To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 713
- compare with another revision
- download diff
- download tarball
- view history from revision 713
- Committer: Teddy Hogeborn
- Date: 2014-07-14 21:41:08 UTC
- Revision ID: teddy@recompile.se-20140714214108-awg7u6gaiy7d40dz
mandos-monitor: New "verbose" mode to see less important log messages.
* mandos-monitor (MandosClientWidget.__init__): Log client creation.
(MandosClientWidget.checker_completed): Log a successful checker.
(MandosClientWidget.checker_started): Log starting of a checker.
(UserInterface.__init__): New optional "log_level" argument.
(UserInterface.log_message, UserInterface.log_message_raw): Take
optional
"level"
arg.
(UserInterface.toggle_log_display): Log visibility change.
(UserInterface.change_log_display): Log wrap mode change.
(UserInterface.process_input): Show new "v" key in help message and
process "v" key if pressed.
* mandos-monitor.xml (KEYS): Document new "v" key.
* mandos-monitor (MandosClientWidget.__init__): Log client creation.
(MandosClientWidget.checker_completed): Log a successful checker.
(MandosClientWidget.checker_started): Log starting of a checker.
(UserInterface.__init__): New optional "log_level" argument.
(UserInterface.log_message, UserInterface.log_message_raw): Take
optional
"level"
arg.
(UserInterface.toggle_log_display): Log visibility change.
(UserInterface.change_log_display): Log wrap mode change.
(UserInterface.process_input): Show new "v" key in help message and
process "v" key if pressed.
* mandos-monitor.xml (KEYS): Document new "v" key.
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
try:
43
import SocketServer as socketserver
44
except ImportError:
45
import socketserver
39
import SocketServer as socketserver
46
40
import socket
47
41
import argparse
48
42
import datetime
49
43
import errno
50
try:
51
import ConfigParser as configparser
52
except ImportError:
53
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
54
51
import sys
55
52
import re
56
53
import os
65
62
import struct
66
63
import fcntl
67
64
import functools
68
try:
69
import cPickle as pickle
70
except ImportError:
71
import pickle
65
import cPickle as pickle
72
66
import multiprocessing
73
67
import types
74
68
import binascii
75
69
import tempfile
76
70
import itertools
77
71
import collections
78
import codecs
79
72
80
73
import dbus
81
74
import dbus.service
82
from gi.repository import GLib
75
import gobject
76
import avahi
83
77
from dbus.mainloop.glib import DBusGMainLoop
84
78
import ctypes
85
79
import ctypes.util
94
88
except ImportError:
95
89
SO_BINDTODEVICE = None
96
90
97
if sys.version_info.major == 2:
98
str = unicode
99
100
version = "1.7.7"
91
version = "1.6.6"
101
92
stored_state_file = "clients.pickle"
102
93
103
94
logger = logging.getLogger()
104
95
syslogger = None
105
96
106
97
try:
107
if_nametoindex = ctypes.cdll.LoadLibrary(
108
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
100
.if_nametoindex)
109
101
except (OSError, AttributeError):
110
111
102
def if_nametoindex(interface):
112
103
"Get an interface index the hard way, i.e. using fcntl()"
113
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
114
105
with contextlib.closing(socket.socket()) as s:
115
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
116
struct.pack(b"16s16x", interface))
117
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
108
interface))
109
interface_index = struct.unpack(str("I"),
110
ifreq[16:20])[0]
118
111
return interface_index
119
112
120
113
121
def copy_function(func):
122
"""Make a copy of a function"""
123
if sys.version_info.major == 2:
124
return types.FunctionType(func.func_code,
125
func.func_globals,
126
func.func_name,
127
func.func_defaults,
128
func.func_closure)
129
else:
130
return types.FunctionType(func.__code__,
131
func.__globals__,
132
func.__name__,
133
func.__defaults__,
134
func.__closure__)
135
136
137
114
def initlogger(debug, level=logging.WARNING):
138
115
"""init logger and add loglevel"""
139
116
140
117
global syslogger
141
syslogger = (logging.handlers.SysLogHandler(
142
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
143
address = "/dev/log"))
118
syslogger = (logging.handlers.SysLogHandler
119
(facility =
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
144
122
syslogger.setFormatter(logging.Formatter
145
123
('Mandos [%(process)d]: %(levelname)s:'
146
124
' %(message)s'))
163
141
164
142
class PGPEngine(object):
165
143
"""A simple class for OpenPGP symmetric encryption & decryption"""
166
167
144
def __init__(self):
168
145
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
169
self.gpg = "gpg"
170
try:
171
output = subprocess.check_output(["gpgconf"])
172
for line in output.splitlines():
173
name, text, path = line.split(b":")
174
if name == "gpg":
175
self.gpg = path
176
break
177
except OSError as e:
178
if e.errno != errno.ENOENT:
179
raise
180
146
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
147
'--home', self.tempdir,
182
148
'--force-mdc',
183
'--quiet']
184
# Only GPG version 1 has the --no-use-agent option.
185
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
186
self.gnupgargs.append("--no-use-agent")
149
'--quiet',
150
'--no-use-agent']
187
151
188
152
def __enter__(self):
189
153
return self
221
185
222
186
def encrypt(self, data, password):
223
187
passphrase = self.password_encode(password)
224
with tempfile.NamedTemporaryFile(
225
dir=self.tempdir) as passfile:
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
189
) as passfile:
226
190
passfile.write(passphrase)
227
191
passfile.flush()
228
proc = subprocess.Popen([self.gpg, '--symmetric',
192
proc = subprocess.Popen(['gpg', '--symmetric',
229
193
'--passphrase-file',
230
194
passfile.name]
231
195
+ self.gnupgargs,
239
203
240
204
def decrypt(self, data, password):
241
205
passphrase = self.password_encode(password)
242
with tempfile.NamedTemporaryFile(
243
dir = self.tempdir) as passfile:
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
207
) as passfile:
244
208
passfile.write(passphrase)
245
209
passfile.flush()
246
proc = subprocess.Popen([self.gpg, '--decrypt',
210
proc = subprocess.Popen(['gpg', '--decrypt',
247
211
'--passphrase-file',
248
212
passfile.name]
249
213
+ self.gnupgargs,
250
214
stdin = subprocess.PIPE,
251
215
stdout = subprocess.PIPE,
252
216
stderr = subprocess.PIPE)
253
decrypted_plaintext, err = proc.communicate(input = data)
217
decrypted_plaintext, err = proc.communicate(input
218
= data)
254
219
if proc.returncode != 0:
255
220
raise PGPError(err)
256
221
return decrypted_plaintext
257
222
258
# Pretend that we have an Avahi module
259
class Avahi(object):
260
"""This isn't so much a class as it is a module-like namespace.
261
It is instantiated once, and simulates having an Avahi module."""
262
IF_UNSPEC = -1 # avahi-common/address.h
263
PROTO_UNSPEC = -1 # avahi-common/address.h
264
PROTO_INET = 0 # avahi-common/address.h
265
PROTO_INET6 = 1 # avahi-common/address.h
266
DBUS_NAME = "org.freedesktop.Avahi"
267
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
268
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
269
DBUS_PATH_SERVER = "/"
270
def string_array_to_txt_array(self, t):
271
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
272
for s in t), signature="ay")
273
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
274
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
275
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
276
SERVER_INVALID = 0 # avahi-common/defs.h
277
SERVER_REGISTERING = 1 # avahi-common/defs.h
278
SERVER_RUNNING = 2 # avahi-common/defs.h
279
SERVER_COLLISION = 3 # avahi-common/defs.h
280
SERVER_FAILURE = 4 # avahi-common/defs.h
281
avahi = Avahi()
282
223
283
224
class AvahiError(Exception):
284
225
def __init__(self, value, *args, **kwargs):
285
226
self.value = value
286
return super(AvahiError, self).__init__(value, *args,
287
**kwargs)
288
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
289
230
290
231
class AvahiServiceError(AvahiError):
291
232
pass
292
233
293
294
234
class AvahiGroupError(AvahiError):
295
235
pass
296
236
316
256
bus: dbus.SystemBus()
317
257
"""
318
258
319
def __init__(self,
320
interface = avahi.IF_UNSPEC,
321
name = None,
322
servicetype = None,
323
port = None,
324
TXT = None,
325
domain = "",
326
host = "",
327
max_renames = 32768,
328
protocol = avahi.PROTO_UNSPEC,
329
bus = None):
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
330
263
self.interface = interface
331
264
self.name = name
332
265
self.type = servicetype
342
275
self.bus = bus
343
276
self.entry_group_state_changed_match = None
344
277
345
def rename(self, remove=True):
278
def rename(self):
346
279
"""Derived from the Avahi example code"""
347
280
if self.rename_count >= self.max_renames:
348
281
logger.critical("No suitable Zeroconf service name found"
349
282
" after %i retries, exiting.",
350
283
self.rename_count)
351
284
raise AvahiServiceError("Too many renames")
352
self.name = str(
353
self.server.GetAlternativeServiceName(self.name))
354
self.rename_count += 1
285
self.name = unicode(self.server
286
.GetAlternativeServiceName(self.name))
355
287
logger.info("Changing Zeroconf service name to %r ...",
356
288
self.name)
357
if remove:
358
self.remove()
289
self.remove()
359
290
try:
360
291
self.add()
361
292
except dbus.exceptions.DBusException as error:
362
if (error.get_dbus_name()
363
== "org.freedesktop.Avahi.CollisionError"):
364
logger.info("Local Zeroconf service name collision.")
365
return self.rename(remove=False)
366
else:
367
logger.critical("D-Bus Exception", exc_info=error)
368
self.cleanup()
369
os._exit(1)
293
logger.critical("D-Bus Exception", exc_info=error)
294
self.cleanup()
295
os._exit(1)
296
self.rename_count += 1
370
297
371
298
def remove(self):
372
299
"""Derived from the Avahi example code"""
410
337
self.rename()
411
338
elif state == avahi.ENTRY_GROUP_FAILURE:
412
339
logger.critical("Avahi: Error in group state changed %s",
413
str(error))
414
raise AvahiGroupError("State changed: {!s}".format(error))
340
unicode(error))
341
raise AvahiGroupError("State changed: {0!s}"
342
.format(error))
415
343
416
344
def cleanup(self):
417
345
"""Derived from the Avahi example code"""
427
355
def server_state_changed(self, state, error=None):
428
356
"""Derived from the Avahi example code"""
429
357
logger.debug("Avahi server state change: %i", state)
430
bad_states = {
431
avahi.SERVER_INVALID: "Zeroconf server invalid",
432
avahi.SERVER_REGISTERING: None,
433
avahi.SERVER_COLLISION: "Zeroconf server name collision",
434
avahi.SERVER_FAILURE: "Zeroconf server failure",
435
}
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
436
365
if state in bad_states:
437
366
if bad_states[state] is not None:
438
367
if error is None:
441
370
logger.error(bad_states[state] + ": %r", error)
442
371
self.cleanup()
443
372
elif state == avahi.SERVER_RUNNING:
444
try:
445
self.add()
446
except dbus.exceptions.DBusException as error:
447
if (error.get_dbus_name()
448
== "org.freedesktop.Avahi.CollisionError"):
449
logger.info("Local Zeroconf service name"
450
" collision.")
451
return self.rename(remove=False)
452
else:
453
logger.critical("D-Bus Exception", exc_info=error)
454
self.cleanup()
455
os._exit(1)
373
self.add()
456
374
else:
457
375
if error is None:
458
376
logger.debug("Unknown state: %r", state)
468
386
follow_name_owner_changes=True),
469
387
avahi.DBUS_INTERFACE_SERVER)
470
388
self.server.connect_to_signal("StateChanged",
471
self.server_state_changed)
389
self.server_state_changed)
472
390
self.server_state_changed(self.server.GetState())
473
391
474
392
475
393
class AvahiServiceToSyslog(AvahiService):
476
def rename(self, *args, **kwargs):
394
def rename(self):
477
395
"""Add the new name to the syslog messages"""
478
ret = AvahiService.rename(self, *args, **kwargs)
479
syslogger.setFormatter(logging.Formatter(
480
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
481
.format(self.name)))
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({0}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
482
401
return ret
483
402
484
# Pretend that we have a GnuTLS module
485
class GnuTLS(object):
486
"""This isn't so much a class as it is a module-like namespace.
487
It is instantiated once, and simulates having a GnuTLS module."""
488
489
_library = ctypes.cdll.LoadLibrary(
490
ctypes.util.find_library("gnutls"))
491
_need_version = b"3.3.0"
492
def __init__(self):
493
# Need to use class name "GnuTLS" here, since this method is
494
# called before the assignment to the "gnutls" global variable
495
# happens.
496
if GnuTLS.check_version(self._need_version) is None:
497
raise GnuTLS.Error("Needs GnuTLS {} or later"
498
.format(self._need_version))
499
500
# Unless otherwise indicated, the constants and types below are
501
# all from the gnutls/gnutls.h C header file.
502
503
# Constants
504
E_SUCCESS = 0
505
E_INTERRUPTED = -52
506
E_AGAIN = -28
507
CRT_OPENPGP = 2
508
CLIENT = 2
509
SHUT_RDWR = 0
510
CRD_CERTIFICATE = 1
511
E_NO_CERTIFICATE_FOUND = -49
512
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
513
514
# Types
515
class session_int(ctypes.Structure):
516
_fields_ = []
517
session_t = ctypes.POINTER(session_int)
518
class certificate_credentials_st(ctypes.Structure):
519
_fields_ = []
520
certificate_credentials_t = ctypes.POINTER(
521
certificate_credentials_st)
522
certificate_type_t = ctypes.c_int
523
class datum_t(ctypes.Structure):
524
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
525
('size', ctypes.c_uint)]
526
class openpgp_crt_int(ctypes.Structure):
527
_fields_ = []
528
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
529
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
531
credentials_type_t = ctypes.c_int
532
transport_ptr_t = ctypes.c_void_p
533
close_request_t = ctypes.c_int
534
535
# Exceptions
536
class Error(Exception):
537
# We need to use the class name "GnuTLS" here, since this
538
# exception might be raised from within GnuTLS.__init__,
539
# which is called before the assignment to the "gnutls"
540
# global variable has happened.
541
def __init__(self, message = None, code = None, args=()):
542
# Default usage is by a message string, but if a return
543
# code is passed, convert it to a string with
544
# gnutls.strerror()
545
self.code = code
546
if message is None and code is not None:
547
message = GnuTLS.strerror(code)
548
return super(GnuTLS.Error, self).__init__(
549
message, *args)
550
551
class CertificateSecurityError(Error):
552
pass
553
554
# Classes
555
class Credentials(object):
556
def __init__(self):
557
self._c_object = gnutls.certificate_credentials_t()
558
gnutls.certificate_allocate_credentials(
559
ctypes.byref(self._c_object))
560
self.type = gnutls.CRD_CERTIFICATE
561
562
def __del__(self):
563
gnutls.certificate_free_credentials(self._c_object)
564
565
class ClientSession(object):
566
def __init__(self, socket, credentials = None):
567
self._c_object = gnutls.session_t()
568
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
569
gnutls.set_default_priority(self._c_object)
570
gnutls.transport_set_ptr(self._c_object, socket.fileno())
571
gnutls.handshake_set_private_extensions(self._c_object,
572
True)
573
self.socket = socket
574
if credentials is None:
575
credentials = gnutls.Credentials()
576
gnutls.credentials_set(self._c_object, credentials.type,
577
ctypes.cast(credentials._c_object,
578
ctypes.c_void_p))
579
self.credentials = credentials
580
581
def __del__(self):
582
gnutls.deinit(self._c_object)
583
584
def handshake(self):
585
return gnutls.handshake(self._c_object)
586
587
def send(self, data):
588
data = bytes(data)
589
data_len = len(data)
590
while data_len > 0:
591
data_len -= gnutls.record_send(self._c_object,
592
data[-data_len:],
593
data_len)
594
595
def bye(self):
596
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
597
598
# Error handling functions
599
def _error_code(result):
600
"""A function to raise exceptions on errors, suitable
601
for the 'restype' attribute on ctypes functions"""
602
if result >= 0:
603
return result
604
if result == gnutls.E_NO_CERTIFICATE_FOUND:
605
raise gnutls.CertificateSecurityError(code = result)
606
raise gnutls.Error(code = result)
607
608
def _retry_on_error(result, func, arguments):
609
"""A function to retry on some errors, suitable
610
for the 'errcheck' attribute on ctypes functions"""
611
while result < 0:
612
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
613
return _error_code(result)
614
result = func(*arguments)
615
return result
616
617
# Unless otherwise indicated, the function declarations below are
618
# all from the gnutls/gnutls.h C header file.
619
620
# Functions
621
priority_set_direct = _library.gnutls_priority_set_direct
622
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
623
ctypes.POINTER(ctypes.c_char_p)]
624
priority_set_direct.restype = _error_code
625
626
init = _library.gnutls_init
627
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
628
init.restype = _error_code
629
630
set_default_priority = _library.gnutls_set_default_priority
631
set_default_priority.argtypes = [session_t]
632
set_default_priority.restype = _error_code
633
634
record_send = _library.gnutls_record_send
635
record_send.argtypes = [session_t, ctypes.c_void_p,
636
ctypes.c_size_t]
637
record_send.restype = ctypes.c_ssize_t
638
record_send.errcheck = _retry_on_error
639
640
certificate_allocate_credentials = (
641
_library.gnutls_certificate_allocate_credentials)
642
certificate_allocate_credentials.argtypes = [
643
ctypes.POINTER(certificate_credentials_t)]
644
certificate_allocate_credentials.restype = _error_code
645
646
certificate_free_credentials = (
647
_library.gnutls_certificate_free_credentials)
648
certificate_free_credentials.argtypes = [certificate_credentials_t]
649
certificate_free_credentials.restype = None
650
651
handshake_set_private_extensions = (
652
_library.gnutls_handshake_set_private_extensions)
653
handshake_set_private_extensions.argtypes = [session_t,
654
ctypes.c_int]
655
handshake_set_private_extensions.restype = None
656
657
credentials_set = _library.gnutls_credentials_set
658
credentials_set.argtypes = [session_t, credentials_type_t,
659
ctypes.c_void_p]
660
credentials_set.restype = _error_code
661
662
strerror = _library.gnutls_strerror
663
strerror.argtypes = [ctypes.c_int]
664
strerror.restype = ctypes.c_char_p
665
666
certificate_type_get = _library.gnutls_certificate_type_get
667
certificate_type_get.argtypes = [session_t]
668
certificate_type_get.restype = _error_code
669
670
certificate_get_peers = _library.gnutls_certificate_get_peers
671
certificate_get_peers.argtypes = [session_t,
672
ctypes.POINTER(ctypes.c_uint)]
673
certificate_get_peers.restype = ctypes.POINTER(datum_t)
674
675
global_set_log_level = _library.gnutls_global_set_log_level
676
global_set_log_level.argtypes = [ctypes.c_int]
677
global_set_log_level.restype = None
678
679
global_set_log_function = _library.gnutls_global_set_log_function
680
global_set_log_function.argtypes = [log_func]
681
global_set_log_function.restype = None
682
683
deinit = _library.gnutls_deinit
684
deinit.argtypes = [session_t]
685
deinit.restype = None
686
687
handshake = _library.gnutls_handshake
688
handshake.argtypes = [session_t]
689
handshake.restype = _error_code
690
handshake.errcheck = _retry_on_error
691
692
transport_set_ptr = _library.gnutls_transport_set_ptr
693
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
694
transport_set_ptr.restype = None
695
696
bye = _library.gnutls_bye
697
bye.argtypes = [session_t, close_request_t]
698
bye.restype = _error_code
699
bye.errcheck = _retry_on_error
700
701
check_version = _library.gnutls_check_version
702
check_version.argtypes = [ctypes.c_char_p]
703
check_version.restype = ctypes.c_char_p
704
705
# All the function declarations below are from gnutls/openpgp.h
706
707
openpgp_crt_init = _library.gnutls_openpgp_crt_init
708
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
709
openpgp_crt_init.restype = _error_code
710
711
openpgp_crt_import = _library.gnutls_openpgp_crt_import
712
openpgp_crt_import.argtypes = [openpgp_crt_t,
713
ctypes.POINTER(datum_t),
714
openpgp_crt_fmt_t]
715
openpgp_crt_import.restype = _error_code
716
717
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
718
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
719
ctypes.POINTER(ctypes.c_uint)]
720
openpgp_crt_verify_self.restype = _error_code
721
722
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
723
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
724
openpgp_crt_deinit.restype = None
725
726
openpgp_crt_get_fingerprint = (
727
_library.gnutls_openpgp_crt_get_fingerprint)
728
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
729
ctypes.c_void_p,
730
ctypes.POINTER(
731
ctypes.c_size_t)]
732
openpgp_crt_get_fingerprint.restype = _error_code
733
734
# Remove non-public functions
735
del _error_code, _retry_on_error
736
# Create the global "gnutls" object, simulating a module
737
gnutls = GnuTLS()
738
739
def call_pipe(connection, # : multiprocessing.Connection
740
func, *args, **kwargs):
741
"""This function is meant to be called by multiprocessing.Process
742
743
This function runs func(*args, **kwargs), and writes the resulting
744
return value on the provided multiprocessing.Connection.
745
"""
746
connection.send(func(*args, **kwargs))
747
connection.close()
403
404
def timedelta_to_milliseconds(td):
405
"Convert a datetime.timedelta() to milliseconds"
406
return ((td.days * 24 * 60 * 60 * 1000)
407
+ (td.seconds * 1000)
408
+ (td.microseconds // 1000))
409
748
410
749
411
class Client(object):
750
412
"""A representation of a client host served by this server.
756
418
checker: subprocess.Popen(); a running checker process used
757
419
to see if the client lives.
758
420
'None' if no process is running.
759
checker_callback_tag: a GLib event source tag, or None
421
checker_callback_tag: a gobject event source tag, or None
760
422
checker_command: string; External command which is run to check
761
423
if client lives. %() expansions are done at
762
424
runtime with vars(self) as dict, so that for
763
425
instance %(name)s can be used in the command.
764
checker_initiator_tag: a GLib event source tag, or None
426
checker_initiator_tag: a gobject event source tag, or None
765
427
created: datetime.datetime(); (UTC) object creation
766
428
client_structure: Object describing what attributes a client has
767
429
and is used for storing the client at exit
768
430
current_checker_command: string; current running checker_command
769
disable_initiator_tag: a GLib event source tag, or None
431
disable_initiator_tag: a gobject event source tag, or None
770
432
enabled: bool()
771
433
fingerprint: string (40 or 32 hexadecimal digits); used to
772
434
uniquely identify the client
777
439
last_checker_status: integer between 0 and 255 reflecting exit
778
440
status of last checker. -1 reflects crashed
779
441
checker, -2 means no checker completed yet.
780
last_checker_signal: The signal which killed the last checker, if
781
last_checker_status is -1
782
442
last_enabled: datetime.datetime(); (UTC) or None
783
443
name: string; from the config file, used in log messages and
784
444
D-Bus identifiers
797
457
"fingerprint", "host", "interval",
798
458
"last_approval_request", "last_checked_ok",
799
459
"last_enabled", "name", "timeout")
800
client_defaults = {
801
"timeout": "PT5M",
802
"extended_timeout": "PT15M",
803
"interval": "PT2M",
804
"checker": "fping -q -- %%(host)s",
805
"host": "",
806
"approval_delay": "PT0S",
807
"approval_duration": "PT1S",
808
"approved_by_default": "True",
809
"enabled": "True",
810
}
460
client_defaults = { "timeout": "PT5M",
461
"extended_timeout": "PT15M",
462
"interval": "PT2M",
463
"checker": "fping -q -- %%(host)s",
464
"host": "",
465
"approval_delay": "PT0S",
466
"approval_duration": "PT1S",
467
"approved_by_default": "True",
468
"enabled": "True",
469
}
470
471
def timeout_milliseconds(self):
472
"Return the 'timeout' attribute in milliseconds"
473
return timedelta_to_milliseconds(self.timeout)
474
475
def extended_timeout_milliseconds(self):
476
"Return the 'extended_timeout' attribute in milliseconds"
477
return timedelta_to_milliseconds(self.extended_timeout)
478
479
def interval_milliseconds(self):
480
"Return the 'interval' attribute in milliseconds"
481
return timedelta_to_milliseconds(self.interval)
482
483
def approval_delay_milliseconds(self):
484
return timedelta_to_milliseconds(self.approval_delay)
811
485
812
486
@staticmethod
813
487
def config_parser(config):
829
503
client["enabled"] = config.getboolean(client_name,
830
504
"enabled")
831
505
832
# Uppercase and remove spaces from fingerprint for later
833
# comparison purposes with return value from the
834
# fingerprint() function
835
506
client["fingerprint"] = (section["fingerprint"].upper()
836
507
.replace(" ", ""))
837
508
if "secret" in section:
838
client["secret"] = codecs.decode(section["secret"]
839
.encode("utf-8"),
840
"base64")
509
client["secret"] = section["secret"].decode("base64")
841
510
elif "secfile" in section:
842
511
with open(os.path.expanduser(os.path.expandvars
843
512
(section["secfile"])),
844
513
"rb") as secfile:
845
514
client["secret"] = secfile.read()
846
515
else:
847
raise TypeError("No secret or secfile for section {}"
516
raise TypeError("No secret or secfile for section {0}"
848
517
.format(section))
849
518
client["timeout"] = string_to_delta(section["timeout"])
850
519
client["extended_timeout"] = string_to_delta(
867
536
server_settings = {}
868
537
self.server_settings = server_settings
869
538
# adding all client settings
870
for setting, value in settings.items():
539
for setting, value in settings.iteritems():
871
540
setattr(self, setting, value)
872
541
873
542
if self.enabled:
881
550
self.expires = None
882
551
883
552
logger.debug("Creating client %r", self.name)
553
# Uppercase and remove spaces from fingerprint for later
554
# comparison purposes with return value from the fingerprint()
555
# function
884
556
logger.debug(" Fingerprint: %s", self.fingerprint)
885
557
self.created = settings.get("created",
886
558
datetime.datetime.utcnow())
893
565
self.current_checker_command = None
894
566
self.approved = None
895
567
self.approvals_pending = 0
896
self.changedstate = multiprocessing_manager.Condition(
897
multiprocessing_manager.Lock())
898
self.client_structure = [attr
899
for attr in self.__dict__.keys()
568
self.changedstate = (multiprocessing_manager
569
.Condition(multiprocessing_manager
570
.Lock()))
571
self.client_structure = [attr for attr in
572
self.__dict__.iterkeys()
900
573
if not attr.startswith("_")]
901
574
self.client_structure.append("client_structure")
902
575
903
for name, t in inspect.getmembers(
904
type(self), lambda obj: isinstance(obj, property)):
576
for name, t in inspect.getmembers(type(self),
577
lambda obj:
578
isinstance(obj,
579
property)):
905
580
if not name.startswith("_"):
906
581
self.client_structure.append(name)
907
582
928
603
if not quiet:
929
604
logger.info("Disabling client %s", self.name)
930
605
if getattr(self, "disable_initiator_tag", None) is not None:
931
GLib.source_remove(self.disable_initiator_tag)
606
gobject.source_remove(self.disable_initiator_tag)
932
607
self.disable_initiator_tag = None
933
608
self.expires = None
934
609
if getattr(self, "checker_initiator_tag", None) is not None:
935
GLib.source_remove(self.checker_initiator_tag)
610
gobject.source_remove(self.checker_initiator_tag)
936
611
self.checker_initiator_tag = None
937
612
self.stop_checker()
938
613
self.enabled = False
939
614
if not quiet:
940
615
self.send_changedstate()
941
# Do not run this again if called by a GLib.timeout_add
616
# Do not run this again if called by a gobject.timeout_add
942
617
return False
943
618
944
619
def __del__(self):
948
623
# Schedule a new checker to be started an 'interval' from now,
949
624
# and every interval from then on.
950
625
if self.checker_initiator_tag is not None:
951
GLib.source_remove(self.checker_initiator_tag)
952
self.checker_initiator_tag = GLib.timeout_add(
953
int(self.interval.total_seconds() * 1000),
954
self.start_checker)
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = (gobject.timeout_add
628
(self.interval_milliseconds(),
629
self.start_checker))
955
630
# Schedule a disable() when 'timeout' has passed
956
631
if self.disable_initiator_tag is not None:
957
GLib.source_remove(self.disable_initiator_tag)
958
self.disable_initiator_tag = GLib.timeout_add(
959
int(self.timeout.total_seconds() * 1000), self.disable)
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = (gobject.timeout_add
634
(self.timeout_milliseconds(),
635
self.disable))
960
636
# Also start a new checker *right now*.
961
637
self.start_checker()
962
638
963
def checker_callback(self, source, condition, connection,
964
command):
639
def checker_callback(self, pid, condition, command):
965
640
"""The checker has completed, so take appropriate actions."""
966
641
self.checker_callback_tag = None
967
642
self.checker = None
968
# Read return code from connection (see call_pipe)
969
returncode = connection.recv()
970
connection.close()
971
972
if returncode >= 0:
973
self.last_checker_status = returncode
974
self.last_checker_signal = None
643
if os.WIFEXITED(condition):
644
self.last_checker_status = os.WEXITSTATUS(condition)
975
645
if self.last_checker_status == 0:
976
646
logger.info("Checker for %(name)s succeeded",
977
647
vars(self))
978
648
self.checked_ok()
979
649
else:
980
logger.info("Checker for %(name)s failed", vars(self))
650
logger.info("Checker for %(name)s failed",
651
vars(self))
981
652
else:
982
653
self.last_checker_status = -1
983
self.last_checker_signal = -returncode
984
654
logger.warning("Checker for %(name)s crashed?",
985
655
vars(self))
986
return False
987
656
988
657
def checked_ok(self):
989
658
"""Assert that the client has been seen, alive and well."""
990
659
self.last_checked_ok = datetime.datetime.utcnow()
991
660
self.last_checker_status = 0
992
self.last_checker_signal = None
993
661
self.bump_timeout()
994
662
995
663
def bump_timeout(self, timeout=None):
997
665
if timeout is None:
998
666
timeout = self.timeout
999
667
if self.disable_initiator_tag is not None:
1000
GLib.source_remove(self.disable_initiator_tag)
668
gobject.source_remove(self.disable_initiator_tag)
1001
669
self.disable_initiator_tag = None
1002
670
if getattr(self, "enabled", False):
1003
self.disable_initiator_tag = GLib.timeout_add(
1004
int(timeout.total_seconds() * 1000), self.disable)
671
self.disable_initiator_tag = (gobject.timeout_add
672
(timedelta_to_milliseconds
673
(timeout), self.disable))
1005
674
self.expires = datetime.datetime.utcnow() + timeout
1006
675
1007
676
def need_approval(self):
1021
690
# than 'timeout' for the client to be disabled, which is as it
1022
691
# should be.
1023
692
1024
if self.checker is not None and not self.checker.is_alive():
1025
logger.warning("Checker was not alive; joining")
1026
self.checker.join()
1027
self.checker = None
693
# If a checker exists, make sure it is not a zombie
694
try:
695
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
696
except AttributeError:
697
pass
698
except OSError as error:
699
if error.errno != errno.ECHILD:
700
raise
701
else:
702
if pid:
703
logger.warning("Checker was a zombie")
704
gobject.source_remove(self.checker_callback_tag)
705
self.checker_callback(pid, status,
706
self.current_checker_command)
1028
707
# Start a new checker if needed
1029
708
if self.checker is None:
1030
709
# Escape attributes for the shell
1031
escaped_attrs = {
1032
attr: re.escape(str(getattr(self, attr)))
1033
for attr in self.runtime_expansions }
710
escaped_attrs = dict(
711
(attr, re.escape(unicode(getattr(self, attr))))
712
for attr in
713
self.runtime_expansions)
1034
714
try:
1035
715
command = self.checker_command % escaped_attrs
1036
716
except TypeError as error:
1037
717
logger.error('Could not format string "%s"',
1038
self.checker_command,
718
self.checker_command, exc_info=error)
719
return True # Try again later
720
self.current_checker_command = command
721
try:
722
logger.info("Starting checker %r for %s",
723
command, self.name)
724
# We don't need to redirect stdout and stderr, since
725
# in normal mode, that is already done by daemon(),
726
# and in debug mode we don't want to. (Stdin is
727
# always replaced by /dev/null.)
728
# The exception is when not debugging but nevertheless
729
# running in the foreground; use the previously
730
# created wnull.
731
popen_args = {}
732
if (not self.server_settings["debug"]
733
and self.server_settings["foreground"]):
734
popen_args.update({"stdout": wnull,
735
"stderr": wnull })
736
self.checker = subprocess.Popen(command,
737
close_fds=True,
738
shell=True, cwd="/",
739
**popen_args)
740
except OSError as error:
741
logger.error("Failed to start subprocess",
1039
742
exc_info=error)
1040
return True # Try again later
1041
self.current_checker_command = command
1042
logger.info("Starting checker %r for %s", command,
1043
self.name)
1044
# We don't need to redirect stdout and stderr, since
1045
# in normal mode, that is already done by daemon(),
1046
# and in debug mode we don't want to. (Stdin is
1047
# always replaced by /dev/null.)
1048
# The exception is when not debugging but nevertheless
1049
# running in the foreground; use the previously
1050
# created wnull.
1051
popen_args = { "close_fds": True,
1052
"shell": True,
1053
"cwd": "/" }
1054
if (not self.server_settings["debug"]
1055
and self.server_settings["foreground"]):
1056
popen_args.update({"stdout": wnull,
1057
"stderr": wnull })
1058
pipe = multiprocessing.Pipe(duplex = False)
1059
self.checker = multiprocessing.Process(
1060
target = call_pipe,
1061
args = (pipe[1], subprocess.call, command),
1062
kwargs = popen_args)
1063
self.checker.start()
1064
self.checker_callback_tag = GLib.io_add_watch(
1065
pipe[0].fileno(), GLib.IO_IN,
1066
self.checker_callback, pipe[0], command)
1067
# Re-run this periodically if run by GLib.timeout_add
743
return True
744
self.checker_callback_tag = (gobject.child_watch_add
745
(self.checker.pid,
746
self.checker_callback,
747
data=command))
748
# The checker may have completed before the gobject
749
# watch was added. Check for this.
750
try:
751
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
752
except OSError as error:
753
if error.errno == errno.ECHILD:
754
# This should never happen
755
logger.error("Child process vanished",
756
exc_info=error)
757
return True
758
raise
759
if pid:
760
gobject.source_remove(self.checker_callback_tag)
761
self.checker_callback(pid, status, command)
762
# Re-run this periodically if run by gobject.timeout_add
1068
763
return True
1069
764
1070
765
def stop_checker(self):
1071
766
"""Force the checker process, if any, to stop."""
1072
767
if self.checker_callback_tag:
1073
GLib.source_remove(self.checker_callback_tag)
768
gobject.source_remove(self.checker_callback_tag)
1074
769
self.checker_callback_tag = None
1075
770
if getattr(self, "checker", None) is None:
1076
771
return
1077
772
logger.debug("Stopping checker for %(name)s", vars(self))
1078
self.checker.terminate()
773
try:
774
self.checker.terminate()
775
#time.sleep(0.5)
776
#if self.checker.poll() is None:
777
# self.checker.kill()
778
except OSError as error:
779
if error.errno != errno.ESRCH: # No such process
780
raise
1079
781
self.checker = None
1080
782
1081
783
1082
def dbus_service_property(dbus_interface,
1083
signature="v",
1084
access="readwrite",
1085
byte_arrays=False):
784
def dbus_service_property(dbus_interface, signature="v",
785
access="readwrite", byte_arrays=False):
1086
786
"""Decorators for marking methods of a DBusObjectWithProperties to
1087
787
become properties on the D-Bus.
1088
788
1097
797
# "Set" method, so we fail early here:
1098
798
if byte_arrays and signature != "ay":
1099
799
raise ValueError("Byte arrays not supported for non-'ay'"
1100
" signature {!r}".format(signature))
1101
800
" signature {0!r}".format(signature))
1102
801
def decorator(func):
1103
802
func._dbus_is_property = True
1104
803
func._dbus_interface = dbus_interface
1109
808
func._dbus_name = func._dbus_name[:-14]
1110
809
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1111
810
return func
1112
1113
811
return decorator
1114
812
1115
813
1124
822
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1125
823
"false"}
1126
824
"""
1127
1128
825
def decorator(func):
1129
826
func._dbus_is_interface = True
1130
827
func._dbus_interface = dbus_interface
1131
828
func._dbus_name = dbus_interface
1132
829
return func
1133
1134
830
return decorator
1135
831
1136
832
1138
834
"""Decorator to annotate D-Bus methods, signals or properties
1139
835
Usage:
1140
836
1141
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1142
"org.freedesktop.DBus.Property."
1143
"EmitsChangedSignal": "false"})
1144
837
@dbus_service_property("org.example.Interface", signature="b",
1145
838
access="r")
839
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
840
"org.freedesktop.DBus.Property."
841
"EmitsChangedSignal": "false"})
1146
842
def Property_dbus_property(self):
1147
843
return dbus.Boolean(False)
1148
1149
See also the DBusObjectWithAnnotations class.
1150
844
"""
1151
1152
845
def decorator(func):
1153
846
func._dbus_annotations = annotations
1154
847
return func
1155
1156
848
return decorator
1157
849
1158
850
1159
851
class DBusPropertyException(dbus.exceptions.DBusException):
1160
852
"""A base class for D-Bus property-related exceptions
1161
853
"""
1162
pass
854
def __unicode__(self):
855
return unicode(str(self))
1163
856
1164
857
1165
858
class DBusPropertyAccessException(DBusPropertyException):
1174
867
pass
1175
868
1176
869
1177
class DBusObjectWithAnnotations(dbus.service.Object):
1178
"""A D-Bus object with annotations.
870
class DBusObjectWithProperties(dbus.service.Object):
871
"""A D-Bus object with properties.
1179
872
1180
Classes inheriting from this can use the dbus_annotations
1181
decorator to add annotations to methods or signals.
873
Classes inheriting from this can use the dbus_service_property
874
decorator to expose methods as D-Bus properties. It exposes the
875
standard Get(), Set(), and GetAll() methods on the D-Bus.
1182
876
"""
1183
877
1184
878
@staticmethod
1188
882
If called like _is_dbus_thing("method") it returns a function
1189
883
suitable for use as predicate to inspect.getmembers().
1190
884
"""
1191
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1192
886
False)
1193
887
1194
888
def _get_all_dbus_things(self, thing):
1195
889
"""Returns a generator of (name, attribute) pairs
1196
890
"""
1197
return ((getattr(athing.__get__(self), "_dbus_name", name),
891
return ((getattr(athing.__get__(self), "_dbus_name",
892
name),
1198
893
athing.__get__(self))
1199
894
for cls in self.__class__.__mro__
1200
895
for name, athing in
1201
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1202
1203
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1204
out_signature = "s",
1205
path_keyword = 'object_path',
1206
connection_keyword = 'connection')
1207
def Introspect(self, object_path, connection):
1208
"""Overloading of standard D-Bus method.
1209
1210
Inserts annotation tags on methods and signals.
1211
"""
1212
xmlstring = dbus.service.Object.Introspect(self, object_path,
1213
connection)
1214
try:
1215
document = xml.dom.minidom.parseString(xmlstring)
1216
1217
for if_tag in document.getElementsByTagName("interface"):
1218
# Add annotation tags
1219
for typ in ("method", "signal"):
1220
for tag in if_tag.getElementsByTagName(typ):
1221
annots = dict()
1222
for name, prop in (self.
1223
_get_all_dbus_things(typ)):
1224
if (name == tag.getAttribute("name")
1225
and prop._dbus_interface
1226
== if_tag.getAttribute("name")):
1227
annots.update(getattr(
1228
prop, "_dbus_annotations", {}))
1229
for name, value in annots.items():
1230
ann_tag = document.createElement(
1231
"annotation")
1232
ann_tag.setAttribute("name", name)
1233
ann_tag.setAttribute("value", value)
1234
tag.appendChild(ann_tag)
1235
# Add interface annotation tags
1236
for annotation, value in dict(
1237
itertools.chain.from_iterable(
1238
annotations().items()
1239
for name, annotations
1240
in self._get_all_dbus_things("interface")
1241
if name == if_tag.getAttribute("name")
1242
)).items():
1243
ann_tag = document.createElement("annotation")
1244
ann_tag.setAttribute("name", annotation)
1245
ann_tag.setAttribute("value", value)
1246
if_tag.appendChild(ann_tag)
1247
# Fix argument name for the Introspect method itself
1248
if (if_tag.getAttribute("name")
1249
== dbus.INTROSPECTABLE_IFACE):
1250
for cn in if_tag.getElementsByTagName("method"):
1251
if cn.getAttribute("name") == "Introspect":
1252
for arg in cn.getElementsByTagName("arg"):
1253
if (arg.getAttribute("direction")
1254
== "out"):
1255
arg.setAttribute("name",
1256
"xml_data")
1257
xmlstring = document.toxml("utf-8")
1258
document.unlink()
1259
except (AttributeError, xml.dom.DOMException,
1260
xml.parsers.expat.ExpatError) as error:
1261
logger.error("Failed to override Introspection method",
1262
exc_info=error)
1263
return xmlstring
1264
1265
1266
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1267
"""A D-Bus object with properties.
1268
1269
Classes inheriting from this can use the dbus_service_property
1270
decorator to expose methods as D-Bus properties. It exposes the
1271
standard Get(), Set(), and GetAll() methods on the D-Bus.
1272
"""
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
1273
898
1274
899
def _get_dbus_property(self, interface_name, property_name):
1275
900
"""Returns a bound method if one exists which is a D-Bus
1276
901
property with the specified name and interface.
1277
902
"""
1278
for cls in self.__class__.__mro__:
1279
for name, value in inspect.getmembers(
1280
cls, self._is_dbus_thing("property")):
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
905
(cls,
906
self._is_dbus_thing("property"))):
1281
907
if (value._dbus_name == property_name
1282
908
and value._dbus_interface == interface_name):
1283
909
return value.__get__(self)
1284
910
1285
911
# No such property
1286
raise DBusPropertyNotFound("{}:{}.{}".format(
1287
self.dbus_object_path, interface_name, property_name))
1288
1289
@classmethod
1290
def _get_all_interface_names(cls):
1291
"""Get a sequence of all interfaces supported by an object"""
1292
return (name for name in set(getattr(getattr(x, attr),
1293
"_dbus_interface", None)
1294
for x in (inspect.getmro(cls))
1295
for attr in dir(x))
1296
if name is not None)
1297
1298
@dbus.service.method(dbus.PROPERTIES_IFACE,
1299
in_signature="ss",
912
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
+ interface_name + "."
914
+ property_name)
915
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1300
917
out_signature="v")
1301
918
def Get(self, interface_name, property_name):
1302
919
"""Standard D-Bus property Get() method, see D-Bus standard.
1321
938
# signatures other than "ay".
1322
939
if prop._dbus_signature != "ay":
1323
940
raise ValueError("Byte arrays not supported for non-"
1324
"'ay' signature {!r}"
941
"'ay' signature {0!r}"
1325
942
.format(prop._dbus_signature))
1326
943
value = dbus.ByteArray(b''.join(chr(byte)
1327
944
for byte in value))
1328
945
prop(value)
1329
946
1330
@dbus.service.method(dbus.PROPERTIES_IFACE,
1331
in_signature="s",
947
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1332
948
out_signature="a{sv}")
1333
949
def GetAll(self, interface_name):
1334
950
"""Standard D-Bus property GetAll() method, see D-Bus
1349
965
if not hasattr(value, "variant_level"):
1350
966
properties[name] = value
1351
967
continue
1352
properties[name] = type(value)(
1353
value, variant_level = value.variant_level + 1)
968
properties[name] = type(value)(value, variant_level=
969
value.variant_level+1)
1354
970
return dbus.Dictionary(properties, signature="sv")
1355
971
1356
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1357
def PropertiesChanged(self, interface_name, changed_properties,
1358
invalidated_properties):
1359
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1360
standard.
1361
"""
1362
pass
1363
1364
972
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1365
973
out_signature="s",
1366
974
path_keyword='object_path',
1370
978
1371
979
Inserts property tags and interface annotation tags.
1372
980
"""
1373
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1374
object_path,
1375
connection)
981
xmlstring = dbus.service.Object.Introspect(self, object_path,
982
connection)
1376
983
try:
1377
984
document = xml.dom.minidom.parseString(xmlstring)
1378
1379
985
def make_tag(document, name, prop):
1380
986
e = document.createElement("property")
1381
987
e.setAttribute("name", name)
1382
988
e.setAttribute("type", prop._dbus_signature)
1383
989
e.setAttribute("access", prop._dbus_access)
1384
990
return e
1385
1386
991
for if_tag in document.getElementsByTagName("interface"):
1387
992
# Add property tags
1388
993
for tag in (make_tag(document, name, prop)
1391
996
if prop._dbus_interface
1392
997
== if_tag.getAttribute("name")):
1393
998
if_tag.appendChild(tag)
1394
# Add annotation tags for properties
1395
for tag in if_tag.getElementsByTagName("property"):
1396
annots = dict()
1397
for name, prop in self._get_all_dbus_things(
1398
"property"):
1399
if (name == tag.getAttribute("name")
1400
and prop._dbus_interface
1401
== if_tag.getAttribute("name")):
1402
annots.update(getattr(
1403
prop, "_dbus_annotations", {}))
1404
for name, value in annots.items():
1405
ann_tag = document.createElement(
1406
"annotation")
1407
ann_tag.setAttribute("name", name)
1408
ann_tag.setAttribute("value", value)
1409
tag.appendChild(ann_tag)
999
# Add annotation tags
1000
for typ in ("method", "signal", "property"):
1001
for tag in if_tag.getElementsByTagName(typ):
1002
annots = dict()
1003
for name, prop in (self.
1004
_get_all_dbus_things(typ)):
1005
if (name == tag.getAttribute("name")
1006
and prop._dbus_interface
1007
== if_tag.getAttribute("name")):
1008
annots.update(getattr
1009
(prop,
1010
"_dbus_annotations",
1011
{}))
1012
for name, value in annots.iteritems():
1013
ann_tag = document.createElement(
1014
"annotation")
1015
ann_tag.setAttribute("name", name)
1016
ann_tag.setAttribute("value", value)
1017
tag.appendChild(ann_tag)
1018
# Add interface annotation tags
1019
for annotation, value in dict(
1020
itertools.chain.from_iterable(
1021
annotations().iteritems()
1022
for name, annotations in
1023
self._get_all_dbus_things("interface")
1024
if name == if_tag.getAttribute("name")
1025
)).iteritems():
1026
ann_tag = document.createElement("annotation")
1027
ann_tag.setAttribute("name", annotation)
1028
ann_tag.setAttribute("value", value)
1029
if_tag.appendChild(ann_tag)
1410
1030
# Add the names to the return values for the
1411
1031
# "org.freedesktop.DBus.Properties" methods
1412
1032
if (if_tag.getAttribute("name")
1430
1050
exc_info=error)
1431
1051
return xmlstring
1432
1052
1433
try:
1434
dbus.OBJECT_MANAGER_IFACE
1435
except AttributeError:
1436
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1437
1438
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1439
"""A D-Bus object with an ObjectManager.
1440
1441
Classes inheriting from this exposes the standard
1442
GetManagedObjects call and the InterfacesAdded and
1443
InterfacesRemoved signals on the standard
1444
"org.freedesktop.DBus.ObjectManager" interface.
1445
1446
Note: No signals are sent automatically; they must be sent
1447
manually.
1448
"""
1449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1450
out_signature = "a{oa{sa{sv}}}")
1451
def GetManagedObjects(self):
1452
"""This function must be overridden"""
1453
raise NotImplementedError()
1454
1455
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1456
signature = "oa{sa{sv}}")
1457
def InterfacesAdded(self, object_path, interfaces_and_properties):
1458
pass
1459
1460
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1461
def InterfacesRemoved(self, object_path, interfaces):
1462
pass
1463
1464
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1465
out_signature = "s",
1466
path_keyword = 'object_path',
1467
connection_keyword = 'connection')
1468
def Introspect(self, object_path, connection):
1469
"""Overloading of standard D-Bus method.
1470
1471
Override return argument name of GetManagedObjects to be
1472
"objpath_interfaces_and_properties"
1473
"""
1474
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1475
object_path,
1476
connection)
1477
try:
1478
document = xml.dom.minidom.parseString(xmlstring)
1479
1480
for if_tag in document.getElementsByTagName("interface"):
1481
# Fix argument name for the GetManagedObjects method
1482
if (if_tag.getAttribute("name")
1483
== dbus.OBJECT_MANAGER_IFACE):
1484
for cn in if_tag.getElementsByTagName("method"):
1485
if (cn.getAttribute("name")
1486
== "GetManagedObjects"):
1487
for arg in cn.getElementsByTagName("arg"):
1488
if (arg.getAttribute("direction")
1489
== "out"):
1490
arg.setAttribute(
1491
"name",
1492
"objpath_interfaces"
1493
"_and_properties")
1494
xmlstring = document.toxml("utf-8")
1495
document.unlink()
1496
except (AttributeError, xml.dom.DOMException,
1497
xml.parsers.expat.ExpatError) as error:
1498
logger.error("Failed to override Introspection method",
1499
exc_info = error)
1500
return xmlstring
1501
1053
1502
1054
def datetime_to_dbus(dt, variant_level=0):
1503
1055
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1504
1056
if dt is None:
1505
1057
return dbus.String("", variant_level = variant_level)
1506
return dbus.String(dt.isoformat(), variant_level=variant_level)
1058
return dbus.String(dt.isoformat(),
1059
variant_level=variant_level)
1507
1060
1508
1061
1509
1062
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1529
1082
(from DBusObjectWithProperties) and interfaces (from the
1530
1083
dbus_interface_annotations decorator).
1531
1084
"""
1532
1533
1085
def wrapper(cls):
1534
1086
for orig_interface_name, alt_interface_name in (
1535
alt_interface_names.items()):
1087
alt_interface_names.iteritems()):
1536
1088
attr = {}
1537
1089
interface_names = set()
1538
1090
# Go though all attributes of the class
1540
1092
# Ignore non-D-Bus attributes, and D-Bus attributes
1541
1093
# with the wrong interface name
1542
1094
if (not hasattr(attribute, "_dbus_interface")
1543
or not attribute._dbus_interface.startswith(
1544
orig_interface_name)):
1095
or not attribute._dbus_interface
1096
.startswith(orig_interface_name)):
1545
1097
continue
1546
1098
# Create an alternate D-Bus interface name based on
1547
1099
# the current name
1548
alt_interface = attribute._dbus_interface.replace(
1549
orig_interface_name, alt_interface_name)
1100
alt_interface = (attribute._dbus_interface
1101
.replace(orig_interface_name,
1102
alt_interface_name))
1550
1103
interface_names.add(alt_interface)
1551
1104
# Is this a D-Bus signal?
1552
1105
if getattr(attribute, "_dbus_is_signal", False):
1553
1106
# Extract the original non-method undecorated
1554
1107
# function by black magic
1555
if sys.version_info.major == 2:
1556
nonmethod_func = (dict(
1108
nonmethod_func = (dict(
1557
1109
zip(attribute.func_code.co_freevars,
1558
attribute.__closure__))
1559
["func"].cell_contents)
1560
else:
1561
nonmethod_func = (dict(
1562
zip(attribute.__code__.co_freevars,
1563
attribute.__closure__))
1564
["func"].cell_contents)
1110
attribute.__closure__))["func"]
1111
.cell_contents)
1565
1112
# Create a new, but exactly alike, function
1566
1113
# object, and decorate it to be a new D-Bus signal
1567
1114
# with the alternate D-Bus interface name
1568
new_function = copy_function(nonmethod_func)
1569
new_function = (dbus.service.signal(
1570
alt_interface,
1571
attribute._dbus_signature)(new_function))
1115
new_function = (dbus.service.signal
1116
(alt_interface,
1117
attribute._dbus_signature)
1118
(types.FunctionType(
1119
nonmethod_func.func_code,
1120
nonmethod_func.func_globals,
1121
nonmethod_func.func_name,
1122
nonmethod_func.func_defaults,
1123
nonmethod_func.func_closure)))
1572
1124
# Copy annotations, if any
1573
1125
try:
1574
new_function._dbus_annotations = dict(
1575
attribute._dbus_annotations)
1126
new_function._dbus_annotations = (
1127
dict(attribute._dbus_annotations))
1576
1128
except AttributeError:
1577
1129
pass
1578
1130
# Define a creator of a function to call both the
1583
1135
"""This function is a scope container to pass
1584
1136
func1 and func2 to the "call_both" function
1585
1137
outside of its arguments"""
1586
1587
@functools.wraps(func2)
1588
1138
def call_both(*args, **kwargs):
1589
1139
"""This function will emit two D-Bus
1590
1140
signals by calling func1 and func2"""
1591
1141
func1(*args, **kwargs)
1592
1142
func2(*args, **kwargs)
1593
# Make wrapper function look like a D-Bus signal
1594
for name, attr in inspect.getmembers(func2):
1595
if name.startswith("_dbus_"):
1596
setattr(call_both, name, attr)
1597
1598
1143
return call_both
1599
1144
# Create the "call_both" function and add it to
1600
1145
# the class
1605
1150
# object. Decorate it to be a new D-Bus method
1606
1151
# with the alternate D-Bus interface name. Add it
1607
1152
# to the class.
1608
attr[attrname] = (
1609
dbus.service.method(
1610
alt_interface,
1611
attribute._dbus_in_signature,
1612
attribute._dbus_out_signature)
1613
(copy_function(attribute)))
1153
attr[attrname] = (dbus.service.method
1154
(alt_interface,
1155
attribute._dbus_in_signature,
1156
attribute._dbus_out_signature)
1157
(types.FunctionType
1158
(attribute.func_code,
1159
attribute.func_globals,
1160
attribute.func_name,
1161
attribute.func_defaults,
1162
attribute.func_closure)))
1614
1163
# Copy annotations, if any
1615
1164
try:
1616
attr[attrname]._dbus_annotations = dict(
1617
attribute._dbus_annotations)
1165
attr[attrname]._dbus_annotations = (
1166
dict(attribute._dbus_annotations))
1618
1167
except AttributeError:
1619
1168
pass
1620
1169
# Is this a D-Bus property?
1623
1172
# object, and decorate it to be a new D-Bus
1624
1173
# property with the alternate D-Bus interface
1625
1174
# name. Add it to the class.
1626
attr[attrname] = (dbus_service_property(
1627
alt_interface, attribute._dbus_signature,
1628
attribute._dbus_access,
1629
attribute._dbus_get_args_options
1630
["byte_arrays"])
1631
(copy_function(attribute)))
1175
attr[attrname] = (dbus_service_property
1176
(alt_interface,
1177
attribute._dbus_signature,
1178
attribute._dbus_access,
1179
attribute
1180
._dbus_get_args_options
1181
["byte_arrays"])
1182
(types.FunctionType
1183
(attribute.func_code,
1184
attribute.func_globals,
1185
attribute.func_name,
1186
attribute.func_defaults,
1187
attribute.func_closure)))
1632
1188
# Copy annotations, if any
1633
1189
try:
1634
attr[attrname]._dbus_annotations = dict(
1635
attribute._dbus_annotations)
1190
attr[attrname]._dbus_annotations = (
1191
dict(attribute._dbus_annotations))
1636
1192
except AttributeError:
1637
1193
pass
1638
1194
# Is this a D-Bus interface?
1641
1197
# object. Decorate it to be a new D-Bus interface
1642
1198
# with the alternate D-Bus interface name. Add it
1643
1199
# to the class.
1644
attr[attrname] = (
1645
dbus_interface_annotations(alt_interface)
1646
(copy_function(attribute)))
1200
attr[attrname] = (dbus_interface_annotations
1201
(alt_interface)
1202
(types.FunctionType
1203
(attribute.func_code,
1204
attribute.func_globals,
1205
attribute.func_name,
1206
attribute.func_defaults,
1207
attribute.func_closure)))
1647
1208
if deprecate:
1648
1209
# Deprecate all alternate interfaces
1649
iname="_AlternateDBusNames_interface_annotation{}"
1210
iname="_AlternateDBusNames_interface_annotation{0}"
1650
1211
for interface_name in interface_names:
1651
1652
1212
@dbus_interface_annotations(interface_name)
1653
1213
def func(self):
1654
1214
return { "org.freedesktop.DBus.Deprecated":
1655
"true" }
1215
"true" }
1656
1216
# Find an unused name
1657
1217
for aname in (iname.format(i)
1658
1218
for i in itertools.count()):
1662
1222
if interface_names:
1663
1223
# Replace the class with a new subclass of it with
1664
1224
# methods, signals, etc. as created above.
1665
if sys.version_info.major == 2:
1666
cls = type(b"{}Alternate".format(cls.__name__),
1667
(cls, ), attr)
1668
else:
1669
cls = type("{}Alternate".format(cls.__name__),
1670
(cls, ), attr)
1225
cls = type(b"{0}Alternate".format(cls.__name__),
1226
(cls,), attr)
1671
1227
return cls
1672
1673
1228
return wrapper
1674
1229
1675
1230
1676
1231
@alternate_dbus_interfaces({"se.recompile.Mandos":
1677
"se.bsnet.fukt.Mandos"})
1232
"se.bsnet.fukt.Mandos"})
1678
1233
class ClientDBus(Client, DBusObjectWithProperties):
1679
1234
"""A Client class using D-Bus
1680
1235
1684
1239
"""
1685
1240
1686
1241
runtime_expansions = (Client.runtime_expansions
1687
+ ("dbus_object_path", ))
1688
1689
_interface = "se.recompile.Mandos.Client"
1242
+ ("dbus_object_path",))
1690
1243
1691
1244
# dbus.service.Object doesn't use super(), so we can't either.
1692
1245
1695
1248
Client.__init__(self, *args, **kwargs)
1696
1249
# Only now, when this client is initialized, can it show up on
1697
1250
# the D-Bus
1698
client_object_name = str(self.name).translate(
1251
client_object_name = unicode(self.name).translate(
1699
1252
{ord("."): ord("_"),
1700
1253
ord("-"): ord("_")})
1701
self.dbus_object_path = dbus.ObjectPath(
1702
"/clients/" + client_object_name)
1254
self.dbus_object_path = (dbus.ObjectPath
1255
("/clients/" + client_object_name))
1703
1256
DBusObjectWithProperties.__init__(self, self.bus,
1704
1257
self.dbus_object_path)
1705
1258
1706
def notifychangeproperty(transform_func, dbus_name,
1707
type_func=lambda x: x,
1708
variant_level=1,
1709
invalidate_only=False,
1710
_interface=_interface):
1259
def notifychangeproperty(transform_func,
1260
dbus_name, type_func=lambda x: x,
1261
variant_level=1):
1711
1262
""" Modify a variable so that it's a property which announces
1712
1263
its changes to DBus.
1713
1264
1718
1269
to the D-Bus. Default: no transform
1719
1270
variant_level: D-Bus variant level. Default: 1
1720
1271
"""
1721
attrname = "_{}".format(dbus_name)
1722
1272
attrname = "_{0}".format(dbus_name)
1723
1273
def setter(self, value):
1724
1274
if hasattr(self, "dbus_object_path"):
1725
1275
if (not hasattr(self, attrname) or
1726
1276
type_func(getattr(self, attrname, None))
1727
1277
!= type_func(value)):
1728
if invalidate_only:
1729
self.PropertiesChanged(
1730
_interface, dbus.Dictionary(),
1731
dbus.Array((dbus_name, )))
1732
else:
1733
dbus_value = transform_func(
1734
type_func(value),
1735
variant_level = variant_level)
1736
self.PropertyChanged(dbus.String(dbus_name),
1737
dbus_value)
1738
self.PropertiesChanged(
1739
_interface,
1740
dbus.Dictionary({ dbus.String(dbus_name):
1741
dbus_value }),
1742
dbus.Array())
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1281
self.PropertyChanged(dbus.String(dbus_name),
1282
dbus_value)
1743
1283
setattr(self, attrname, value)
1744
1284
1745
1285
return property(lambda self: getattr(self, attrname), setter)
1751
1291
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1752
1292
last_enabled = notifychangeproperty(datetime_to_dbus,
1753
1293
"LastEnabled")
1754
checker = notifychangeproperty(
1755
dbus.Boolean, "CheckerRunning",
1756
type_func = lambda checker: checker is not None)
1294
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1295
type_func = lambda checker:
1296
checker is not None)
1757
1297
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1758
1298
"LastCheckedOK")
1759
1299
last_checker_status = notifychangeproperty(dbus.Int16,
1762
1302
datetime_to_dbus, "LastApprovalRequest")
1763
1303
approved_by_default = notifychangeproperty(dbus.Boolean,
1764
1304
"ApprovedByDefault")
1765
approval_delay = notifychangeproperty(
1766
dbus.UInt64, "ApprovalDelay",
1767
type_func = lambda td: td.total_seconds() * 1000)
1305
approval_delay = notifychangeproperty(dbus.UInt64,
1306
"ApprovalDelay",
1307
type_func =
1308
timedelta_to_milliseconds)
1768
1309
approval_duration = notifychangeproperty(
1769
1310
dbus.UInt64, "ApprovalDuration",
1770
type_func = lambda td: td.total_seconds() * 1000)
1311
type_func = timedelta_to_milliseconds)
1771
1312
host = notifychangeproperty(dbus.String, "Host")
1772
timeout = notifychangeproperty(
1773
dbus.UInt64, "Timeout",
1774
type_func = lambda td: td.total_seconds() * 1000)
1313
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1314
type_func =
1315
timedelta_to_milliseconds)
1775
1316
extended_timeout = notifychangeproperty(
1776
1317
dbus.UInt64, "ExtendedTimeout",
1777
type_func = lambda td: td.total_seconds() * 1000)
1778
interval = notifychangeproperty(
1779
dbus.UInt64, "Interval",
1780
type_func = lambda td: td.total_seconds() * 1000)
1318
type_func = timedelta_to_milliseconds)
1319
interval = notifychangeproperty(dbus.UInt64,
1320
"Interval",
1321
type_func =
1322
timedelta_to_milliseconds)
1781
1323
checker_command = notifychangeproperty(dbus.String, "Checker")
1782
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1783
invalidate_only=True)
1784
1324
1785
1325
del notifychangeproperty
1786
1326
1793
1333
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1794
1334
Client.__del__(self, *args, **kwargs)
1795
1335
1796
def checker_callback(self, source, condition,
1797
connection, command, *args, **kwargs):
1798
ret = Client.checker_callback(self, source, condition,
1799
connection, command, *args,
1800
**kwargs)
1801
exitstatus = self.last_checker_status
1802
if exitstatus >= 0:
1336
def checker_callback(self, pid, condition, command,
1337
*args, **kwargs):
1338
self.checker_callback_tag = None
1339
self.checker = None
1340
if os.WIFEXITED(condition):
1341
exitstatus = os.WEXITSTATUS(condition)
1803
1342
# Emit D-Bus signal
1804
1343
self.CheckerCompleted(dbus.Int16(exitstatus),
1805
# This is specific to GNU libC
1806
dbus.Int64(exitstatus << 8),
1344
dbus.Int64(condition),
1807
1345
dbus.String(command))
1808
1346
else:
1809
1347
# Emit D-Bus signal
1810
1348
self.CheckerCompleted(dbus.Int16(-1),
1811
dbus.Int64(
1812
# This is specific to GNU libC
1813
(exitstatus << 8)
1814
| self.last_checker_signal),
1349
dbus.Int64(condition),
1815
1350
dbus.String(command))
1816
return ret
1351
1352
return Client.checker_callback(self, pid, condition, command,
1353
*args, **kwargs)
1817
1354
1818
1355
def start_checker(self, *args, **kwargs):
1819
1356
old_checker_pid = getattr(self.checker, "pid", None)
1831
1368
1832
1369
def approve(self, value=True):
1833
1370
self.approved = value
1834
GLib.timeout_add(int(self.approval_duration.total_seconds()
1835
* 1000), self._reset_approved)
1371
gobject.timeout_add(timedelta_to_milliseconds
1372
(self.approval_duration),
1373
self._reset_approved)
1836
1374
self.send_changedstate()
1837
1375
1838
1376
## D-Bus methods, signals & properties
1377
_interface = "se.recompile.Mandos.Client"
1839
1378
1840
1379
## Interfaces
1841
1380
1381
@dbus_interface_annotations(_interface)
1382
def _foo(self):
1383
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1384
"false"}
1385
1842
1386
## Signals
1843
1387
1844
1388
# CheckerCompleted - signal
1854
1398
pass
1855
1399
1856
1400
# PropertyChanged - signal
1857
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1858
1401
@dbus.service.signal(_interface, signature="sv")
1859
1402
def PropertyChanged(self, property, value):
1860
1403
"D-Bus signal"
1894
1437
self.checked_ok()
1895
1438
1896
1439
# Enable - method
1897
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1898
1440
@dbus.service.method(_interface)
1899
1441
def Enable(self):
1900
1442
"D-Bus method"
1901
1443
self.enable()
1902
1444
1903
1445
# StartChecker - method
1904
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1905
1446
@dbus.service.method(_interface)
1906
1447
def StartChecker(self):
1907
1448
"D-Bus method"
1908
1449
self.start_checker()
1909
1450
1910
1451
# Disable - method
1911
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1912
1452
@dbus.service.method(_interface)
1913
1453
def Disable(self):
1914
1454
"D-Bus method"
1915
1455
self.disable()
1916
1456
1917
1457
# StopChecker - method
1918
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1919
1458
@dbus.service.method(_interface)
1920
1459
def StopChecker(self):
1921
1460
self.stop_checker()
1928
1467
return dbus.Boolean(bool(self.approvals_pending))
1929
1468
1930
1469
# ApprovedByDefault - property
1931
@dbus_service_property(_interface,
1932
signature="b",
1470
@dbus_service_property(_interface, signature="b",
1933
1471
access="readwrite")
1934
1472
def ApprovedByDefault_dbus_property(self, value=None):
1935
1473
if value is None: # get
1937
1475
self.approved_by_default = bool(value)
1938
1476
1939
1477
# ApprovalDelay - property
1940
@dbus_service_property(_interface,
1941
signature="t",
1478
@dbus_service_property(_interface, signature="t",
1942
1479
access="readwrite")
1943
1480
def ApprovalDelay_dbus_property(self, value=None):
1944
1481
if value is None: # get
1945
return dbus.UInt64(self.approval_delay.total_seconds()
1946
* 1000)
1482
return dbus.UInt64(self.approval_delay_milliseconds())
1947
1483
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1948
1484
1949
1485
# ApprovalDuration - property
1950
@dbus_service_property(_interface,
1951
signature="t",
1486
@dbus_service_property(_interface, signature="t",
1952
1487
access="readwrite")
1953
1488
def ApprovalDuration_dbus_property(self, value=None):
1954
1489
if value is None: # get
1955
return dbus.UInt64(self.approval_duration.total_seconds()
1956
* 1000)
1490
return dbus.UInt64(timedelta_to_milliseconds(
1491
self.approval_duration))
1957
1492
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1958
1493
1959
1494
# Name - property
1960
@dbus_annotations(
1961
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1962
1495
@dbus_service_property(_interface, signature="s", access="read")
1963
1496
def Name_dbus_property(self):
1964
1497
return dbus.String(self.name)
1965
1498
1966
1499
# Fingerprint - property
1967
@dbus_annotations(
1968
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1969
1500
@dbus_service_property(_interface, signature="s", access="read")
1970
1501
def Fingerprint_dbus_property(self):
1971
1502
return dbus.String(self.fingerprint)
1972
1503
1973
1504
# Host - property
1974
@dbus_service_property(_interface,
1975
signature="s",
1505
@dbus_service_property(_interface, signature="s",
1976
1506
access="readwrite")
1977
1507
def Host_dbus_property(self, value=None):
1978
1508
if value is None: # get
1979
1509
return dbus.String(self.host)
1980
self.host = str(value)
1510
self.host = unicode(value)
1981
1511
1982
1512
# Created - property
1983
@dbus_annotations(
1984
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1985
1513
@dbus_service_property(_interface, signature="s", access="read")
1986
1514
def Created_dbus_property(self):
1987
1515
return datetime_to_dbus(self.created)
1992
1520
return datetime_to_dbus(self.last_enabled)
1993
1521
1994
1522
# Enabled - property
1995
@dbus_service_property(_interface,
1996
signature="b",
1523
@dbus_service_property(_interface, signature="b",
1997
1524
access="readwrite")
1998
1525
def Enabled_dbus_property(self, value=None):
1999
1526
if value is None: # get
2004
1531
self.disable()
2005
1532
2006
1533
# LastCheckedOK - property
2007
@dbus_service_property(_interface,
2008
signature="s",
1534
@dbus_service_property(_interface, signature="s",
2009
1535
access="readwrite")
2010
1536
def LastCheckedOK_dbus_property(self, value=None):
2011
1537
if value is not None:
2014
1540
return datetime_to_dbus(self.last_checked_ok)
2015
1541
2016
1542
# LastCheckerStatus - property
2017
@dbus_service_property(_interface, signature="n", access="read")
1543
@dbus_service_property(_interface, signature="n",
1544
access="read")
2018
1545
def LastCheckerStatus_dbus_property(self):
2019
1546
return dbus.Int16(self.last_checker_status)
2020
1547
2029
1556
return datetime_to_dbus(self.last_approval_request)
2030
1557
2031
1558
# Timeout - property
2032
@dbus_service_property(_interface,
2033
signature="t",
1559
@dbus_service_property(_interface, signature="t",
2034
1560
access="readwrite")
2035
1561
def Timeout_dbus_property(self, value=None):
2036
1562
if value is None: # get
2037
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1563
return dbus.UInt64(self.timeout_milliseconds())
2038
1564
old_timeout = self.timeout
2039
1565
self.timeout = datetime.timedelta(0, 0, 0, value)
2040
1566
# Reschedule disabling
2048
1574
if (getattr(self, "disable_initiator_tag", None)
2049
1575
is None):
2050
1576
return
2051
GLib.source_remove(self.disable_initiator_tag)
2052
self.disable_initiator_tag = GLib.timeout_add(
2053
int((self.expires - now).total_seconds() * 1000),
2054
self.disable)
1577
gobject.source_remove(self.disable_initiator_tag)
1578
self.disable_initiator_tag = (
1579
gobject.timeout_add(
1580
timedelta_to_milliseconds(self.expires - now),
1581
self.disable))
2055
1582
2056
1583
# ExtendedTimeout - property
2057
@dbus_service_property(_interface,
2058
signature="t",
1584
@dbus_service_property(_interface, signature="t",
2059
1585
access="readwrite")
2060
1586
def ExtendedTimeout_dbus_property(self, value=None):
2061
1587
if value is None: # get
2062
return dbus.UInt64(self.extended_timeout.total_seconds()
2063
* 1000)
1588
return dbus.UInt64(self.extended_timeout_milliseconds())
2064
1589
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2065
1590
2066
1591
# Interval - property
2067
@dbus_service_property(_interface,
2068
signature="t",
1592
@dbus_service_property(_interface, signature="t",
2069
1593
access="readwrite")
2070
1594
def Interval_dbus_property(self, value=None):
2071
1595
if value is None: # get
2072
return dbus.UInt64(self.interval.total_seconds() * 1000)
1596
return dbus.UInt64(self.interval_milliseconds())
2073
1597
self.interval = datetime.timedelta(0, 0, 0, value)
2074
1598
if getattr(self, "checker_initiator_tag", None) is None:
2075
1599
return
2076
1600
if self.enabled:
2077
1601
# Reschedule checker run
2078
GLib.source_remove(self.checker_initiator_tag)
2079
self.checker_initiator_tag = GLib.timeout_add(
2080
value, self.start_checker)
2081
self.start_checker() # Start one now, too
1602
gobject.source_remove(self.checker_initiator_tag)
1603
self.checker_initiator_tag = (gobject.timeout_add
1604
(value, self.start_checker))
1605
self.start_checker() # Start one now, too
2082
1606
2083
1607
# Checker - property
2084
@dbus_service_property(_interface,
2085
signature="s",
1608
@dbus_service_property(_interface, signature="s",
2086
1609
access="readwrite")
2087
1610
def Checker_dbus_property(self, value=None):
2088
1611
if value is None: # get
2089
1612
return dbus.String(self.checker_command)
2090
self.checker_command = str(value)
1613
self.checker_command = unicode(value)
2091
1614
2092
1615
# CheckerRunning - property
2093
@dbus_service_property(_interface,
2094
signature="b",
1616
@dbus_service_property(_interface, signature="b",
2095
1617
access="readwrite")
2096
1618
def CheckerRunning_dbus_property(self, value=None):
2097
1619
if value is None: # get
2102
1624
self.stop_checker()
2103
1625
2104
1626
# ObjectPath - property
2105
@dbus_annotations(
2106
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2107
"org.freedesktop.DBus.Deprecated": "true"})
2108
1627
@dbus_service_property(_interface, signature="o", access="read")
2109
1628
def ObjectPath_dbus_property(self):
2110
1629
return self.dbus_object_path # is already a dbus.ObjectPath
2111
1630
2112
1631
# Secret = property
2113
@dbus_annotations(
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2115
"invalidates"})
2116
@dbus_service_property(_interface,
2117
signature="ay",
2118
access="write",
2119
byte_arrays=True)
1632
@dbus_service_property(_interface, signature="ay",
1633
access="write", byte_arrays=True)
2120
1634
def Secret_dbus_property(self, value):
2121
self.secret = bytes(value)
1635
self.secret = str(value)
2122
1636
2123
1637
del _interface
2124
1638
2128
1642
self._pipe = child_pipe
2129
1643
self._pipe.send(('init', fpr, address))
2130
1644
if not self._pipe.recv():
2131
raise KeyError(fpr)
1645
raise KeyError()
2132
1646
2133
1647
def __getattribute__(self, name):
2134
1648
if name == '_pipe':
2138
1652
if data[0] == 'data':
2139
1653
return data[1]
2140
1654
if data[0] == 'function':
2141
2142
1655
def func(*args, **kwargs):
2143
1656
self._pipe.send(('funcall', name, args, kwargs))
2144
1657
return self._pipe.recv()[1]
2145
2146
1658
return func
2147
1659
2148
1660
def __setattr__(self, name, value):
2160
1672
def handle(self):
2161
1673
with contextlib.closing(self.server.child_pipe) as child_pipe:
2162
1674
logger.info("TCP connection from: %s",
2163
str(self.client_address))
1675
unicode(self.client_address))
2164
1676
logger.debug("Pipe FD: %d",
2165
1677
self.server.child_pipe.fileno())
2166
1678
2167
session = gnutls.ClientSession(self.request)
1679
session = (gnutls.connection
1680
.ClientSession(self.request,
1681
gnutls.connection
1682
.X509Credentials()))
1683
1684
# Note: gnutls.connection.X509Credentials is really a
1685
# generic GnuTLS certificate credentials object so long as
1686
# no X.509 keys are added to it. Therefore, we can use it
1687
# here despite using OpenPGP certificates.
2168
1688
2169
1689
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2170
1690
# "+AES-256-CBC", "+SHA1",
2174
1694
priority = self.server.gnutls_priority
2175
1695
if priority is None:
2176
1696
priority = "NORMAL"
2177
gnutls.priority_set_direct(session._c_object, priority,
2178
None)
1697
(gnutls.library.functions
1698
.gnutls_priority_set_direct(session._c_object,
1699
priority, None))
2179
1700
2180
1701
# Start communication using the Mandos protocol
2181
1702
# Get protocol number
2191
1712
# Start GnuTLS connection
2192
1713
try:
2193
1714
session.handshake()
2194
except gnutls.Error as error:
1715
except gnutls.errors.GNUTLSError as error:
2195
1716
logger.warning("Handshake failed: %s", error)
2196
1717
# Do not run session.bye() here: the session is not
2197
1718
# established. Just abandon the request.
2201
1722
approval_required = False
2202
1723
try:
2203
1724
try:
2204
fpr = self.fingerprint(
2205
self.peer_certificate(session))
2206
except (TypeError, gnutls.Error) as error:
1725
fpr = self.fingerprint(self.peer_certificate
1726
(session))
1727
except (TypeError,
1728
gnutls.errors.GNUTLSError) as error:
2207
1729
logger.warning("Bad certificate: %s", error)
2208
1730
return
2209
1731
logger.debug("Fingerprint: %s", fpr)
2222
1744
while True:
2223
1745
if not client.enabled:
2224
1746
logger.info("Client %s is disabled",
2225
client.name)
1747
client.name)
2226
1748
if self.server.use_dbus:
2227
1749
# Emit D-Bus signal
2228
1750
client.Rejected("Disabled")
2237
1759
if self.server.use_dbus:
2238
1760
# Emit D-Bus signal
2239
1761
client.NeedApproval(
2240
client.approval_delay.total_seconds()
2241
* 1000, client.approved_by_default)
1762
client.approval_delay_milliseconds(),
1763
client.approved_by_default)
2242
1764
else:
2243
1765
logger.warning("Client %s was not approved",
2244
1766
client.name)
2250
1772
#wait until timeout or approved
2251
1773
time = datetime.datetime.now()
2252
1774
client.changedstate.acquire()
2253
client.changedstate.wait(delay.total_seconds())
1775
client.changedstate.wait(
1776
float(timedelta_to_milliseconds(delay)
1777
/ 1000))
2254
1778
client.changedstate.release()
2255
1779
time2 = datetime.datetime.now()
2256
1780
if (time2 - time) >= delay:
2267
1791
else:
2268
1792
delay -= time2 - time
2269
1793
2270
try:
2271
session.send(client.secret)
2272
except gnutls.Error as error:
2273
logger.warning("gnutls send failed",
2274
exc_info = error)
2275
return
1794
sent_size = 0
1795
while sent_size < len(client.secret):
1796
try:
1797
sent = session.send(client.secret[sent_size:])
1798
except gnutls.errors.GNUTLSError as error:
1799
logger.warning("gnutls send failed",
1800
exc_info=error)
1801
return
1802
logger.debug("Sent: %d, remaining: %d",
1803
sent, len(client.secret)
1804
- (sent_size + sent))
1805
sent_size += sent
2276
1806
2277
1807
logger.info("Sending secret to %s", client.name)
2278
1808
# bump the timeout using extended_timeout
2286
1816
client.approvals_pending -= 1
2287
1817
try:
2288
1818
session.bye()
2289
except gnutls.Error as error:
1819
except gnutls.errors.GNUTLSError as error:
2290
1820
logger.warning("GnuTLS bye failed",
2291
1821
exc_info=error)
2292
1822
2294
1824
def peer_certificate(session):
2295
1825
"Return the peer's OpenPGP certificate as a bytestring"
2296
1826
# If not an OpenPGP certificate...
2297
if (gnutls.certificate_type_get(session._c_object)
2298
!= gnutls.CRT_OPENPGP):
2299
# ...return invalid data
2300
return b""
1827
if (gnutls.library.functions
1828
.gnutls_certificate_type_get(session._c_object)
1829
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1830
# ...do the normal thing
1831
return session.peer_certificate
2301
1832
list_size = ctypes.c_uint(1)
2302
cert_list = (gnutls.certificate_get_peers
1833
cert_list = (gnutls.library.functions
1834
.gnutls_certificate_get_peers
2303
1835
(session._c_object, ctypes.byref(list_size)))
2304
1836
if not bool(cert_list) and list_size.value != 0:
2305
raise gnutls.Error("error getting peer certificate")
1837
raise gnutls.errors.GNUTLSError("error getting peer"
1838
" certificate")
2306
1839
if list_size.value == 0:
2307
1840
return None
2308
1841
cert = cert_list[0]
2312
1845
def fingerprint(openpgp):
2313
1846
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2314
1847
# New GnuTLS "datum" with the OpenPGP public key
2315
datum = gnutls.datum_t(
2316
ctypes.cast(ctypes.c_char_p(openpgp),
2317
ctypes.POINTER(ctypes.c_ubyte)),
2318
ctypes.c_uint(len(openpgp)))
1848
datum = (gnutls.library.types
1849
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1850
ctypes.POINTER
1851
(ctypes.c_ubyte)),
1852
ctypes.c_uint(len(openpgp))))
2319
1853
# New empty GnuTLS certificate
2320
crt = gnutls.openpgp_crt_t()
2321
gnutls.openpgp_crt_init(ctypes.byref(crt))
1854
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1855
(gnutls.library.functions
1856
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2322
1857
# Import the OpenPGP public key into the certificate
2323
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2324
gnutls.OPENPGP_FMT_RAW)
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1860
gnutls.library.constants
1861
.GNUTLS_OPENPGP_FMT_RAW))
2325
1862
# Verify the self signature in the key
2326
1863
crtverify = ctypes.c_uint()
2327
gnutls.openpgp_crt_verify_self(crt, 0,
2328
ctypes.byref(crtverify))
1864
(gnutls.library.functions
1865
.gnutls_openpgp_crt_verify_self(crt, 0,
1866
ctypes.byref(crtverify)))
2329
1867
if crtverify.value != 0:
2330
gnutls.openpgp_crt_deinit(crt)
2331
raise gnutls.CertificateSecurityError("Verify failed")
1868
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1869
raise (gnutls.errors.CertificateSecurityError
1870
("Verify failed"))
2332
1871
# New buffer for the fingerprint
2333
1872
buf = ctypes.create_string_buffer(20)
2334
1873
buf_len = ctypes.c_size_t()
2335
1874
# Get the fingerprint from the certificate into the buffer
2336
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2337
ctypes.byref(buf_len))
1875
(gnutls.library.functions
1876
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1877
ctypes.byref(buf_len)))
2338
1878
# Deinit the certificate
2339
gnutls.openpgp_crt_deinit(crt)
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2340
1880
# Convert the buffer to a Python bytestring
2341
1881
fpr = ctypes.string_at(buf, buf_len.value)
2342
1882
# Convert the bytestring to hexadecimal notation
2346
1886
2347
1887
class MultiprocessingMixIn(object):
2348
1888
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2349
2350
1889
def sub_process_main(self, request, address):
2351
1890
try:
2352
1891
self.finish_request(request, address)
2364
1903
2365
1904
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2366
1905
""" adds a pipe to the MixIn """
2367
2368
1906
def process_request(self, request, client_address):
2369
1907
"""Overrides and wraps the original process_request().
2370
1908
2391
1929
interface: None or a network interface name (string)
2392
1930
use_ipv6: Boolean; to use IPv6 or not
2393
1931
"""
2394
2395
1932
def __init__(self, server_address, RequestHandlerClass,
2396
interface=None,
2397
use_ipv6=True,
2398
socketfd=None):
1933
interface=None, use_ipv6=True, socketfd=None):
2399
1934
"""If socketfd is set, use that file descriptor instead of
2400
1935
creating a new one with socket.socket().
2401
1936
"""
2442
1977
self.interface)
2443
1978
else:
2444
1979
try:
2445
self.socket.setsockopt(
2446
socket.SOL_SOCKET, SO_BINDTODEVICE,
2447
(self.interface + "\0").encode("utf-8"))
1980
self.socket.setsockopt(socket.SOL_SOCKET,
1981
SO_BINDTODEVICE,
1982
str(self.interface + '\0'))
2448
1983
except socket.error as error:
2449
1984
if error.errno == errno.EPERM:
2450
1985
logger.error("No permission to bind to"
2468
2003
self.server_address = (any_address,
2469
2004
self.server_address[1])
2470
2005
elif not self.server_address[1]:
2471
self.server_address = (self.server_address[0], 0)
2006
self.server_address = (self.server_address[0],
2007
0)
2472
2008
# if self.interface:
2473
2009
# self.server_address = (self.server_address[0],
2474
2010
# 0, # port
2486
2022
gnutls_priority GnuTLS priority string
2487
2023
use_dbus: Boolean; to emit D-Bus signals or not
2488
2024
2489
Assumes a GLib.MainLoop event loop.
2025
Assumes a gobject.MainLoop event loop.
2490
2026
"""
2491
2492
2027
def __init__(self, server_address, RequestHandlerClass,
2493
interface=None,
2494
use_ipv6=True,
2495
clients=None,
2496
gnutls_priority=None,
2497
use_dbus=True,
2498
socketfd=None):
2028
interface=None, use_ipv6=True, clients=None,
2029
gnutls_priority=None, use_dbus=True, socketfd=None):
2499
2030
self.enabled = False
2500
2031
self.clients = clients
2501
2032
if self.clients is None:
2507
2038
interface = interface,
2508
2039
use_ipv6 = use_ipv6,
2509
2040
socketfd = socketfd)
2510
2511
2041
def server_activate(self):
2512
2042
if self.enabled:
2513
2043
return socketserver.TCPServer.server_activate(self)
2517
2047
2518
2048
def add_pipe(self, parent_pipe, proc):
2519
2049
# Call "handle_ipc" for both data and EOF events
2520
GLib.io_add_watch(
2521
parent_pipe.fileno(),
2522
GLib.IO_IN | GLib.IO_HUP,
2523
functools.partial(self.handle_ipc,
2524
parent_pipe = parent_pipe,
2525
proc = proc))
2050
gobject.io_add_watch(parent_pipe.fileno(),
2051
gobject.IO_IN | gobject.IO_HUP,
2052
functools.partial(self.handle_ipc,
2053
parent_pipe =
2054
parent_pipe,
2055
proc = proc))
2526
2056
2527
def handle_ipc(self, source, condition,
2528
parent_pipe=None,
2529
proc = None,
2530
client_object=None):
2057
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2531
2059
# error, or the other end of multiprocessing.Pipe has closed
2532
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2060
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2533
2061
# Wait for other process to exit
2534
2062
proc.join()
2535
2063
return False
2542
2070
fpr = request[1]
2543
2071
address = request[2]
2544
2072
2545
for c in self.clients.values():
2073
for c in self.clients.itervalues():
2546
2074
if c.fingerprint == fpr:
2547
2075
client = c
2548
2076
break
2556
2084
parent_pipe.send(False)
2557
2085
return False
2558
2086
2559
GLib.io_add_watch(
2560
parent_pipe.fileno(),
2561
GLib.IO_IN | GLib.IO_HUP,
2562
functools.partial(self.handle_ipc,
2563
parent_pipe = parent_pipe,
2564
proc = proc,
2565
client_object = client))
2087
gobject.io_add_watch(parent_pipe.fileno(),
2088
gobject.IO_IN | gobject.IO_HUP,
2089
functools.partial(self.handle_ipc,
2090
parent_pipe =
2091
parent_pipe,
2092
proc = proc,
2093
client_object =
2094
client))
2566
2095
parent_pipe.send(True)
2567
2096
# remove the old hook in favor of the new above hook on
2568
2097
# same fileno
2574
2103
2575
2104
parent_pipe.send(('data', getattr(client_object,
2576
2105
funcname)(*args,
2577
**kwargs)))
2106
**kwargs)))
2578
2107
2579
2108
if command == 'getattr':
2580
2109
attrname = request[1]
2581
if isinstance(client_object.__getattribute__(attrname),
2582
collections.Callable):
2583
parent_pipe.send(('function', ))
2110
if callable(client_object.__getattribute__(attrname)):
2111
parent_pipe.send(('function',))
2584
2112
else:
2585
parent_pipe.send((
2586
'data', client_object.__getattribute__(attrname)))
2113
parent_pipe.send(('data', client_object
2114
.__getattribute__(attrname)))
2587
2115
2588
2116
if command == 'setattr':
2589
2117
attrname = request[1]
2620
2148
# avoid excessive use of external libraries.
2621
2149
2622
2150
# New type for defining tokens, syntax, and semantics all-in-one
2623
Token = collections.namedtuple("Token", (
2624
"regexp", # To match token; if "value" is not None, must have
2625
# a "group" containing digits
2626
"value", # datetime.timedelta or None
2627
"followers")) # Tokens valid after this token
2151
Token = collections.namedtuple("Token",
2152
("regexp", # To match token; if
2153
# "value" is not None,
2154
# must have a "group"
2155
# containing digits
2156
"value", # datetime.timedelta or
2157
# None
2158
"followers")) # Tokens valid after
2159
# this token
2628
2160
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2629
2161
# the "duration" ABNF definition in RFC 3339, Appendix A.
2630
2162
token_end = Token(re.compile(r"$"), None, frozenset())
2631
2163
token_second = Token(re.compile(r"(\d+)S"),
2632
2164
datetime.timedelta(seconds=1),
2633
frozenset((token_end, )))
2165
frozenset((token_end,)))
2634
2166
token_minute = Token(re.compile(r"(\d+)M"),
2635
2167
datetime.timedelta(minutes=1),
2636
2168
frozenset((token_second, token_end)))
2652
2184
frozenset((token_month, token_end)))
2653
2185
token_week = Token(re.compile(r"(\d+)W"),
2654
2186
datetime.timedelta(weeks=1),
2655
frozenset((token_end, )))
2187
frozenset((token_end,)))
2656
2188
token_duration = Token(re.compile(r"P"), None,
2657
2189
frozenset((token_year, token_month,
2658
2190
token_day, token_time,
2659
token_week)))
2191
token_week))),
2660
2192
# Define starting values
2661
2193
value = datetime.timedelta() # Value so far
2662
2194
found_token = None
2663
followers = frozenset((token_duration, )) # Following valid tokens
2195
followers = frozenset(token_duration,) # Following valid tokens
2664
2196
s = duration # String left to parse
2665
2197
# Loop until end token is found
2666
2198
while found_token is not token_end:
2683
2215
break
2684
2216
else:
2685
2217
# No currently valid tokens were found
2686
raise ValueError("Invalid RFC 3339 duration: {!r}"
2687
.format(duration))
2218
raise ValueError("Invalid RFC 3339 duration")
2688
2219
# End token found
2689
2220
return value
2690
2221
2714
2245
timevalue = datetime.timedelta(0)
2715
2246
for s in interval.split():
2716
2247
try:
2717
suffix = s[-1]
2248
suffix = unicode(s[-1])
2718
2249
value = int(s[:-1])
2719
2250
if suffix == "d":
2720
2251
delta = datetime.timedelta(value)
2727
2258
elif suffix == "w":
2728
2259
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2729
2260
else:
2730
raise ValueError("Unknown suffix {!r}".format(suffix))
2261
raise ValueError("Unknown suffix {0!r}"
2262
.format(suffix))
2731
2263
except IndexError as e:
2732
2264
raise ValueError(*(e.args))
2733
2265
timevalue += delta
2750
2282
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2751
2283
if not stat.S_ISCHR(os.fstat(null).st_mode):
2752
2284
raise OSError(errno.ENODEV,
2753
"{} not a character device"
2285
"{0} not a character device"
2754
2286
.format(os.devnull))
2755
2287
os.dup2(null, sys.stdin.fileno())
2756
2288
os.dup2(null, sys.stdout.fileno())
2766
2298
2767
2299
parser = argparse.ArgumentParser()
2768
2300
parser.add_argument("-v", "--version", action="version",
2769
version = "%(prog)s {}".format(version),
2301
version = "%(prog)s {0}".format(version),
2770
2302
help="show version number and exit")
2771
2303
parser.add_argument("-i", "--interface", metavar="IF",
2772
2304
help="Bind to interface IF")
2822
2354
"port": "",
2823
2355
"debug": "False",
2824
2356
"priority":
2825
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2826
":+SIGN-DSA-SHA256",
2357
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2827
2358
"servicename": "Mandos",
2828
2359
"use_dbus": "True",
2829
2360
"use_ipv6": "True",
2833
2364
"statedir": "/var/lib/mandos",
2834
2365
"foreground": "False",
2835
2366
"zeroconf": "True",
2836
}
2367
}
2837
2368
2838
2369
# Parse config file for server-global settings
2839
2370
server_config = configparser.SafeConfigParser(server_defaults)
2840
2371
del server_defaults
2841
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2372
server_config.read(os.path.join(options.configdir,
2373
"mandos.conf"))
2842
2374
# Convert the SafeConfigParser object to a dict
2843
2375
server_settings = server_config.defaults()
2844
2376
# Use the appropriate methods on the non-string config options
2862
2394
# Override the settings from the config file with command line
2863
2395
# options, if set.
2864
2396
for option in ("interface", "address", "port", "debug",
2865
"priority", "servicename", "configdir", "use_dbus",
2866
"use_ipv6", "debuglevel", "restore", "statedir",
2867
"socket", "foreground", "zeroconf"):
2397
"priority", "servicename", "configdir",
2398
"use_dbus", "use_ipv6", "debuglevel", "restore",
2399
"statedir", "socket", "foreground", "zeroconf"):
2868
2400
value = getattr(options, option)
2869
2401
if value is not None:
2870
2402
server_settings[option] = value
2871
2403
del options
2872
2404
# Force all strings to be unicode
2873
2405
for option in server_settings.keys():
2874
if isinstance(server_settings[option], bytes):
2875
server_settings[option] = (server_settings[option]
2876
.decode("utf-8"))
2406
if type(server_settings[option]) is str:
2407
server_settings[option] = unicode(server_settings[option])
2877
2408
# Force all boolean options to be boolean
2878
2409
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2879
2410
"foreground", "zeroconf"):
2885
2416
2886
2417
##################################################################
2887
2418
2888
if (not server_settings["zeroconf"]
2889
and not (server_settings["port"]
2890
or server_settings["socket"] != "")):
2891
parser.error("Needs port or socket to work without Zeroconf")
2419
if (not server_settings["zeroconf"] and
2420
not (server_settings["port"]
2421
or server_settings["socket"] != "")):
2422
parser.error("Needs port or socket to work without"
2423
" Zeroconf")
2892
2424
2893
2425
# For convenience
2894
2426
debug = server_settings["debug"]
2910
2442
initlogger(debug, level)
2911
2443
2912
2444
if server_settings["servicename"] != "Mandos":
2913
syslogger.setFormatter(
2914
logging.Formatter('Mandos ({}) [%(process)d]:'
2915
' %(levelname)s: %(message)s'.format(
2916
server_settings["servicename"])))
2445
syslogger.setFormatter(logging.Formatter
2446
('Mandos ({0}) [%(process)d]:'
2447
' %(levelname)s: %(message)s'
2448
.format(server_settings
2449
["servicename"])))
2917
2450
2918
2451
# Parse config file with clients
2919
2452
client_config = configparser.SafeConfigParser(Client
2927
2460
socketfd = None
2928
2461
if server_settings["socket"] != "":
2929
2462
socketfd = server_settings["socket"]
2930
tcp_server = MandosServer(
2931
(server_settings["address"], server_settings["port"]),
2932
ClientHandler,
2933
interface=(server_settings["interface"] or None),
2934
use_ipv6=use_ipv6,
2935
gnutls_priority=server_settings["priority"],
2936
use_dbus=use_dbus,
2937
socketfd=socketfd)
2463
tcp_server = MandosServer((server_settings["address"],
2464
server_settings["port"]),
2465
ClientHandler,
2466
interface=(server_settings["interface"]
2467
or None),
2468
use_ipv6=use_ipv6,
2469
gnutls_priority=
2470
server_settings["priority"],
2471
use_dbus=use_dbus,
2472
socketfd=socketfd)
2938
2473
if not foreground:
2939
2474
pidfilename = "/run/mandos.pid"
2940
2475
if not os.path.isdir("/run/."):
2941
2476
pidfilename = "/var/run/mandos.pid"
2942
2477
pidfile = None
2943
2478
try:
2944
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2479
pidfile = open(pidfilename, "w")
2945
2480
except IOError as e:
2946
2481
logger.error("Could not open file %r", pidfilename,
2947
2482
exc_info=e)
2948
2483
2949
for name, group in (("_mandos", "_mandos"),
2950
("mandos", "mandos"),
2951
("nobody", "nogroup")):
2484
for name in ("_mandos", "mandos", "nobody"):
2952
2485
try:
2953
2486
uid = pwd.getpwnam(name).pw_uid
2954
gid = pwd.getpwnam(group).pw_gid
2487
gid = pwd.getpwnam(name).pw_gid
2955
2488
break
2956
2489
except KeyError:
2957
2490
continue
2961
2494
try:
2962
2495
os.setgid(gid)
2963
2496
os.setuid(uid)
2964
if debug:
2965
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2966
gid))
2967
2497
except OSError as error:
2968
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2969
.format(uid, gid, os.strerror(error.errno)))
2970
2498
if error.errno != errno.EPERM:
2971
2499
raise
2972
2500
2975
2503
2976
2504
# "Use a log level over 10 to enable all debugging options."
2977
2505
# - GnuTLS manual
2978
gnutls.global_set_log_level(11)
2506
gnutls.library.functions.gnutls_global_set_log_level(11)
2979
2507
2980
@gnutls.log_func
2508
@gnutls.library.types.gnutls_log_func
2981
2509
def debug_gnutls(level, string):
2982
2510
logger.debug("GnuTLS: %s", string[:-1])
2983
2511
2984
gnutls.global_set_log_function(debug_gnutls)
2512
(gnutls.library.functions
2513
.gnutls_global_set_log_function(debug_gnutls))
2985
2514
2986
2515
# Redirect stdin so all checkers get /dev/null
2987
2516
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2994
2523
# Close all input and output, do double fork, etc.
2995
2524
daemon()
2996
2525
2997
# multiprocessing will use threads, so before we use GLib we need
2998
# to inform GLib that threads will be used.
2999
GLib.threads_init()
2526
# multiprocessing will use threads, so before we use gobject we
2527
# need to inform gobject that threads will be used.
2528
gobject.threads_init()
3000
2529
3001
2530
global main_loop
3002
2531
# From the Avahi example code
3003
2532
DBusGMainLoop(set_as_default=True)
3004
main_loop = GLib.MainLoop()
2533
main_loop = gobject.MainLoop()
3005
2534
bus = dbus.SystemBus()
3006
2535
# End of Avahi example code
3007
2536
if use_dbus:
3008
2537
try:
3009
2538
bus_name = dbus.service.BusName("se.recompile.Mandos",
3010
bus,
3011
do_not_queue=True)
3012
old_bus_name = dbus.service.BusName(
3013
"se.bsnet.fukt.Mandos", bus,
3014
do_not_queue=True)
3015
except dbus.exceptions.DBusException as e:
2539
bus, do_not_queue=True)
2540
old_bus_name = (dbus.service.BusName
2541
("se.bsnet.fukt.Mandos", bus,
2542
do_not_queue=True))
2543
except dbus.exceptions.NameExistsException as e:
3016
2544
logger.error("Disabling D-Bus:", exc_info=e)
3017
2545
use_dbus = False
3018
2546
server_settings["use_dbus"] = False
3019
2547
tcp_server.use_dbus = False
3020
2548
if zeroconf:
3021
2549
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3022
service = AvahiServiceToSyslog(
3023
name = server_settings["servicename"],
3024
servicetype = "_mandos._tcp",
3025
protocol = protocol,
3026
bus = bus)
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
3027
2554
if server_settings["interface"]:
3028
service.interface = if_nametoindex(
3029
server_settings["interface"].encode("utf-8"))
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
3030
2557
3031
2558
global multiprocessing_manager
3032
2559
multiprocessing_manager = multiprocessing.Manager()
3051
2578
if server_settings["restore"]:
3052
2579
try:
3053
2580
with open(stored_state_path, "rb") as stored_state:
3054
if sys.version_info.major == 2:
3055
clients_data, old_client_settings = pickle.load(
3056
stored_state)
3057
else:
3058
bytes_clients_data, bytes_old_client_settings = (
3059
pickle.load(stored_state, encoding = "bytes"))
3060
### Fix bytes to strings
3061
## clients_data
3062
# .keys()
3063
clients_data = { (key.decode("utf-8")
3064
if isinstance(key, bytes)
3065
else key): value
3066
for key, value in
3067
bytes_clients_data.items() }
3068
del bytes_clients_data
3069
for key in clients_data:
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3072
for k, v in
3073
clients_data[key].items() }
3074
clients_data[key] = value
3075
# .client_structure
3076
value["client_structure"] = [
3077
(s.decode("utf-8")
3078
if isinstance(s, bytes)
3079
else s) for s in
3080
value["client_structure"] ]
3081
# .name & .host
3082
for k in ("name", "host"):
3083
if isinstance(value[k], bytes):
3084
value[k] = value[k].decode("utf-8")
3085
## old_client_settings
3086
# .keys()
3087
old_client_settings = {
3088
(key.decode("utf-8")
3089
if isinstance(key, bytes)
3090
else key): value
3091
for key, value in
3092
bytes_old_client_settings.items() }
3093
del bytes_old_client_settings
3094
# .host
3095
for value in old_client_settings.values():
3096
if isinstance(value["host"], bytes):
3097
value["host"] = (value["host"]
3098
.decode("utf-8"))
2581
clients_data, old_client_settings = (pickle.load
2582
(stored_state))
3099
2583
os.remove(stored_state_path)
3100
2584
except IOError as e:
3101
2585
if e.errno == errno.ENOENT:
3102
logger.warning("Could not load persistent state:"
3103
" {}".format(os.strerror(e.errno)))
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
3104
2588
else:
3105
2589
logger.critical("Could not load persistent state:",
3106
2590
exc_info=e)
3107
2591
raise
3108
2592
except EOFError as e:
3109
2593
logger.warning("Could not load persistent state: "
3110
"EOFError:",
3111
exc_info=e)
2594
"EOFError:", exc_info=e)
3112
2595
3113
2596
with PGPEngine() as pgp:
3114
for client_name, client in clients_data.items():
2597
for client_name, client in clients_data.iteritems():
3115
2598
# Skip removed clients
3116
2599
if client_name not in client_settings:
3117
2600
continue
3126
2609
# For each value in new config, check if it
3127
2610
# differs from the old config value (Except for
3128
2611
# the "secret" attribute)
3129
if (name != "secret"
3130
and (value !=
3131
old_client_settings[client_name][name])):
2612
if (name != "secret" and
2613
value != old_client_settings[client_name]
2614
[name]):
3132
2615
client[name] = value
3133
2616
except KeyError:
3134
2617
pass
3135
2618
3136
2619
# Clients who has passed its expire date can still be
3137
# enabled if its last checker was successful. A Client
2620
# enabled if its last checker was successful. Clients
3138
2621
# whose checker succeeded before we stored its state is
3139
2622
# assumed to have successfully run all checkers during
3140
2623
# downtime.
3142
2625
if datetime.datetime.utcnow() >= client["expires"]:
3143
2626
if not client["last_checked_ok"]:
3144
2627
logger.warning(
3145
"disabling client {} - Client never "
3146
"performed a successful checker".format(
3147
client_name))
2628
"disabling client {0} - Client never "
2629
"performed a successful checker"
2630
.format(client_name))
3148
2631
client["enabled"] = False
3149
2632
elif client["last_checker_status"] != 0:
3150
2633
logger.warning(
3151
"disabling client {} - Client last"
3152
" checker failed with error code"
3153
" {}".format(
3154
client_name,
3155
client["last_checker_status"]))
2634
"disabling client {0} - Client "
2635
"last checker failed with error code {1}"
2636
.format(client_name,
2637
client["last_checker_status"]))
3156
2638
client["enabled"] = False
3157
2639
else:
3158
client["expires"] = (
3159
datetime.datetime.utcnow()
3160
+ client["timeout"])
2640
client["expires"] = (datetime.datetime
2641
.utcnow()
2642
+ client["timeout"])
3161
2643
logger.debug("Last checker succeeded,"
3162
" keeping {} enabled".format(
3163
client_name))
2644
" keeping {0} enabled"
2645
.format(client_name))
3164
2646
try:
3165
client["secret"] = pgp.decrypt(
3166
client["encrypted_secret"],
3167
client_settings[client_name]["secret"])
2647
client["secret"] = (
2648
pgp.decrypt(client["encrypted_secret"],
2649
client_settings[client_name]
2650
["secret"]))
3168
2651
except PGPError:
3169
2652
# If decryption fails, we use secret from new settings
3170
logger.debug("Failed to decrypt {} old secret".format(
3171
client_name))
3172
client["secret"] = (client_settings[client_name]
3173
["secret"])
2653
logger.debug("Failed to decrypt {0} old secret"
2654
.format(client_name))
2655
client["secret"] = (
2656
client_settings[client_name]["secret"])
3174
2657
3175
2658
# Add/remove clients based on new changes made to config
3176
2659
for client_name in (set(old_client_settings)
3181
2664
clients_data[client_name] = client_settings[client_name]
3182
2665
3183
2666
# Create all client objects
3184
for client_name, client in clients_data.items():
2667
for client_name, client in clients_data.iteritems():
3185
2668
tcp_server.clients[client_name] = client_class(
3186
name = client_name,
3187
settings = client,
2669
name = client_name, settings = client,
3188
2670
server_settings = server_settings)
3189
2671
3190
2672
if not tcp_server.clients:
3192
2674
3193
2675
if not foreground:
3194
2676
if pidfile is not None:
3195
pid = os.getpid()
3196
2677
try:
3197
2678
with pidfile:
3198
print(pid, file=pidfile)
2679
pid = os.getpid()
2680
pidfile.write(str(pid) + "\n".encode("utf-8"))
3199
2681
except IOError:
3200
2682
logger.error("Could not write to file %r with PID %d",
3201
2683
pidfilename, pid)
3202
2684
del pidfile
3203
2685
del pidfilename
3204
2686
3205
for termsig in (signal.SIGHUP, signal.SIGTERM):
3206
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3207
lambda: main_loop.quit() and False)
2687
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2688
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3208
2689
3209
2690
if use_dbus:
3210
3211
@alternate_dbus_interfaces(
3212
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3213
class MandosDBusService(DBusObjectWithObjectManager):
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2693
class MandosDBusService(DBusObjectWithProperties):
3214
2694
"""A D-Bus proxy object"""
3215
3216
2695
def __init__(self):
3217
2696
dbus.service.Object.__init__(self, bus, "/")
3218
3219
2697
_interface = "se.recompile.Mandos"
3220
2698
2699
@dbus_interface_annotations(_interface)
2700
def _foo(self):
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
2703
"false"}
2704
3221
2705
@dbus.service.signal(_interface, signature="o")
3222
2706
def ClientAdded(self, objpath):
3223
2707
"D-Bus signal"
3228
2712
"D-Bus signal"
3229
2713
pass
3230
2714
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3232
"true"})
3233
2715
@dbus.service.signal(_interface, signature="os")
3234
2716
def ClientRemoved(self, objpath, name):
3235
2717
"D-Bus signal"
3236
2718
pass
3237
2719
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3239
"true"})
3240
2720
@dbus.service.method(_interface, out_signature="ao")
3241
2721
def GetAllClients(self):
3242
2722
"D-Bus method"
3243
return dbus.Array(c.dbus_object_path for c in
3244
tcp_server.clients.values())
2723
return dbus.Array(c.dbus_object_path
2724
for c in
2725
tcp_server.clients.itervalues())
3245
2726
3246
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3247
"true"})
3248
2727
@dbus.service.method(_interface,
3249
2728
out_signature="a{oa{sv}}")
3250
2729
def GetAllClientsWithProperties(self):
3251
2730
"D-Bus method"
3252
2731
return dbus.Dictionary(
3253
{ c.dbus_object_path: c.GetAll(
3254
"se.recompile.Mandos.Client")
3255
for c in tcp_server.clients.values() },
2732
((c.dbus_object_path, c.GetAll(""))
2733
for c in tcp_server.clients.itervalues()),
3256
2734
signature="oa{sv}")
3257
2735
3258
2736
@dbus.service.method(_interface, in_signature="o")
3259
2737
def RemoveClient(self, object_path):
3260
2738
"D-Bus method"
3261
for c in tcp_server.clients.values():
2739
for c in tcp_server.clients.itervalues():
3262
2740
if c.dbus_object_path == object_path:
3263
2741
del tcp_server.clients[c.name]
3264
2742
c.remove_from_connection()
3265
# Don't signal the disabling
2743
# Don't signal anything except ClientRemoved
3266
2744
c.disable(quiet=True)
3267
# Emit D-Bus signal for removal
3268
self.client_removed_signal(c)
2745
# Emit D-Bus signal
2746
self.ClientRemoved(object_path, c.name)
3269
2747
return
3270
2748
raise KeyError(object_path)
3271
2749
3272
2750
del _interface
3273
3274
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3275
out_signature = "a{oa{sa{sv}}}")
3276
def GetManagedObjects(self):
3277
"""D-Bus method"""
3278
return dbus.Dictionary(
3279
{ client.dbus_object_path:
3280
dbus.Dictionary(
3281
{ interface: client.GetAll(interface)
3282
for interface in
3283
client._get_all_interface_names()})
3284
for client in tcp_server.clients.values()})
3285
3286
def client_added_signal(self, client):
3287
"""Send the new standard signal and the old signal"""
3288
if use_dbus:
3289
# New standard signal
3290
self.InterfacesAdded(
3291
client.dbus_object_path,
3292
dbus.Dictionary(
3293
{ interface: client.GetAll(interface)
3294
for interface in
3295
client._get_all_interface_names()}))
3296
# Old signal
3297
self.ClientAdded(client.dbus_object_path)
3298
3299
def client_removed_signal(self, client):
3300
"""Send the new standard signal and the old signal"""
3301
if use_dbus:
3302
# New standard signal
3303
self.InterfacesRemoved(
3304
client.dbus_object_path,
3305
client._get_all_interface_names())
3306
# Old signal
3307
self.ClientRemoved(client.dbus_object_path,
3308
client.name)
3309
2751
3310
2752
mandos_dbus_service = MandosDBusService()
3311
2753
3312
# Save modules to variables to exempt the modules from being
3313
# unloaded before the function registered with atexit() is run.
3314
mp = multiprocessing
3315
wn = wnull
3316
2754
def cleanup():
3317
2755
"Cleanup function; run on exit"
3318
2756
if zeroconf:
3319
2757
service.cleanup()
3320
2758
3321
mp.active_children()
3322
wn.close()
2759
multiprocessing.active_children()
2760
wnull.close()
3323
2761
if not (tcp_server.clients or client_settings):
3324
2762
return
3325
2763
3328
2766
# removed/edited, old secret will thus be unrecovable.
3329
2767
clients = {}
3330
2768
with PGPEngine() as pgp:
3331
for client in tcp_server.clients.values():
2769
for client in tcp_server.clients.itervalues():
3332
2770
key = client_settings[client.name]["secret"]
3333
2771
client.encrypted_secret = pgp.encrypt(client.secret,
3334
2772
key)
3336
2774
3337
2775
# A list of attributes that can not be pickled
3338
2776
# + secret.
3339
exclude = { "bus", "changedstate", "secret",
3340
"checker", "server_settings" }
3341
for name, typ in inspect.getmembers(dbus.service
3342
.Object):
2777
exclude = set(("bus", "changedstate", "secret",
2778
"checker", "server_settings"))
2779
for name, typ in (inspect.getmembers
2780
(dbus.service.Object)):
3343
2781
exclude.add(name)
3344
2782
3345
2783
client_dict["encrypted_secret"] = (client
3352
2790
del client_settings[client.name]["secret"]
3353
2791
3354
2792
try:
3355
with tempfile.NamedTemporaryFile(
3356
mode='wb',
3357
suffix=".pickle",
3358
prefix='clients-',
3359
dir=os.path.dirname(stored_state_path),
3360
delete=False) as stored_state:
3361
pickle.dump((clients, client_settings), stored_state,
3362
protocol = 2)
3363
tempname = stored_state.name
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
2797
pickle.dump((clients, client_settings), stored_state)
2798
tempname=stored_state.name
3364
2799
os.rename(tempname, stored_state_path)
3365
2800
except (IOError, OSError) as e:
3366
2801
if not debug:
3369
2804
except NameError:
3370
2805
pass
3371
2806
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3372
logger.warning("Could not save persistent state: {}"
2807
logger.warning("Could not save persistent state: {0}"
3373
2808
.format(os.strerror(e.errno)))
3374
2809
else:
3375
2810
logger.warning("Could not save persistent state:",
3381
2816
name, client = tcp_server.clients.popitem()
3382
2817
if use_dbus:
3383
2818
client.remove_from_connection()
3384
# Don't signal the disabling
2819
# Don't signal anything except ClientRemoved
3385
2820
client.disable(quiet=True)
3386
# Emit D-Bus signal for removal
3387
2821
if use_dbus:
3388
mandos_dbus_service.client_removed_signal(client)
2822
# Emit D-Bus signal
2823
mandos_dbus_service.ClientRemoved(client
2824
.dbus_object_path,
2825
client.name)
3389
2826
client_settings.clear()
3390
2827
3391
2828
atexit.register(cleanup)
3392
2829
3393
for client in tcp_server.clients.values():
2830
for client in tcp_server.clients.itervalues():
3394
2831
if use_dbus:
3395
# Emit D-Bus signal for adding
3396
mandos_dbus_service.client_added_signal(client)
2832
# Emit D-Bus signal
2833
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3397
2834
# Need to initiate checking of clients
3398
2835
if client.enabled:
3399
2836
client.init_checker()
3425
2862
sys.exit(1)
3426
2863
# End of Avahi example code
3427
2864
3428
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3429
lambda *args, **kwargs:
3430
(tcp_server.handle_request
3431
(*args[2:], **kwargs) or True))
2865
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2866
lambda *args, **kwargs:
2867
(tcp_server.handle_request
2868
(*args[2:], **kwargs) or True))
3432
2869
3433
2870
logger.debug("Starting main loop")
3434
2871
main_loop.run()
3444
2881
# Must run before the D-Bus bus name gets deregistered
3445
2882
cleanup()
3446
2883
3447
3448
2884
if __name__ == '__main__':
3449
2885
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0