690
handshake.errcheck = _retry_on_error
691
692
transport_set_ptr = _library.gnutls_transport_set_ptr
693
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
694
transport_set_ptr.restype = None
695
696
bye = _library.gnutls_bye
697
bye.argtypes = [session_t, close_request_t]
698
bye.restype = _error_code
699
bye.errcheck = _retry_on_error
700
701
check_version = _library.gnutls_check_version
702
check_version.argtypes = [ctypes.c_char_p]
703
check_version.restype = ctypes.c_char_p
704
705
# All the function declarations below are from gnutls/openpgp.h
706
707
openpgp_crt_init = _library.gnutls_openpgp_crt_init
708
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
709
openpgp_crt_init.restype = _error_code
710
711
openpgp_crt_import = _library.gnutls_openpgp_crt_import
712
openpgp_crt_import.argtypes = [openpgp_crt_t,
713
ctypes.POINTER(datum_t),
714
openpgp_crt_fmt_t]
715
openpgp_crt_import.restype = _error_code
716
717
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
718
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
719
ctypes.POINTER(ctypes.c_uint)]
720
openpgp_crt_verify_self.restype = _error_code
721
722
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
723
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
724
openpgp_crt_deinit.restype = None
725
726
openpgp_crt_get_fingerprint = (
727
_library.gnutls_openpgp_crt_get_fingerprint)
728
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
729
ctypes.c_void_p,
730
ctypes.POINTER(
731
ctypes.c_size_t)]
732
openpgp_crt_get_fingerprint.restype = _error_code
733
734
# Remove non-public functions
735
del _error_code, _retry_on_error
736
# Create the global "gnutls" object, simulating a module
737
gnutls = GnuTLS()
738
739
def call_pipe(connection, # : multiprocessing.Connection
740
func, *args, **kwargs):
741
"""This function is meant to be called by multiprocessing.Process
742
743
This function runs func(*args, **kwargs), and writes the resulting
744
return value on the provided multiprocessing.Connection.
745
"""
746
connection.send(func(*args, **kwargs))
747
connection.close()
402
403
def timedelta_to_milliseconds(td):
404
"Convert a datetime.timedelta() to milliseconds"
405
return ((td.days * 24 * 60 * 60 * 1000)
406
+ (td.seconds * 1000)
407
+ (td.microseconds // 1000))
408
748
409
749
410
class Client(object):
750
411
"""A representation of a client host served by this server.
756
417
checker: subprocess.Popen(); a running checker process used
757
418
to see if the client lives.
758
419
'None' if no process is running.
759
checker_callback_tag: a GLib event source tag, or None
420
checker_callback_tag: a gobject event source tag, or None
760
421
checker_command: string; External command which is run to check
761
422
if client lives. %() expansions are done at
762
423
runtime with vars(self) as dict, so that for
763
424
instance %(name)s can be used in the command.
764
checker_initiator_tag: a GLib event source tag, or None
425
checker_initiator_tag: a gobject event source tag, or None
765
426
created: datetime.datetime(); (UTC) object creation
766
427
client_structure: Object describing what attributes a client has
767
428
and is used for storing the client at exit
768
429
current_checker_command: string; current running checker_command
769
disable_initiator_tag: a GLib event source tag, or None
430
disable_initiator_tag: a gobject event source tag, or None
770
431
enabled: bool()
771
432
fingerprint: string (40 or 32 hexadecimal digits); used to
772
433
uniquely identify the client
777
438
last_checker_status: integer between 0 and 255 reflecting exit
778
439
status of last checker. -1 reflects crashed
779
440
checker, -2 means no checker completed yet.
780
last_checker_signal: The signal which killed the last checker, if
781
last_checker_status is -1
782
441
last_enabled: datetime.datetime(); (UTC) or None
783
442
name: string; from the config file, used in log messages and
784
443
D-Bus identifiers
797
456
"fingerprint", "host", "interval",
798
457
"last_approval_request", "last_checked_ok",
799
458
"last_enabled", "name", "timeout")
800
client_defaults = {
801
"timeout": "PT5M",
802
"extended_timeout": "PT15M",
803
"interval": "PT2M",
804
"checker": "fping -q -- %%(host)s",
805
"host": "",
806
"approval_delay": "PT0S",
807
"approval_duration": "PT1S",
808
"approved_by_default": "True",
809
"enabled": "True",
810
}
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
469
470
def timeout_milliseconds(self):
471
"Return the 'timeout' attribute in milliseconds"
472
return timedelta_to_milliseconds(self.timeout)
473
474
def extended_timeout_milliseconds(self):
475
"Return the 'extended_timeout' attribute in milliseconds"
476
return timedelta_to_milliseconds(self.extended_timeout)
477
478
def interval_milliseconds(self):
479
"Return the 'interval' attribute in milliseconds"
480
return timedelta_to_milliseconds(self.interval)
481
482
def approval_delay_milliseconds(self):
483
return timedelta_to_milliseconds(self.approval_delay)
811
484
812
485
@staticmethod
813
486
def config_parser(config):
829
502
client["enabled"] = config.getboolean(client_name,
830
503
"enabled")
831
504
832
# Uppercase and remove spaces from fingerprint for later
833
# comparison purposes with return value from the
834
# fingerprint() function
835
505
client["fingerprint"] = (section["fingerprint"].upper()
836
506
.replace(" ", ""))
837
507
if "secret" in section:
838
client["secret"] = codecs.decode(section["secret"]
839
.encode("utf-8"),
840
"base64")
508
client["secret"] = section["secret"].decode("base64")
841
509
elif "secfile" in section:
842
510
with open(os.path.expanduser(os.path.expandvars
843
511
(section["secfile"])),
844
512
"rb") as secfile:
845
513
client["secret"] = secfile.read()
846
514
else:
847
raise TypeError("No secret or secfile for section {}"
515
raise TypeError("No secret or secfile for section {0}"
848
516
.format(section))
849
517
client["timeout"] = string_to_delta(section["timeout"])
850
518
client["extended_timeout"] = string_to_delta(
867
535
server_settings = {}
868
536
self.server_settings = server_settings
869
537
# adding all client settings
870
for setting, value in settings.items():
538
for setting, value in settings.iteritems():
871
539
setattr(self, setting, value)
872
540
873
541
if self.enabled:
881
549
self.expires = None
882
550
883
551
logger.debug("Creating client %r", self.name)
552
# Uppercase and remove spaces from fingerprint for later
553
# comparison purposes with return value from the fingerprint()
554
# function
884
555
logger.debug(" Fingerprint: %s", self.fingerprint)
885
556
self.created = settings.get("created",
886
557
datetime.datetime.utcnow())
893
564
self.current_checker_command = None
894
565
self.approved = None
895
566
self.approvals_pending = 0
896
self.changedstate = multiprocessing_manager.Condition(
897
multiprocessing_manager.Lock())
898
self.client_structure = [attr
899
for attr in self.__dict__.keys()
567
self.changedstate = (multiprocessing_manager
568
.Condition(multiprocessing_manager
569
.Lock()))
570
self.client_structure = [attr for attr in
571
self.__dict__.iterkeys()
900
572
if not attr.startswith("_")]
901
573
self.client_structure.append("client_structure")
902
574
903
for name, t in inspect.getmembers(
904
type(self), lambda obj: isinstance(obj, property)):
575
for name, t in inspect.getmembers(type(self),
576
lambda obj:
577
isinstance(obj,
578
property)):
905
579
if not name.startswith("_"):
906
580
self.client_structure.append(name)
907
581
928
602
if not quiet:
929
603
logger.info("Disabling client %s", self.name)
930
604
if getattr(self, "disable_initiator_tag", None) is not None:
931
GLib.source_remove(self.disable_initiator_tag)
605
gobject.source_remove(self.disable_initiator_tag)
932
606
self.disable_initiator_tag = None
933
607
self.expires = None
934
608
if getattr(self, "checker_initiator_tag", None) is not None:
935
GLib.source_remove(self.checker_initiator_tag)
609
gobject.source_remove(self.checker_initiator_tag)
936
610
self.checker_initiator_tag = None
937
611
self.stop_checker()
938
612
self.enabled = False
939
613
if not quiet:
940
614
self.send_changedstate()
941
# Do not run this again if called by a GLib.timeout_add
615
# Do not run this again if called by a gobject.timeout_add
942
616
return False
943
617
944
618
def __del__(self):
948
622
# Schedule a new checker to be started an 'interval' from now,
949
623
# and every interval from then on.
950
624
if self.checker_initiator_tag is not None:
951
GLib.source_remove(self.checker_initiator_tag)
952
self.checker_initiator_tag = GLib.timeout_add(
953
int(self.interval.total_seconds() * 1000),
954
self.start_checker)
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = (gobject.timeout_add
627
(self.interval_milliseconds(),
628
self.start_checker))
955
629
# Schedule a disable() when 'timeout' has passed
956
630
if self.disable_initiator_tag is not None:
957
GLib.source_remove(self.disable_initiator_tag)
958
self.disable_initiator_tag = GLib.timeout_add(
959
int(self.timeout.total_seconds() * 1000), self.disable)
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = (gobject.timeout_add
633
(self.timeout_milliseconds(),
634
self.disable))
960
635
# Also start a new checker *right now*.
961
636
self.start_checker()
962
637
963
def checker_callback(self, source, condition, connection,
964
command):
638
def checker_callback(self, pid, condition, command):
965
639
"""The checker has completed, so take appropriate actions."""
966
640
self.checker_callback_tag = None
967
641
self.checker = None
968
# Read return code from connection (see call_pipe)
969
returncode = connection.recv()
970
connection.close()
971
972
if returncode >= 0:
973
self.last_checker_status = returncode
974
self.last_checker_signal = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
975
644
if self.last_checker_status == 0:
976
645
logger.info("Checker for %(name)s succeeded",
977
646
vars(self))
978
647
self.checked_ok()
979
648
else:
980
logger.info("Checker for %(name)s failed", vars(self))
649
logger.info("Checker for %(name)s failed",
650
vars(self))
981
651
else:
982
652
self.last_checker_status = -1
983
self.last_checker_signal = -returncode
984
653
logger.warning("Checker for %(name)s crashed?",
985
654
vars(self))
986
return False
987
655
988
656
def checked_ok(self):
989
657
"""Assert that the client has been seen, alive and well."""
990
658
self.last_checked_ok = datetime.datetime.utcnow()
991
659
self.last_checker_status = 0
992
self.last_checker_signal = None
993
660
self.bump_timeout()
994
661
995
662
def bump_timeout(self, timeout=None):
997
664
if timeout is None:
998
665
timeout = self.timeout
999
666
if self.disable_initiator_tag is not None:
1000
GLib.source_remove(self.disable_initiator_tag)
667
gobject.source_remove(self.disable_initiator_tag)
1001
668
self.disable_initiator_tag = None
1002
669
if getattr(self, "enabled", False):
1003
self.disable_initiator_tag = GLib.timeout_add(
1004
int(timeout.total_seconds() * 1000), self.disable)
670
self.disable_initiator_tag = (gobject.timeout_add
671
(timedelta_to_milliseconds
672
(timeout), self.disable))
1005
673
self.expires = datetime.datetime.utcnow() + timeout
1006
674
1007
675
def need_approval(self):
1021
689
# than 'timeout' for the client to be disabled, which is as it
1022
690
# should be.
1023
691
1024
if self.checker is not None and not self.checker.is_alive():
1025
logger.warning("Checker was not alive; joining")
1026
self.checker.join()
1027
self.checker = None
692
# If a checker exists, make sure it is not a zombie
693
try:
694
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
695
except AttributeError:
696
pass
697
except OSError as error:
698
if error.errno != errno.ECHILD:
699
raise
700
else:
701
if pid:
702
logger.warning("Checker was a zombie")
703
gobject.source_remove(self.checker_callback_tag)
704
self.checker_callback(pid, status,
705
self.current_checker_command)
1028
706
# Start a new checker if needed
1029
707
if self.checker is None:
1030
708
# Escape attributes for the shell
1031
escaped_attrs = {
1032
attr: re.escape(str(getattr(self, attr)))
1033
for attr in self.runtime_expansions }
709
escaped_attrs = dict(
710
(attr, re.escape(unicode(getattr(self, attr))))
711
for attr in
712
self.runtime_expansions)
1034
713
try:
1035
714
command = self.checker_command % escaped_attrs
1036
715
except TypeError as error:
1037
716
logger.error('Could not format string "%s"',
1038
self.checker_command,
717
self.checker_command, exc_info=error)
718
return True # Try again later
719
self.current_checker_command = command
720
try:
721
logger.info("Starting checker %r for %s",
722
command, self.name)
723
# We don't need to redirect stdout and stderr, since
724
# in normal mode, that is already done by daemon(),
725
# and in debug mode we don't want to. (Stdin is
726
# always replaced by /dev/null.)
727
# The exception is when not debugging but nevertheless
728
# running in the foreground; use the previously
729
# created wnull.
730
popen_args = {}
731
if (not self.server_settings["debug"]
732
and self.server_settings["foreground"]):
733
popen_args.update({"stdout": wnull,
734
"stderr": wnull })
735
self.checker = subprocess.Popen(command,
736
close_fds=True,
737
shell=True, cwd="/",
738
**popen_args)
739
except OSError as error:
740
logger.error("Failed to start subprocess",
1039
741
exc_info=error)
1040
return True # Try again later
1041
self.current_checker_command = command
1042
logger.info("Starting checker %r for %s", command,
1043
self.name)
1044
# We don't need to redirect stdout and stderr, since
1045
# in normal mode, that is already done by daemon(),
1046
# and in debug mode we don't want to. (Stdin is
1047
# always replaced by /dev/null.)
1048
# The exception is when not debugging but nevertheless
1049
# running in the foreground; use the previously
1050
# created wnull.
1051
popen_args = { "close_fds": True,
1052
"shell": True,
1053
"cwd": "/" }
1054
if (not self.server_settings["debug"]
1055
and self.server_settings["foreground"]):
1056
popen_args.update({"stdout": wnull,
1057
"stderr": wnull })
1058
pipe = multiprocessing.Pipe(duplex = False)
1059
self.checker = multiprocessing.Process(
1060
target = call_pipe,
1061
args = (pipe[1], subprocess.call, command),
1062
kwargs = popen_args)
1063
self.checker.start()
1064
self.checker_callback_tag = GLib.io_add_watch(
1065
pipe[0].fileno(), GLib.IO_IN,
1066
self.checker_callback, pipe[0], command)
1067
# Re-run this periodically if run by GLib.timeout_add
742
return True
743
self.checker_callback_tag = (gobject.child_watch_add
744
(self.checker.pid,
745
self.checker_callback,
746
data=command))
747
# The checker may have completed before the gobject
748
# watch was added. Check for this.
749
try:
750
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
751
except OSError as error:
752
if error.errno == errno.ECHILD:
753
# This should never happen
754
logger.error("Child process vanished",
755
exc_info=error)
756
return True
757
raise
758
if pid:
759
gobject.source_remove(self.checker_callback_tag)
760
self.checker_callback(pid, status, command)
761
# Re-run this periodically if run by gobject.timeout_add
1068
762
return True
1069
763
1070
764
def stop_checker(self):
1071
765
"""Force the checker process, if any, to stop."""
1072
766
if self.checker_callback_tag:
1073
GLib.source_remove(self.checker_callback_tag)
767
gobject.source_remove(self.checker_callback_tag)
1074
768
self.checker_callback_tag = None
1075
769
if getattr(self, "checker", None) is None:
1076
770
return
1077
771
logger.debug("Stopping checker for %(name)s", vars(self))
1078
self.checker.terminate()
772
try:
773
self.checker.terminate()
774
#time.sleep(0.5)
775
#if self.checker.poll() is None:
776
# self.checker.kill()
777
except OSError as error:
778
if error.errno != errno.ESRCH: # No such process
779
raise
1079
780
self.checker = None
1080
781
1081
782
1082
def dbus_service_property(dbus_interface,
1083
signature="v",
1084
access="readwrite",
1085
byte_arrays=False):
783
def dbus_service_property(dbus_interface, signature="v",
784
access="readwrite", byte_arrays=False):
1086
785
"""Decorators for marking methods of a DBusObjectWithProperties to
1087
786
become properties on the D-Bus.
1088
787
1097
796
# "Set" method, so we fail early here:
1098
797
if byte_arrays and signature != "ay":
1099
798
raise ValueError("Byte arrays not supported for non-'ay'"
1100
" signature {!r}".format(signature))
1101
799
" signature {0!r}".format(signature))
1102
800
def decorator(func):
1103
801
func._dbus_is_property = True
1104
802
func._dbus_interface = dbus_interface
1109
807
func._dbus_name = func._dbus_name[:-14]
1110
808
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1111
809
return func
1112
1113
810
return decorator
1114
811
1115
812
1124
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1125
822
"false"}
1126
823
"""
1127
1128
824
def decorator(func):
1129
825
func._dbus_is_interface = True
1130
826
func._dbus_interface = dbus_interface
1131
827
func._dbus_name = dbus_interface
1132
828
return func
1133
1134
829
return decorator
1135
830
1136
831
1138
833
"""Decorator to annotate D-Bus methods, signals or properties
1139
834
Usage:
1140
835
1141
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1142
"org.freedesktop.DBus.Property."
1143
"EmitsChangedSignal": "false"})
1144
836
@dbus_service_property("org.example.Interface", signature="b",
1145
837
access="r")
838
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
1146
841
def Property_dbus_property(self):
1147
842
return dbus.Boolean(False)
1148
1149
See also the DBusObjectWithAnnotations class.
1150
843
"""
1151
1152
844
def decorator(func):
1153
845
func._dbus_annotations = annotations
1154
846
return func
1155
1156
847
return decorator
1157
848
1158
849
1159
850
class DBusPropertyException(dbus.exceptions.DBusException):
1160
851
"""A base class for D-Bus property-related exceptions
1161
852
"""
1162
pass
853
def __unicode__(self):
854
return unicode(str(self))
1163
855
1164
856
1165
857
class DBusPropertyAccessException(DBusPropertyException):
1174
866
pass
1175
867
1176
868
1177
class DBusObjectWithAnnotations(dbus.service.Object):
1178
"""A D-Bus object with annotations.
869
class DBusObjectWithProperties(dbus.service.Object):
870
"""A D-Bus object with properties.
1179
871
1180
Classes inheriting from this can use the dbus_annotations
1181
decorator to add annotations to methods or signals.
872
Classes inheriting from this can use the dbus_service_property
873
decorator to expose methods as D-Bus properties. It exposes the
874
standard Get(), Set(), and GetAll() methods on the D-Bus.
1182
875
"""
1183
876
1184
877
@staticmethod
1188
881
If called like _is_dbus_thing("method") it returns a function
1189
882
suitable for use as predicate to inspect.getmembers().
1190
883
"""
1191
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
884
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1192
885
False)
1193
886
1194
887
def _get_all_dbus_things(self, thing):
1195
888
"""Returns a generator of (name, attribute) pairs
1196
889
"""
1197
return ((getattr(athing.__get__(self), "_dbus_name", name),
890
return ((getattr(athing.__get__(self), "_dbus_name",
891
name),
1198
892
athing.__get__(self))
1199
893
for cls in self.__class__.__mro__
1200
894
for name, athing in
1201
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1202
1203
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1204
out_signature = "s",
1205
path_keyword = 'object_path',
1206
connection_keyword = 'connection')
1207
def Introspect(self, object_path, connection):
1208
"""Overloading of standard D-Bus method.
1209
1210
Inserts annotation tags on methods and signals.
1211
"""
1212
xmlstring = dbus.service.Object.Introspect(self, object_path,
1213
connection)
1214
try:
1215
document = xml.dom.minidom.parseString(xmlstring)
1216
1217
for if_tag in document.getElementsByTagName("interface"):
1218
# Add annotation tags
1219
for typ in ("method", "signal"):
1220
for tag in if_tag.getElementsByTagName(typ):
1221
annots = dict()
1222
for name, prop in (self.
1223
_get_all_dbus_things(typ)):
1224
if (name == tag.getAttribute("name")
1225
and prop._dbus_interface
1226
== if_tag.getAttribute("name")):
1227
annots.update(getattr(
1228
prop, "_dbus_annotations", {}))
1229
for name, value in annots.items():
1230
ann_tag = document.createElement(
1231
"annotation")
1232
ann_tag.setAttribute("name", name)
1233
ann_tag.setAttribute("value", value)
1234
tag.appendChild(ann_tag)
1235
# Add interface annotation tags
1236
for annotation, value in dict(
1237
itertools.chain.from_iterable(
1238
annotations().items()
1239
for name, annotations
1240
in self._get_all_dbus_things("interface")
1241
if name == if_tag.getAttribute("name")
1242
)).items():
1243
ann_tag = document.createElement("annotation")
1244
ann_tag.setAttribute("name", annotation)
1245
ann_tag.setAttribute("value", value)
1246
if_tag.appendChild(ann_tag)
1247
# Fix argument name for the Introspect method itself
1248
if (if_tag.getAttribute("name")
1249
== dbus.INTROSPECTABLE_IFACE):
1250
for cn in if_tag.getElementsByTagName("method"):
1251
if cn.getAttribute("name") == "Introspect":
1252
for arg in cn.getElementsByTagName("arg"):
1253
if (arg.getAttribute("direction")
1254
== "out"):
1255
arg.setAttribute("name",
1256
"xml_data")
1257
xmlstring = document.toxml("utf-8")
1258
document.unlink()
1259
except (AttributeError, xml.dom.DOMException,
1260
xml.parsers.expat.ExpatError) as error:
1261
logger.error("Failed to override Introspection method",
1262
exc_info=error)
1263
return xmlstring
1264
1265
1266
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1267
"""A D-Bus object with properties.
1268
1269
Classes inheriting from this can use the dbus_service_property
1270
decorator to expose methods as D-Bus properties. It exposes the
1271
standard Get(), Set(), and GetAll() methods on the D-Bus.
1272
"""
895
inspect.getmembers(cls,
896
self._is_dbus_thing(thing)))
1273
897
1274
898
def _get_dbus_property(self, interface_name, property_name):
1275
899
"""Returns a bound method if one exists which is a D-Bus
1276
900
property with the specified name and interface.
1277
901
"""
1278
for cls in self.__class__.__mro__:
1279
for name, value in inspect.getmembers(
1280
cls, self._is_dbus_thing("property")):
902
for cls in self.__class__.__mro__:
903
for name, value in (inspect.getmembers
904
(cls,
905
self._is_dbus_thing("property"))):
1281
906
if (value._dbus_name == property_name
1282
907
and value._dbus_interface == interface_name):
1283
908
return value.__get__(self)
1284
909
1285
910
# No such property
1286
raise DBusPropertyNotFound("{}:{}.{}".format(
1287
self.dbus_object_path, interface_name, property_name))
1288
1289
@classmethod
1290
def _get_all_interface_names(cls):
1291
"""Get a sequence of all interfaces supported by an object"""
1292
return (name for name in set(getattr(getattr(x, attr),
1293
"_dbus_interface", None)
1294
for x in (inspect.getmro(cls))
1295
for attr in dir(x))
1296
if name is not None)
1297
1298
@dbus.service.method(dbus.PROPERTIES_IFACE,
1299
in_signature="ss",
911
raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
+ interface_name + "."
913
+ property_name)
914
915
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1300
916
out_signature="v")
1301
917
def Get(self, interface_name, property_name):
1302
918
"""Standard D-Bus property Get() method, see D-Bus standard.
1321
937
# signatures other than "ay".
1322
938
if prop._dbus_signature != "ay":
1323
939
raise ValueError("Byte arrays not supported for non-"
1324
"'ay' signature {!r}"
940
"'ay' signature {0!r}"
1325
941
.format(prop._dbus_signature))
1326
942
value = dbus.ByteArray(b''.join(chr(byte)
1327
943
for byte in value))
1328
944
prop(value)
1329
945
1330
@dbus.service.method(dbus.PROPERTIES_IFACE,
1331
in_signature="s",
946
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1332
947
out_signature="a{sv}")
1333
948
def GetAll(self, interface_name):
1334
949
"""Standard D-Bus property GetAll() method, see D-Bus
1349
964
if not hasattr(value, "variant_level"):
1350
965
properties[name] = value
1351
966
continue
1352
properties[name] = type(value)(
1353
value, variant_level = value.variant_level + 1)
967
properties[name] = type(value)(value, variant_level=
968
value.variant_level+1)
1354
969
return dbus.Dictionary(properties, signature="sv")
1355
970
1356
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1357
def PropertiesChanged(self, interface_name, changed_properties,
1358
invalidated_properties):
1359
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1360
standard.
1361
"""
1362
pass
1363
1364
971
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1365
972
out_signature="s",
1366
973
path_keyword='object_path',
1370
977
1371
978
Inserts property tags and interface annotation tags.
1372
979
"""
1373
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1374
object_path,
1375
connection)
980
xmlstring = dbus.service.Object.Introspect(self, object_path,
981
connection)
1376
982
try:
1377
983
document = xml.dom.minidom.parseString(xmlstring)
1378
1379
984
def make_tag(document, name, prop):
1380
985
e = document.createElement("property")
1381
986
e.setAttribute("name", name)
1382
987
e.setAttribute("type", prop._dbus_signature)
1383
988
e.setAttribute("access", prop._dbus_access)
1384
989
return e
1385
1386
990
for if_tag in document.getElementsByTagName("interface"):
1387
991
# Add property tags
1388
992
for tag in (make_tag(document, name, prop)
1391
995
if prop._dbus_interface
1392
996
== if_tag.getAttribute("name")):
1393
997
if_tag.appendChild(tag)
1394
# Add annotation tags for properties
1395
for tag in if_tag.getElementsByTagName("property"):
1396
annots = dict()
1397
for name, prop in self._get_all_dbus_things(
1398
"property"):
1399
if (name == tag.getAttribute("name")
1400
and prop._dbus_interface
1401
== if_tag.getAttribute("name")):
1402
annots.update(getattr(
1403
prop, "_dbus_annotations", {}))
1404
for name, value in annots.items():
1405
ann_tag = document.createElement(
1406
"annotation")
1407
ann_tag.setAttribute("name", name)
1408
ann_tag.setAttribute("value", value)
1409
tag.appendChild(ann_tag)
998
# Add annotation tags
999
for typ in ("method", "signal", "property"):
1000
for tag in if_tag.getElementsByTagName(typ):
1001
annots = dict()
1002
for name, prop in (self.
1003
_get_all_dbus_things(typ)):
1004
if (name == tag.getAttribute("name")
1005
and prop._dbus_interface
1006
== if_tag.getAttribute("name")):
1007
annots.update(getattr
1008
(prop,
1009
"_dbus_annotations",
1010
{}))
1011
for name, value in annots.iteritems():
1012
ann_tag = document.createElement(
1013
"annotation")
1014
ann_tag.setAttribute("name", name)
1015
ann_tag.setAttribute("value", value)
1016
tag.appendChild(ann_tag)
1017
# Add interface annotation tags
1018
for annotation, value in dict(
1019
itertools.chain.from_iterable(
1020
annotations().iteritems()
1021
for name, annotations in
1022
self._get_all_dbus_things("interface")
1023
if name == if_tag.getAttribute("name")
1024
)).iteritems():
1025
ann_tag = document.createElement("annotation")
1026
ann_tag.setAttribute("name", annotation)
1027
ann_tag.setAttribute("value", value)
1028
if_tag.appendChild(ann_tag)
1410
1029
# Add the names to the return values for the
1411
1030
# "org.freedesktop.DBus.Properties" methods
1412
1031
if (if_tag.getAttribute("name")
1430
1049
exc_info=error)
1431
1050
return xmlstring
1432
1051
1433
try:
1434
dbus.OBJECT_MANAGER_IFACE
1435
except AttributeError:
1436
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1437
1438
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1439
"""A D-Bus object with an ObjectManager.
1440
1441
Classes inheriting from this exposes the standard
1442
GetManagedObjects call and the InterfacesAdded and
1443
InterfacesRemoved signals on the standard
1444
"org.freedesktop.DBus.ObjectManager" interface.
1445
1446
Note: No signals are sent automatically; they must be sent
1447
manually.
1448
"""
1449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1450
out_signature = "a{oa{sa{sv}}}")
1451
def GetManagedObjects(self):
1452
"""This function must be overridden"""
1453
raise NotImplementedError()
1454
1455
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1456
signature = "oa{sa{sv}}")
1457
def InterfacesAdded(self, object_path, interfaces_and_properties):
1458
pass
1459
1460
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1461
def InterfacesRemoved(self, object_path, interfaces):
1462
pass
1463
1464
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1465
out_signature = "s",
1466
path_keyword = 'object_path',
1467
connection_keyword = 'connection')
1468
def Introspect(self, object_path, connection):
1469
"""Overloading of standard D-Bus method.
1470
1471
Override return argument name of GetManagedObjects to be
1472
"objpath_interfaces_and_properties"
1473
"""
1474
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1475
object_path,
1476
connection)
1477
try:
1478
document = xml.dom.minidom.parseString(xmlstring)
1479
1480
for if_tag in document.getElementsByTagName("interface"):
1481
# Fix argument name for the GetManagedObjects method
1482
if (if_tag.getAttribute("name")
1483
== dbus.OBJECT_MANAGER_IFACE):
1484
for cn in if_tag.getElementsByTagName("method"):
1485
if (cn.getAttribute("name")
1486
== "GetManagedObjects"):
1487
for arg in cn.getElementsByTagName("arg"):
1488
if (arg.getAttribute("direction")
1489
== "out"):
1490
arg.setAttribute(
1491
"name",
1492
"objpath_interfaces"
1493
"_and_properties")
1494
xmlstring = document.toxml("utf-8")
1495
document.unlink()
1496
except (AttributeError, xml.dom.DOMException,
1497
xml.parsers.expat.ExpatError) as error:
1498
logger.error("Failed to override Introspection method",
1499
exc_info = error)
1500
return xmlstring
1501
1052
1502
1053
def datetime_to_dbus(dt, variant_level=0):
1503
1054
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1504
1055
if dt is None:
1505
1056
return dbus.String("", variant_level = variant_level)
1506
return dbus.String(dt.isoformat(), variant_level=variant_level)
1057
return dbus.String(dt.isoformat(),
1058
variant_level=variant_level)
1507
1059
1508
1060
1509
1061
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1529
1081
(from DBusObjectWithProperties) and interfaces (from the
1530
1082
dbus_interface_annotations decorator).
1531
1083
"""
1532
1533
1084
def wrapper(cls):
1534
1085
for orig_interface_name, alt_interface_name in (
1535
alt_interface_names.items()):
1086
alt_interface_names.iteritems()):
1536
1087
attr = {}
1537
1088
interface_names = set()
1538
1089
# Go though all attributes of the class
1540
1091
# Ignore non-D-Bus attributes, and D-Bus attributes
1541
1092
# with the wrong interface name
1542
1093
if (not hasattr(attribute, "_dbus_interface")
1543
or not attribute._dbus_interface.startswith(
1544
orig_interface_name)):
1094
or not attribute._dbus_interface
1095
.startswith(orig_interface_name)):
1545
1096
continue
1546
1097
# Create an alternate D-Bus interface name based on
1547
1098
# the current name
1548
alt_interface = attribute._dbus_interface.replace(
1549
orig_interface_name, alt_interface_name)
1099
alt_interface = (attribute._dbus_interface
1100
.replace(orig_interface_name,
1101
alt_interface_name))
1550
1102
interface_names.add(alt_interface)
1551
1103
# Is this a D-Bus signal?
1552
1104
if getattr(attribute, "_dbus_is_signal", False):
1553
1105
# Extract the original non-method undecorated
1554
1106
# function by black magic
1555
if sys.version_info.major == 2:
1556
nonmethod_func = (dict(
1107
nonmethod_func = (dict(
1557
1108
zip(attribute.func_code.co_freevars,
1558
attribute.__closure__))
1559
["func"].cell_contents)
1560
else:
1561
nonmethod_func = (dict(
1562
zip(attribute.__code__.co_freevars,
1563
attribute.__closure__))
1564
["func"].cell_contents)
1109
attribute.__closure__))["func"]
1110
.cell_contents)
1565
1111
# Create a new, but exactly alike, function
1566
1112
# object, and decorate it to be a new D-Bus signal
1567
1113
# with the alternate D-Bus interface name
1568
new_function = copy_function(nonmethod_func)
1569
new_function = (dbus.service.signal(
1570
alt_interface,
1571
attribute._dbus_signature)(new_function))
1114
new_function = (dbus.service.signal
1115
(alt_interface,
1116
attribute._dbus_signature)
1117
(types.FunctionType(
1118
nonmethod_func.func_code,
1119
nonmethod_func.func_globals,
1120
nonmethod_func.func_name,
1121
nonmethod_func.func_defaults,
1122
nonmethod_func.func_closure)))
1572
1123
# Copy annotations, if any
1573
1124
try:
1574
new_function._dbus_annotations = dict(
1575
attribute._dbus_annotations)
1125
new_function._dbus_annotations = (
1126
dict(attribute._dbus_annotations))
1576
1127
except AttributeError:
1577
1128
pass
1578
1129
# Define a creator of a function to call both the
1583
1134
"""This function is a scope container to pass
1584
1135
func1 and func2 to the "call_both" function
1585
1136
outside of its arguments"""
1586
1587
@functools.wraps(func2)
1588
1137
def call_both(*args, **kwargs):
1589
1138
"""This function will emit two D-Bus
1590
1139
signals by calling func1 and func2"""
1591
1140
func1(*args, **kwargs)
1592
1141
func2(*args, **kwargs)
1593
# Make wrapper function look like a D-Bus signal
1594
for name, attr in inspect.getmembers(func2):
1595
if name.startswith("_dbus_"):
1596
setattr(call_both, name, attr)
1597
1598
1142
return call_both
1599
1143
# Create the "call_both" function and add it to
1600
1144
# the class
1605
1149
# object. Decorate it to be a new D-Bus method
1606
1150
# with the alternate D-Bus interface name. Add it
1607
1151
# to the class.
1608
attr[attrname] = (
1609
dbus.service.method(
1610
alt_interface,
1611
attribute._dbus_in_signature,
1612
attribute._dbus_out_signature)
1613
(copy_function(attribute)))
1152
attr[attrname] = (dbus.service.method
1153
(alt_interface,
1154
attribute._dbus_in_signature,
1155
attribute._dbus_out_signature)
1156
(types.FunctionType
1157
(attribute.func_code,
1158
attribute.func_globals,
1159
attribute.func_name,
1160
attribute.func_defaults,
1161
attribute.func_closure)))
1614
1162
# Copy annotations, if any
1615
1163
try:
1616
attr[attrname]._dbus_annotations = dict(
1617
attribute._dbus_annotations)
1164
attr[attrname]._dbus_annotations = (
1165
dict(attribute._dbus_annotations))
1618
1166
except AttributeError:
1619
1167
pass
1620
1168
# Is this a D-Bus property?
1623
1171
# object, and decorate it to be a new D-Bus
1624
1172
# property with the alternate D-Bus interface
1625
1173
# name. Add it to the class.
1626
attr[attrname] = (dbus_service_property(
1627
alt_interface, attribute._dbus_signature,
1628
attribute._dbus_access,
1629
attribute._dbus_get_args_options
1630
["byte_arrays"])
1631
(copy_function(attribute)))
1174
attr[attrname] = (dbus_service_property
1175
(alt_interface,
1176
attribute._dbus_signature,
1177
attribute._dbus_access,
1178
attribute
1179
._dbus_get_args_options
1180
["byte_arrays"])
1181
(types.FunctionType
1182
(attribute.func_code,
1183
attribute.func_globals,
1184
attribute.func_name,
1185
attribute.func_defaults,
1186
attribute.func_closure)))
1632
1187
# Copy annotations, if any
1633
1188
try:
1634
attr[attrname]._dbus_annotations = dict(
1635
attribute._dbus_annotations)
1189
attr[attrname]._dbus_annotations = (
1190
dict(attribute._dbus_annotations))
1636
1191
except AttributeError:
1637
1192
pass
1638
1193
# Is this a D-Bus interface?
1641
1196
# object. Decorate it to be a new D-Bus interface
1642
1197
# with the alternate D-Bus interface name. Add it
1643
1198
# to the class.
1644
attr[attrname] = (
1645
dbus_interface_annotations(alt_interface)
1646
(copy_function(attribute)))
1199
attr[attrname] = (dbus_interface_annotations
1200
(alt_interface)
1201
(types.FunctionType
1202
(attribute.func_code,
1203
attribute.func_globals,
1204
attribute.func_name,
1205
attribute.func_defaults,
1206
attribute.func_closure)))
1647
1207
if deprecate:
1648
1208
# Deprecate all alternate interfaces
1649
iname="_AlternateDBusNames_interface_annotation{}"
1209
iname="_AlternateDBusNames_interface_annotation{0}"
1650
1210
for interface_name in interface_names:
1651
1652
1211
@dbus_interface_annotations(interface_name)
1653
1212
def func(self):
1654
1213
return { "org.freedesktop.DBus.Deprecated":
1655
"true" }
1214
"true" }
1656
1215
# Find an unused name
1657
1216
for aname in (iname.format(i)
1658
1217
for i in itertools.count()):
1662
1221
if interface_names:
1663
1222
# Replace the class with a new subclass of it with
1664
1223
# methods, signals, etc. as created above.
1665
if sys.version_info.major == 2:
1666
cls = type(b"{}Alternate".format(cls.__name__),
1667
(cls, ), attr)
1668
else:
1669
cls = type("{}Alternate".format(cls.__name__),
1670
(cls, ), attr)
1224
cls = type(b"{0}Alternate".format(cls.__name__),
1225
(cls,), attr)
1671
1226
return cls
1672
1673
1227
return wrapper
1674
1228
1675
1229
1676
1230
@alternate_dbus_interfaces({"se.recompile.Mandos":
1677
"se.bsnet.fukt.Mandos"})
1231
"se.bsnet.fukt.Mandos"})
1678
1232
class ClientDBus(Client, DBusObjectWithProperties):
1679
1233
"""A Client class using D-Bus
1680
1234
1684
1238
"""
1685
1239
1686
1240
runtime_expansions = (Client.runtime_expansions
1687
+ ("dbus_object_path", ))
1688
1689
_interface = "se.recompile.Mandos.Client"
1241
+ ("dbus_object_path",))
1690
1242
1691
1243
# dbus.service.Object doesn't use super(), so we can't either.
1692
1244
1695
1247
Client.__init__(self, *args, **kwargs)
1696
1248
# Only now, when this client is initialized, can it show up on
1697
1249
# the D-Bus
1698
client_object_name = str(self.name).translate(
1250
client_object_name = unicode(self.name).translate(
1699
1251
{ord("."): ord("_"),
1700
1252
ord("-"): ord("_")})
1701
self.dbus_object_path = dbus.ObjectPath(
1702
"/clients/" + client_object_name)
1253
self.dbus_object_path = (dbus.ObjectPath
1254
("/clients/" + client_object_name))
1703
1255
DBusObjectWithProperties.__init__(self, self.bus,
1704
1256
self.dbus_object_path)
1705
1257
1706
def notifychangeproperty(transform_func, dbus_name,
1707
type_func=lambda x: x,
1708
variant_level=1,
1709
invalidate_only=False,
1710
_interface=_interface):
1258
def notifychangeproperty(transform_func,
1259
dbus_name, type_func=lambda x: x,
1260
variant_level=1):
1711
1261
""" Modify a variable so that it's a property which announces
1712
1262
its changes to DBus.
1713
1263
1718
1268
to the D-Bus. Default: no transform
1719
1269
variant_level: D-Bus variant level. Default: 1
1720
1270
"""
1721
attrname = "_{}".format(dbus_name)
1722
1271
attrname = "_{0}".format(dbus_name)
1723
1272
def setter(self, value):
1724
1273
if hasattr(self, "dbus_object_path"):
1725
1274
if (not hasattr(self, attrname) or
1726
1275
type_func(getattr(self, attrname, None))
1727
1276
!= type_func(value)):
1728
if invalidate_only:
1729
self.PropertiesChanged(
1730
_interface, dbus.Dictionary(),
1731
dbus.Array((dbus_name, )))
1732
else:
1733
dbus_value = transform_func(
1734
type_func(value),
1735
variant_level = variant_level)
1736
self.PropertyChanged(dbus.String(dbus_name),
1737
dbus_value)
1738
self.PropertiesChanged(
1739
_interface,
1740
dbus.Dictionary({ dbus.String(dbus_name):
1741
dbus_value }),
1742
dbus.Array())
1277
dbus_value = transform_func(type_func(value),
1278
variant_level
1279
=variant_level)
1280
self.PropertyChanged(dbus.String(dbus_name),
1281
dbus_value)
1743
1282
setattr(self, attrname, value)
1744
1283
1745
1284
return property(lambda self: getattr(self, attrname), setter)
1751
1290
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1752
1291
last_enabled = notifychangeproperty(datetime_to_dbus,
1753
1292
"LastEnabled")
1754
checker = notifychangeproperty(
1755
dbus.Boolean, "CheckerRunning",
1756
type_func = lambda checker: checker is not None)
1293
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1294
type_func = lambda checker:
1295
checker is not None)
1757
1296
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1758
1297
"LastCheckedOK")
1759
1298
last_checker_status = notifychangeproperty(dbus.Int16,
1762
1301
datetime_to_dbus, "LastApprovalRequest")
1763
1302
approved_by_default = notifychangeproperty(dbus.Boolean,
1764
1303
"ApprovedByDefault")
1765
approval_delay = notifychangeproperty(
1766
dbus.UInt64, "ApprovalDelay",
1767
type_func = lambda td: td.total_seconds() * 1000)
1304
approval_delay = notifychangeproperty(dbus.UInt64,
1305
"ApprovalDelay",
1306
type_func =
1307
timedelta_to_milliseconds)
1768
1308
approval_duration = notifychangeproperty(
1769
1309
dbus.UInt64, "ApprovalDuration",
1770
type_func = lambda td: td.total_seconds() * 1000)
1310
type_func = timedelta_to_milliseconds)
1771
1311
host = notifychangeproperty(dbus.String, "Host")
1772
timeout = notifychangeproperty(
1773
dbus.UInt64, "Timeout",
1774
type_func = lambda td: td.total_seconds() * 1000)
1312
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
type_func =
1314
timedelta_to_milliseconds)
1775
1315
extended_timeout = notifychangeproperty(
1776
1316
dbus.UInt64, "ExtendedTimeout",
1777
type_func = lambda td: td.total_seconds() * 1000)
1778
interval = notifychangeproperty(
1779
dbus.UInt64, "Interval",
1780
type_func = lambda td: td.total_seconds() * 1000)
1317
type_func = timedelta_to_milliseconds)
1318
interval = notifychangeproperty(dbus.UInt64,
1319
"Interval",
1320
type_func =
1321
timedelta_to_milliseconds)
1781
1322
checker_command = notifychangeproperty(dbus.String, "Checker")
1782
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1783
invalidate_only=True)
1784
1323
1785
1324
del notifychangeproperty
1786
1325
1793
1332
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1794
1333
Client.__del__(self, *args, **kwargs)
1795
1334
1796
def checker_callback(self, source, condition,
1797
connection, command, *args, **kwargs):
1798
ret = Client.checker_callback(self, source, condition,
1799
connection, command, *args,
1800
**kwargs)
1801
exitstatus = self.last_checker_status
1802
if exitstatus >= 0:
1335
def checker_callback(self, pid, condition, command,
1336
*args, **kwargs):
1337
self.checker_callback_tag = None
1338
self.checker = None
1339
if os.WIFEXITED(condition):
1340
exitstatus = os.WEXITSTATUS(condition)
1803
1341
# Emit D-Bus signal
1804
1342
self.CheckerCompleted(dbus.Int16(exitstatus),
1805
# This is specific to GNU libC
1806
dbus.Int64(exitstatus << 8),
1343
dbus.Int64(condition),
1807
1344
dbus.String(command))
1808
1345
else:
1809
1346
# Emit D-Bus signal
1810
1347
self.CheckerCompleted(dbus.Int16(-1),
1811
dbus.Int64(
1812
# This is specific to GNU libC
1813
(exitstatus << 8)
1814
| self.last_checker_signal),
1348
dbus.Int64(condition),
1815
1349
dbus.String(command))
1816
return ret
1350
1351
return Client.checker_callback(self, pid, condition, command,
1352
*args, **kwargs)
1817
1353
1818
1354
def start_checker(self, *args, **kwargs):
1819
1355
old_checker_pid = getattr(self.checker, "pid", None)
1831
1367
1832
1368
def approve(self, value=True):
1833
1369
self.approved = value
1834
GLib.timeout_add(int(self.approval_duration.total_seconds()
1835
* 1000), self._reset_approved)
1370
gobject.timeout_add(timedelta_to_milliseconds
1371
(self.approval_duration),
1372
self._reset_approved)
1836
1373
self.send_changedstate()
1837
1374
1838
1375
## D-Bus methods, signals & properties
1376
_interface = "se.recompile.Mandos.Client"
1839
1377
1840
1378
## Interfaces
1841
1379
1380
@dbus_interface_annotations(_interface)
1381
def _foo(self):
1382
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1383
"false"}
1384
1842
1385
## Signals
1843
1386
1844
1387
# CheckerCompleted - signal
1854
1397
pass
1855
1398
1856
1399
# PropertyChanged - signal
1857
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1858
1400
@dbus.service.signal(_interface, signature="sv")
1859
1401
def PropertyChanged(self, property, value):
1860
1402
"D-Bus signal"
1894
1436
self.checked_ok()
1895
1437
1896
1438
# Enable - method
1897
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1898
1439
@dbus.service.method(_interface)
1899
1440
def Enable(self):
1900
1441
"D-Bus method"
1901
1442
self.enable()
1902
1443
1903
1444
# StartChecker - method
1904
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1905
1445
@dbus.service.method(_interface)
1906
1446
def StartChecker(self):
1907
1447
"D-Bus method"
1908
1448
self.start_checker()
1909
1449
1910
1450
# Disable - method
1911
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1912
1451
@dbus.service.method(_interface)
1913
1452
def Disable(self):
1914
1453
"D-Bus method"
1915
1454
self.disable()
1916
1455
1917
1456
# StopChecker - method
1918
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1919
1457
@dbus.service.method(_interface)
1920
1458
def StopChecker(self):
1921
1459
self.stop_checker()
1928
1466
return dbus.Boolean(bool(self.approvals_pending))
1929
1467
1930
1468
# ApprovedByDefault - property
1931
@dbus_service_property(_interface,
1932
signature="b",
1469
@dbus_service_property(_interface, signature="b",
1933
1470
access="readwrite")
1934
1471
def ApprovedByDefault_dbus_property(self, value=None):
1935
1472
if value is None: # get
1937
1474
self.approved_by_default = bool(value)
1938
1475
1939
1476
# ApprovalDelay - property
1940
@dbus_service_property(_interface,
1941
signature="t",
1477
@dbus_service_property(_interface, signature="t",
1942
1478
access="readwrite")
1943
1479
def ApprovalDelay_dbus_property(self, value=None):
1944
1480
if value is None: # get
1945
return dbus.UInt64(self.approval_delay.total_seconds()
1946
* 1000)
1481
return dbus.UInt64(self.approval_delay_milliseconds())
1947
1482
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1948
1483
1949
1484
# ApprovalDuration - property
1950
@dbus_service_property(_interface,
1951
signature="t",
1485
@dbus_service_property(_interface, signature="t",
1952
1486
access="readwrite")
1953
1487
def ApprovalDuration_dbus_property(self, value=None):
1954
1488
if value is None: # get
1955
return dbus.UInt64(self.approval_duration.total_seconds()
1956
* 1000)
1489
return dbus.UInt64(timedelta_to_milliseconds(
1490
self.approval_duration))
1957
1491
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1958
1492
1959
1493
# Name - property
1960
@dbus_annotations(
1961
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1962
1494
@dbus_service_property(_interface, signature="s", access="read")
1963
1495
def Name_dbus_property(self):
1964
1496
return dbus.String(self.name)
1965
1497
1966
1498
# Fingerprint - property
1967
@dbus_annotations(
1968
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1969
1499
@dbus_service_property(_interface, signature="s", access="read")
1970
1500
def Fingerprint_dbus_property(self):
1971
1501
return dbus.String(self.fingerprint)
1972
1502
1973
1503
# Host - property
1974
@dbus_service_property(_interface,
1975
signature="s",
1504
@dbus_service_property(_interface, signature="s",
1976
1505
access="readwrite")
1977
1506
def Host_dbus_property(self, value=None):
1978
1507
if value is None: # get
1979
1508
return dbus.String(self.host)
1980
self.host = str(value)
1509
self.host = unicode(value)
1981
1510
1982
1511
# Created - property
1983
@dbus_annotations(
1984
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1985
1512
@dbus_service_property(_interface, signature="s", access="read")
1986
1513
def Created_dbus_property(self):
1987
1514
return datetime_to_dbus(self.created)
1992
1519
return datetime_to_dbus(self.last_enabled)
1993
1520
1994
1521
# Enabled - property
1995
@dbus_service_property(_interface,
1996
signature="b",
1522
@dbus_service_property(_interface, signature="b",
1997
1523
access="readwrite")
1998
1524
def Enabled_dbus_property(self, value=None):
1999
1525
if value is None: # get
2004
1530
self.disable()
2005
1531
2006
1532
# LastCheckedOK - property
2007
@dbus_service_property(_interface,
2008
signature="s",
1533
@dbus_service_property(_interface, signature="s",
2009
1534
access="readwrite")
2010
1535
def LastCheckedOK_dbus_property(self, value=None):
2011
1536
if value is not None:
2014
1539
return datetime_to_dbus(self.last_checked_ok)
2015
1540
2016
1541
# LastCheckerStatus - property
2017
@dbus_service_property(_interface, signature="n", access="read")
1542
@dbus_service_property(_interface, signature="n",
1543
access="read")
2018
1544
def LastCheckerStatus_dbus_property(self):
2019
1545
return dbus.Int16(self.last_checker_status)
2020
1546
2029
1555
return datetime_to_dbus(self.last_approval_request)
2030
1556
2031
1557
# Timeout - property
2032
@dbus_service_property(_interface,
2033
signature="t",
1558
@dbus_service_property(_interface, signature="t",
2034
1559
access="readwrite")
2035
1560
def Timeout_dbus_property(self, value=None):
2036
1561
if value is None: # get
2037
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1562
return dbus.UInt64(self.timeout_milliseconds())
2038
1563
old_timeout = self.timeout
2039
1564
self.timeout = datetime.timedelta(0, 0, 0, value)
2040
1565
# Reschedule disabling
2048
1573
if (getattr(self, "disable_initiator_tag", None)
2049
1574
is None):
2050
1575
return
2051
GLib.source_remove(self.disable_initiator_tag)
2052
self.disable_initiator_tag = GLib.timeout_add(
2053
int((self.expires - now).total_seconds() * 1000),
2054
self.disable)
1576
gobject.source_remove(self.disable_initiator_tag)
1577
self.disable_initiator_tag = (
1578
gobject.timeout_add(
1579
timedelta_to_milliseconds(self.expires - now),
1580
self.disable))
2055
1581
2056
1582
# ExtendedTimeout - property
2057
@dbus_service_property(_interface,
2058
signature="t",
1583
@dbus_service_property(_interface, signature="t",
2059
1584
access="readwrite")
2060
1585
def ExtendedTimeout_dbus_property(self, value=None):
2061
1586
if value is None: # get
2062
return dbus.UInt64(self.extended_timeout.total_seconds()
2063
* 1000)
1587
return dbus.UInt64(self.extended_timeout_milliseconds())
2064
1588
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2065
1589
2066
1590
# Interval - property
2067
@dbus_service_property(_interface,
2068
signature="t",
1591
@dbus_service_property(_interface, signature="t",
2069
1592
access="readwrite")
2070
1593
def Interval_dbus_property(self, value=None):
2071
1594
if value is None: # get
2072
return dbus.UInt64(self.interval.total_seconds() * 1000)
1595
return dbus.UInt64(self.interval_milliseconds())
2073
1596
self.interval = datetime.timedelta(0, 0, 0, value)
2074
1597
if getattr(self, "checker_initiator_tag", None) is None:
2075
1598
return
2076
1599
if self.enabled:
2077
1600
# Reschedule checker run
2078
GLib.source_remove(self.checker_initiator_tag)
2079
self.checker_initiator_tag = GLib.timeout_add(
2080
value, self.start_checker)
2081
self.start_checker() # Start one now, too
1601
gobject.source_remove(self.checker_initiator_tag)
1602
self.checker_initiator_tag = (gobject.timeout_add
1603
(value, self.start_checker))
1604
self.start_checker() # Start one now, too
2082
1605
2083
1606
# Checker - property
2084
@dbus_service_property(_interface,
2085
signature="s",
1607
@dbus_service_property(_interface, signature="s",
2086
1608
access="readwrite")
2087
1609
def Checker_dbus_property(self, value=None):
2088
1610
if value is None: # get
2089
1611
return dbus.String(self.checker_command)
2090
self.checker_command = str(value)
1612
self.checker_command = unicode(value)
2091
1613
2092
1614
# CheckerRunning - property
2093
@dbus_service_property(_interface,
2094
signature="b",
1615
@dbus_service_property(_interface, signature="b",
2095
1616
access="readwrite")
2096
1617
def CheckerRunning_dbus_property(self, value=None):
2097
1618
if value is None: # get
2102
1623
self.stop_checker()
2103
1624
2104
1625
# ObjectPath - property
2105
@dbus_annotations(
2106
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2107
"org.freedesktop.DBus.Deprecated": "true"})
2108
1626
@dbus_service_property(_interface, signature="o", access="read")
2109
1627
def ObjectPath_dbus_property(self):
2110
1628
return self.dbus_object_path # is already a dbus.ObjectPath
2111
1629
2112
1630
# Secret = property
2113
@dbus_annotations(
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2115
"invalidates"})
2116
@dbus_service_property(_interface,
2117
signature="ay",
2118
access="write",
2119
byte_arrays=True)
1631
@dbus_service_property(_interface, signature="ay",
1632
access="write", byte_arrays=True)
2120
1633
def Secret_dbus_property(self, value):
2121
self.secret = bytes(value)
1634
self.secret = str(value)
2122
1635
2123
1636
del _interface
2124
1637
2128
1641
self._pipe = child_pipe
2129
1642
self._pipe.send(('init', fpr, address))
2130
1643
if not self._pipe.recv():
2131
raise KeyError(fpr)
1644
raise KeyError()
2132
1645
2133
1646
def __getattribute__(self, name):
2134
1647
if name == '_pipe':
2138
1651
if data[0] == 'data':
2139
1652
return data[1]
2140
1653
if data[0] == 'function':
2141
2142
1654
def func(*args, **kwargs):
2143
1655
self._pipe.send(('funcall', name, args, kwargs))
2144
1656
return self._pipe.recv()[1]
2145
2146
1657
return func
2147
1658
2148
1659
def __setattr__(self, name, value):
2160
1671
def handle(self):
2161
1672
with contextlib.closing(self.server.child_pipe) as child_pipe:
2162
1673
logger.info("TCP connection from: %s",
2163
str(self.client_address))
1674
unicode(self.client_address))
2164
1675
logger.debug("Pipe FD: %d",
2165
1676
self.server.child_pipe.fileno())
2166
1677
2167
session = gnutls.ClientSession(self.request)
1678
session = (gnutls.connection
1679
.ClientSession(self.request,
1680
gnutls.connection
1681
.X509Credentials()))
1682
1683
# Note: gnutls.connection.X509Credentials is really a
1684
# generic GnuTLS certificate credentials object so long as
1685
# no X.509 keys are added to it. Therefore, we can use it
1686
# here despite using OpenPGP certificates.
2168
1687
2169
1688
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2170
1689
# "+AES-256-CBC", "+SHA1",
2174
1693
priority = self.server.gnutls_priority
2175
1694
if priority is None:
2176
1695
priority = "NORMAL"
2177
gnutls.priority_set_direct(session._c_object, priority,
2178
None)
1696
(gnutls.library.functions
1697
.gnutls_priority_set_direct(session._c_object,
1698
priority, None))
2179
1699
2180
1700
# Start communication using the Mandos protocol
2181
1701
# Get protocol number
2191
1711
# Start GnuTLS connection
2192
1712
try:
2193
1713
session.handshake()
2194
except gnutls.Error as error:
1714
except gnutls.errors.GNUTLSError as error:
2195
1715
logger.warning("Handshake failed: %s", error)
2196
1716
# Do not run session.bye() here: the session is not
2197
1717
# established. Just abandon the request.
2201
1721
approval_required = False
2202
1722
try:
2203
1723
try:
2204
fpr = self.fingerprint(
2205
self.peer_certificate(session))
2206
except (TypeError, gnutls.Error) as error:
1724
fpr = self.fingerprint(self.peer_certificate
1725
(session))
1726
except (TypeError,
1727
gnutls.errors.GNUTLSError) as error:
2207
1728
logger.warning("Bad certificate: %s", error)
2208
1729
return
2209
1730
logger.debug("Fingerprint: %s", fpr)
2222
1743
while True:
2223
1744
if not client.enabled:
2224
1745
logger.info("Client %s is disabled",
2225
client.name)
1746
client.name)
2226
1747
if self.server.use_dbus:
2227
1748
# Emit D-Bus signal
2228
1749
client.Rejected("Disabled")
2237
1758
if self.server.use_dbus:
2238
1759
# Emit D-Bus signal
2239
1760
client.NeedApproval(
2240
client.approval_delay.total_seconds()
2241
* 1000, client.approved_by_default)
1761
client.approval_delay_milliseconds(),
1762
client.approved_by_default)
2242
1763
else:
2243
1764
logger.warning("Client %s was not approved",
2244
1765
client.name)
2250
1771
#wait until timeout or approved
2251
1772
time = datetime.datetime.now()
2252
1773
client.changedstate.acquire()
2253
client.changedstate.wait(delay.total_seconds())
1774
client.changedstate.wait(
1775
float(timedelta_to_milliseconds(delay)
1776
/ 1000))
2254
1777
client.changedstate.release()
2255
1778
time2 = datetime.datetime.now()
2256
1779
if (time2 - time) >= delay:
2267
1790
else:
2268
1791
delay -= time2 - time
2269
1792
2270
try:
2271
session.send(client.secret)
2272
except gnutls.Error as error:
2273
logger.warning("gnutls send failed",
2274
exc_info = error)
2275
return
1793
sent_size = 0
1794
while sent_size < len(client.secret):
1795
try:
1796
sent = session.send(client.secret[sent_size:])
1797
except gnutls.errors.GNUTLSError as error:
1798
logger.warning("gnutls send failed",
1799
exc_info=error)
1800
return
1801
logger.debug("Sent: %d, remaining: %d",
1802
sent, len(client.secret)
1803
- (sent_size + sent))
1804
sent_size += sent
2276
1805
2277
1806
logger.info("Sending secret to %s", client.name)
2278
1807
# bump the timeout using extended_timeout
2286
1815
client.approvals_pending -= 1
2287
1816
try:
2288
1817
session.bye()
2289
except gnutls.Error as error:
1818
except gnutls.errors.GNUTLSError as error:
2290
1819
logger.warning("GnuTLS bye failed",
2291
1820
exc_info=error)
2292
1821
2294
1823
def peer_certificate(session):
2295
1824
"Return the peer's OpenPGP certificate as a bytestring"
2296
1825
# If not an OpenPGP certificate...
2297
if (gnutls.certificate_type_get(session._c_object)
2298
!= gnutls.CRT_OPENPGP):
2299
# ...return invalid data
2300
return b""
1826
if (gnutls.library.functions
1827
.gnutls_certificate_type_get(session._c_object)
1828
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1829
# ...do the normal thing
1830
return session.peer_certificate
2301
1831
list_size = ctypes.c_uint(1)
2302
cert_list = (gnutls.certificate_get_peers
1832
cert_list = (gnutls.library.functions
1833
.gnutls_certificate_get_peers
2303
1834
(session._c_object, ctypes.byref(list_size)))
2304
1835
if not bool(cert_list) and list_size.value != 0:
2305
raise gnutls.Error("error getting peer certificate")
1836
raise gnutls.errors.GNUTLSError("error getting peer"
1837
" certificate")
2306
1838
if list_size.value == 0:
2307
1839
return None
2308
1840
cert = cert_list[0]
2312
1844
def fingerprint(openpgp):
2313
1845
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2314
1846
# New GnuTLS "datum" with the OpenPGP public key
2315
datum = gnutls.datum_t(
2316
ctypes.cast(ctypes.c_char_p(openpgp),
2317
ctypes.POINTER(ctypes.c_ubyte)),
2318
ctypes.c_uint(len(openpgp)))
1847
datum = (gnutls.library.types
1848
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1849
ctypes.POINTER
1850
(ctypes.c_ubyte)),
1851
ctypes.c_uint(len(openpgp))))
2319
1852
# New empty GnuTLS certificate
2320
crt = gnutls.openpgp_crt_t()
2321
gnutls.openpgp_crt_init(ctypes.byref(crt))
1853
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1854
(gnutls.library.functions
1855
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2322
1856
# Import the OpenPGP public key into the certificate
2323
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2324
gnutls.OPENPGP_FMT_RAW)
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1859
gnutls.library.constants
1860
.GNUTLS_OPENPGP_FMT_RAW))
2325
1861
# Verify the self signature in the key
2326
1862
crtverify = ctypes.c_uint()
2327
gnutls.openpgp_crt_verify_self(crt, 0,
2328
ctypes.byref(crtverify))
1863
(gnutls.library.functions
1864
.gnutls_openpgp_crt_verify_self(crt, 0,
1865
ctypes.byref(crtverify)))
2329
1866
if crtverify.value != 0:
2330
gnutls.openpgp_crt_deinit(crt)
2331
raise gnutls.CertificateSecurityError("Verify failed")
1867
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1868
raise (gnutls.errors.CertificateSecurityError
1869
("Verify failed"))
2332
1870
# New buffer for the fingerprint
2333
1871
buf = ctypes.create_string_buffer(20)
2334
1872
buf_len = ctypes.c_size_t()
2335
1873
# Get the fingerprint from the certificate into the buffer
2336
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2337
ctypes.byref(buf_len))
1874
(gnutls.library.functions
1875
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1876
ctypes.byref(buf_len)))
2338
1877
# Deinit the certificate
2339
gnutls.openpgp_crt_deinit(crt)
1878
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2340
1879
# Convert the buffer to a Python bytestring
2341
1880
fpr = ctypes.string_at(buf, buf_len.value)
2342
1881
# Convert the bytestring to hexadecimal notation
2346
1885
2347
1886
class MultiprocessingMixIn(object):
2348
1887
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2349
2350
1888
def sub_process_main(self, request, address):
2351
1889
try:
2352
1890
self.finish_request(request, address)
2364
1902
2365
1903
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2366
1904
""" adds a pipe to the MixIn """
2367
2368
1905
def process_request(self, request, client_address):
2369
1906
"""Overrides and wraps the original process_request().
2370
1907
2391
1928
interface: None or a network interface name (string)
2392
1929
use_ipv6: Boolean; to use IPv6 or not
2393
1930
"""
2394
2395
1931
def __init__(self, server_address, RequestHandlerClass,
2396
interface=None,
2397
use_ipv6=True,
2398
socketfd=None):
1932
interface=None, use_ipv6=True, socketfd=None):
2399
1933
"""If socketfd is set, use that file descriptor instead of
2400
1934
creating a new one with socket.socket().
2401
1935
"""
2442
1976
self.interface)
2443
1977
else:
2444
1978
try:
2445
self.socket.setsockopt(
2446
socket.SOL_SOCKET, SO_BINDTODEVICE,
2447
(self.interface + "\0").encode("utf-8"))
1979
self.socket.setsockopt(socket.SOL_SOCKET,
1980
SO_BINDTODEVICE,
1981
str(self.interface + '\0'))
2448
1982
except socket.error as error:
2449
1983
if error.errno == errno.EPERM:
2450
1984
logger.error("No permission to bind to"
2468
2002
self.server_address = (any_address,
2469
2003
self.server_address[1])
2470
2004
elif not self.server_address[1]:
2471
self.server_address = (self.server_address[0], 0)
2005
self.server_address = (self.server_address[0],
2006
0)
2472
2007
# if self.interface:
2473
2008
# self.server_address = (self.server_address[0],
2474
2009
# 0, # port
2486
2021
gnutls_priority GnuTLS priority string
2487
2022
use_dbus: Boolean; to emit D-Bus signals or not
2488
2023
2489
Assumes a GLib.MainLoop event loop.
2024
Assumes a gobject.MainLoop event loop.
2490
2025
"""
2491
2492
2026
def __init__(self, server_address, RequestHandlerClass,
2493
interface=None,
2494
use_ipv6=True,
2495
clients=None,
2496
gnutls_priority=None,
2497
use_dbus=True,
2498
socketfd=None):
2027
interface=None, use_ipv6=True, clients=None,
2028
gnutls_priority=None, use_dbus=True, socketfd=None):
2499
2029
self.enabled = False
2500
2030
self.clients = clients
2501
2031
if self.clients is None:
2507
2037
interface = interface,
2508
2038
use_ipv6 = use_ipv6,
2509
2039
socketfd = socketfd)
2510
2511
2040
def server_activate(self):
2512
2041
if self.enabled:
2513
2042
return socketserver.TCPServer.server_activate(self)
2517
2046
2518
2047
def add_pipe(self, parent_pipe, proc):
2519
2048
# Call "handle_ipc" for both data and EOF events
2520
GLib.io_add_watch(
2521
parent_pipe.fileno(),
2522
GLib.IO_IN | GLib.IO_HUP,
2523
functools.partial(self.handle_ipc,
2524
parent_pipe = parent_pipe,
2525
proc = proc))
2049
gobject.io_add_watch(parent_pipe.fileno(),
2050
gobject.IO_IN | gobject.IO_HUP,
2051
functools.partial(self.handle_ipc,
2052
parent_pipe =
2053
parent_pipe,
2054
proc = proc))
2526
2055
2527
def handle_ipc(self, source, condition,
2528
parent_pipe=None,
2529
proc = None,
2530
client_object=None):
2056
def handle_ipc(self, source, condition, parent_pipe=None,
2057
proc = None, client_object=None):
2531
2058
# error, or the other end of multiprocessing.Pipe has closed
2532
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2059
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2533
2060
# Wait for other process to exit
2534
2061
proc.join()
2535
2062
return False
2542
2069
fpr = request[1]
2543
2070
address = request[2]
2544
2071
2545
for c in self.clients.values():
2072
for c in self.clients.itervalues():
2546
2073
if c.fingerprint == fpr:
2547
2074
client = c
2548
2075
break
2556
2083
parent_pipe.send(False)
2557
2084
return False
2558
2085
2559
GLib.io_add_watch(
2560
parent_pipe.fileno(),
2561
GLib.IO_IN | GLib.IO_HUP,
2562
functools.partial(self.handle_ipc,
2563
parent_pipe = parent_pipe,
2564
proc = proc,
2565
client_object = client))
2086
gobject.io_add_watch(parent_pipe.fileno(),
2087
gobject.IO_IN | gobject.IO_HUP,
2088
functools.partial(self.handle_ipc,
2089
parent_pipe =
2090
parent_pipe,
2091
proc = proc,
2092
client_object =
2093
client))
2566
2094
parent_pipe.send(True)
2567
2095
# remove the old hook in favor of the new above hook on
2568
2096
# same fileno
2574
2102
2575
2103
parent_pipe.send(('data', getattr(client_object,
2576
2104
funcname)(*args,
2577
**kwargs)))
2105
**kwargs)))
2578
2106
2579
2107
if command == 'getattr':
2580
2108
attrname = request[1]
2581
if isinstance(client_object.__getattribute__(attrname),
2582
collections.Callable):
2583
parent_pipe.send(('function', ))
2109
if callable(client_object.__getattribute__(attrname)):
2110
parent_pipe.send(('function',))
2584
2111
else:
2585
parent_pipe.send((
2586
'data', client_object.__getattribute__(attrname)))
2112
parent_pipe.send(('data', client_object
2113
.__getattribute__(attrname)))
2587
2114
2588
2115
if command == 'setattr':
2589
2116
attrname = request[1]
2620
2147
# avoid excessive use of external libraries.
2621
2148
2622
2149
# New type for defining tokens, syntax, and semantics all-in-one
2623
Token = collections.namedtuple("Token", (
2624
"regexp", # To match token; if "value" is not None, must have
2625
# a "group" containing digits
2626
"value", # datetime.timedelta or None
2627
"followers")) # Tokens valid after this token
2150
Token = collections.namedtuple("Token",
2151
("regexp", # To match token; if
2152
# "value" is not None,
2153
# must have a "group"
2154
# containing digits
2155
"value", # datetime.timedelta or
2156
# None
2157
"followers")) # Tokens valid after
2158
# this token
2628
2159
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2629
2160
# the "duration" ABNF definition in RFC 3339, Appendix A.
2630
2161
token_end = Token(re.compile(r"$"), None, frozenset())
2631
2162
token_second = Token(re.compile(r"(\d+)S"),
2632
2163
datetime.timedelta(seconds=1),
2633
frozenset((token_end, )))
2164
frozenset((token_end,)))
2634
2165
token_minute = Token(re.compile(r"(\d+)M"),
2635
2166
datetime.timedelta(minutes=1),
2636
2167
frozenset((token_second, token_end)))
2652
2183
frozenset((token_month, token_end)))
2653
2184
token_week = Token(re.compile(r"(\d+)W"),
2654
2185
datetime.timedelta(weeks=1),
2655
frozenset((token_end, )))
2186
frozenset((token_end,)))
2656
2187
token_duration = Token(re.compile(r"P"), None,
2657
2188
frozenset((token_year, token_month,
2658
2189
token_day, token_time,
2659
token_week)))
2190
token_week))),
2660
2191
# Define starting values
2661
2192
value = datetime.timedelta() # Value so far
2662
2193
found_token = None
2663
followers = frozenset((token_duration, )) # Following valid tokens
2194
followers = frozenset(token_duration,) # Following valid tokens
2664
2195
s = duration # String left to parse
2665
2196
# Loop until end token is found
2666
2197
while found_token is not token_end:
2683
2214
break
2684
2215
else:
2685
2216
# No currently valid tokens were found
2686
raise ValueError("Invalid RFC 3339 duration: {!r}"
2687
.format(duration))
2217
raise ValueError("Invalid RFC 3339 duration")
2688
2218
# End token found
2689
2219
return value
2690
2220
2714
2244
timevalue = datetime.timedelta(0)
2715
2245
for s in interval.split():
2716
2246
try:
2717
suffix = s[-1]
2247
suffix = unicode(s[-1])
2718
2248
value = int(s[:-1])
2719
2249
if suffix == "d":
2720
2250
delta = datetime.timedelta(value)
2727
2257
elif suffix == "w":
2728
2258
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2729
2259
else:
2730
raise ValueError("Unknown suffix {!r}".format(suffix))
2260
raise ValueError("Unknown suffix {0!r}"
2261
.format(suffix))
2731
2262
except IndexError as e:
2732
2263
raise ValueError(*(e.args))
2733
2264
timevalue += delta
2750
2281
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2751
2282
if not stat.S_ISCHR(os.fstat(null).st_mode):
2752
2283
raise OSError(errno.ENODEV,
2753
"{} not a character device"
2284
"{0} not a character device"
2754
2285
.format(os.devnull))
2755
2286
os.dup2(null, sys.stdin.fileno())
2756
2287
os.dup2(null, sys.stdout.fileno())
2766
2297
2767
2298
parser = argparse.ArgumentParser()
2768
2299
parser.add_argument("-v", "--version", action="version",
2769
version = "%(prog)s {}".format(version),
2300
version = "%(prog)s {0}".format(version),
2770
2301
help="show version number and exit")
2771
2302
parser.add_argument("-i", "--interface", metavar="IF",
2772
2303
help="Bind to interface IF")
2805
2336
help="Directory to save/restore state in")
2806
2337
parser.add_argument("--foreground", action="store_true",
2807
2338
help="Run in foreground", default=None)
2808
parser.add_argument("--no-zeroconf", action="store_false",
2809
dest="zeroconf", help="Do not use Zeroconf",
2810
default=None)
2811
2339
2812
2340
options = parser.parse_args()
2813
2341
2822
2350
"port": "",
2823
2351
"debug": "False",
2824
2352
"priority":
2825
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2826
":+SIGN-DSA-SHA256",
2353
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2827
2354
"servicename": "Mandos",
2828
2355
"use_dbus": "True",
2829
2356
"use_ipv6": "True",
2832
2359
"socket": "",
2833
2360
"statedir": "/var/lib/mandos",
2834
2361
"foreground": "False",
2835
"zeroconf": "True",
2836
}
2362
}
2837
2363
2838
2364
# Parse config file for server-global settings
2839
2365
server_config = configparser.SafeConfigParser(server_defaults)
2840
2366
del server_defaults
2841
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2367
server_config.read(os.path.join(options.configdir,
2368
"mandos.conf"))
2842
2369
# Convert the SafeConfigParser object to a dict
2843
2370
server_settings = server_config.defaults()
2844
2371
# Use the appropriate methods on the non-string config options
2862
2389
# Override the settings from the config file with command line
2863
2390
# options, if set.
2864
2391
for option in ("interface", "address", "port", "debug",
2865
"priority", "servicename", "configdir", "use_dbus",
2866
"use_ipv6", "debuglevel", "restore", "statedir",
2867
"socket", "foreground", "zeroconf"):
2392
"priority", "servicename", "configdir",
2393
"use_dbus", "use_ipv6", "debuglevel", "restore",
2394
"statedir", "socket", "foreground"):
2868
2395
value = getattr(options, option)
2869
2396
if value is not None:
2870
2397
server_settings[option] = value
2871
2398
del options
2872
2399
# Force all strings to be unicode
2873
2400
for option in server_settings.keys():
2874
if isinstance(server_settings[option], bytes):
2875
server_settings[option] = (server_settings[option]
2876
.decode("utf-8"))
2401
if type(server_settings[option]) is str:
2402
server_settings[option] = unicode(server_settings[option])
2877
2403
# Force all boolean options to be boolean
2878
2404
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2879
"foreground", "zeroconf"):
2405
"foreground"):
2880
2406
server_settings[option] = bool(server_settings[option])
2881
2407
# Debug implies foreground
2882
2408
if server_settings["debug"]:
2885
2411
2886
2412
##################################################################
2887
2413
2888
if (not server_settings["zeroconf"]
2889
and not (server_settings["port"]
2890
or server_settings["socket"] != "")):
2891
parser.error("Needs port or socket to work without Zeroconf")
2892
2893
2414
# For convenience
2894
2415
debug = server_settings["debug"]
2895
2416
debuglevel = server_settings["debuglevel"]
2898
2419
stored_state_path = os.path.join(server_settings["statedir"],
2899
2420
stored_state_file)
2900
2421
foreground = server_settings["foreground"]
2901
zeroconf = server_settings["zeroconf"]
2902
2422
2903
2423
if debug:
2904
2424
initlogger(debug, logging.DEBUG)
2910
2430
initlogger(debug, level)
2911
2431
2912
2432
if server_settings["servicename"] != "Mandos":
2913
syslogger.setFormatter(
2914
logging.Formatter('Mandos ({}) [%(process)d]:'
2915
' %(levelname)s: %(message)s'.format(
2916
server_settings["servicename"])))
2433
syslogger.setFormatter(logging.Formatter
2434
('Mandos ({0}) [%(process)d]:'
2435
' %(levelname)s: %(message)s'
2436
.format(server_settings
2437
["servicename"])))
2917
2438
2918
2439
# Parse config file with clients
2919
2440
client_config = configparser.SafeConfigParser(Client
2924
2445
global mandos_dbus_service
2925
2446
mandos_dbus_service = None
2926
2447
2927
socketfd = None
2928
if server_settings["socket"] != "":
2929
socketfd = server_settings["socket"]
2930
tcp_server = MandosServer(
2931
(server_settings["address"], server_settings["port"]),
2932
ClientHandler,
2933
interface=(server_settings["interface"] or None),
2934
use_ipv6=use_ipv6,
2935
gnutls_priority=server_settings["priority"],
2936
use_dbus=use_dbus,
2937
socketfd=socketfd)
2448
tcp_server = MandosServer((server_settings["address"],
2449
server_settings["port"]),
2450
ClientHandler,
2451
interface=(server_settings["interface"]
2452
or None),
2453
use_ipv6=use_ipv6,
2454
gnutls_priority=
2455
server_settings["priority"],
2456
use_dbus=use_dbus,
2457
socketfd=(server_settings["socket"]
2458
or None))
2938
2459
if not foreground:
2939
2460
pidfilename = "/run/mandos.pid"
2940
2461
if not os.path.isdir("/run/."):
2941
2462
pidfilename = "/var/run/mandos.pid"
2942
2463
pidfile = None
2943
2464
try:
2944
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2465
pidfile = open(pidfilename, "w")
2945
2466
except IOError as e:
2946
2467
logger.error("Could not open file %r", pidfilename,
2947
2468
exc_info=e)
2948
2469
2949
for name, group in (("_mandos", "_mandos"),
2950
("mandos", "mandos"),
2951
("nobody", "nogroup")):
2470
for name in ("_mandos", "mandos", "nobody"):
2952
2471
try:
2953
2472
uid = pwd.getpwnam(name).pw_uid
2954
gid = pwd.getpwnam(group).pw_gid
2473
gid = pwd.getpwnam(name).pw_gid
2955
2474
break
2956
2475
except KeyError:
2957
2476
continue
2961
2480
try:
2962
2481
os.setgid(gid)
2963
2482
os.setuid(uid)
2964
if debug:
2965
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2966
gid))
2967
2483
except OSError as error:
2968
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2969
.format(uid, gid, os.strerror(error.errno)))
2970
2484
if error.errno != errno.EPERM:
2971
2485
raise
2972
2486
2975
2489
2976
2490
# "Use a log level over 10 to enable all debugging options."
2977
2491
# - GnuTLS manual
2978
gnutls.global_set_log_level(11)
2492
gnutls.library.functions.gnutls_global_set_log_level(11)
2979
2493
2980
@gnutls.log_func
2494
@gnutls.library.types.gnutls_log_func
2981
2495
def debug_gnutls(level, string):
2982
2496
logger.debug("GnuTLS: %s", string[:-1])
2983
2497
2984
gnutls.global_set_log_function(debug_gnutls)
2498
(gnutls.library.functions
2499
.gnutls_global_set_log_function(debug_gnutls))
2985
2500
2986
2501
# Redirect stdin so all checkers get /dev/null
2987
2502
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2994
2509
# Close all input and output, do double fork, etc.
2995
2510
daemon()
2996
2511
2997
# multiprocessing will use threads, so before we use GLib we need
2998
# to inform GLib that threads will be used.
2999
GLib.threads_init()
2512
# multiprocessing will use threads, so before we use gobject we
2513
# need to inform gobject that threads will be used.
2514
gobject.threads_init()
3000
2515
3001
2516
global main_loop
3002
2517
# From the Avahi example code
3003
2518
DBusGMainLoop(set_as_default=True)
3004
main_loop = GLib.MainLoop()
2519
main_loop = gobject.MainLoop()
3005
2520
bus = dbus.SystemBus()
3006
2521
# End of Avahi example code
3007
2522
if use_dbus:
3008
2523
try:
3009
2524
bus_name = dbus.service.BusName("se.recompile.Mandos",
3010
bus,
3011
do_not_queue=True)
3012
old_bus_name = dbus.service.BusName(
3013
"se.bsnet.fukt.Mandos", bus,
3014
do_not_queue=True)
3015
except dbus.exceptions.DBusException as e:
2525
bus, do_not_queue=True)
2526
old_bus_name = (dbus.service.BusName
2527
("se.bsnet.fukt.Mandos", bus,
2528
do_not_queue=True))
2529
except dbus.exceptions.NameExistsException as e:
3016
2530
logger.error("Disabling D-Bus:", exc_info=e)
3017
2531
use_dbus = False
3018
2532
server_settings["use_dbus"] = False
3019
2533
tcp_server.use_dbus = False
3020
if zeroconf:
3021
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3022
service = AvahiServiceToSyslog(
3023
name = server_settings["servicename"],
3024
servicetype = "_mandos._tcp",
3025
protocol = protocol,
3026
bus = bus)
3027
if server_settings["interface"]:
3028
service.interface = if_nametoindex(
3029
server_settings["interface"].encode("utf-8"))
2534
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2535
service = AvahiServiceToSyslog(name =
2536
server_settings["servicename"],
2537
servicetype = "_mandos._tcp",
2538
protocol = protocol, bus = bus)
2539
if server_settings["interface"]:
2540
service.interface = (if_nametoindex
2541
(str(server_settings["interface"])))
3030
2542
3031
2543
global multiprocessing_manager
3032
2544
multiprocessing_manager = multiprocessing.Manager()
3051
2563
if server_settings["restore"]:
3052
2564
try:
3053
2565
with open(stored_state_path, "rb") as stored_state:
3054
if sys.version_info.major == 2:
3055
clients_data, old_client_settings = pickle.load(
3056
stored_state)
3057
else:
3058
bytes_clients_data, bytes_old_client_settings = (
3059
pickle.load(stored_state, encoding = "bytes"))
3060
### Fix bytes to strings
3061
## clients_data
3062
# .keys()
3063
clients_data = { (key.decode("utf-8")
3064
if isinstance(key, bytes)
3065
else key): value
3066
for key, value in
3067
bytes_clients_data.items() }
3068
del bytes_clients_data
3069
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3074
clients_data[key] = value
3075
# .client_structure
3076
value["client_structure"] = [
3077
(s.decode("utf-8")
3078
if isinstance(s, bytes)
3079
else s) for s in
3080
value["client_structure"] ]
3081
# .name & .host
3082
for k in ("name", "host"):
3083
if isinstance(value[k], bytes):
3084
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys()
3087
old_client_settings = {
3088
(key.decode("utf-8")
3089
if isinstance(key, bytes)
3090
else key): value
3091
for key, value in
3092
bytes_old_client_settings.items() }
3093
del bytes_old_client_settings
3094
# .host
3095
for value in old_client_settings.values():
3096
if isinstance(value["host"], bytes):
3097
value["host"] = (value["host"]
3098
.decode("utf-8"))
2566
clients_data, old_client_settings = (pickle.load
2567
(stored_state))
3099
2568
os.remove(stored_state_path)
3100
2569
except IOError as e:
3101
2570
if e.errno == errno.ENOENT:
3102
logger.warning("Could not load persistent state:"
3103
" {}".format(os.strerror(e.errno)))
2571
logger.warning("Could not load persistent state: {0}"
2572
.format(os.strerror(e.errno)))
3104
2573
else:
3105
2574
logger.critical("Could not load persistent state:",
3106
2575
exc_info=e)
3107
2576
raise
3108
2577
except EOFError as e:
3109
2578
logger.warning("Could not load persistent state: "
3110
"EOFError:",
3111
exc_info=e)
2579
"EOFError:", exc_info=e)
3112
2580
3113
2581
with PGPEngine() as pgp:
3114
for client_name, client in clients_data.items():
2582
for client_name, client in clients_data.iteritems():
3115
2583
# Skip removed clients
3116
2584
if client_name not in client_settings:
3117
2585
continue
3126
2594
# For each value in new config, check if it
3127
2595
# differs from the old config value (Except for
3128
2596
# the "secret" attribute)
3129
if (name != "secret"
3130
and (value !=
3131
old_client_settings[client_name][name])):
2597
if (name != "secret" and
2598
value != old_client_settings[client_name]
2599
[name]):
3132
2600
client[name] = value
3133
2601
except KeyError:
3134
2602
pass
3135
2603
3136
2604
# Clients who has passed its expire date can still be
3137
# enabled if its last checker was successful. A Client
2605
# enabled if its last checker was successful. Clients
3138
2606
# whose checker succeeded before we stored its state is
3139
2607
# assumed to have successfully run all checkers during
3140
2608
# downtime.
3142
2610
if datetime.datetime.utcnow() >= client["expires"]:
3143
2611
if not client["last_checked_ok"]:
3144
2612
logger.warning(
3145
"disabling client {} - Client never "
3146
"performed a successful checker".format(
3147
client_name))
2613
"disabling client {0} - Client never "
2614
"performed a successful checker"
2615
.format(client_name))
3148
2616
client["enabled"] = False
3149
2617
elif client["last_checker_status"] != 0:
3150
2618
logger.warning(
3151
"disabling client {} - Client last"
3152
" checker failed with error code"
3153
" {}".format(
3154
client_name,
3155
client["last_checker_status"]))
2619
"disabling client {0} - Client "
2620
"last checker failed with error code {1}"
2621
.format(client_name,
2622
client["last_checker_status"]))
3156
2623
client["enabled"] = False
3157
2624
else:
3158
client["expires"] = (
3159
datetime.datetime.utcnow()
3160
+ client["timeout"])
2625
client["expires"] = (datetime.datetime
2626
.utcnow()
2627
+ client["timeout"])
3161
2628
logger.debug("Last checker succeeded,"
3162
" keeping {} enabled".format(
3163
client_name))
2629
" keeping {0} enabled"
2630
.format(client_name))
3164
2631
try:
3165
client["secret"] = pgp.decrypt(
3166
client["encrypted_secret"],
3167
client_settings[client_name]["secret"])
2632
client["secret"] = (
2633
pgp.decrypt(client["encrypted_secret"],
2634
client_settings[client_name]
2635
["secret"]))
3168
2636
except PGPError:
3169
2637
# If decryption fails, we use secret from new settings
3170
logger.debug("Failed to decrypt {} old secret".format(
3171
client_name))
3172
client["secret"] = (client_settings[client_name]
3173
["secret"])
2638
logger.debug("Failed to decrypt {0} old secret"
2639
.format(client_name))
2640
client["secret"] = (
2641
client_settings[client_name]["secret"])
3174
2642
3175
2643
# Add/remove clients based on new changes made to config
3176
2644
for client_name in (set(old_client_settings)
3181
2649
clients_data[client_name] = client_settings[client_name]
3182
2650
3183
2651
# Create all client objects
3184
for client_name, client in clients_data.items():
2652
for client_name, client in clients_data.iteritems():
3185
2653
tcp_server.clients[client_name] = client_class(
3186
name = client_name,
3187
settings = client,
2654
name = client_name, settings = client,
3188
2655
server_settings = server_settings)
3189
2656
3190
2657
if not tcp_server.clients:
3192
2659
3193
2660
if not foreground:
3194
2661
if pidfile is not None:
3195
pid = os.getpid()
3196
2662
try:
3197
2663
with pidfile:
3198
print(pid, file=pidfile)
2664
pid = os.getpid()
2665
pidfile.write(str(pid) + "\n".encode("utf-8"))
3199
2666
except IOError:
3200
2667
logger.error("Could not write to file %r with PID %d",
3201
2668
pidfilename, pid)
3202
2669
del pidfile
3203
2670
del pidfilename
3204
2671
3205
for termsig in (signal.SIGHUP, signal.SIGTERM):
3206
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3207
lambda: main_loop.quit() and False)
2672
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2673
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3208
2674
3209
2675
if use_dbus:
3210
3211
@alternate_dbus_interfaces(
3212
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3213
class MandosDBusService(DBusObjectWithObjectManager):
2676
@alternate_dbus_interfaces({"se.recompile.Mandos":
2677
"se.bsnet.fukt.Mandos"})
2678
class MandosDBusService(DBusObjectWithProperties):
3214
2679
"""A D-Bus proxy object"""
3215
3216
2680
def __init__(self):
3217
2681
dbus.service.Object.__init__(self, bus, "/")
3218
3219
2682
_interface = "se.recompile.Mandos"
3220
2683
2684
@dbus_interface_annotations(_interface)
2685
def _foo(self):
2686
return { "org.freedesktop.DBus.Property"
2687
".EmitsChangedSignal":
2688
"false"}
2689
3221
2690
@dbus.service.signal(_interface, signature="o")
3222
2691
def ClientAdded(self, objpath):
3223
2692
"D-Bus signal"
3228
2697
"D-Bus signal"
3229
2698
pass
3230
2699
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3232
"true"})
3233
2700
@dbus.service.signal(_interface, signature="os")
3234
2701
def ClientRemoved(self, objpath, name):
3235
2702
"D-Bus signal"
3236
2703
pass
3237
2704
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3239
"true"})
3240
2705
@dbus.service.method(_interface, out_signature="ao")
3241
2706
def GetAllClients(self):
3242
2707
"D-Bus method"
3243
return dbus.Array(c.dbus_object_path for c in
3244
tcp_server.clients.values())
2708
return dbus.Array(c.dbus_object_path
2709
for c in
2710
tcp_server.clients.itervalues())
3245
2711
3246
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3247
"true"})
3248
2712
@dbus.service.method(_interface,
3249
2713
out_signature="a{oa{sv}}")
3250
2714
def GetAllClientsWithProperties(self):
3251
2715
"D-Bus method"
3252
2716
return dbus.Dictionary(
3253
{ c.dbus_object_path: c.GetAll(
3254
"se.recompile.Mandos.Client")
3255
for c in tcp_server.clients.values() },
2717
((c.dbus_object_path, c.GetAll(""))
2718
for c in tcp_server.clients.itervalues()),
3256
2719
signature="oa{sv}")
3257
2720
3258
2721
@dbus.service.method(_interface, in_signature="o")
3259
2722
def RemoveClient(self, object_path):
3260
2723
"D-Bus method"
3261
for c in tcp_server.clients.values():
2724
for c in tcp_server.clients.itervalues():
3262
2725
if c.dbus_object_path == object_path:
3263
2726
del tcp_server.clients[c.name]
3264
2727
c.remove_from_connection()
3265
# Don't signal the disabling
2728
# Don't signal anything except ClientRemoved
3266
2729
c.disable(quiet=True)
3267
# Emit D-Bus signal for removal
3268
self.client_removed_signal(c)
2730
# Emit D-Bus signal
2731
self.ClientRemoved(object_path, c.name)
3269
2732
return
3270
2733
raise KeyError(object_path)
3271
2734
3272
2735
del _interface
3273
3274
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3275
out_signature = "a{oa{sa{sv}}}")
3276
def GetManagedObjects(self):
3277
"""D-Bus method"""
3278
return dbus.Dictionary(
3279
{ client.dbus_object_path:
3280
dbus.Dictionary(
3281
{ interface: client.GetAll(interface)
3282
for interface in
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3285
3286
def client_added_signal(self, client):
3287
"""Send the new standard signal and the old signal"""
3288
if use_dbus:
3289
# New standard signal
3290
self.InterfacesAdded(
3291
client.dbus_object_path,
3292
dbus.Dictionary(
3293
{ interface: client.GetAll(interface)
3294
for interface in
3295
client._get_all_interface_names()}))
3296
# Old signal
3297
self.ClientAdded(client.dbus_object_path)
3298
3299
def client_removed_signal(self, client):
3300
"""Send the new standard signal and the old signal"""
3301
if use_dbus:
3302
# New standard signal
3303
self.InterfacesRemoved(
3304
client.dbus_object_path,
3305
client._get_all_interface_names())
3306
# Old signal
3307
self.ClientRemoved(client.dbus_object_path,
3308
client.name)
3309
2736
3310
2737
mandos_dbus_service = MandosDBusService()
3311
2738
3312
2739
def cleanup():
3313
2740
"Cleanup function; run on exit"
3314
if zeroconf:
3315
service.cleanup()
2741
service.cleanup()
3316
2742
3317
2743
multiprocessing.active_children()
3318
2744
wnull.close()
3324
2750
# removed/edited, old secret will thus be unrecovable.
3325
2751
clients = {}
3326
2752
with PGPEngine() as pgp:
3327
for client in tcp_server.clients.values():
2753
for client in tcp_server.clients.itervalues():
3328
2754
key = client_settings[client.name]["secret"]
3329
2755
client.encrypted_secret = pgp.encrypt(client.secret,
3330
2756
key)
3332
2758
3333
2759
# A list of attributes that can not be pickled
3334
2760
# + secret.
3335
exclude = { "bus", "changedstate", "secret",
3336
"checker", "server_settings" }
3337
for name, typ in inspect.getmembers(dbus.service
3338
.Object):
2761
exclude = set(("bus", "changedstate", "secret",
2762
"checker", "server_settings"))
2763
for name, typ in (inspect.getmembers
2764
(dbus.service.Object)):
3339
2765
exclude.add(name)
3340
2766
3341
2767
client_dict["encrypted_secret"] = (client
3348
2774
del client_settings[client.name]["secret"]
3349
2775
3350
2776
try:
3351
with tempfile.NamedTemporaryFile(
3352
mode='wb',
3353
suffix=".pickle",
3354
prefix='clients-',
3355
dir=os.path.dirname(stored_state_path),
3356
delete=False) as stored_state:
3357
pickle.dump((clients, client_settings), stored_state,
3358
protocol = 2)
3359
tempname = stored_state.name
2777
with (tempfile.NamedTemporaryFile
2778
(mode='wb', suffix=".pickle", prefix='clients-',
2779
dir=os.path.dirname(stored_state_path),
2780
delete=False)) as stored_state:
2781
pickle.dump((clients, client_settings), stored_state)
2782
tempname=stored_state.name
3360
2783
os.rename(tempname, stored_state_path)
3361
2784
except (IOError, OSError) as e:
3362
2785
if not debug:
3365
2788
except NameError:
3366
2789
pass
3367
2790
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3368
logger.warning("Could not save persistent state: {}"
2791
logger.warning("Could not save persistent state: {0}"
3369
2792
.format(os.strerror(e.errno)))
3370
2793
else:
3371
2794
logger.warning("Could not save persistent state:",
3377
2800
name, client = tcp_server.clients.popitem()
3378
2801
if use_dbus:
3379
2802
client.remove_from_connection()
3380
# Don't signal the disabling
2803
# Don't signal anything except ClientRemoved
3381
2804
client.disable(quiet=True)
3382
# Emit D-Bus signal for removal
3383
2805
if use_dbus:
3384
mandos_dbus_service.client_removed_signal(client)
2806
# Emit D-Bus signal
2807
mandos_dbus_service.ClientRemoved(client
2808
.dbus_object_path,
2809
client.name)
3385
2810
client_settings.clear()
3386
2811
3387
2812
atexit.register(cleanup)
3388
2813
3389
for client in tcp_server.clients.values():
2814
for client in tcp_server.clients.itervalues():
3390
2815
if use_dbus:
3391
# Emit D-Bus signal for adding
3392
mandos_dbus_service.client_added_signal(client)
2816
# Emit D-Bus signal
2817
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3393
2818
# Need to initiate checking of clients
3394
2819
if client.enabled:
3395
2820
client.init_checker()
3398
2823
tcp_server.server_activate()
3399
2824
3400
2825
# Find out what port we got
3401
if zeroconf:
3402
service.port = tcp_server.socket.getsockname()[1]
2826
service.port = tcp_server.socket.getsockname()[1]
3403
2827
if use_ipv6:
3404
2828
logger.info("Now listening on address %r, port %d,"
3405
2829
" flowinfo %d, scope_id %d",
3411
2835
#service.interface = tcp_server.socket.getsockname()[3]
3412
2836
3413
2837
try:
3414
if zeroconf:
3415
# From the Avahi example code
3416
try:
3417
service.activate()
3418
except dbus.exceptions.DBusException as error:
3419
logger.critical("D-Bus Exception", exc_info=error)
3420
cleanup()
3421
sys.exit(1)
3422
# End of Avahi example code
2838
# From the Avahi example code
2839
try:
2840
service.activate()
2841
except dbus.exceptions.DBusException as error:
2842
logger.critical("D-Bus Exception", exc_info=error)
2843
cleanup()
2844
sys.exit(1)
2845
# End of Avahi example code
3423
2846
3424
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3425
lambda *args, **kwargs:
3426
(tcp_server.handle_request
3427
(*args[2:], **kwargs) or True))
2847
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2848
lambda *args, **kwargs:
2849
(tcp_server.handle_request
2850
(*args[2:], **kwargs) or True))
3428
2851
3429
2852
logger.debug("Starting main loop")
3430
2853
main_loop.run()
3440
2863
# Must run before the D-Bus bus name gets deregistered
3441
2864
cleanup()
3442
2865
3443
3444
2866
if __name__ == '__main__':
3445
2867
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0