/mandos/trunk : revision 729

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

46

43

import errno

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

65

import cPickle as pickle

69

66

import multiprocessing

70

67

import types

71

68

import binascii

72

69

import tempfile

73

70

import itertools

74

71

import collections

75

import codecs

76

72

77

73

import dbus

78

74

import dbus.service

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

75

import gobject

83

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

95

88

except ImportError:

96

89

SO_BINDTODEVICE = None

97

90

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.1"

91

version = "1.6.8"

102

92

stored_state_file = "clients.pickle"

103

93

104

94

logger = logging.getLogger()

105

95

syslogger = None

106

96

107

97

try:

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

110

101

except (OSError, AttributeError):

111

112

102

def if_nametoindex(interface):

113

103

"Get an interface index the hard way, i.e. using fcntl()"

114

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

123

113

"""init logger and add loglevel"""

124

114

125

115

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

116

syslogger = (logging.handlers.SysLogHandler

117

(facility =

118

logging.handlers.SysLogHandler.LOG_DAEMON,

119

address = "/dev/log"))

129

120

syslogger.setFormatter(logging.Formatter

130

121

('Mandos [%(process)d]: %(levelname)s:'

131

122

' %(message)s'))

148

139

149

140

class PGPEngine(object):

150

141

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

152

142

def __init__(self):

153

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

144

self.gnupgargs = ['--batch',

193

183

194

184

def encrypt(self, data, password):

195

185

passphrase = self.password_encode(password)

196

with tempfile.NamedTemporaryFile(

197

dir=self.tempdir) as passfile:

186

with tempfile.NamedTemporaryFile(dir=self.tempdir

187

) as passfile:

198

188

passfile.write(passphrase)

199

189

passfile.flush()

200

190

proc = subprocess.Popen(['gpg', '--symmetric',

211

201

212

202

def decrypt(self, data, password):

213

203

passphrase = self.password_encode(password)

214

with tempfile.NamedTemporaryFile(

215

dir = self.tempdir) as passfile:

204

with tempfile.NamedTemporaryFile(dir = self.tempdir

205

) as passfile:

216

206

passfile.write(passphrase)

217

207

passfile.flush()

218

208

proc = subprocess.Popen(['gpg', '--decrypt',

222

212

stdin = subprocess.PIPE,

223

213

stdout = subprocess.PIPE,

224

214

stderr = subprocess.PIPE)

225

decrypted_plaintext, err = proc.communicate(input = data)

215

decrypted_plaintext, err = proc.communicate(input

216

= data)

226

217

if proc.returncode != 0:

227

218

raise PGPError(err)

228

219

return decrypted_plaintext

234

225

return super(AvahiError, self).__init__(value, *args,

235

226

**kwargs)

236

227

237

238

228

class AvahiServiceError(AvahiError):

239

229

pass

240

230

241

242

231

class AvahiGroupError(AvahiError):

243

232

pass

244

233

264

253

bus: dbus.SystemBus()

265

254

"""

266

255

267

def __init__(self,

268

interface = avahi.IF_UNSPEC,

269

name = None,

270

servicetype = None,

271

port = None,

272

TXT = None,

273

domain = "",

274

host = "",

275

max_renames = 32768,

276

protocol = avahi.PROTO_UNSPEC,

277

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

278

260

self.interface = interface

279

261

self.name = name

280

262

self.type = servicetype

290

272

self.bus = bus

291

273

self.entry_group_state_changed_match = None

292

274

293

def rename(self, remove=True):

275

def rename(self):

294

276

"""Derived from the Avahi example code"""

295

277

if self.rename_count >= self.max_renames:

296

278

logger.critical("No suitable Zeroconf service name found"

297

279

" after %i retries, exiting.",

298

280

self.rename_count)

299

281

raise AvahiServiceError("Too many renames")

300

self.name = str(

301

self.server.GetAlternativeServiceName(self.name))

302

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

303

284

logger.info("Changing Zeroconf service name to %r ...",

304

285

self.name)

305

if remove:

306

self.remove()

286

self.remove()

307

287

try:

308

288

self.add()

309

289

except dbus.exceptions.DBusException as error:

310

if (error.get_dbus_name()

311

== "org.freedesktop.Avahi.CollisionError"):

312

logger.info("Local Zeroconf service name collision.")

313

return self.rename(remove=False)

314

else:

315

logger.critical("D-Bus Exception", exc_info=error)

316

self.cleanup()

317

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

318

294

319

295

def remove(self):

320

296

"""Derived from the Avahi example code"""

358

334

self.rename()

359

335

elif state == avahi.ENTRY_GROUP_FAILURE:

360

336

logger.critical("Avahi: Error in group state changed %s",

361

str(error))

362

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {!s}"

339

.format(error))

363

340

364

341

def cleanup(self):

365

342

"""Derived from the Avahi example code"""

375

352

def server_state_changed(self, state, error=None):

376

353

"""Derived from the Avahi example code"""

377

354

logger.debug("Avahi server state change: %i", state)

378

bad_states = {

379

avahi.SERVER_INVALID: "Zeroconf server invalid",

380

avahi.SERVER_REGISTERING: None,

381

avahi.SERVER_COLLISION: "Zeroconf server name collision",

382

avahi.SERVER_FAILURE: "Zeroconf server failure",

383

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

384

362

if state in bad_states:

385

363

if bad_states[state] is not None:

386

364

if error is None:

389

367

logger.error(bad_states[state] + ": %r", error)

390

368

self.cleanup()

391

369

elif state == avahi.SERVER_RUNNING:

392

try:

393

self.add()

394

except dbus.exceptions.DBusException as error:

395

if (error.get_dbus_name()

396

== "org.freedesktop.Avahi.CollisionError"):

397

logger.info("Local Zeroconf service name"

398

" collision.")

399

return self.rename(remove=False)

400

else:

401

logger.critical("D-Bus Exception", exc_info=error)

402

self.cleanup()

403

os._exit(1)

370

self.add()

404

371

else:

405

372

if error is None:

406

373

logger.debug("Unknown state: %r", state)

416

383

follow_name_owner_changes=True),

417

384

avahi.DBUS_INTERFACE_SERVER)

418

385

self.server.connect_to_signal("StateChanged",

419

self.server_state_changed)

386

self.server_state_changed)

420

387

self.server_state_changed(self.server.GetState())

421

388

422

389

423

390

class AvahiServiceToSyslog(AvahiService):

424

def rename(self, *args, **kwargs):

391

def rename(self):

425

392

"""Add the new name to the syslog messages"""

426

ret = AvahiService.rename(self, *args, **kwargs)

427

syslogger.setFormatter(logging.Formatter(

428

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

429

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

430

398

return ret

431

399

432

# Pretend that we have a GnuTLS module

433

class GnuTLS(object):

434

"""This isn't so much a class as it is a module-like namespace.

435

It is instantiated once, and simulates having a GnuTLS module."""

436

437

_library = ctypes.cdll.LoadLibrary(

438

ctypes.util.find_library("gnutls"))

439

_need_version = "3.3.0"

440

def __init__(self):

441

# Need to use class name "GnuTLS" here, since this method is

442

# called before the assignment to the "gnutls" global variable

443

# happens.

444

if GnuTLS.check_version(self._need_version) is None:

445

raise GnuTLS.Error("Needs GnuTLS {} or later"

446

.format(self._need_version))

447

448

# Unless otherwise indicated, the constants and types below are

449

# all from the gnutls/gnutls.h C header file.

450

451

# Constants

452

E_SUCCESS = 0

453

E_INTERRUPTED = -52

454

E_AGAIN = -28

455

CRT_OPENPGP = 2

456

CLIENT = 2

457

SHUT_RDWR = 0

458

CRD_CERTIFICATE = 1

459

E_NO_CERTIFICATE_FOUND = -49

460

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

461

462

# Types

463

class session_int(ctypes.Structure):

464

_fields_ = []

465

session_t = ctypes.POINTER(session_int)

466

class certificate_credentials_st(ctypes.Structure):

467

_fields_ = []

468

certificate_credentials_t = ctypes.POINTER(

469

certificate_credentials_st)

470

certificate_type_t = ctypes.c_int

471

class datum_t(ctypes.Structure):

472

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

473

('size', ctypes.c_uint)]

474

class openpgp_crt_int(ctypes.Structure):

475

_fields_ = []

476

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

477

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

478

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

479

credentials_type_t = ctypes.c_int #

480

transport_ptr_t = ctypes.c_void_p

481

close_request_t = ctypes.c_int

482

483

# Exceptions

484

class Error(Exception):

485

# We need to use the class name "GnuTLS" here, since this

486

# exception might be raised from within GnuTLS.__init__,

487

# which is called before the assignment to the "gnutls"

488

# global variable has happened.

489

def __init__(self, message = None, code = None, args=()):

490

# Default usage is by a message string, but if a return

491

# code is passed, convert it to a string with

492

# gnutls.strerror()

493

self.code = code

494

if message is None and code is not None:

495

message = GnuTLS.strerror(code)

496

return super(GnuTLS.Error, self).__init__(

497

message, *args)

498

499

class CertificateSecurityError(Error):

500

pass

501

502

# Classes

503

class Credentials(object):

504

def __init__(self):

505

self._c_object = gnutls.certificate_credentials_t()

506

gnutls.certificate_allocate_credentials(

507

ctypes.byref(self._c_object))

508

self.type = gnutls.CRD_CERTIFICATE

509

510

def __del__(self):

511

gnutls.certificate_free_credentials(self._c_object)

512

513

class ClientSession(object):

514

def __init__(self, socket, credentials = None):

515

self._c_object = gnutls.session_t()

516

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

517

gnutls.set_default_priority(self._c_object)

518

gnutls.transport_set_ptr(self._c_object, socket.fileno())

519

gnutls.handshake_set_private_extensions(self._c_object,

520

True)

521

self.socket = socket

522

if credentials is None:

523

credentials = gnutls.Credentials()

524

gnutls.credentials_set(self._c_object, credentials.type,

525

ctypes.cast(credentials._c_object,

526

ctypes.c_void_p))

527

self.credentials = credentials

528

529

def __del__(self):

530

gnutls.deinit(self._c_object)

531

532

def handshake(self):

533

return gnutls.handshake(self._c_object)

534

535

def send(self, data):

536

data = bytes(data)

537

data_len = len(data)

538

while data_len > 0:

539

data_len -= gnutls.record_send(self._c_object,

540

data[-data_len:],

541

data_len)

542

543

def bye(self):

544

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

545

546

# Error handling functions

547

def _error_code(result):

548

"""A function to raise exceptions on errors, suitable

549

for the 'restype' attribute on ctypes functions"""

550

if result >= 0:

551

return result

552

if result == gnutls.E_NO_CERTIFICATE_FOUND:

553

raise gnutls.CertificateSecurityError(code = result)

554

raise gnutls.Error(code = result)

555

556

def _retry_on_error(result, func, arguments):

557

"""A function to retry on some errors, suitable

558

for the 'errcheck' attribute on ctypes functions"""

559

while result < 0:

560

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

561

return _error_code(result)

562

result = func(*arguments)

563

return result

564

565

# Unless otherwise indicated, the function declarations below are

566

# all from the gnutls/gnutls.h C header file.

567

568

# Functions

569

priority_set_direct = _library.gnutls_priority_set_direct

570

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

571

ctypes.POINTER(ctypes.c_char_p)]

572

priority_set_direct.restype = _error_code

573

574

init = _library.gnutls_init

575

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

576

init.restype = _error_code

577

578

set_default_priority = _library.gnutls_set_default_priority

579

set_default_priority.argtypes = [session_t]

580

set_default_priority.restype = _error_code

581

582

record_send = _library.gnutls_record_send

583

record_send.argtypes = [session_t, ctypes.c_void_p,

584

ctypes.c_size_t]

585

record_send.restype = ctypes.c_ssize_t

586

record_send.errcheck = _retry_on_error

587

588

certificate_allocate_credentials = (

589

_library.gnutls_certificate_allocate_credentials)

590

certificate_allocate_credentials.argtypes = [

591

ctypes.POINTER(certificate_credentials_t)]

592

certificate_allocate_credentials.restype = _error_code

593

594

certificate_free_credentials = (

595

_library.gnutls_certificate_free_credentials)

596

certificate_free_credentials.argtypes = [certificate_credentials_t]

597

certificate_free_credentials.restype = None

598

599

handshake_set_private_extensions = (

600

_library.gnutls_handshake_set_private_extensions)

601

handshake_set_private_extensions.argtypes = [session_t,

602

ctypes.c_int]

603

handshake_set_private_extensions.restype = None

604

605

credentials_set = _library.gnutls_credentials_set

606

credentials_set.argtypes = [session_t, credentials_type_t,

607

ctypes.c_void_p]

608

credentials_set.restype = _error_code

609

610

strerror = _library.gnutls_strerror

611

strerror.argtypes = [ctypes.c_int]

612

strerror.restype = ctypes.c_char_p

613

614

certificate_type_get = _library.gnutls_certificate_type_get

615

certificate_type_get.argtypes = [session_t]

616

certificate_type_get.restype = _error_code

617

618

certificate_get_peers = _library.gnutls_certificate_get_peers

619

certificate_get_peers.argtypes = [session_t,

620

ctypes.POINTER(ctypes.c_uint)]

621

certificate_get_peers.restype = ctypes.POINTER(datum_t)

622

623

global_set_log_level = _library.gnutls_global_set_log_level

624

global_set_log_level.argtypes = [ctypes.c_int]

625

global_set_log_level.restype = None

626

627

global_set_log_function = _library.gnutls_global_set_log_function

628

global_set_log_function.argtypes = [log_func]

629

global_set_log_function.restype = None

630

631

deinit = _library.gnutls_deinit

632

deinit.argtypes = [session_t]

633

deinit.restype = None

634

635

handshake = _library.gnutls_handshake

636

handshake.argtypes = [session_t]

637

handshake.restype = _error_code

638

handshake.errcheck = _retry_on_error

639

640

transport_set_ptr = _library.gnutls_transport_set_ptr

641

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

642

transport_set_ptr.restype = None

643

644

bye = _library.gnutls_bye

645

bye.argtypes = [session_t, close_request_t]

646

bye.restype = _error_code

647

bye.errcheck = _retry_on_error

648

649

check_version = _library.gnutls_check_version

650

check_version.argtypes = [ctypes.c_char_p]

651

check_version.restype = ctypes.c_char_p

652

653

# All the function declarations below are from gnutls/openpgp.h

654

655

openpgp_crt_init = _library.gnutls_openpgp_crt_init

656

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

657

openpgp_crt_init.restype = _error_code

658

659

openpgp_crt_import = _library.gnutls_openpgp_crt_import

660

openpgp_crt_import.argtypes = [openpgp_crt_t,

661

ctypes.POINTER(datum_t),

662

openpgp_crt_fmt_t]

663

openpgp_crt_import.restype = _error_code

664

665

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

666

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

667

ctypes.POINTER(ctypes.c_uint)]

668

openpgp_crt_verify_self.restype = _error_code

669

670

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

671

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

672

openpgp_crt_deinit.restype = None

673

674

openpgp_crt_get_fingerprint = (

675

_library.gnutls_openpgp_crt_get_fingerprint)

676

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

677

ctypes.c_void_p,

678

ctypes.POINTER(

679

ctypes.c_size_t)]

680

openpgp_crt_get_fingerprint.restype = _error_code

681

682

# Remove non-public functions

683

del _error_code, _retry_on_error

684

# Create the global "gnutls" object, simulating a module

685

gnutls = GnuTLS()

686

687

def call_pipe(connection, # : multiprocessing.Connection

688

func, *args, **kwargs):

689

"""This function is meant to be called by multiprocessing.Process

690

691

This function runs func(*args, **kwargs), and writes the resulting

692

return value on the provided multiprocessing.Connection.

693

"""

694

connection.send(func(*args, **kwargs))

695

connection.close()

696

400

697

401

class Client(object):

698

402

"""A representation of a client host served by this server.

725

429

last_checker_status: integer between 0 and 255 reflecting exit

726

430

status of last checker. -1 reflects crashed

727

431

checker, -2 means no checker completed yet.

728

last_checker_signal: The signal which killed the last checker, if

729

last_checker_status is -1

730

432

last_enabled: datetime.datetime(); (UTC) or None

731

433

name: string; from the config file, used in log messages and

732

434

D-Bus identifiers

745

447

"fingerprint", "host", "interval",

746

448

"last_approval_request", "last_checked_ok",

747

449

"last_enabled", "name", "timeout")

748

client_defaults = {

749

"timeout": "PT5M",

750

"extended_timeout": "PT15M",

751

"interval": "PT2M",

752

"checker": "fping -q -- %%(host)s",

753

"host": "",

754

"approval_delay": "PT0S",

755

"approval_duration": "PT1S",

756

"approved_by_default": "True",

757

"enabled": "True",

758

}

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

759

460

760

461

@staticmethod

761

462

def config_parser(config):

777

478

client["enabled"] = config.getboolean(client_name,

778

479

"enabled")

779

480

780

# Uppercase and remove spaces from fingerprint for later

781

# comparison purposes with return value from the

782

# fingerprint() function

783

481

client["fingerprint"] = (section["fingerprint"].upper()

784

482

.replace(" ", ""))

785

483

if "secret" in section:

827

525

self.expires = None

828

526

829

527

logger.debug("Creating client %r", self.name)

528

# Uppercase and remove spaces from fingerprint for later

529

# comparison purposes with return value from the fingerprint()

530

# function

830

531

logger.debug(" Fingerprint: %s", self.fingerprint)

831

532

self.created = settings.get("created",

832

533

datetime.datetime.utcnow())

839

540

self.current_checker_command = None

840

541

self.approved = None

841

542

self.approvals_pending = 0

842

self.changedstate = multiprocessing_manager.Condition(

843

multiprocessing_manager.Lock())

844

self.client_structure = [attr

845

for attr in self.__dict__.iterkeys()

543

self.changedstate = (multiprocessing_manager

544

.Condition(multiprocessing_manager

545

.Lock()))

546

self.client_structure = [attr for attr in

547

self.__dict__.iterkeys()

846

548

if not attr.startswith("_")]

847

549

self.client_structure.append("client_structure")

848

550

849

for name, t in inspect.getmembers(

850

type(self), lambda obj: isinstance(obj, property)):

551

for name, t in inspect.getmembers(type(self),

552

lambda obj:

553

isinstance(obj,

554

property)):

851

555

if not name.startswith("_"):

852

556

self.client_structure.append(name)

853

557

895

599

# and every interval from then on.

896

600

if self.checker_initiator_tag is not None:

897

601

gobject.source_remove(self.checker_initiator_tag)

898

self.checker_initiator_tag = gobject.timeout_add(

899

int(self.interval.total_seconds() * 1000),

900

self.start_checker)

602

self.checker_initiator_tag = (gobject.timeout_add

603

(int(self.interval

604

.total_seconds() * 1000),

605

self.start_checker))

901

606

# Schedule a disable() when 'timeout' has passed

902

607

if self.disable_initiator_tag is not None:

903

608

gobject.source_remove(self.disable_initiator_tag)

904

self.disable_initiator_tag = gobject.timeout_add(

905

int(self.timeout.total_seconds() * 1000), self.disable)

609

self.disable_initiator_tag = (gobject.timeout_add

610

(int(self.timeout

611

.total_seconds() * 1000),

612

self.disable))

906

613

# Also start a new checker *right now*.

907

614

self.start_checker()

908

615

909

def checker_callback(self, source, condition, connection,

910

command):

616

def checker_callback(self, pid, condition, command):

911

617

"""The checker has completed, so take appropriate actions."""

912

618

self.checker_callback_tag = None

913

619

self.checker = None

914

# Read return code from connection (see call_pipe)

915

returncode = connection.recv()

916

connection.close()

917

918

if returncode >= 0:

919

self.last_checker_status = returncode

920

self.last_checker_signal = None

620

if os.WIFEXITED(condition):

621

self.last_checker_status = os.WEXITSTATUS(condition)

921

622

if self.last_checker_status == 0:

922

623

logger.info("Checker for %(name)s succeeded",

923

624

vars(self))

924

625

self.checked_ok()

925

626

else:

926

logger.info("Checker for %(name)s failed", vars(self))

627

logger.info("Checker for %(name)s failed",

628

vars(self))

927

629

else:

928

630

self.last_checker_status = -1

929

self.last_checker_signal = -returncode

930

631

logger.warning("Checker for %(name)s crashed?",

931

632

vars(self))

932

return False

933

633

934

634

def checked_ok(self):

935

635

"""Assert that the client has been seen, alive and well."""

936

636

self.last_checked_ok = datetime.datetime.utcnow()

937

637

self.last_checker_status = 0

938

self.last_checker_signal = None

939

638

self.bump_timeout()

940

639

941

640

def bump_timeout(self, timeout=None):

946

645

gobject.source_remove(self.disable_initiator_tag)

947

646

self.disable_initiator_tag = None

948

647

if getattr(self, "enabled", False):

949

self.disable_initiator_tag = gobject.timeout_add(

950

int(timeout.total_seconds() * 1000), self.disable)

648

self.disable_initiator_tag = (gobject.timeout_add

649

(int(timeout.total_seconds()

650

* 1000), self.disable))

951

651

self.expires = datetime.datetime.utcnow() + timeout

952

652

953

653

def need_approval(self):

967

667

# than 'timeout' for the client to be disabled, which is as it

968

668

# should be.

969

669

970

if self.checker is not None and not self.checker.is_alive():

971

logger.warning("Checker was not alive; joining")

972

self.checker.join()

973

self.checker = None

670

# If a checker exists, make sure it is not a zombie

671

try:

672

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

673

except AttributeError:

674

pass

675

except OSError as error:

676

if error.errno != errno.ECHILD:

677

raise

678

else:

679

if pid:

680

logger.warning("Checker was a zombie")

681

gobject.source_remove(self.checker_callback_tag)

682

self.checker_callback(pid, status,

683

self.current_checker_command)

974

684

# Start a new checker if needed

975

685

if self.checker is None:

976

686

# Escape attributes for the shell

977

escaped_attrs = {

978

attr: re.escape(str(getattr(self, attr)))

979

for attr in self.runtime_expansions }

687

escaped_attrs = { attr:

688

re.escape(unicode(getattr(self,

689

attr)))

690

for attr in self.runtime_expansions }

980

691

try:

981

692

command = self.checker_command % escaped_attrs

982

693

except TypeError as error:

983

694

logger.error('Could not format string "%s"',

984

self.checker_command,

695

self.checker_command, exc_info=error)

696

return True # Try again later

697

self.current_checker_command = command

698

try:

699

logger.info("Starting checker %r for %s",

700

command, self.name)

701

# We don't need to redirect stdout and stderr, since

702

# in normal mode, that is already done by daemon(),

703

# and in debug mode we don't want to. (Stdin is

704

# always replaced by /dev/null.)

705

# The exception is when not debugging but nevertheless

706

# running in the foreground; use the previously

707

# created wnull.

708

popen_args = {}

709

if (not self.server_settings["debug"]

710

and self.server_settings["foreground"]):

711

popen_args.update({"stdout": wnull,

712

"stderr": wnull })

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/",

716

**popen_args)

717

except OSError as error:

718

logger.error("Failed to start subprocess",

985

719

exc_info=error)

986

return True # Try again later

987

self.current_checker_command = command

988

logger.info("Starting checker %r for %s", command,

989

self.name)

990

# We don't need to redirect stdout and stderr, since

991

# in normal mode, that is already done by daemon(),

992

# and in debug mode we don't want to. (Stdin is

993

# always replaced by /dev/null.)

994

# The exception is when not debugging but nevertheless

995

# running in the foreground; use the previously

996

# created wnull.

997

popen_args = { "close_fds": True,

998

"shell": True,

999

"cwd": "/" }

1000

if (not self.server_settings["debug"]

1001

and self.server_settings["foreground"]):

1002

popen_args.update({"stdout": wnull,

1003

"stderr": wnull })

1004

pipe = multiprocessing.Pipe(duplex = False)

1005

self.checker = multiprocessing.Process(

1006

target = call_pipe,

1007

args = (pipe[1], subprocess.call, command),

1008

kwargs = popen_args)

1009

self.checker.start()

1010

self.checker_callback_tag = gobject.io_add_watch(

1011

pipe[0].fileno(), gobject.IO_IN,

1012

self.checker_callback, pipe[0], command)

720

return True

721

self.checker_callback_tag = (gobject.child_watch_add

722

(self.checker.pid,

723

self.checker_callback,

724

data=command))

725

# The checker may have completed before the gobject

726

# watch was added. Check for this.

727

try:

728

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

729

except OSError as error:

730

if error.errno == errno.ECHILD:

731

# This should never happen

732

logger.error("Child process vanished",

733

exc_info=error)

734

return True

735

raise

736

if pid:

737

gobject.source_remove(self.checker_callback_tag)

738

self.checker_callback(pid, status, command)

1013

739

# Re-run this periodically if run by gobject.timeout_add

1014

740

return True

1015

741

1021

747

if getattr(self, "checker", None) is None:

1022

748

return

1023

749

logger.debug("Stopping checker for %(name)s", vars(self))

1024

self.checker.terminate()

750

try:

751

self.checker.terminate()

752

#time.sleep(0.5)

753

#if self.checker.poll() is None:

754

# self.checker.kill()

755

except OSError as error:

756

if error.errno != errno.ESRCH: # No such process

757

raise

1025

758

self.checker = None

1026

759

1027

760

1028

def dbus_service_property(dbus_interface,

1029

signature="v",

1030

access="readwrite",

1031

byte_arrays=False):

761

def dbus_service_property(dbus_interface, signature="v",

762

access="readwrite", byte_arrays=False):

1032

763

"""Decorators for marking methods of a DBusObjectWithProperties to

1033

764

become properties on the D-Bus.

1034

765

1044

775

if byte_arrays and signature != "ay":

1045

776

raise ValueError("Byte arrays not supported for non-'ay'"

1046

777

" signature {!r}".format(signature))

1047

1048

778

def decorator(func):

1049

779

func._dbus_is_property = True

1050

780

func._dbus_interface = dbus_interface

1055

785

func._dbus_name = func._dbus_name[:-14]

1056

786

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1057

787

return func

1058

1059

788

return decorator

1060

789

1061

790

1070

799

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1071

800

"false"}

1072

801

"""

1073

1074

802

def decorator(func):

1075

803

func._dbus_is_interface = True

1076

804

func._dbus_interface = dbus_interface

1077

805

func._dbus_name = dbus_interface

1078

806

return func

1079

1080

807

return decorator

1081

808

1082

809

1084

811

"""Decorator to annotate D-Bus methods, signals or properties

1085

812

Usage:

1086

813

1087

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1088

"org.freedesktop.DBus.Property."

1089

"EmitsChangedSignal": "false"})

1090

814

@dbus_service_property("org.example.Interface", signature="b",

1091

815

access="r")

816

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

817

"org.freedesktop.DBus.Property."

818

"EmitsChangedSignal": "false"})

1092

819

def Property_dbus_property(self):

1093

820

return dbus.Boolean(False)

1094

1095

See also the DBusObjectWithAnnotations class.

1096

821

"""

1097

1098

822

def decorator(func):

1099

823

func._dbus_annotations = annotations

1100

824

return func

1101

1102

825

return decorator

1103

826

1104

827

1107

830

"""

1108

831

pass

1109

832

1110

1111

833

class DBusPropertyAccessException(DBusPropertyException):

1112

834

"""A property's access permissions disallows an operation.

1113

835

"""

1120

842

pass

1121

843

1122

844

1123

class DBusObjectWithAnnotations(dbus.service.Object):

1124

"""A D-Bus object with annotations.

845

class DBusObjectWithProperties(dbus.service.Object):

846

"""A D-Bus object with properties.

1125

847

1126

Classes inheriting from this can use the dbus_annotations

1127

decorator to add annotations to methods or signals.

848

Classes inheriting from this can use the dbus_service_property

849

decorator to expose methods as D-Bus properties. It exposes the

850

standard Get(), Set(), and GetAll() methods on the D-Bus.

1128

851

"""

1129

852

1130

853

@staticmethod

1140

863

def _get_all_dbus_things(self, thing):

1141

864

"""Returns a generator of (name, attribute) pairs

1142

865

"""

1143

return ((getattr(athing.__get__(self), "_dbus_name", name),

866

return ((getattr(athing.__get__(self), "_dbus_name",

867

name),

1144

868

athing.__get__(self))

1145

869

for cls in self.__class__.__mro__

1146

870

for name, athing in

1147

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1148

1149

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1150

out_signature = "s",

1151

path_keyword = 'object_path',

1152

connection_keyword = 'connection')

1153

def Introspect(self, object_path, connection):

1154

"""Overloading of standard D-Bus method.

1155

1156

Inserts annotation tags on methods and signals.

1157

"""

1158

xmlstring = dbus.service.Object.Introspect(self, object_path,

1159

connection)

1160

try:

1161

document = xml.dom.minidom.parseString(xmlstring)

1162

1163

for if_tag in document.getElementsByTagName("interface"):

1164

# Add annotation tags

1165

for typ in ("method", "signal"):

1166

for tag in if_tag.getElementsByTagName(typ):

1167

annots = dict()

1168

for name, prop in (self.

1169

_get_all_dbus_things(typ)):

1170

if (name == tag.getAttribute("name")

1171

and prop._dbus_interface

1172

== if_tag.getAttribute("name")):

1173

annots.update(getattr(

1174

prop, "_dbus_annotations", {}))

1175

for name, value in annots.items():

1176

ann_tag = document.createElement(

1177

"annotation")

1178

ann_tag.setAttribute("name", name)

1179

ann_tag.setAttribute("value", value)

1180

tag.appendChild(ann_tag)

1181

# Add interface annotation tags

1182

for annotation, value in dict(

1183

itertools.chain.from_iterable(

1184

annotations().items()

1185

for name, annotations

1186

in self._get_all_dbus_things("interface")

1187

if name == if_tag.getAttribute("name")

1188

)).items():

1189

ann_tag = document.createElement("annotation")

1190

ann_tag.setAttribute("name", annotation)

1191

ann_tag.setAttribute("value", value)

1192

if_tag.appendChild(ann_tag)

1193

# Fix argument name for the Introspect method itself

1194

if (if_tag.getAttribute("name")

1195

== dbus.INTROSPECTABLE_IFACE):

1196

for cn in if_tag.getElementsByTagName("method"):

1197

if cn.getAttribute("name") == "Introspect":

1198

for arg in cn.getElementsByTagName("arg"):

1199

if (arg.getAttribute("direction")

1200

== "out"):

1201

arg.setAttribute("name",

1202

"xml_data")

1203

xmlstring = document.toxml("utf-8")

1204

document.unlink()

1205

except (AttributeError, xml.dom.DOMException,

1206

xml.parsers.expat.ExpatError) as error:

1207

logger.error("Failed to override Introspection method",

1208

exc_info=error)

1209

return xmlstring

1210

1211

1212

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1213

"""A D-Bus object with properties.

1214

1215

Classes inheriting from this can use the dbus_service_property

1216

decorator to expose methods as D-Bus properties. It exposes the

1217

standard Get(), Set(), and GetAll() methods on the D-Bus.

1218

"""

871

inspect.getmembers(cls,

872

self._is_dbus_thing(thing)))

1219

873

1220

874

def _get_dbus_property(self, interface_name, property_name):

1221

875

"""Returns a bound method if one exists which is a D-Bus

1222

876

property with the specified name and interface.

1223

877

"""

1224

for cls in self.__class__.__mro__:

1225

for name, value in inspect.getmembers(

1226

cls, self._is_dbus_thing("property")):

878

for cls in self.__class__.__mro__:

879

for name, value in (inspect.getmembers

880

(cls,

881

self._is_dbus_thing("property"))):

1227

882

if (value._dbus_name == property_name

1228

883

and value._dbus_interface == interface_name):

1229

884

return value.__get__(self)

1230

885

1231

886

# No such property

1232

raise DBusPropertyNotFound("{}:{}.{}".format(

1233

self.dbus_object_path, interface_name, property_name))

1234

1235

@classmethod

1236

def _get_all_interface_names(cls):

1237

"""Get a sequence of all interfaces supported by an object"""

1238

return (name for name in set(getattr(getattr(x, attr),

1239

"_dbus_interface", None)

1240

for x in (inspect.getmro(cls))

1241

for attr in dir(x))

1242

if name is not None)

1243

1244

@dbus.service.method(dbus.PROPERTIES_IFACE,

1245

in_signature="ss",

887

raise DBusPropertyNotFound(self.dbus_object_path + ":"

888

+ interface_name + "."

889

+ property_name)

890

891

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1246

892

out_signature="v")

1247

893

def Get(self, interface_name, property_name):

1248

894

"""Standard D-Bus property Get() method, see D-Bus standard.

1273

919

for byte in value))

1274

920

prop(value)

1275

921

1276

@dbus.service.method(dbus.PROPERTIES_IFACE,

1277

in_signature="s",

922

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1278

923

out_signature="a{sv}")

1279

924

def GetAll(self, interface_name):

1280

925

"""Standard D-Bus property GetAll() method, see D-Bus

1295

940

if not hasattr(value, "variant_level"):

1296

941

properties[name] = value

1297

942

continue

1298

properties[name] = type(value)(

1299

value, variant_level = value.variant_level + 1)

943

properties[name] = type(value)(value, variant_level=

944

value.variant_level+1)

1300

945

return dbus.Dictionary(properties, signature="sv")

1301

946

1302

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1303

def PropertiesChanged(self, interface_name, changed_properties,

1304

invalidated_properties):

1305

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1306

standard.

1307

"""

1308

pass

1309

1310

947

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1311

948

out_signature="s",

1312

949

path_keyword='object_path',

1316

953

1317

954

Inserts property tags and interface annotation tags.

1318

955

"""

1319

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1320

object_path,

1321

connection)

956

xmlstring = dbus.service.Object.Introspect(self, object_path,

957

connection)

1322

958

try:

1323

959

document = xml.dom.minidom.parseString(xmlstring)

1324

1325

960

def make_tag(document, name, prop):

1326

961

e = document.createElement("property")

1327

962

e.setAttribute("name", name)

1328

963

e.setAttribute("type", prop._dbus_signature)

1329

964

e.setAttribute("access", prop._dbus_access)

1330

965

return e

1331

1332

966

for if_tag in document.getElementsByTagName("interface"):

1333

967

# Add property tags

1334

968

for tag in (make_tag(document, name, prop)

1337

971

if prop._dbus_interface

1338

972

== if_tag.getAttribute("name")):

1339

973

if_tag.appendChild(tag)

1340

# Add annotation tags for properties

1341

for tag in if_tag.getElementsByTagName("property"):

1342

annots = dict()

1343

for name, prop in self._get_all_dbus_things(

1344

"property"):

1345

if (name == tag.getAttribute("name")

1346

and prop._dbus_interface

1347

== if_tag.getAttribute("name")):

1348

annots.update(getattr(

1349

prop, "_dbus_annotations", {}))

1350

for name, value in annots.items():

1351

ann_tag = document.createElement(

1352

"annotation")

1353

ann_tag.setAttribute("name", name)

1354

ann_tag.setAttribute("value", value)

1355

tag.appendChild(ann_tag)

974

# Add annotation tags

975

for typ in ("method", "signal", "property"):

976

for tag in if_tag.getElementsByTagName(typ):

977

annots = dict()

978

for name, prop in (self.

979

_get_all_dbus_things(typ)):

980

if (name == tag.getAttribute("name")

981

and prop._dbus_interface

982

== if_tag.getAttribute("name")):

983

annots.update(getattr

984

(prop,

985

"_dbus_annotations",

986

{}))

987

for name, value in annots.items():

988

ann_tag = document.createElement(

989

"annotation")

990

ann_tag.setAttribute("name", name)

991

ann_tag.setAttribute("value", value)

992

tag.appendChild(ann_tag)

993

# Add interface annotation tags

994

for annotation, value in dict(

995

itertools.chain.from_iterable(

996

annotations().items()

997

for name, annotations in

998

self._get_all_dbus_things("interface")

999

if name == if_tag.getAttribute("name")

1000

)).items():

1001

ann_tag = document.createElement("annotation")

1002

ann_tag.setAttribute("name", annotation)

1003

ann_tag.setAttribute("value", value)

1004

if_tag.appendChild(ann_tag)

1356

1005

# Add the names to the return values for the

1357

1006

# "org.freedesktop.DBus.Properties" methods

1358

1007

if (if_tag.getAttribute("name")

1376

1025

exc_info=error)

1377

1026

return xmlstring

1378

1027

1379

try:

1380

dbus.OBJECT_MANAGER_IFACE

1381

except AttributeError:

1382

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1383

1384

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1385

"""A D-Bus object with an ObjectManager.

1386

1387

Classes inheriting from this exposes the standard

1388

GetManagedObjects call and the InterfacesAdded and

1389

InterfacesRemoved signals on the standard

1390

"org.freedesktop.DBus.ObjectManager" interface.

1391

1392

Note: No signals are sent automatically; they must be sent

1393

manually.

1394

"""

1395

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1396

out_signature = "a{oa{sa{sv}}}")

1397

def GetManagedObjects(self):

1398

"""This function must be overridden"""

1399

raise NotImplementedError()

1400

1401

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1402

signature = "oa{sa{sv}}")

1403

def InterfacesAdded(self, object_path, interfaces_and_properties):

1404

pass

1405

1406

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1407

def InterfacesRemoved(self, object_path, interfaces):

1408

pass

1409

1410

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1411

out_signature = "s",

1412

path_keyword = 'object_path',

1413

connection_keyword = 'connection')

1414

def Introspect(self, object_path, connection):

1415

"""Overloading of standard D-Bus method.

1416

1417

Override return argument name of GetManagedObjects to be

1418

"objpath_interfaces_and_properties"

1419

"""

1420

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1421

object_path,

1422

connection)

1423

try:

1424

document = xml.dom.minidom.parseString(xmlstring)

1425

1426

for if_tag in document.getElementsByTagName("interface"):

1427

# Fix argument name for the GetManagedObjects method

1428

if (if_tag.getAttribute("name")

1429

== dbus.OBJECT_MANAGER_IFACE):

1430

for cn in if_tag.getElementsByTagName("method"):

1431

if (cn.getAttribute("name")

1432

== "GetManagedObjects"):

1433

for arg in cn.getElementsByTagName("arg"):

1434

if (arg.getAttribute("direction")

1435

== "out"):

1436

arg.setAttribute(

1437

"name",

1438

"objpath_interfaces"

1439

"_and_properties")

1440

xmlstring = document.toxml("utf-8")

1441

document.unlink()

1442

except (AttributeError, xml.dom.DOMException,

1443

xml.parsers.expat.ExpatError) as error:

1444

logger.error("Failed to override Introspection method",

1445

exc_info = error)

1446

return xmlstring

1447

1028

1448

1029

def datetime_to_dbus(dt, variant_level=0):

1449

1030

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1450

1031

if dt is None:

1451

1032

return dbus.String("", variant_level = variant_level)

1452

return dbus.String(dt.isoformat(), variant_level=variant_level)

1033

return dbus.String(dt.isoformat(),

1034

variant_level=variant_level)

1453

1035

1454

1036

1455

1037

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1475

1057

(from DBusObjectWithProperties) and interfaces (from the

1476

1058

dbus_interface_annotations decorator).

1477

1059

"""

1478

1479

1060

def wrapper(cls):

1480

1061

for orig_interface_name, alt_interface_name in (

1481

alt_interface_names.items()):

1062

alt_interface_names.items()):

1482

1063

attr = {}

1483

1064

interface_names = set()

1484

1065

# Go though all attributes of the class

1486

1067

# Ignore non-D-Bus attributes, and D-Bus attributes

1487

1068

# with the wrong interface name

1488

1069

if (not hasattr(attribute, "_dbus_interface")

1489

or not attribute._dbus_interface.startswith(

1490

orig_interface_name)):

1070

or not attribute._dbus_interface

1071

.startswith(orig_interface_name)):

1491

1072

continue

1492

1073

# Create an alternate D-Bus interface name based on

1493

1074

# the current name

1494

alt_interface = attribute._dbus_interface.replace(

1495

orig_interface_name, alt_interface_name)

1075

alt_interface = (attribute._dbus_interface

1076

.replace(orig_interface_name,

1077

alt_interface_name))

1496

1078

interface_names.add(alt_interface)

1497

1079

# Is this a D-Bus signal?

1498

1080

if getattr(attribute, "_dbus_is_signal", False):

1499

if sys.version_info.major == 2:

1500

# Extract the original non-method undecorated

1501

# function by black magic

1502

nonmethod_func = (dict(

1081

# Extract the original non-method undecorated

1082

# function by black magic

1083

nonmethod_func = (dict(

1503

1084

zip(attribute.func_code.co_freevars,

1504

attribute.__closure__))

1505

["func"].cell_contents)

1506

else:

1507

nonmethod_func = attribute

1085

attribute.__closure__))["func"]

1086

.cell_contents)

1508

1087

# Create a new, but exactly alike, function

1509

1088

# object, and decorate it to be a new D-Bus signal

1510

1089

# with the alternate D-Bus interface name

1511

if sys.version_info.major == 2:

1512

new_function = types.FunctionType(

1513

nonmethod_func.func_code,

1514

nonmethod_func.func_globals,

1515

nonmethod_func.func_name,

1516

nonmethod_func.func_defaults,

1517

nonmethod_func.func_closure)

1518

else:

1519

new_function = types.FunctionType(

1520

nonmethod_func.__code__,

1521

nonmethod_func.__globals__,

1522

nonmethod_func.__name__,

1523

nonmethod_func.__defaults__,

1524

nonmethod_func.__closure__)

1525

new_function = (dbus.service.signal(

1526

alt_interface,

1527

attribute._dbus_signature)(new_function))

1090

new_function = (dbus.service.signal

1091

(alt_interface,

1092

attribute._dbus_signature)

1093

(types.FunctionType(

1094

nonmethod_func.func_code,

1095

nonmethod_func.func_globals,

1096

nonmethod_func.func_name,

1097

nonmethod_func.func_defaults,

1098

nonmethod_func.func_closure)))

1528

1099

# Copy annotations, if any

1529

1100

try:

1530

new_function._dbus_annotations = dict(

1531

attribute._dbus_annotations)

1101

new_function._dbus_annotations = (

1102

dict(attribute._dbus_annotations))

1532

1103

except AttributeError:

1533

1104

pass

1534

1105

# Define a creator of a function to call both the

1539

1110

"""This function is a scope container to pass

1540

1111

func1 and func2 to the "call_both" function

1541

1112

outside of its arguments"""

1542

1543

@functools.wraps(func2)

1544

1113

def call_both(*args, **kwargs):

1545

1114

"""This function will emit two D-Bus

1546

1115

signals by calling func1 and func2"""

1547

1116

func1(*args, **kwargs)

1548

1117

func2(*args, **kwargs)

1549

# Make wrapper function look like a D-Bus signal

1550

for name, attr in inspect.getmembers(func2):

1551

if name.startswith("_dbus_"):

1552

setattr(call_both, name, attr)

1553

1554

1118

return call_both

1555

1119

# Create the "call_both" function and add it to

1556

1120

# the class

1561

1125

# object. Decorate it to be a new D-Bus method

1562

1126

# with the alternate D-Bus interface name. Add it

1563

1127

# to the class.

1564

attr[attrname] = (

1565

dbus.service.method(

1566

alt_interface,

1567

attribute._dbus_in_signature,

1568

attribute._dbus_out_signature)

1569

(types.FunctionType(attribute.func_code,

1570

attribute.func_globals,

1571

attribute.func_name,

1572

attribute.func_defaults,

1573

attribute.func_closure)))

1128

attr[attrname] = (dbus.service.method

1129

(alt_interface,

1130

attribute._dbus_in_signature,

1131

attribute._dbus_out_signature)

1132

(types.FunctionType

1133

(attribute.func_code,

1134

attribute.func_globals,

1135

attribute.func_name,

1136

attribute.func_defaults,

1137

attribute.func_closure)))

1574

1138

# Copy annotations, if any

1575

1139

try:

1576

attr[attrname]._dbus_annotations = dict(

1577

attribute._dbus_annotations)

1140

attr[attrname]._dbus_annotations = (

1141

dict(attribute._dbus_annotations))

1578

1142

except AttributeError:

1579

1143

pass

1580

1144

# Is this a D-Bus property?

1583

1147

# object, and decorate it to be a new D-Bus

1584

1148

# property with the alternate D-Bus interface

1585

1149

# name. Add it to the class.

1586

attr[attrname] = (dbus_service_property(

1587

alt_interface, attribute._dbus_signature,

1588

attribute._dbus_access,

1589

attribute._dbus_get_args_options

1590

["byte_arrays"])

1591

(types.FunctionType(

1592

attribute.func_code,

1593

attribute.func_globals,

1594

attribute.func_name,

1595

attribute.func_defaults,

1596

attribute.func_closure)))

1150

attr[attrname] = (dbus_service_property

1151

(alt_interface,

1152

attribute._dbus_signature,

1153

attribute._dbus_access,

1154

attribute

1155

._dbus_get_args_options

1156

["byte_arrays"])

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1597

1163

# Copy annotations, if any

1598

1164

try:

1599

attr[attrname]._dbus_annotations = dict(

1600

attribute._dbus_annotations)

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1601

1167

except AttributeError:

1602

1168

pass

1603

1169

# Is this a D-Bus interface?

1606

1172

# object. Decorate it to be a new D-Bus interface

1607

1173

# with the alternate D-Bus interface name. Add it

1608

1174

# to the class.

1609

attr[attrname] = (

1610

dbus_interface_annotations(alt_interface)

1611

(types.FunctionType(attribute.func_code,

1612

attribute.func_globals,

1613

attribute.func_name,

1614

attribute.func_defaults,

1615

attribute.func_closure)))

1175

attr[attrname] = (dbus_interface_annotations

1176

(alt_interface)

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1616

1183

if deprecate:

1617

1184

# Deprecate all alternate interfaces

1618

1185

iname="_AlternateDBusNames_interface_annotation{}"

1619

1186

for interface_name in interface_names:

1620

1621

1187

@dbus_interface_annotations(interface_name)

1622

1188

def func(self):

1623

1189

return { "org.freedesktop.DBus.Deprecated":

1624

"true" }

1190

"true" }

1625

1191

# Find an unused name

1626

1192

for aname in (iname.format(i)

1627

1193

for i in itertools.count()):

1632

1198

# Replace the class with a new subclass of it with

1633

1199

# methods, signals, etc. as created above.

1634

1200

cls = type(b"{}Alternate".format(cls.__name__),

1635

(cls, ), attr)

1201

(cls,), attr)

1636

1202

return cls

1637

1638

1203

return wrapper

1639

1204

1640

1205

1641

1206

@alternate_dbus_interfaces({"se.recompile.Mandos":

1642

"se.bsnet.fukt.Mandos"})

1207

"se.bsnet.fukt.Mandos"})

1643

1208

class ClientDBus(Client, DBusObjectWithProperties):

1644

1209

"""A Client class using D-Bus

1645

1210

1649

1214

"""

1650

1215

1651

1216

runtime_expansions = (Client.runtime_expansions

1652

+ ("dbus_object_path", ))

1653

1654

_interface = "se.recompile.Mandos.Client"

1217

+ ("dbus_object_path",))

1655

1218

1656

1219

# dbus.service.Object doesn't use super(), so we can't either.

1657

1220

1660

1223

Client.__init__(self, *args, **kwargs)

1661

1224

# Only now, when this client is initialized, can it show up on

1662

1225

# the D-Bus

1663

client_object_name = str(self.name).translate(

1226

client_object_name = unicode(self.name).translate(

1664

1227

{ord("."): ord("_"),

1665

1228

ord("-"): ord("_")})

1666

self.dbus_object_path = dbus.ObjectPath(

1667

"/clients/" + client_object_name)

1229

self.dbus_object_path = (dbus.ObjectPath

1230

("/clients/" + client_object_name))

1668

1231

DBusObjectWithProperties.__init__(self, self.bus,

1669

1232

self.dbus_object_path)

1670

1233

1671

def notifychangeproperty(transform_func, dbus_name,

1672

type_func=lambda x: x,

1673

variant_level=1,

1674

invalidate_only=False,

1675

_interface=_interface):

1234

def notifychangeproperty(transform_func,

1235

dbus_name, type_func=lambda x: x,

1236

variant_level=1):

1676

1237

""" Modify a variable so that it's a property which announces

1677

1238

its changes to DBus.

1678

1239

1684

1245

variant_level: D-Bus variant level. Default: 1

1685

1246

"""

1686

1247

attrname = "_{}".format(dbus_name)

1687

1688

1248

def setter(self, value):

1689

1249

if hasattr(self, "dbus_object_path"):

1690

1250

if (not hasattr(self, attrname) or

1691

1251

type_func(getattr(self, attrname, None))

1692

1252

!= type_func(value)):

1693

if invalidate_only:

1694

self.PropertiesChanged(

1695

_interface, dbus.Dictionary(),

1696

dbus.Array((dbus_name, )))

1697

else:

1698

dbus_value = transform_func(

1699

type_func(value),

1700

variant_level = variant_level)

1701

self.PropertyChanged(dbus.String(dbus_name),

1702

dbus_value)

1703

self.PropertiesChanged(

1704

_interface,

1705

dbus.Dictionary({ dbus.String(dbus_name):

1706

dbus_value }),

1707

dbus.Array())

1253

dbus_value = transform_func(type_func(value),

1254

variant_level

1255

=variant_level)

1256

self.PropertyChanged(dbus.String(dbus_name),

1257

dbus_value)

1708

1258

setattr(self, attrname, value)

1709

1259

1710

1260

return property(lambda self: getattr(self, attrname), setter)

1716

1266

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1717

1267

last_enabled = notifychangeproperty(datetime_to_dbus,

1718

1268

"LastEnabled")

1719

checker = notifychangeproperty(

1720

dbus.Boolean, "CheckerRunning",

1721

type_func = lambda checker: checker is not None)

1269

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1270

type_func = lambda checker:

1271

checker is not None)

1722

1272

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1723

1273

"LastCheckedOK")

1724

1274

last_checker_status = notifychangeproperty(dbus.Int16,

1727

1277

datetime_to_dbus, "LastApprovalRequest")

1728

1278

approved_by_default = notifychangeproperty(dbus.Boolean,

1729

1279

"ApprovedByDefault")

1730

approval_delay = notifychangeproperty(

1731

dbus.UInt64, "ApprovalDelay",

1732

type_func = lambda td: td.total_seconds() * 1000)

1280

approval_delay = notifychangeproperty(dbus.UInt64,

1281

"ApprovalDelay",

1282

type_func =

1283

lambda td: td.total_seconds()

1284

* 1000)

1733

1285

approval_duration = notifychangeproperty(

1734

1286

dbus.UInt64, "ApprovalDuration",

1735

1287

type_func = lambda td: td.total_seconds() * 1000)

1736

1288

host = notifychangeproperty(dbus.String, "Host")

1737

timeout = notifychangeproperty(

1738

dbus.UInt64, "Timeout",

1739

type_func = lambda td: td.total_seconds() * 1000)

1289

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1290

type_func = lambda td:

1291

td.total_seconds() * 1000)

1740

1292

extended_timeout = notifychangeproperty(

1741

1293

dbus.UInt64, "ExtendedTimeout",

1742

1294

type_func = lambda td: td.total_seconds() * 1000)

1743

interval = notifychangeproperty(

1744

dbus.UInt64, "Interval",

1745

type_func = lambda td: td.total_seconds() * 1000)

1295

interval = notifychangeproperty(dbus.UInt64,

1296

"Interval",

1297

type_func =

1298

lambda td: td.total_seconds()

1299

* 1000)

1746

1300

checker_command = notifychangeproperty(dbus.String, "Checker")

1747

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1748

invalidate_only=True)

1749

1301

1750

1302

del notifychangeproperty

1751

1303

1758

1310

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1759

1311

Client.__del__(self, *args, **kwargs)

1760

1312

1761

def checker_callback(self, source, condition,

1762

connection, command, *args, **kwargs):

1763

ret = Client.checker_callback(self, source, condition,

1764

connection, command, *args,

1765

**kwargs)

1766

exitstatus = self.last_checker_status

1767

if exitstatus >= 0:

1313

def checker_callback(self, pid, condition, command,

1314

*args, **kwargs):

1315

self.checker_callback_tag = None

1316

self.checker = None

1317

if os.WIFEXITED(condition):

1318

exitstatus = os.WEXITSTATUS(condition)

1768

1319

# Emit D-Bus signal

1769

1320

self.CheckerCompleted(dbus.Int16(exitstatus),

1770

# This is specific to GNU libC

1771

dbus.Int64(exitstatus << 8),

1321

dbus.Int64(condition),

1772

1322

dbus.String(command))

1773

1323

else:

1774

1324

# Emit D-Bus signal

1775

1325

self.CheckerCompleted(dbus.Int16(-1),

1776

dbus.Int64(

1777

# This is specific to GNU libC

1778

(exitstatus << 8)

1779

| self.last_checker_signal),

1326

dbus.Int64(condition),

1780

1327

dbus.String(command))

1781

return ret

1328

1329

return Client.checker_callback(self, pid, condition, command,

1330

*args, **kwargs)

1782

1331

1783

1332

def start_checker(self, *args, **kwargs):

1784

1333

old_checker_pid = getattr(self.checker, "pid", None)

1801

1350

self.send_changedstate()

1802

1351

1803

1352

## D-Bus methods, signals & properties

1353

_interface = "se.recompile.Mandos.Client"

1804

1354

1805

1355

## Interfaces

1806

1356

1357

@dbus_interface_annotations(_interface)

1358

def _foo(self):

1359

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1360

"false"}

1361

1807

1362

## Signals

1808

1363

1809

1364

# CheckerCompleted - signal

1819

1374

pass

1820

1375

1821

1376

# PropertyChanged - signal

1822

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1823

1377

@dbus.service.signal(_interface, signature="sv")

1824

1378

def PropertyChanged(self, property, value):

1825

1379

"D-Bus signal"

1859

1413

self.checked_ok()

1860

1414

1861

1415

# Enable - method

1862

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1863

1416

@dbus.service.method(_interface)

1864

1417

def Enable(self):

1865

1418

"D-Bus method"

1866

1419

self.enable()

1867

1420

1868

1421

# StartChecker - method

1869

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1870

1422

@dbus.service.method(_interface)

1871

1423

def StartChecker(self):

1872

1424

"D-Bus method"

1873

1425

self.start_checker()

1874

1426

1875

1427

# Disable - method

1876

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1877

1428

@dbus.service.method(_interface)

1878

1429

def Disable(self):

1879

1430

"D-Bus method"

1880

1431

self.disable()

1881

1432

1882

1433

# StopChecker - method

1883

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1884

1434

@dbus.service.method(_interface)

1885

1435

def StopChecker(self):

1886

1436

self.stop_checker()

1893

1443

return dbus.Boolean(bool(self.approvals_pending))

1894

1444

1895

1445

# ApprovedByDefault - property

1896

@dbus_service_property(_interface,

1897

signature="b",

1446

@dbus_service_property(_interface, signature="b",

1898

1447

access="readwrite")

1899

1448

def ApprovedByDefault_dbus_property(self, value=None):

1900

1449

if value is None: # get

1902

1451

self.approved_by_default = bool(value)

1903

1452

1904

1453

# ApprovalDelay - property

1905

@dbus_service_property(_interface,

1906

signature="t",

1454

@dbus_service_property(_interface, signature="t",

1907

1455

access="readwrite")

1908

1456

def ApprovalDelay_dbus_property(self, value=None):

1909

1457

if value is None: # get

1912

1460

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1913

1461

1914

1462

# ApprovalDuration - property

1915

@dbus_service_property(_interface,

1916

signature="t",

1463

@dbus_service_property(_interface, signature="t",

1917

1464

access="readwrite")

1918

1465

def ApprovalDuration_dbus_property(self, value=None):

1919

1466

if value is None: # get

1922

1469

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1923

1470

1924

1471

# Name - property

1925

@dbus_annotations(

1926

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1927

1472

@dbus_service_property(_interface, signature="s", access="read")

1928

1473

def Name_dbus_property(self):

1929

1474

return dbus.String(self.name)

1930

1475

1931

1476

# Fingerprint - property

1932

@dbus_annotations(

1933

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1934

1477

@dbus_service_property(_interface, signature="s", access="read")

1935

1478

def Fingerprint_dbus_property(self):

1936

1479

return dbus.String(self.fingerprint)

1937

1480

1938

1481

# Host - property

1939

@dbus_service_property(_interface,

1940

signature="s",

1482

@dbus_service_property(_interface, signature="s",

1941

1483

access="readwrite")

1942

1484

def Host_dbus_property(self, value=None):

1943

1485

if value is None: # get

1944

1486

return dbus.String(self.host)

1945

self.host = str(value)

1487

self.host = unicode(value)

1946

1488

1947

1489

# Created - property

1948

@dbus_annotations(

1949

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1950

1490

@dbus_service_property(_interface, signature="s", access="read")

1951

1491

def Created_dbus_property(self):

1952

1492

return datetime_to_dbus(self.created)

1957

1497

return datetime_to_dbus(self.last_enabled)

1958

1498

1959

1499

# Enabled - property

1960

@dbus_service_property(_interface,

1961

signature="b",

1500

@dbus_service_property(_interface, signature="b",

1962

1501

access="readwrite")

1963

1502

def Enabled_dbus_property(self, value=None):

1964

1503

if value is None: # get

1969

1508

self.disable()

1970

1509

1971

1510

# LastCheckedOK - property

1972

@dbus_service_property(_interface,

1973

signature="s",

1511

@dbus_service_property(_interface, signature="s",

1974

1512

access="readwrite")

1975

1513

def LastCheckedOK_dbus_property(self, value=None):

1976

1514

if value is not None:

1979

1517

return datetime_to_dbus(self.last_checked_ok)

1980

1518

1981

1519

# LastCheckerStatus - property

1982

@dbus_service_property(_interface, signature="n", access="read")

1520

@dbus_service_property(_interface, signature="n",

1521

access="read")

1983

1522

def LastCheckerStatus_dbus_property(self):

1984

1523

return dbus.Int16(self.last_checker_status)

1985

1524

1994

1533

return datetime_to_dbus(self.last_approval_request)

1995

1534

1996

1535

# Timeout - property

1997

@dbus_service_property(_interface,

1998

signature="t",

1536

@dbus_service_property(_interface, signature="t",

1999

1537

access="readwrite")

2000

1538

def Timeout_dbus_property(self, value=None):

2001

1539

if value is None: # get

2014

1552

is None):

2015

1553

return

2016

1554

gobject.source_remove(self.disable_initiator_tag)

2017

self.disable_initiator_tag = gobject.timeout_add(

2018

int((self.expires - now).total_seconds() * 1000),

2019

self.disable)

1555

self.disable_initiator_tag = (

1556

gobject.timeout_add(

1557

int((self.expires - now).total_seconds()

1558

* 1000), self.disable))

2020

1559

2021

1560

# ExtendedTimeout - property

2022

@dbus_service_property(_interface,

2023

signature="t",

1561

@dbus_service_property(_interface, signature="t",

2024

1562

access="readwrite")

2025

1563

def ExtendedTimeout_dbus_property(self, value=None):

2026

1564

if value is None: # get

2029

1567

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2030

1568

2031

1569

# Interval - property

2032

@dbus_service_property(_interface,

2033

signature="t",

1570

@dbus_service_property(_interface, signature="t",

2034

1571

access="readwrite")

2035

1572

def Interval_dbus_property(self, value=None):

2036

1573

if value is None: # get

2041

1578

if self.enabled:

2042

1579

# Reschedule checker run

2043

1580

gobject.source_remove(self.checker_initiator_tag)

2044

self.checker_initiator_tag = gobject.timeout_add(

2045

value, self.start_checker)

2046

self.start_checker() # Start one now, too

1581

self.checker_initiator_tag = (gobject.timeout_add

1582

(value, self.start_checker))

1583

self.start_checker() # Start one now, too

2047

1584

2048

1585

# Checker - property

2049

@dbus_service_property(_interface,

2050

signature="s",

1586

@dbus_service_property(_interface, signature="s",

2051

1587

access="readwrite")

2052

1588

def Checker_dbus_property(self, value=None):

2053

1589

if value is None: # get

2054

1590

return dbus.String(self.checker_command)

2055

self.checker_command = str(value)

1591

self.checker_command = unicode(value)

2056

1592

2057

1593

# CheckerRunning - property

2058

@dbus_service_property(_interface,

2059

signature="b",

1594

@dbus_service_property(_interface, signature="b",

2060

1595

access="readwrite")

2061

1596

def CheckerRunning_dbus_property(self, value=None):

2062

1597

if value is None: # get

2067

1602

self.stop_checker()

2068

1603

2069

1604

# ObjectPath - property

2070

@dbus_annotations(

2071

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2072

"org.freedesktop.DBus.Deprecated": "true"})

2073

1605

@dbus_service_property(_interface, signature="o", access="read")

2074

1606

def ObjectPath_dbus_property(self):

2075

1607

return self.dbus_object_path # is already a dbus.ObjectPath

2076

1608

2077

1609

# Secret = property

2078

@dbus_annotations(

2079

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2080

"invalidates"})

2081

@dbus_service_property(_interface,

2082

signature="ay",

2083

access="write",

2084

byte_arrays=True)

1610

@dbus_service_property(_interface, signature="ay",

1611

access="write", byte_arrays=True)

2085

1612

def Secret_dbus_property(self, value):

2086

1613

self.secret = bytes(value)

2087

1614

2093

1620

self._pipe = child_pipe

2094

1621

self._pipe.send(('init', fpr, address))

2095

1622

if not self._pipe.recv():

2096

raise KeyError(fpr)

1623

raise KeyError()

2097

1624

2098

1625

def __getattribute__(self, name):

2099

1626

if name == '_pipe':

2103

1630

if data[0] == 'data':

2104

1631

return data[1]

2105

1632

if data[0] == 'function':

2106

2107

1633

def func(*args, **kwargs):

2108

1634

self._pipe.send(('funcall', name, args, kwargs))

2109

1635

return self._pipe.recv()[1]

2110

2111

1636

return func

2112

1637

2113

1638

def __setattr__(self, name, value):

2125

1650

def handle(self):

2126

1651

with contextlib.closing(self.server.child_pipe) as child_pipe:

2127

1652

logger.info("TCP connection from: %s",

2128

str(self.client_address))

1653

unicode(self.client_address))

2129

1654

logger.debug("Pipe FD: %d",

2130

1655

self.server.child_pipe.fileno())

2131

1656

2132

session = gnutls.ClientSession(self.request)

1657

session = (gnutls.connection

1658

.ClientSession(self.request,

1659

gnutls.connection

1660

.X509Credentials()))

1661

1662

# Note: gnutls.connection.X509Credentials is really a

1663

# generic GnuTLS certificate credentials object so long as

1664

# no X.509 keys are added to it. Therefore, we can use it

1665

# here despite using OpenPGP certificates.

2133

1666

2134

1667

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2135

1668

# "+AES-256-CBC", "+SHA1",

2139

1672

priority = self.server.gnutls_priority

2140

1673

if priority is None:

2141

1674

priority = "NORMAL"

2142

gnutls.priority_set_direct(session._c_object, priority,

2143

None)

1675

(gnutls.library.functions

1676

.gnutls_priority_set_direct(session._c_object,

1677

priority, None))

2144

1678

2145

1679

# Start communication using the Mandos protocol

2146

1680

# Get protocol number

2156

1690

# Start GnuTLS connection

2157

1691

try:

2158

1692

session.handshake()

2159

except gnutls.Error as error:

1693

except gnutls.errors.GNUTLSError as error:

2160

1694

logger.warning("Handshake failed: %s", error)

2161

1695

# Do not run session.bye() here: the session is not

2162

1696

# established. Just abandon the request.

2166

1700

approval_required = False

2167

1701

try:

2168

1702

try:

2169

fpr = self.fingerprint(

2170

self.peer_certificate(session))

2171

except (TypeError, gnutls.Error) as error:

1703

fpr = self.fingerprint(self.peer_certificate

1704

(session))

1705

except (TypeError,

1706

gnutls.errors.GNUTLSError) as error:

2172

1707

logger.warning("Bad certificate: %s", error)

2173

1708

return

2174

1709

logger.debug("Fingerprint: %s", fpr)

2187

1722

while True:

2188

1723

if not client.enabled:

2189

1724

logger.info("Client %s is disabled",

2190

client.name)

1725

client.name)

2191

1726

if self.server.use_dbus:

2192

1727

# Emit D-Bus signal

2193

1728

client.Rejected("Disabled")

2232

1767

else:

2233

1768

delay -= time2 - time

2234

1769

2235

try:

2236

session.send(client.secret)

2237

except gnutls.Error as error:

2238

logger.warning("gnutls send failed",

2239

exc_info = error)

2240

return

1770

sent_size = 0

1771

while sent_size < len(client.secret):

1772

try:

1773

sent = session.send(client.secret[sent_size:])

1774

except gnutls.errors.GNUTLSError as error:

1775

logger.warning("gnutls send failed",

1776

exc_info=error)

1777

return

1778

logger.debug("Sent: %d, remaining: %d",

1779

sent, len(client.secret)

1780

- (sent_size + sent))

1781

sent_size += sent

2241

1782

2242

1783

logger.info("Sending secret to %s", client.name)

2243

1784

# bump the timeout using extended_timeout

2251

1792

client.approvals_pending -= 1

2252

1793

try:

2253

1794

session.bye()

2254

except gnutls.Error as error:

1795

except gnutls.errors.GNUTLSError as error:

2255

1796

logger.warning("GnuTLS bye failed",

2256

1797

exc_info=error)

2257

1798

2259

1800

def peer_certificate(session):

2260

1801

"Return the peer's OpenPGP certificate as a bytestring"

2261

1802

# If not an OpenPGP certificate...

2262

if (gnutls.certificate_type_get(session._c_object)

2263

!= gnutls.CRT_OPENPGP):

2264

# ...return invalid data

2265

return b""

1803

if (gnutls.library.functions

1804

.gnutls_certificate_type_get(session._c_object)

1805

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1806

# ...do the normal thing

1807

return session.peer_certificate

2266

1808

list_size = ctypes.c_uint(1)

2267

cert_list = (gnutls.certificate_get_peers

1809

cert_list = (gnutls.library.functions

1810

.gnutls_certificate_get_peers

2268

1811

(session._c_object, ctypes.byref(list_size)))

2269

1812

if not bool(cert_list) and list_size.value != 0:

2270

raise gnutls.Error("error getting peer certificate")

1813

raise gnutls.errors.GNUTLSError("error getting peer"

1814

" certificate")

2271

1815

if list_size.value == 0:

2272

1816

return None

2273

1817

cert = cert_list[0]

2277

1821

def fingerprint(openpgp):

2278

1822

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2279

1823

# New GnuTLS "datum" with the OpenPGP public key

2280

datum = gnutls.datum_t(

2281

ctypes.cast(ctypes.c_char_p(openpgp),

2282

ctypes.POINTER(ctypes.c_ubyte)),

2283

ctypes.c_uint(len(openpgp)))

1824

datum = (gnutls.library.types

1825

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1826

ctypes.POINTER

1827

(ctypes.c_ubyte)),

1828

ctypes.c_uint(len(openpgp))))

2284

1829

# New empty GnuTLS certificate

2285

crt = gnutls.openpgp_crt_t()

2286

gnutls.openpgp_crt_init(ctypes.byref(crt))

1830

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1831

(gnutls.library.functions

1832

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2287

1833

# Import the OpenPGP public key into the certificate

2288

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2289

gnutls.OPENPGP_FMT_RAW)

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1836

gnutls.library.constants

1837

.GNUTLS_OPENPGP_FMT_RAW))

2290

1838

# Verify the self signature in the key

2291

1839

crtverify = ctypes.c_uint()

2292

gnutls.openpgp_crt_verify_self(crt, 0,

2293

ctypes.byref(crtverify))

1840

(gnutls.library.functions

1841

.gnutls_openpgp_crt_verify_self(crt, 0,

1842

ctypes.byref(crtverify)))

2294

1843

if crtverify.value != 0:

2295

gnutls.openpgp_crt_deinit(crt)

2296

raise gnutls.CertificateSecurityError("Verify failed")

1844

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1845

raise (gnutls.errors.CertificateSecurityError

1846

("Verify failed"))

2297

1847

# New buffer for the fingerprint

2298

1848

buf = ctypes.create_string_buffer(20)

2299

1849

buf_len = ctypes.c_size_t()

2300

1850

# Get the fingerprint from the certificate into the buffer

2301

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2302

ctypes.byref(buf_len))

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1853

ctypes.byref(buf_len)))

2303

1854

# Deinit the certificate

2304

gnutls.openpgp_crt_deinit(crt)

1855

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2305

1856

# Convert the buffer to a Python bytestring

2306

1857

fpr = ctypes.string_at(buf, buf_len.value)

2307

1858

# Convert the bytestring to hexadecimal notation

2311

1862

2312

1863

class MultiprocessingMixIn(object):

2313

1864

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2314

2315

1865

def sub_process_main(self, request, address):

2316

1866

try:

2317

1867

self.finish_request(request, address)

2329

1879

2330

1880

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2331

1881

""" adds a pipe to the MixIn """

2332

2333

1882

def process_request(self, request, client_address):

2334

1883

"""Overrides and wraps the original process_request().

2335

1884

2356

1905

interface: None or a network interface name (string)

2357

1906

use_ipv6: Boolean; to use IPv6 or not

2358

1907

"""

2359

2360

1908

def __init__(self, server_address, RequestHandlerClass,

2361

interface=None,

2362

use_ipv6=True,

2363

socketfd=None):

1909

interface=None, use_ipv6=True, socketfd=None):

2364

1910

"""If socketfd is set, use that file descriptor instead of

2365

1911

creating a new one with socket.socket().

2366

1912

"""

2407

1953

self.interface)

2408

1954

else:

2409

1955

try:

2410

self.socket.setsockopt(

2411

socket.SOL_SOCKET, SO_BINDTODEVICE,

2412

(self.interface + "\0").encode("utf-8"))

1956

self.socket.setsockopt(socket.SOL_SOCKET,

1957

SO_BINDTODEVICE,

1958

(self.interface + "\0")

1959

.encode("utf-8"))

2413

1960

except socket.error as error:

2414

1961

if error.errno == errno.EPERM:

2415

1962

logger.error("No permission to bind to"

2433

1980

self.server_address = (any_address,

2434

1981

self.server_address[1])

2435

1982

elif not self.server_address[1]:

2436

self.server_address = (self.server_address[0], 0)

1983

self.server_address = (self.server_address[0],

1984

0)

2437

1985

# if self.interface:

2438

1986

# self.server_address = (self.server_address[0],

2439

1987

# 0, # port

2453

2001

2454

2002

Assumes a gobject.MainLoop event loop.

2455

2003

"""

2456

2457

2004

def __init__(self, server_address, RequestHandlerClass,

2458

interface=None,

2459

use_ipv6=True,

2460

clients=None,

2461

gnutls_priority=None,

2462

use_dbus=True,

2463

socketfd=None):

2005

interface=None, use_ipv6=True, clients=None,

2006

gnutls_priority=None, use_dbus=True, socketfd=None):

2464

2007

self.enabled = False

2465

2008

self.clients = clients

2466

2009

if self.clients is None:

2472

2015

interface = interface,

2473

2016

use_ipv6 = use_ipv6,

2474

2017

socketfd = socketfd)

2475

2476

2018

def server_activate(self):

2477

2019

if self.enabled:

2478

2020

return socketserver.TCPServer.server_activate(self)

2482

2024

2483

2025

def add_pipe(self, parent_pipe, proc):

2484

2026

# Call "handle_ipc" for both data and EOF events

2485

gobject.io_add_watch(

2486

parent_pipe.fileno(),

2487

gobject.IO_IN | gobject.IO_HUP,

2488

functools.partial(self.handle_ipc,

2489

parent_pipe = parent_pipe,

2490

proc = proc))

2027

gobject.io_add_watch(parent_pipe.fileno(),

2028

gobject.IO_IN | gobject.IO_HUP,

2029

functools.partial(self.handle_ipc,

2030

parent_pipe =

2031

parent_pipe,

2032

proc = proc))

2491

2033

2492

def handle_ipc(self, source, condition,

2493

parent_pipe=None,

2494

proc = None,

2495

client_object=None):

2034

def handle_ipc(self, source, condition, parent_pipe=None,

2035

proc = None, client_object=None):

2496

2036

# error, or the other end of multiprocessing.Pipe has closed

2497

2037

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2498

2038

# Wait for other process to exit

2521

2061

parent_pipe.send(False)

2522

2062

return False

2523

2063

2524

gobject.io_add_watch(

2525

parent_pipe.fileno(),

2526

gobject.IO_IN | gobject.IO_HUP,

2527

functools.partial(self.handle_ipc,

2528

parent_pipe = parent_pipe,

2529

proc = proc,

2530

client_object = client))

2064

gobject.io_add_watch(parent_pipe.fileno(),

2065

gobject.IO_IN | gobject.IO_HUP,

2066

functools.partial(self.handle_ipc,

2067

parent_pipe =

2068

parent_pipe,

2069

proc = proc,

2070

client_object =

2071

client))

2531

2072

parent_pipe.send(True)

2532

2073

# remove the old hook in favor of the new above hook on

2533

2074

# same fileno

2539

2080

2540

2081

parent_pipe.send(('data', getattr(client_object,

2541

2082

funcname)(*args,

2542

**kwargs)))

2083

**kwargs)))

2543

2084

2544

2085

if command == 'getattr':

2545

2086

attrname = request[1]

2546

if isinstance(client_object.__getattribute__(attrname),

2547

collections.Callable):

2548

parent_pipe.send(('function', ))

2087

if callable(client_object.__getattribute__(attrname)):

2088

parent_pipe.send(('function',))

2549

2089

else:

2550

parent_pipe.send((

2551

'data', client_object.__getattribute__(attrname)))

2090

parent_pipe.send(('data', client_object

2091

.__getattribute__(attrname)))

2552

2092

2553

2093

if command == 'setattr':

2554

2094

attrname = request[1]

2585

2125

# avoid excessive use of external libraries.

2586

2126

2587

2127

# New type for defining tokens, syntax, and semantics all-in-one

2588

Token = collections.namedtuple("Token", (

2589

"regexp", # To match token; if "value" is not None, must have

2590

# a "group" containing digits

2591

"value", # datetime.timedelta or None

2592

"followers")) # Tokens valid after this token

2128

Token = collections.namedtuple("Token",

2129

("regexp", # To match token; if

2130

# "value" is not None,

2131

# must have a "group"

2132

# containing digits

2133

"value", # datetime.timedelta or

2134

# None

2135

"followers")) # Tokens valid after

2136

# this token

2593

2137

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2594

2138

# the "duration" ABNF definition in RFC 3339, Appendix A.

2595

2139

token_end = Token(re.compile(r"$"), None, frozenset())

2596

2140

token_second = Token(re.compile(r"(\d+)S"),

2597

2141

datetime.timedelta(seconds=1),

2598

frozenset((token_end, )))

2142

frozenset((token_end,)))

2599

2143

token_minute = Token(re.compile(r"(\d+)M"),

2600

2144

datetime.timedelta(minutes=1),

2601

2145

frozenset((token_second, token_end)))

2617

2161

frozenset((token_month, token_end)))

2618

2162

token_week = Token(re.compile(r"(\d+)W"),

2619

2163

datetime.timedelta(weeks=1),

2620

frozenset((token_end, )))

2164

frozenset((token_end,)))

2621

2165

token_duration = Token(re.compile(r"P"), None,

2622

2166

frozenset((token_year, token_month,

2623

2167

token_day, token_time,

2625

2169

# Define starting values

2626

2170

value = datetime.timedelta() # Value so far

2627

2171

found_token = None

2628

followers = frozenset((token_duration, )) # Following valid tokens

2172

followers = frozenset((token_duration,)) # Following valid tokens

2629

2173

s = duration # String left to parse

2630

2174

# Loop until end token is found

2631

2175

while found_token is not token_end:

2648

2192

break

2649

2193

else:

2650

2194

# No currently valid tokens were found

2651

raise ValueError("Invalid RFC 3339 duration: {!r}"

2652

.format(duration))

2195

raise ValueError("Invalid RFC 3339 duration")

2653

2196

# End token found

2654

2197

return value

2655

2198

2692

2235

elif suffix == "w":

2693

2236

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2694

2237

else:

2695

raise ValueError("Unknown suffix {!r}".format(suffix))

2238

raise ValueError("Unknown suffix {!r}"

2239

.format(suffix))

2696

2240

except IndexError as e:

2697

2241

raise ValueError(*(e.args))

2698

2242

timevalue += delta

2714

2258

# Close all standard open file descriptors

2715

2259

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2716

2260

if not stat.S_ISCHR(os.fstat(null).st_mode):

2717

raise OSError(errno.ENODEV,

2718

"{} not a character device"

2261

raise OSError(errno.ENODEV, "{} not a character device"

2719

2262

.format(os.devnull))

2720

2263

os.dup2(null, sys.stdin.fileno())

2721

2264

os.dup2(null, sys.stdout.fileno())

2787

2330

"port": "",

2788

2331

"debug": "False",

2789

2332

"priority":

2790

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2791

":+SIGN-DSA-SHA256",

2333

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2792

2334

"servicename": "Mandos",

2793

2335

"use_dbus": "True",

2794

2336

"use_ipv6": "True",

2798

2340

"statedir": "/var/lib/mandos",

2799

2341

"foreground": "False",

2800

2342

"zeroconf": "True",

2801

}

2343

}

2802

2344

2803

2345

# Parse config file for server-global settings

2804

2346

server_config = configparser.SafeConfigParser(server_defaults)

2805

2347

del server_defaults

2806

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2348

server_config.read(os.path.join(options.configdir,

2349

"mandos.conf"))

2807

2350

# Convert the SafeConfigParser object to a dict

2808

2351

server_settings = server_config.defaults()

2809

2352

# Use the appropriate methods on the non-string config options

2827

2370

# Override the settings from the config file with command line

2828

2371

# options, if set.

2829

2372

for option in ("interface", "address", "port", "debug",

2830

"priority", "servicename", "configdir", "use_dbus",

2831

"use_ipv6", "debuglevel", "restore", "statedir",

2832

"socket", "foreground", "zeroconf"):

2373

"priority", "servicename", "configdir",

2374

"use_dbus", "use_ipv6", "debuglevel", "restore",

2375

"statedir", "socket", "foreground", "zeroconf"):

2833

2376

value = getattr(options, option)

2834

2377

if value is not None:

2835

2378

server_settings[option] = value

2850

2393

2851

2394

##################################################################

2852

2395

2853

if (not server_settings["zeroconf"]

2854

and not (server_settings["port"]

2855

or server_settings["socket"] != "")):

2856

parser.error("Needs port or socket to work without Zeroconf")

2396

if (not server_settings["zeroconf"] and

2397

not (server_settings["port"]

2398

or server_settings["socket"] != "")):

2399

parser.error("Needs port or socket to work without"

2400

" Zeroconf")

2857

2401

2858

2402

# For convenience

2859

2403

debug = server_settings["debug"]

2875

2419

initlogger(debug, level)

2876

2420

2877

2421

if server_settings["servicename"] != "Mandos":

2878

syslogger.setFormatter(

2879

logging.Formatter('Mandos ({}) [%(process)d]:'

2880

' %(levelname)s: %(message)s'.format(

2881

server_settings["servicename"])))

2422

syslogger.setFormatter(logging.Formatter

2423

('Mandos ({}) [%(process)d]:'

2424

' %(levelname)s: %(message)s'

2425

.format(server_settings

2426

["servicename"])))

2882

2427

2883

2428

# Parse config file with clients

2884

2429

client_config = configparser.SafeConfigParser(Client

2892

2437

socketfd = None

2893

2438

if server_settings["socket"] != "":

2894

2439

socketfd = server_settings["socket"]

2895

tcp_server = MandosServer(

2896

(server_settings["address"], server_settings["port"]),

2897

ClientHandler,

2898

interface=(server_settings["interface"] or None),

2899

use_ipv6=use_ipv6,

2900

gnutls_priority=server_settings["priority"],

2901

use_dbus=use_dbus,

2902

socketfd=socketfd)

2440

tcp_server = MandosServer((server_settings["address"],

2441

server_settings["port"]),

2442

ClientHandler,

2443

interface=(server_settings["interface"]

2444

or None),

2445

use_ipv6=use_ipv6,

2446

gnutls_priority=

2447

server_settings["priority"],

2448

use_dbus=use_dbus,

2449

socketfd=socketfd)

2903

2450

if not foreground:

2904

2451

pidfilename = "/run/mandos.pid"

2905

2452

if not os.path.isdir("/run/."):

2906

2453

pidfilename = "/var/run/mandos.pid"

2907

2454

pidfile = None

2908

2455

try:

2909

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2456

pidfile = open(pidfilename, "w")

2910

2457

except IOError as e:

2911

2458

logger.error("Could not open file %r", pidfilename,

2912

2459

exc_info=e)

2933

2480

2934

2481

# "Use a log level over 10 to enable all debugging options."

2935

2482

# - GnuTLS manual

2936

gnutls.global_set_log_level(11)

2483

gnutls.library.functions.gnutls_global_set_log_level(11)

2937

2484

2938

@gnutls.log_func

2485

@gnutls.library.types.gnutls_log_func

2939

2486

def debug_gnutls(level, string):

2940

2487

logger.debug("GnuTLS: %s", string[:-1])

2941

2488

2942

gnutls.global_set_log_function(debug_gnutls)

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2943

2491

2944

2492

# Redirect stdin so all checkers get /dev/null

2945

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2965

2513

if use_dbus:

2966

2514

try:

2967

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

2968

bus,

2969

do_not_queue=True)

2970

old_bus_name = dbus.service.BusName(

2971

"se.bsnet.fukt.Mandos", bus,

2972

do_not_queue=True)

2973

except dbus.exceptions.DBusException as e:

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

2974

2521

logger.error("Disabling D-Bus:", exc_info=e)

2975

2522

use_dbus = False

2976

2523

server_settings["use_dbus"] = False

2977

2524

tcp_server.use_dbus = False

2978

2525

if zeroconf:

2979

2526

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2980

service = AvahiServiceToSyslog(

2981

name = server_settings["servicename"],

2982

servicetype = "_mandos._tcp",

2983

protocol = protocol,

2984

bus = bus)

2527

service = AvahiServiceToSyslog(name =

2528

server_settings["servicename"],

2529

servicetype = "_mandos._tcp",

2530

protocol = protocol, bus = bus)

2985

2531

if server_settings["interface"]:

2986

service.interface = if_nametoindex(

2987

server_settings["interface"].encode("utf-8"))

2532

service.interface = (if_nametoindex

2533

(server_settings["interface"]

2534

.encode("utf-8")))

2988

2535

2989

2536

global multiprocessing_manager

2990

2537

multiprocessing_manager = multiprocessing.Manager()

3009

2556

if server_settings["restore"]:

3010

2557

try:

3011

2558

with open(stored_state_path, "rb") as stored_state:

3012

clients_data, old_client_settings = pickle.load(

3013

stored_state)

2559

clients_data, old_client_settings = (pickle.load

2560

(stored_state))

3014

2561

os.remove(stored_state_path)

3015

2562

except IOError as e:

3016

2563

if e.errno == errno.ENOENT:

3017

logger.warning("Could not load persistent state:"

3018

" {}".format(os.strerror(e.errno)))

2564

logger.warning("Could not load persistent state: {}"

2565

.format(os.strerror(e.errno)))

3019

2566

else:

3020

2567

logger.critical("Could not load persistent state:",

3021

2568

exc_info=e)

3022

2569

raise

3023

2570

except EOFError as e:

3024

2571

logger.warning("Could not load persistent state: "

3025

"EOFError:",

3026

exc_info=e)

2572

"EOFError:", exc_info=e)

3027

2573

3028

2574

with PGPEngine() as pgp:

3029

2575

for client_name, client in clients_data.items():

3041

2587

# For each value in new config, check if it

3042

2588

# differs from the old config value (Except for

3043

2589

# the "secret" attribute)

3044

if (name != "secret"

3045

and (value !=

3046

old_client_settings[client_name][name])):

2590

if (name != "secret" and

2591

value != old_client_settings[client_name]

2592

[name]):

3047

2593

client[name] = value

3048

2594

except KeyError:

3049

2595

pass

3050

2596

3051

2597

# Clients who has passed its expire date can still be

3052

# enabled if its last checker was successful. A Client

2598

# enabled if its last checker was successful. Clients

3053

2599

# whose checker succeeded before we stored its state is

3054

2600

# assumed to have successfully run all checkers during

3055

2601

# downtime.

3058

2604

if not client["last_checked_ok"]:

3059

2605

logger.warning(

3060

2606

"disabling client {} - Client never "

3061

"performed a successful checker".format(

3062

client_name))

2607

"performed a successful checker"

2608

.format(client_name))

3063

2609

client["enabled"] = False

3064

2610

elif client["last_checker_status"] != 0:

3065

2611

logger.warning(

3066

2612

"disabling client {} - Client last"

3067

" checker failed with error code"

3068

" {}".format(

3069

client_name,

3070

client["last_checker_status"]))

2613

" checker failed with error code {}"

2614

.format(client_name,

2615

client["last_checker_status"]))

3071

2616

client["enabled"] = False

3072

2617

else:

3073

client["expires"] = (

3074

datetime.datetime.utcnow()

3075

+ client["timeout"])

2618

client["expires"] = (datetime.datetime

2619

.utcnow()

2620

+ client["timeout"])

3076

2621

logger.debug("Last checker succeeded,"

3077

" keeping {} enabled".format(

3078

client_name))

2622

" keeping {} enabled"

2623

.format(client_name))

3079

2624

try:

3080

client["secret"] = pgp.decrypt(

3081

client["encrypted_secret"],

3082

client_settings[client_name]["secret"])

2625

client["secret"] = (

2626

pgp.decrypt(client["encrypted_secret"],

2627

client_settings[client_name]

2628

["secret"]))

3083

2629

except PGPError:

3084

2630

# If decryption fails, we use secret from new settings

3085

logger.debug("Failed to decrypt {} old secret".format(

3086

client_name))

3087

client["secret"] = (client_settings[client_name]

3088

["secret"])

2631

logger.debug("Failed to decrypt {} old secret"

2632

.format(client_name))

2633

client["secret"] = (

2634

client_settings[client_name]["secret"])

3089

2635

3090

2636

# Add/remove clients based on new changes made to config

3091

2637

for client_name in (set(old_client_settings)

3098

2644

# Create all client objects

3099

2645

for client_name, client in clients_data.items():

3100

2646

tcp_server.clients[client_name] = client_class(

3101

name = client_name,

3102

settings = client,

2647

name = client_name, settings = client,

3103

2648

server_settings = server_settings)

3104

2649

3105

2650

if not tcp_server.clients:

3107

2652

3108

2653

if not foreground:

3109

2654

if pidfile is not None:

3110

pid = os.getpid()

3111

2655

try:

3112

2656

with pidfile:

3113

print(pid, file=pidfile)

2657

pid = os.getpid()

2658

pidfile.write("{}\n".format(pid).encode("utf-8"))

3114

2659

except IOError:

3115

2660

logger.error("Could not write to file %r with PID %d",

3116

2661

pidfilename, pid)

3121

2666

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3122

2667

3123

2668

if use_dbus:

3124

3125

@alternate_dbus_interfaces(

3126

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3127

class MandosDBusService(DBusObjectWithObjectManager):

2669

@alternate_dbus_interfaces({"se.recompile.Mandos":

2670

"se.bsnet.fukt.Mandos"})

2671

class MandosDBusService(DBusObjectWithProperties):

3128

2672

"""A D-Bus proxy object"""

3129

3130

2673

def __init__(self):

3131

2674

dbus.service.Object.__init__(self, bus, "/")

3132

3133

2675

_interface = "se.recompile.Mandos"

3134

2676

2677

@dbus_interface_annotations(_interface)

2678

def _foo(self):

2679

return { "org.freedesktop.DBus.Property"

2680

".EmitsChangedSignal":

2681

"false"}

2682

3135

2683

@dbus.service.signal(_interface, signature="o")

3136

2684

def ClientAdded(self, objpath):

3137

2685

"D-Bus signal"

3142

2690

"D-Bus signal"

3143

2691

pass

3144

2692

3145

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3146

"true"})

3147

2693

@dbus.service.signal(_interface, signature="os")

3148

2694

def ClientRemoved(self, objpath, name):

3149

2695

"D-Bus signal"

3150

2696

pass

3151

2697

3152

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3153

"true"})

3154

2698

@dbus.service.method(_interface, out_signature="ao")

3155

2699

def GetAllClients(self):

3156

2700

"D-Bus method"

3157

return dbus.Array(c.dbus_object_path for c in

2701

return dbus.Array(c.dbus_object_path

2702

for c in

3158

2703

tcp_server.clients.itervalues())

3159

2704

3160

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3161

"true"})

3162

2705

@dbus.service.method(_interface,

3163

2706

out_signature="a{oa{sv}}")

3164

2707

def GetAllClientsWithProperties(self):

3165

2708

"D-Bus method"

3166

2709

return dbus.Dictionary(

3167

{ c.dbus_object_path: c.GetAll(

3168

"se.recompile.Mandos.Client")

3169

for c in tcp_server.clients.itervalues() },

2710

((c.dbus_object_path, c.GetAll(""))

2711

for c in tcp_server.clients.itervalues()),

3170

2712

signature="oa{sv}")

3171

2713

3172

2714

@dbus.service.method(_interface, in_signature="o")

3176

2718

if c.dbus_object_path == object_path:

3177

2719

del tcp_server.clients[c.name]

3178

2720

c.remove_from_connection()

3179

# Don't signal the disabling

2721

# Don't signal anything except ClientRemoved

3180

2722

c.disable(quiet=True)

3181

# Emit D-Bus signal for removal

3182

self.client_removed_signal(c)

2723

# Emit D-Bus signal

2724

self.ClientRemoved(object_path, c.name)

3183

2725

return

3184

2726

raise KeyError(object_path)

3185

2727

3186

2728

del _interface

3187

3188

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3189

out_signature = "a{oa{sa{sv}}}")

3190

def GetManagedObjects(self):

3191

"""D-Bus method"""

3192

return dbus.Dictionary(

3193

{ client.dbus_object_path:

3194

dbus.Dictionary(

3195

{ interface: client.GetAll(interface)

3196

for interface in

3197

client._get_all_interface_names()})

3198

for client in tcp_server.clients.values()})

3199

3200

def client_added_signal(self, client):

3201

"""Send the new standard signal and the old signal"""

3202

if use_dbus:

3203

# New standard signal

3204

self.InterfacesAdded(

3205

client.dbus_object_path,

3206

dbus.Dictionary(

3207

{ interface: client.GetAll(interface)

3208

for interface in

3209

client._get_all_interface_names()}))

3210

# Old signal

3211

self.ClientAdded(client.dbus_object_path)

3212

3213

def client_removed_signal(self, client):

3214

"""Send the new standard signal and the old signal"""

3215

if use_dbus:

3216

# New standard signal

3217

self.InterfacesRemoved(

3218

client.dbus_object_path,

3219

client._get_all_interface_names())

3220

# Old signal

3221

self.ClientRemoved(client.dbus_object_path,

3222

client.name)

3223

2729

3224

2730

mandos_dbus_service = MandosDBusService()

3225

2731

3248

2754

# + secret.

3249

2755

exclude = { "bus", "changedstate", "secret",

3250

2756

"checker", "server_settings" }

3251

for name, typ in inspect.getmembers(dbus.service

3252

.Object):

2757

for name, typ in (inspect.getmembers

2758

(dbus.service.Object)):

3253

2759

exclude.add(name)

3254

2760

3255

2761

client_dict["encrypted_secret"] = (client

3262

2768

del client_settings[client.name]["secret"]

3263

2769

3264

2770

try:

3265

with tempfile.NamedTemporaryFile(

3266

mode='wb',

3267

suffix=".pickle",

3268

prefix='clients-',

3269

dir=os.path.dirname(stored_state_path),

3270

delete=False) as stored_state:

2771

with (tempfile.NamedTemporaryFile

2772

(mode='wb', suffix=".pickle", prefix='clients-',

2773

dir=os.path.dirname(stored_state_path),

2774

delete=False)) as stored_state:

3271

2775

pickle.dump((clients, client_settings), stored_state)

3272

tempname = stored_state.name

2776

tempname=stored_state.name

3273

2777

os.rename(tempname, stored_state_path)

3274

2778

except (IOError, OSError) as e:

3275

2779

if not debug:

3290

2794

name, client = tcp_server.clients.popitem()

3291

2795

if use_dbus:

3292

2796

client.remove_from_connection()

3293

# Don't signal the disabling

2797

# Don't signal anything except ClientRemoved

3294

2798

client.disable(quiet=True)

3295

# Emit D-Bus signal for removal

3296

2799

if use_dbus:

3297

mandos_dbus_service.client_removed_signal(client)

2800

# Emit D-Bus signal

2801

mandos_dbus_service.ClientRemoved(client

2802

.dbus_object_path,

2803

client.name)

3298

2804

client_settings.clear()

3299

2805

3300

2806

atexit.register(cleanup)

3301

2807

3302

2808

for client in tcp_server.clients.itervalues():

3303

2809

if use_dbus:

3304

# Emit D-Bus signal for adding

3305

mandos_dbus_service.client_added_signal(client)

2810

# Emit D-Bus signal

2811

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3306

2812

# Need to initiate checking of clients

3307

2813

if client.enabled:

3308

2814

client.init_checker()

3353

2859

# Must run before the D-Bus bus name gets deregistered

3354

2860

cleanup()

3355

2861

3356

3357

2862

if __name__ == '__main__':

3358

2863

main()