/mandos/trunk : revision 729

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

46

43

import errno

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

65

import cPickle as pickle

69

66

import multiprocessing

70

67

import types

71

68

import binascii

72

69

import tempfile

73

70

import itertools

74

71

import collections

75

import codecs

76

72

77

73

import dbus

78

74

import dbus.service

79

try:

80

from gi.repository import GObject

81

except ImportError:

82

import gobject as GObject

75

import gobject

83

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

95

88

except ImportError:

96

89

SO_BINDTODEVICE = None

97

90

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.3"

91

version = "1.6.8"

102

92

stored_state_file = "clients.pickle"

103

93

104

94

logger = logging.getLogger()

105

95

syslogger = None

106

96

107

97

try:

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

110

101

except (OSError, AttributeError):

111

112

102

def if_nametoindex(interface):

113

103

"Get an interface index the hard way, i.e. using fcntl()"

114

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

123

113

"""init logger and add loglevel"""

124

114

125

115

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

116

syslogger = (logging.handlers.SysLogHandler

117

(facility =

118

logging.handlers.SysLogHandler.LOG_DAEMON,

119

address = "/dev/log"))

129

120

syslogger.setFormatter(logging.Formatter

130

121

('Mandos [%(process)d]: %(levelname)s:'

131

122

' %(message)s'))

148

139

149

140

class PGPEngine(object):

150

141

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

152

142

def __init__(self):

153

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

self.gpg = "gpg"

155

try:

156

output = subprocess.check_output(["gpgconf"])

157

for line in output.splitlines():

158

name, text, path = line.split(":")

159

if name == "gpg":

160

self.gpg = path

161

break

162

except OSError as e:

163

if e.errno != errno.ENOENT:

164

raise

165

144

self.gnupgargs = ['--batch',

166

'--homedir', self.tempdir,

145

'--home', self.tempdir,

167

146

'--force-mdc',

168

147

'--quiet',

169

148

'--no-use-agent']

204

183

205

184

def encrypt(self, data, password):

206

185

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(

208

dir=self.tempdir) as passfile:

186

with tempfile.NamedTemporaryFile(dir=self.tempdir

187

) as passfile:

209

188

passfile.write(passphrase)

210

189

passfile.flush()

211

proc = subprocess.Popen([self.gpg, '--symmetric',

190

proc = subprocess.Popen(['gpg', '--symmetric',

212

191

'--passphrase-file',

213

192

passfile.name]

214

193

+ self.gnupgargs,

222

201

223

202

def decrypt(self, data, password):

224

203

passphrase = self.password_encode(password)

225

with tempfile.NamedTemporaryFile(

226

dir = self.tempdir) as passfile:

204

with tempfile.NamedTemporaryFile(dir = self.tempdir

205

) as passfile:

227

206

passfile.write(passphrase)

228

207

passfile.flush()

229

proc = subprocess.Popen([self.gpg, '--decrypt',

208

proc = subprocess.Popen(['gpg', '--decrypt',

230

209

'--passphrase-file',

231

210

passfile.name]

232

211

+ self.gnupgargs,

233

212

stdin = subprocess.PIPE,

234

213

stdout = subprocess.PIPE,

235

214

stderr = subprocess.PIPE)

236

decrypted_plaintext, err = proc.communicate(input = data)

215

decrypted_plaintext, err = proc.communicate(input

216

= data)

237

217

if proc.returncode != 0:

238

218

raise PGPError(err)

239

219

return decrypted_plaintext

245

225

return super(AvahiError, self).__init__(value, *args,

246

226

**kwargs)

247

227

248

249

228

class AvahiServiceError(AvahiError):

250

229

pass

251

230

252

253

231

class AvahiGroupError(AvahiError):

254

232

pass

255

233

275

253

bus: dbus.SystemBus()

276

254

"""

277

255

278

def __init__(self,

279

interface = avahi.IF_UNSPEC,

280

name = None,

281

servicetype = None,

282

port = None,

283

TXT = None,

284

domain = "",

285

host = "",

286

max_renames = 32768,

287

protocol = avahi.PROTO_UNSPEC,

288

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

289

260

self.interface = interface

290

261

self.name = name

291

262

self.type = servicetype

301

272

self.bus = bus

302

273

self.entry_group_state_changed_match = None

303

274

304

def rename(self, remove=True):

275

def rename(self):

305

276

"""Derived from the Avahi example code"""

306

277

if self.rename_count >= self.max_renames:

307

278

logger.critical("No suitable Zeroconf service name found"

308

279

" after %i retries, exiting.",

309

280

self.rename_count)

310

281

raise AvahiServiceError("Too many renames")

311

self.name = str(

312

self.server.GetAlternativeServiceName(self.name))

313

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

314

284

logger.info("Changing Zeroconf service name to %r ...",

315

285

self.name)

316

if remove:

317

self.remove()

286

self.remove()

318

287

try:

319

288

self.add()

320

289

except dbus.exceptions.DBusException as error:

321

if (error.get_dbus_name()

322

== "org.freedesktop.Avahi.CollisionError"):

323

logger.info("Local Zeroconf service name collision.")

324

return self.rename(remove=False)

325

else:

326

logger.critical("D-Bus Exception", exc_info=error)

327

self.cleanup()

328

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

329

294

330

295

def remove(self):

331

296

"""Derived from the Avahi example code"""

369

334

self.rename()

370

335

elif state == avahi.ENTRY_GROUP_FAILURE:

371

336

logger.critical("Avahi: Error in group state changed %s",

372

str(error))

373

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {!s}"

339

.format(error))

374

340

375

341

def cleanup(self):

376

342

"""Derived from the Avahi example code"""

386

352

def server_state_changed(self, state, error=None):

387

353

"""Derived from the Avahi example code"""

388

354

logger.debug("Avahi server state change: %i", state)

389

bad_states = {

390

avahi.SERVER_INVALID: "Zeroconf server invalid",

391

avahi.SERVER_REGISTERING: None,

392

avahi.SERVER_COLLISION: "Zeroconf server name collision",

393

avahi.SERVER_FAILURE: "Zeroconf server failure",

394

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

395

362

if state in bad_states:

396

363

if bad_states[state] is not None:

397

364

if error is None:

400

367

logger.error(bad_states[state] + ": %r", error)

401

368

self.cleanup()

402

369

elif state == avahi.SERVER_RUNNING:

403

try:

404

self.add()

405

except dbus.exceptions.DBusException as error:

406

if (error.get_dbus_name()

407

== "org.freedesktop.Avahi.CollisionError"):

408

logger.info("Local Zeroconf service name"

409

" collision.")

410

return self.rename(remove=False)

411

else:

412

logger.critical("D-Bus Exception", exc_info=error)

413

self.cleanup()

414

os._exit(1)

370

self.add()

415

371

else:

416

372

if error is None:

417

373

logger.debug("Unknown state: %r", state)

427

383

follow_name_owner_changes=True),

428

384

avahi.DBUS_INTERFACE_SERVER)

429

385

self.server.connect_to_signal("StateChanged",

430

self.server_state_changed)

386

self.server_state_changed)

431

387

self.server_state_changed(self.server.GetState())

432

388

433

389

434

390

class AvahiServiceToSyslog(AvahiService):

435

def rename(self, *args, **kwargs):

391

def rename(self):

436

392

"""Add the new name to the syslog messages"""

437

ret = AvahiService.rename(self, *args, **kwargs)

438

syslogger.setFormatter(logging.Formatter(

439

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

440

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

441

398

return ret

442

399

443

# Pretend that we have a GnuTLS module

444

class GnuTLS(object):

445

"""This isn't so much a class as it is a module-like namespace.

446

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

451

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

459

# Unless otherwise indicated, the constants and types below are

460

# all from the gnutls/gnutls.h C header file.

461

462

# Constants

463

E_SUCCESS = 0

464

E_INTERRUPTED = -52

465

E_AGAIN = -28

466

CRT_OPENPGP = 2

467

CLIENT = 2

468

SHUT_RDWR = 0

469

CRD_CERTIFICATE = 1

470

E_NO_CERTIFICATE_FOUND = -49

471

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

473

# Types

474

class session_int(ctypes.Structure):

475

_fields_ = []

476

session_t = ctypes.POINTER(session_int)

477

class certificate_credentials_st(ctypes.Structure):

478

_fields_ = []

479

certificate_credentials_t = ctypes.POINTER(

480

certificate_credentials_st)

481

certificate_type_t = ctypes.c_int

482

class datum_t(ctypes.Structure):

483

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

('size', ctypes.c_uint)]

485

class openpgp_crt_int(ctypes.Structure):

486

_fields_ = []

487

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int #

491

transport_ptr_t = ctypes.c_void_p

492

close_request_t = ctypes.c_int

493

494

# Exceptions

495

class Error(Exception):

496

# We need to use the class name "GnuTLS" here, since this

497

# exception might be raised from within GnuTLS.__init__,

498

# which is called before the assignment to the "gnutls"

499

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

501

# Default usage is by a message string, but if a return

502

# code is passed, convert it to a string with

503

# gnutls.strerror()

504

self.code = code

505

if message is None and code is not None:

506

message = GnuTLS.strerror(code)

507

return super(GnuTLS.Error, self).__init__(

508

message, *args)

509

510

class CertificateSecurityError(Error):

511

pass

512

513

# Classes

514

class Credentials(object):

515

def __init__(self):

516

self._c_object = gnutls.certificate_credentials_t()

517

gnutls.certificate_allocate_credentials(

518

ctypes.byref(self._c_object))

519

self.type = gnutls.CRD_CERTIFICATE

520

521

def __del__(self):

522

gnutls.certificate_free_credentials(self._c_object)

523

524

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

526

self._c_object = gnutls.session_t()

527

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

gnutls.set_default_priority(self._c_object)

529

gnutls.transport_set_ptr(self._c_object, socket.fileno())

530

gnutls.handshake_set_private_extensions(self._c_object,

531

True)

532

self.socket = socket

533

if credentials is None:

534

credentials = gnutls.Credentials()

535

gnutls.credentials_set(self._c_object, credentials.type,

536

ctypes.cast(credentials._c_object,

537

ctypes.c_void_p))

538

self.credentials = credentials

539

540

def __del__(self):

541

gnutls.deinit(self._c_object)

542

543

def handshake(self):

544

return gnutls.handshake(self._c_object)

545

546

def send(self, data):

547

data = bytes(data)

548

data_len = len(data)

549

while data_len > 0:

550

data_len -= gnutls.record_send(self._c_object,

551

data[-data_len:],

552

data_len)

553

554

def bye(self):

555

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

557

# Error handling functions

558

def _error_code(result):

559

"""A function to raise exceptions on errors, suitable

560

for the 'restype' attribute on ctypes functions"""

561

if result >= 0:

562

return result

563

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

567

def _retry_on_error(result, func, arguments):

568

"""A function to retry on some errors, suitable

569

for the 'errcheck' attribute on ctypes functions"""

570

while result < 0:

571

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

572

return _error_code(result)

573

result = func(*arguments)

574

return result

575

576

# Unless otherwise indicated, the function declarations below are

577

# all from the gnutls/gnutls.h C header file.

578

579

# Functions

580

priority_set_direct = _library.gnutls_priority_set_direct

581

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

ctypes.POINTER(ctypes.c_char_p)]

583

priority_set_direct.restype = _error_code

584

585

init = _library.gnutls_init

586

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

init.restype = _error_code

588

589

set_default_priority = _library.gnutls_set_default_priority

590

set_default_priority.argtypes = [session_t]

591

set_default_priority.restype = _error_code

592

593

record_send = _library.gnutls_record_send

594

record_send.argtypes = [session_t, ctypes.c_void_p,

595

ctypes.c_size_t]

596

record_send.restype = ctypes.c_ssize_t

597

record_send.errcheck = _retry_on_error

598

599

certificate_allocate_credentials = (

600

_library.gnutls_certificate_allocate_credentials)

601

certificate_allocate_credentials.argtypes = [

602

ctypes.POINTER(certificate_credentials_t)]

603

certificate_allocate_credentials.restype = _error_code

604

605

certificate_free_credentials = (

606

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

608

certificate_free_credentials.restype = None

609

610

handshake_set_private_extensions = (

611

_library.gnutls_handshake_set_private_extensions)

612

handshake_set_private_extensions.argtypes = [session_t,

613

ctypes.c_int]

614

handshake_set_private_extensions.restype = None

615

616

credentials_set = _library.gnutls_credentials_set

617

credentials_set.argtypes = [session_t, credentials_type_t,

618

ctypes.c_void_p]

619

credentials_set.restype = _error_code

620

621

strerror = _library.gnutls_strerror

622

strerror.argtypes = [ctypes.c_int]

623

strerror.restype = ctypes.c_char_p

624

625

certificate_type_get = _library.gnutls_certificate_type_get

626

certificate_type_get.argtypes = [session_t]

627

certificate_type_get.restype = _error_code

628

629

certificate_get_peers = _library.gnutls_certificate_get_peers

630

certificate_get_peers.argtypes = [session_t,

631

ctypes.POINTER(ctypes.c_uint)]

632

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

634

global_set_log_level = _library.gnutls_global_set_log_level

635

global_set_log_level.argtypes = [ctypes.c_int]

636

global_set_log_level.restype = None

637

638

global_set_log_function = _library.gnutls_global_set_log_function

639

global_set_log_function.argtypes = [log_func]

640

global_set_log_function.restype = None

641

642

deinit = _library.gnutls_deinit

643

deinit.argtypes = [session_t]

644

deinit.restype = None

645

646

handshake = _library.gnutls_handshake

647

handshake.argtypes = [session_t]

648

handshake.restype = _error_code

649

handshake.errcheck = _retry_on_error

650

651

transport_set_ptr = _library.gnutls_transport_set_ptr

652

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

transport_set_ptr.restype = None

654

655

bye = _library.gnutls_bye

656

bye.argtypes = [session_t, close_request_t]

657

bye.restype = _error_code

658

bye.errcheck = _retry_on_error

659

660

check_version = _library.gnutls_check_version

661

check_version.argtypes = [ctypes.c_char_p]

662

check_version.restype = ctypes.c_char_p

663

664

# All the function declarations below are from gnutls/openpgp.h

665

666

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

openpgp_crt_init.restype = _error_code

669

670

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

ctypes.POINTER(datum_t),

673

openpgp_crt_fmt_t]

674

openpgp_crt_import.restype = _error_code

675

676

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

ctypes.POINTER(ctypes.c_uint)]

679

openpgp_crt_verify_self.restype = _error_code

680

681

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

openpgp_crt_deinit.restype = None

684

685

openpgp_crt_get_fingerprint = (

686

_library.gnutls_openpgp_crt_get_fingerprint)

687

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

688

ctypes.c_void_p,

689

ctypes.POINTER(

690

ctypes.c_size_t)]

691

openpgp_crt_get_fingerprint.restype = _error_code

692

693

# Remove non-public functions

694

del _error_code, _retry_on_error

695

# Create the global "gnutls" object, simulating a module

696

gnutls = GnuTLS()

697

698

def call_pipe(connection, # : multiprocessing.Connection

699

func, *args, **kwargs):

700

"""This function is meant to be called by multiprocessing.Process

701

702

This function runs func(*args, **kwargs), and writes the resulting

703

return value on the provided multiprocessing.Connection.

704

"""

705

connection.send(func(*args, **kwargs))

706

connection.close()

707

400

708

401

class Client(object):

709

402

"""A representation of a client host served by this server.

715

408

checker: subprocess.Popen(); a running checker process used

716

409

to see if the client lives.

717

410

'None' if no process is running.

718

checker_callback_tag: a GObject event source tag, or None

411

checker_callback_tag: a gobject event source tag, or None

719

412

checker_command: string; External command which is run to check

720

413

if client lives. %() expansions are done at

721

414

runtime with vars(self) as dict, so that for

722

415

instance %(name)s can be used in the command.

723

checker_initiator_tag: a GObject event source tag, or None

416

checker_initiator_tag: a gobject event source tag, or None

724

417

created: datetime.datetime(); (UTC) object creation

725

418

client_structure: Object describing what attributes a client has

726

419

and is used for storing the client at exit

727

420

current_checker_command: string; current running checker_command

728

disable_initiator_tag: a GObject event source tag, or None

421

disable_initiator_tag: a gobject event source tag, or None

729

422

enabled: bool()

730

423

fingerprint: string (40 or 32 hexadecimal digits); used to

731

424

uniquely identify the client

736

429

last_checker_status: integer between 0 and 255 reflecting exit

737

430

status of last checker. -1 reflects crashed

738

431

checker, -2 means no checker completed yet.

739

last_checker_signal: The signal which killed the last checker, if

740

last_checker_status is -1

741

432

last_enabled: datetime.datetime(); (UTC) or None

742

433

name: string; from the config file, used in log messages and

743

434

D-Bus identifiers

756

447

"fingerprint", "host", "interval",

757

448

"last_approval_request", "last_checked_ok",

758

449

"last_enabled", "name", "timeout")

759

client_defaults = {

760

"timeout": "PT5M",

761

"extended_timeout": "PT15M",

762

"interval": "PT2M",

763

"checker": "fping -q -- %%(host)s",

764

"host": "",

765

"approval_delay": "PT0S",

766

"approval_duration": "PT1S",

767

"approved_by_default": "True",

768

"enabled": "True",

769

}

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

770

460

771

461

@staticmethod

772

462

def config_parser(config):

788

478

client["enabled"] = config.getboolean(client_name,

789

479

"enabled")

790

480

791

# Uppercase and remove spaces from fingerprint for later

792

# comparison purposes with return value from the

793

# fingerprint() function

794

481

client["fingerprint"] = (section["fingerprint"].upper()

795

482

.replace(" ", ""))

796

483

if "secret" in section:

838

525

self.expires = None

839

526

840

527

logger.debug("Creating client %r", self.name)

528

# Uppercase and remove spaces from fingerprint for later

529

# comparison purposes with return value from the fingerprint()

530

# function

841

531

logger.debug(" Fingerprint: %s", self.fingerprint)

842

532

self.created = settings.get("created",

843

533

datetime.datetime.utcnow())

850

540

self.current_checker_command = None

851

541

self.approved = None

852

542

self.approvals_pending = 0

853

self.changedstate = multiprocessing_manager.Condition(

854

multiprocessing_manager.Lock())

855

self.client_structure = [attr

856

for attr in self.__dict__.iterkeys()

543

self.changedstate = (multiprocessing_manager

544

.Condition(multiprocessing_manager

545

.Lock()))

546

self.client_structure = [attr for attr in

547

self.__dict__.iterkeys()

857

548

if not attr.startswith("_")]

858

549

self.client_structure.append("client_structure")

859

550

860

for name, t in inspect.getmembers(

861

type(self), lambda obj: isinstance(obj, property)):

551

for name, t in inspect.getmembers(type(self),

552

lambda obj:

553

isinstance(obj,

554

property)):

862

555

if not name.startswith("_"):

863

556

self.client_structure.append(name)

864

557

885

578

if not quiet:

886

579

logger.info("Disabling client %s", self.name)

887

580

if getattr(self, "disable_initiator_tag", None) is not None:

888

GObject.source_remove(self.disable_initiator_tag)

581

gobject.source_remove(self.disable_initiator_tag)

889

582

self.disable_initiator_tag = None

890

583

self.expires = None

891

584

if getattr(self, "checker_initiator_tag", None) is not None:

892

GObject.source_remove(self.checker_initiator_tag)

585

gobject.source_remove(self.checker_initiator_tag)

893

586

self.checker_initiator_tag = None

894

587

self.stop_checker()

895

588

self.enabled = False

896

589

if not quiet:

897

590

self.send_changedstate()

898

# Do not run this again if called by a GObject.timeout_add

591

# Do not run this again if called by a gobject.timeout_add

899

592

return False

900

593

901

594

def __del__(self):

905

598

# Schedule a new checker to be started an 'interval' from now,

906

599

# and every interval from then on.

907

600

if self.checker_initiator_tag is not None:

908

GObject.source_remove(self.checker_initiator_tag)

909

self.checker_initiator_tag = GObject.timeout_add(

910

int(self.interval.total_seconds() * 1000),

911

self.start_checker)

601

gobject.source_remove(self.checker_initiator_tag)

602

self.checker_initiator_tag = (gobject.timeout_add

603

(int(self.interval

604

.total_seconds() * 1000),

605

self.start_checker))

912

606

# Schedule a disable() when 'timeout' has passed

913

607

if self.disable_initiator_tag is not None:

914

GObject.source_remove(self.disable_initiator_tag)

915

self.disable_initiator_tag = GObject.timeout_add(

916

int(self.timeout.total_seconds() * 1000), self.disable)

608

gobject.source_remove(self.disable_initiator_tag)

609

self.disable_initiator_tag = (gobject.timeout_add

610

(int(self.timeout

611

.total_seconds() * 1000),

612

self.disable))

917

613

# Also start a new checker *right now*.

918

614

self.start_checker()

919

615

920

def checker_callback(self, source, condition, connection,

921

command):

616

def checker_callback(self, pid, condition, command):

922

617

"""The checker has completed, so take appropriate actions."""

923

618

self.checker_callback_tag = None

924

619

self.checker = None

925

# Read return code from connection (see call_pipe)

926

returncode = connection.recv()

927

connection.close()

928

929

if returncode >= 0:

930

self.last_checker_status = returncode

931

self.last_checker_signal = None

620

if os.WIFEXITED(condition):

621

self.last_checker_status = os.WEXITSTATUS(condition)

932

622

if self.last_checker_status == 0:

933

623

logger.info("Checker for %(name)s succeeded",

934

624

vars(self))

935

625

self.checked_ok()

936

626

else:

937

logger.info("Checker for %(name)s failed", vars(self))

627

logger.info("Checker for %(name)s failed",

628

vars(self))

938

629

else:

939

630

self.last_checker_status = -1

940

self.last_checker_signal = -returncode

941

631

logger.warning("Checker for %(name)s crashed?",

942

632

vars(self))

943

return False

944

633

945

634

def checked_ok(self):

946

635

"""Assert that the client has been seen, alive and well."""

947

636

self.last_checked_ok = datetime.datetime.utcnow()

948

637

self.last_checker_status = 0

949

self.last_checker_signal = None

950

638

self.bump_timeout()

951

639

952

640

def bump_timeout(self, timeout=None):

954

642

if timeout is None:

955

643

timeout = self.timeout

956

644

if self.disable_initiator_tag is not None:

957

GObject.source_remove(self.disable_initiator_tag)

645

gobject.source_remove(self.disable_initiator_tag)

958

646

self.disable_initiator_tag = None

959

647

if getattr(self, "enabled", False):

960

self.disable_initiator_tag = GObject.timeout_add(

961

int(timeout.total_seconds() * 1000), self.disable)

648

self.disable_initiator_tag = (gobject.timeout_add

649

(int(timeout.total_seconds()

650

* 1000), self.disable))

962

651

self.expires = datetime.datetime.utcnow() + timeout

963

652

964

653

def need_approval(self):

978

667

# than 'timeout' for the client to be disabled, which is as it

979

668

# should be.

980

669

981

if self.checker is not None and not self.checker.is_alive():

982

logger.warning("Checker was not alive; joining")

983

self.checker.join()

984

self.checker = None

670

# If a checker exists, make sure it is not a zombie

671

try:

672

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

673

except AttributeError:

674

pass

675

except OSError as error:

676

if error.errno != errno.ECHILD:

677

raise

678

else:

679

if pid:

680

logger.warning("Checker was a zombie")

681

gobject.source_remove(self.checker_callback_tag)

682

self.checker_callback(pid, status,

683

self.current_checker_command)

985

684

# Start a new checker if needed

986

685

if self.checker is None:

987

686

# Escape attributes for the shell

988

escaped_attrs = {

989

attr: re.escape(str(getattr(self, attr)))

990

for attr in self.runtime_expansions }

687

escaped_attrs = { attr:

688

re.escape(unicode(getattr(self,

689

attr)))

690

for attr in self.runtime_expansions }

991

691

try:

992

692

command = self.checker_command % escaped_attrs

993

693

except TypeError as error:

994

694

logger.error('Could not format string "%s"',

995

self.checker_command,

695

self.checker_command, exc_info=error)

696

return True # Try again later

697

self.current_checker_command = command

698

try:

699

logger.info("Starting checker %r for %s",

700

command, self.name)

701

# We don't need to redirect stdout and stderr, since

702

# in normal mode, that is already done by daemon(),

703

# and in debug mode we don't want to. (Stdin is

704

# always replaced by /dev/null.)

705

# The exception is when not debugging but nevertheless

706

# running in the foreground; use the previously

707

# created wnull.

708

popen_args = {}

709

if (not self.server_settings["debug"]

710

and self.server_settings["foreground"]):

711

popen_args.update({"stdout": wnull,

712

"stderr": wnull })

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/",

716

**popen_args)

717

except OSError as error:

718

logger.error("Failed to start subprocess",

996

719

exc_info=error)

997

return True # Try again later

998

self.current_checker_command = command

999

logger.info("Starting checker %r for %s", command,

1000

self.name)

1001

# We don't need to redirect stdout and stderr, since

1002

# in normal mode, that is already done by daemon(),

1003

# and in debug mode we don't want to. (Stdin is

1004

# always replaced by /dev/null.)

1005

# The exception is when not debugging but nevertheless

1006

# running in the foreground; use the previously

1007

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1011

if (not self.server_settings["debug"]

1012

and self.server_settings["foreground"]):

1013

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1016

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1020

self.checker.start()

1021

self.checker_callback_tag = GObject.io_add_watch(

1022

pipe[0].fileno(), GObject.IO_IN,

1023

self.checker_callback, pipe[0], command)

1024

# Re-run this periodically if run by GObject.timeout_add

720

return True

721

self.checker_callback_tag = (gobject.child_watch_add

722

(self.checker.pid,

723

self.checker_callback,

724

data=command))

725

# The checker may have completed before the gobject

726

# watch was added. Check for this.

727

try:

728

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

729

except OSError as error:

730

if error.errno == errno.ECHILD:

731

# This should never happen

732

logger.error("Child process vanished",

733

exc_info=error)

734

return True

735

raise

736

if pid:

737

gobject.source_remove(self.checker_callback_tag)

738

self.checker_callback(pid, status, command)

739

# Re-run this periodically if run by gobject.timeout_add

1025

740

return True

1026

741

1027

742

def stop_checker(self):

1028

743

"""Force the checker process, if any, to stop."""

1029

744

if self.checker_callback_tag:

1030

GObject.source_remove(self.checker_callback_tag)

745

gobject.source_remove(self.checker_callback_tag)

1031

746

self.checker_callback_tag = None

1032

747

if getattr(self, "checker", None) is None:

1033

748

return

1034

749

logger.debug("Stopping checker for %(name)s", vars(self))

1035

self.checker.terminate()

750

try:

751

self.checker.terminate()

752

#time.sleep(0.5)

753

#if self.checker.poll() is None:

754

# self.checker.kill()

755

except OSError as error:

756

if error.errno != errno.ESRCH: # No such process

757

raise

1036

758

self.checker = None

1037

759

1038

760

1039

def dbus_service_property(dbus_interface,

1040

signature="v",

1041

access="readwrite",

1042

byte_arrays=False):

761

def dbus_service_property(dbus_interface, signature="v",

762

access="readwrite", byte_arrays=False):

1043

763

"""Decorators for marking methods of a DBusObjectWithProperties to

1044

764

become properties on the D-Bus.

1045

765

1055

775

if byte_arrays and signature != "ay":

1056

776

raise ValueError("Byte arrays not supported for non-'ay'"

1057

777

" signature {!r}".format(signature))

1058

1059

778

def decorator(func):

1060

779

func._dbus_is_property = True

1061

780

func._dbus_interface = dbus_interface

1066

785

func._dbus_name = func._dbus_name[:-14]

1067

786

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1068

787

return func

1069

1070

788

return decorator

1071

789

1072

790

1081

799

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1082

800

"false"}

1083

801

"""

1084

1085

802

def decorator(func):

1086

803

func._dbus_is_interface = True

1087

804

func._dbus_interface = dbus_interface

1088

805

func._dbus_name = dbus_interface

1089

806

return func

1090

1091

807

return decorator

1092

808

1093

809

1095

811

"""Decorator to annotate D-Bus methods, signals or properties

1096

812

Usage:

1097

813

1098

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1099

"org.freedesktop.DBus.Property."

1100

"EmitsChangedSignal": "false"})

1101

814

@dbus_service_property("org.example.Interface", signature="b",

1102

815

access="r")

816

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

817

"org.freedesktop.DBus.Property."

818

"EmitsChangedSignal": "false"})

1103

819

def Property_dbus_property(self):

1104

820

return dbus.Boolean(False)

1105

1106

See also the DBusObjectWithAnnotations class.

1107

821

"""

1108

1109

822

def decorator(func):

1110

823

func._dbus_annotations = annotations

1111

824

return func

1112

1113

825

return decorator

1114

826

1115

827

1118

830

"""

1119

831

pass

1120

832

1121

1122

833

class DBusPropertyAccessException(DBusPropertyException):

1123

834

"""A property's access permissions disallows an operation.

1124

835

"""

1131

842

pass

1132

843

1133

844

1134

class DBusObjectWithAnnotations(dbus.service.Object):

1135

"""A D-Bus object with annotations.

845

class DBusObjectWithProperties(dbus.service.Object):

846

"""A D-Bus object with properties.

1136

847

1137

Classes inheriting from this can use the dbus_annotations

1138

decorator to add annotations to methods or signals.

848

Classes inheriting from this can use the dbus_service_property

849

decorator to expose methods as D-Bus properties. It exposes the

850

standard Get(), Set(), and GetAll() methods on the D-Bus.

1139

851

"""

1140

852

1141

853

@staticmethod

1151

863

def _get_all_dbus_things(self, thing):

1152

864

"""Returns a generator of (name, attribute) pairs

1153

865

"""

1154

return ((getattr(athing.__get__(self), "_dbus_name", name),

866

return ((getattr(athing.__get__(self), "_dbus_name",

867

name),

1155

868

athing.__get__(self))

1156

869

for cls in self.__class__.__mro__

1157

870

for name, athing in

1158

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

1160

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1164

def Introspect(self, object_path, connection):

1165

"""Overloading of standard D-Bus method.

1166

1167

Inserts annotation tags on methods and signals.

1168

"""

1169

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

connection)

1171

try:

1172

document = xml.dom.minidom.parseString(xmlstring)

1173

1174

for if_tag in document.getElementsByTagName("interface"):

1175

# Add annotation tags

1176

for typ in ("method", "signal"):

1177

for tag in if_tag.getElementsByTagName(typ):

1178

annots = dict()

1179

for name, prop in (self.

1180

_get_all_dbus_things(typ)):

1181

if (name == tag.getAttribute("name")

1182

and prop._dbus_interface

1183

== if_tag.getAttribute("name")):

1184

annots.update(getattr(

1185

prop, "_dbus_annotations", {}))

1186

for name, value in annots.items():

1187

ann_tag = document.createElement(

1188

"annotation")

1189

ann_tag.setAttribute("name", name)

1190

ann_tag.setAttribute("value", value)

1191

tag.appendChild(ann_tag)

1192

# Add interface annotation tags

1193

for annotation, value in dict(

1194

itertools.chain.from_iterable(

1195

annotations().items()

1196

for name, annotations

1197

in self._get_all_dbus_things("interface")

1198

if name == if_tag.getAttribute("name")

1199

)).items():

1200

ann_tag = document.createElement("annotation")

1201

ann_tag.setAttribute("name", annotation)

1202

ann_tag.setAttribute("value", value)

1203

if_tag.appendChild(ann_tag)

1204

# Fix argument name for the Introspect method itself

1205

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1207

for cn in if_tag.getElementsByTagName("method"):

1208

if cn.getAttribute("name") == "Introspect":

1209

for arg in cn.getElementsByTagName("arg"):

1210

if (arg.getAttribute("direction")

1211

== "out"):

1212

arg.setAttribute("name",

1213

"xml_data")

1214

xmlstring = document.toxml("utf-8")

1215

document.unlink()

1216

except (AttributeError, xml.dom.DOMException,

1217

xml.parsers.expat.ExpatError) as error:

1218

logger.error("Failed to override Introspection method",

1219

exc_info=error)

1220

return xmlstring

1221

1222

1223

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1224

"""A D-Bus object with properties.

1225

1226

Classes inheriting from this can use the dbus_service_property

1227

decorator to expose methods as D-Bus properties. It exposes the

1228

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

"""

871

inspect.getmembers(cls,

872

self._is_dbus_thing(thing)))

1230

873

1231

874

def _get_dbus_property(self, interface_name, property_name):

1232

875

"""Returns a bound method if one exists which is a D-Bus

1233

876

property with the specified name and interface.

1234

877

"""

1235

for cls in self.__class__.__mro__:

1236

for name, value in inspect.getmembers(

1237

cls, self._is_dbus_thing("property")):

878

for cls in self.__class__.__mro__:

879

for name, value in (inspect.getmembers

880

(cls,

881

self._is_dbus_thing("property"))):

1238

882

if (value._dbus_name == property_name

1239

883

and value._dbus_interface == interface_name):

1240

884

return value.__get__(self)

1241

885

1242

886

# No such property

1243

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

self.dbus_object_path, interface_name, property_name))

1245

1246

@classmethod

1247

def _get_all_interface_names(cls):

1248

"""Get a sequence of all interfaces supported by an object"""

1249

return (name for name in set(getattr(getattr(x, attr),

1250

"_dbus_interface", None)

1251

for x in (inspect.getmro(cls))

1252

for attr in dir(x))

1253

if name is not None)

1254

1255

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

in_signature="ss",

887

raise DBusPropertyNotFound(self.dbus_object_path + ":"

888

+ interface_name + "."

889

+ property_name)

890

891

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1257

892

out_signature="v")

1258

893

def Get(self, interface_name, property_name):

1259

894

"""Standard D-Bus property Get() method, see D-Bus standard.

1284

919

for byte in value))

1285

920

prop(value)

1286

921

1287

@dbus.service.method(dbus.PROPERTIES_IFACE,

1288

in_signature="s",

922

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1289

923

out_signature="a{sv}")

1290

924

def GetAll(self, interface_name):

1291

925

"""Standard D-Bus property GetAll() method, see D-Bus

1306

940

if not hasattr(value, "variant_level"):

1307

941

properties[name] = value

1308

942

continue

1309

properties[name] = type(value)(

1310

value, variant_level = value.variant_level + 1)

943

properties[name] = type(value)(value, variant_level=

944

value.variant_level+1)

1311

945

return dbus.Dictionary(properties, signature="sv")

1312

946

1313

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1314

def PropertiesChanged(self, interface_name, changed_properties,

1315

invalidated_properties):

1316

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1317

standard.

1318

"""

1319

pass

1320

1321

947

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1322

948

out_signature="s",

1323

949

path_keyword='object_path',

1327

953

1328

954

Inserts property tags and interface annotation tags.

1329

955

"""

1330

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1331

object_path,

1332

connection)

956

xmlstring = dbus.service.Object.Introspect(self, object_path,

957

connection)

1333

958

try:

1334

959

document = xml.dom.minidom.parseString(xmlstring)

1335

1336

960

def make_tag(document, name, prop):

1337

961

e = document.createElement("property")

1338

962

e.setAttribute("name", name)

1339

963

e.setAttribute("type", prop._dbus_signature)

1340

964

e.setAttribute("access", prop._dbus_access)

1341

965

return e

1342

1343

966

for if_tag in document.getElementsByTagName("interface"):

1344

967

# Add property tags

1345

968

for tag in (make_tag(document, name, prop)

1348

971

if prop._dbus_interface

1349

972

== if_tag.getAttribute("name")):

1350

973

if_tag.appendChild(tag)

1351

# Add annotation tags for properties

1352

for tag in if_tag.getElementsByTagName("property"):

1353

annots = dict()

1354

for name, prop in self._get_all_dbus_things(

1355

"property"):

1356

if (name == tag.getAttribute("name")

1357

and prop._dbus_interface

1358

== if_tag.getAttribute("name")):

1359

annots.update(getattr(

1360

prop, "_dbus_annotations", {}))

1361

for name, value in annots.items():

1362

ann_tag = document.createElement(

1363

"annotation")

1364

ann_tag.setAttribute("name", name)

1365

ann_tag.setAttribute("value", value)

1366

tag.appendChild(ann_tag)

974

# Add annotation tags

975

for typ in ("method", "signal", "property"):

976

for tag in if_tag.getElementsByTagName(typ):

977

annots = dict()

978

for name, prop in (self.

979

_get_all_dbus_things(typ)):

980

if (name == tag.getAttribute("name")

981

and prop._dbus_interface

982

== if_tag.getAttribute("name")):

983

annots.update(getattr

984

(prop,

985

"_dbus_annotations",

986

{}))

987

for name, value in annots.items():

988

ann_tag = document.createElement(

989

"annotation")

990

ann_tag.setAttribute("name", name)

991

ann_tag.setAttribute("value", value)

992

tag.appendChild(ann_tag)

993

# Add interface annotation tags

994

for annotation, value in dict(

995

itertools.chain.from_iterable(

996

annotations().items()

997

for name, annotations in

998

self._get_all_dbus_things("interface")

999

if name == if_tag.getAttribute("name")

1000

)).items():

1001

ann_tag = document.createElement("annotation")

1002

ann_tag.setAttribute("name", annotation)

1003

ann_tag.setAttribute("value", value)

1004

if_tag.appendChild(ann_tag)

1367

1005

# Add the names to the return values for the

1368

1006

# "org.freedesktop.DBus.Properties" methods

1369

1007

if (if_tag.getAttribute("name")

1387

1025

exc_info=error)

1388

1026

return xmlstring

1389

1027

1390

try:

1391

dbus.OBJECT_MANAGER_IFACE

1392

except AttributeError:

1393

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1395

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

"""A D-Bus object with an ObjectManager.

1397

1398

Classes inheriting from this exposes the standard

1399

GetManagedObjects call and the InterfacesAdded and

1400

InterfacesRemoved signals on the standard

1401

"org.freedesktop.DBus.ObjectManager" interface.

1402

1403

Note: No signals are sent automatically; they must be sent

1404

manually.

1405

"""

1406

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1408

def GetManagedObjects(self):

1409

"""This function must be overridden"""

1410

raise NotImplementedError()

1411

1412

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1414

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1418

def InterfacesRemoved(self, object_path, interfaces):

1419

pass

1420

1421

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1425

def Introspect(self, object_path, connection):

1426

"""Overloading of standard D-Bus method.

1427

1428

Override return argument name of GetManagedObjects to be

1429

"objpath_interfaces_and_properties"

1430

"""

1431

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1432

object_path,

1433

connection)

1434

try:

1435

document = xml.dom.minidom.parseString(xmlstring)

1436

1437

for if_tag in document.getElementsByTagName("interface"):

1438

# Fix argument name for the GetManagedObjects method

1439

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1441

for cn in if_tag.getElementsByTagName("method"):

1442

if (cn.getAttribute("name")

1443

== "GetManagedObjects"):

1444

for arg in cn.getElementsByTagName("arg"):

1445

if (arg.getAttribute("direction")

1446

== "out"):

1447

arg.setAttribute(

1448

"name",

1449

"objpath_interfaces"

1450

"_and_properties")

1451

xmlstring = document.toxml("utf-8")

1452

document.unlink()

1453

except (AttributeError, xml.dom.DOMException,

1454

xml.parsers.expat.ExpatError) as error:

1455

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1457

return xmlstring

1458

1028

1459

1029

def datetime_to_dbus(dt, variant_level=0):

1460

1030

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1461

1031

if dt is None:

1462

1032

return dbus.String("", variant_level = variant_level)

1463

return dbus.String(dt.isoformat(), variant_level=variant_level)

1033

return dbus.String(dt.isoformat(),

1034

variant_level=variant_level)

1464

1035

1465

1036

1466

1037

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1486

1057

(from DBusObjectWithProperties) and interfaces (from the

1487

1058

dbus_interface_annotations decorator).

1488

1059

"""

1489

1490

1060

def wrapper(cls):

1491

1061

for orig_interface_name, alt_interface_name in (

1492

alt_interface_names.items()):

1062

alt_interface_names.items()):

1493

1063

attr = {}

1494

1064

interface_names = set()

1495

1065

# Go though all attributes of the class

1497

1067

# Ignore non-D-Bus attributes, and D-Bus attributes

1498

1068

# with the wrong interface name

1499

1069

if (not hasattr(attribute, "_dbus_interface")

1500

or not attribute._dbus_interface.startswith(

1501

orig_interface_name)):

1070

or not attribute._dbus_interface

1071

.startswith(orig_interface_name)):

1502

1072

continue

1503

1073

# Create an alternate D-Bus interface name based on

1504

1074

# the current name

1505

alt_interface = attribute._dbus_interface.replace(

1506

orig_interface_name, alt_interface_name)

1075

alt_interface = (attribute._dbus_interface

1076

.replace(orig_interface_name,

1077

alt_interface_name))

1507

1078

interface_names.add(alt_interface)

1508

1079

# Is this a D-Bus signal?

1509

1080

if getattr(attribute, "_dbus_is_signal", False):

1510

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

nonmethod_func = (dict(

1081

# Extract the original non-method undecorated

1082

# function by black magic

1083

nonmethod_func = (dict(

1514

1084

zip(attribute.func_code.co_freevars,

1515

attribute.__closure__))

1516

["func"].cell_contents)

1517

else:

1518

nonmethod_func = attribute

1085

attribute.__closure__))["func"]

1086

.cell_contents)

1519

1087

# Create a new, but exactly alike, function

1520

1088

# object, and decorate it to be a new D-Bus signal

1521

1089

# with the alternate D-Bus interface name

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1536

new_function = (dbus.service.signal(

1537

alt_interface,

1538

attribute._dbus_signature)(new_function))

1090

new_function = (dbus.service.signal

1091

(alt_interface,

1092

attribute._dbus_signature)

1093

(types.FunctionType(

1094

nonmethod_func.func_code,

1095

nonmethod_func.func_globals,

1096

nonmethod_func.func_name,

1097

nonmethod_func.func_defaults,

1098

nonmethod_func.func_closure)))

1539

1099

# Copy annotations, if any

1540

1100

try:

1541

new_function._dbus_annotations = dict(

1542

attribute._dbus_annotations)

1101

new_function._dbus_annotations = (

1102

dict(attribute._dbus_annotations))

1543

1103

except AttributeError:

1544

1104

pass

1545

1105

# Define a creator of a function to call both the

1550

1110

"""This function is a scope container to pass

1551

1111

func1 and func2 to the "call_both" function

1552

1112

outside of its arguments"""

1553

1554

@functools.wraps(func2)

1555

1113

def call_both(*args, **kwargs):

1556

1114

"""This function will emit two D-Bus

1557

1115

signals by calling func1 and func2"""

1558

1116

func1(*args, **kwargs)

1559

1117

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1561

for name, attr in inspect.getmembers(func2):

1562

if name.startswith("_dbus_"):

1563

setattr(call_both, name, attr)

1564

1565

1118

return call_both

1566

1119

# Create the "call_both" function and add it to

1567

1120

# the class

1572

1125

# object. Decorate it to be a new D-Bus method

1573

1126

# with the alternate D-Bus interface name. Add it

1574

1127

# to the class.

1575

attr[attrname] = (

1576

dbus.service.method(

1577

alt_interface,

1578

attribute._dbus_in_signature,

1579

attribute._dbus_out_signature)

1580

(types.FunctionType(attribute.func_code,

1581

attribute.func_globals,

1582

attribute.func_name,

1583

attribute.func_defaults,

1584

attribute.func_closure)))

1128

attr[attrname] = (dbus.service.method

1129

(alt_interface,

1130

attribute._dbus_in_signature,

1131

attribute._dbus_out_signature)

1132

(types.FunctionType

1133

(attribute.func_code,

1134

attribute.func_globals,

1135

attribute.func_name,

1136

attribute.func_defaults,

1137

attribute.func_closure)))

1585

1138

# Copy annotations, if any

1586

1139

try:

1587

attr[attrname]._dbus_annotations = dict(

1588

attribute._dbus_annotations)

1140

attr[attrname]._dbus_annotations = (

1141

dict(attribute._dbus_annotations))

1589

1142

except AttributeError:

1590

1143

pass

1591

1144

# Is this a D-Bus property?

1594

1147

# object, and decorate it to be a new D-Bus

1595

1148

# property with the alternate D-Bus interface

1596

1149

# name. Add it to the class.

1597

attr[attrname] = (dbus_service_property(

1598

alt_interface, attribute._dbus_signature,

1599

attribute._dbus_access,

1600

attribute._dbus_get_args_options

1601

["byte_arrays"])

1602

(types.FunctionType(

1603

attribute.func_code,

1604

attribute.func_globals,

1605

attribute.func_name,

1606

attribute.func_defaults,

1607

attribute.func_closure)))

1150

attr[attrname] = (dbus_service_property

1151

(alt_interface,

1152

attribute._dbus_signature,

1153

attribute._dbus_access,

1154

attribute

1155

._dbus_get_args_options

1156

["byte_arrays"])

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1608

1163

# Copy annotations, if any

1609

1164

try:

1610

attr[attrname]._dbus_annotations = dict(

1611

attribute._dbus_annotations)

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1612

1167

except AttributeError:

1613

1168

pass

1614

1169

# Is this a D-Bus interface?

1617

1172

# object. Decorate it to be a new D-Bus interface

1618

1173

# with the alternate D-Bus interface name. Add it

1619

1174

# to the class.

1620

attr[attrname] = (

1621

dbus_interface_annotations(alt_interface)

1622

(types.FunctionType(attribute.func_code,

1623

attribute.func_globals,

1624

attribute.func_name,

1625

attribute.func_defaults,

1626

attribute.func_closure)))

1175

attr[attrname] = (dbus_interface_annotations

1176

(alt_interface)

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1627

1183

if deprecate:

1628

1184

# Deprecate all alternate interfaces

1629

1185

iname="_AlternateDBusNames_interface_annotation{}"

1630

1186

for interface_name in interface_names:

1631

1632

1187

@dbus_interface_annotations(interface_name)

1633

1188

def func(self):

1634

1189

return { "org.freedesktop.DBus.Deprecated":

1635

"true" }

1190

"true" }

1636

1191

# Find an unused name

1637

1192

for aname in (iname.format(i)

1638

1193

for i in itertools.count()):

1643

1198

# Replace the class with a new subclass of it with

1644

1199

# methods, signals, etc. as created above.

1645

1200

cls = type(b"{}Alternate".format(cls.__name__),

1646

(cls, ), attr)

1201

(cls,), attr)

1647

1202

return cls

1648

1649

1203

return wrapper

1650

1204

1651

1205

1652

1206

@alternate_dbus_interfaces({"se.recompile.Mandos":

1653

"se.bsnet.fukt.Mandos"})

1207

"se.bsnet.fukt.Mandos"})

1654

1208

class ClientDBus(Client, DBusObjectWithProperties):

1655

1209

"""A Client class using D-Bus

1656

1210

1660

1214

"""

1661

1215

1662

1216

runtime_expansions = (Client.runtime_expansions

1663

+ ("dbus_object_path", ))

1664

1665

_interface = "se.recompile.Mandos.Client"

1217

+ ("dbus_object_path",))

1666

1218

1667

1219

# dbus.service.Object doesn't use super(), so we can't either.

1668

1220

1671

1223

Client.__init__(self, *args, **kwargs)

1672

1224

# Only now, when this client is initialized, can it show up on

1673

1225

# the D-Bus

1674

client_object_name = str(self.name).translate(

1226

client_object_name = unicode(self.name).translate(

1675

1227

{ord("."): ord("_"),

1676

1228

ord("-"): ord("_")})

1677

self.dbus_object_path = dbus.ObjectPath(

1678

"/clients/" + client_object_name)

1229

self.dbus_object_path = (dbus.ObjectPath

1230

("/clients/" + client_object_name))

1679

1231

DBusObjectWithProperties.__init__(self, self.bus,

1680

1232

self.dbus_object_path)

1681

1233

1682

def notifychangeproperty(transform_func, dbus_name,

1683

type_func=lambda x: x,

1684

variant_level=1,

1685

invalidate_only=False,

1686

_interface=_interface):

1234

def notifychangeproperty(transform_func,

1235

dbus_name, type_func=lambda x: x,

1236

variant_level=1):

1687

1237

""" Modify a variable so that it's a property which announces

1688

1238

its changes to DBus.

1689

1239

1695

1245

variant_level: D-Bus variant level. Default: 1

1696

1246

"""

1697

1247

attrname = "_{}".format(dbus_name)

1698

1699

1248

def setter(self, value):

1700

1249

if hasattr(self, "dbus_object_path"):

1701

1250

if (not hasattr(self, attrname) or

1702

1251

type_func(getattr(self, attrname, None))

1703

1252

!= type_func(value)):

1704

if invalidate_only:

1705

self.PropertiesChanged(

1706

_interface, dbus.Dictionary(),

1707

dbus.Array((dbus_name, )))

1708

else:

1709

dbus_value = transform_func(

1710

type_func(value),

1711

variant_level = variant_level)

1712

self.PropertyChanged(dbus.String(dbus_name),

1713

dbus_value)

1714

self.PropertiesChanged(

1715

_interface,

1716

dbus.Dictionary({ dbus.String(dbus_name):

1717

dbus_value }),

1718

dbus.Array())

1253

dbus_value = transform_func(type_func(value),

1254

variant_level

1255

=variant_level)

1256

self.PropertyChanged(dbus.String(dbus_name),

1257

dbus_value)

1719

1258

setattr(self, attrname, value)

1720

1259

1721

1260

return property(lambda self: getattr(self, attrname), setter)

1727

1266

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1728

1267

last_enabled = notifychangeproperty(datetime_to_dbus,

1729

1268

"LastEnabled")

1730

checker = notifychangeproperty(

1731

dbus.Boolean, "CheckerRunning",

1732

type_func = lambda checker: checker is not None)

1269

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1270

type_func = lambda checker:

1271

checker is not None)

1733

1272

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1734

1273

"LastCheckedOK")

1735

1274

last_checker_status = notifychangeproperty(dbus.Int16,

1738

1277

datetime_to_dbus, "LastApprovalRequest")

1739

1278

approved_by_default = notifychangeproperty(dbus.Boolean,

1740

1279

"ApprovedByDefault")

1741

approval_delay = notifychangeproperty(

1742

dbus.UInt64, "ApprovalDelay",

1743

type_func = lambda td: td.total_seconds() * 1000)

1280

approval_delay = notifychangeproperty(dbus.UInt64,

1281

"ApprovalDelay",

1282

type_func =

1283

lambda td: td.total_seconds()

1284

* 1000)

1744

1285

approval_duration = notifychangeproperty(

1745

1286

dbus.UInt64, "ApprovalDuration",

1746

1287

type_func = lambda td: td.total_seconds() * 1000)

1747

1288

host = notifychangeproperty(dbus.String, "Host")

1748

timeout = notifychangeproperty(

1749

dbus.UInt64, "Timeout",

1750

type_func = lambda td: td.total_seconds() * 1000)

1289

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1290

type_func = lambda td:

1291

td.total_seconds() * 1000)

1751

1292

extended_timeout = notifychangeproperty(

1752

1293

dbus.UInt64, "ExtendedTimeout",

1753

1294

type_func = lambda td: td.total_seconds() * 1000)

1754

interval = notifychangeproperty(

1755

dbus.UInt64, "Interval",

1756

type_func = lambda td: td.total_seconds() * 1000)

1295

interval = notifychangeproperty(dbus.UInt64,

1296

"Interval",

1297

type_func =

1298

lambda td: td.total_seconds()

1299

* 1000)

1757

1300

checker_command = notifychangeproperty(dbus.String, "Checker")

1758

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1759

invalidate_only=True)

1760

1301

1761

1302

del notifychangeproperty

1762

1303

1769

1310

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1770

1311

Client.__del__(self, *args, **kwargs)

1771

1312

1772

def checker_callback(self, source, condition,

1773

connection, command, *args, **kwargs):

1774

ret = Client.checker_callback(self, source, condition,

1775

connection, command, *args,

1776

**kwargs)

1777

exitstatus = self.last_checker_status

1778

if exitstatus >= 0:

1313

def checker_callback(self, pid, condition, command,

1314

*args, **kwargs):

1315

self.checker_callback_tag = None

1316

self.checker = None

1317

if os.WIFEXITED(condition):

1318

exitstatus = os.WEXITSTATUS(condition)

1779

1319

# Emit D-Bus signal

1780

1320

self.CheckerCompleted(dbus.Int16(exitstatus),

1781

# This is specific to GNU libC

1782

dbus.Int64(exitstatus << 8),

1321

dbus.Int64(condition),

1783

1322

dbus.String(command))

1784

1323

else:

1785

1324

# Emit D-Bus signal

1786

1325

self.CheckerCompleted(dbus.Int16(-1),

1787

dbus.Int64(

1788

# This is specific to GNU libC

1789

(exitstatus << 8)

1790

| self.last_checker_signal),

1326

dbus.Int64(condition),

1791

1327

dbus.String(command))

1792

return ret

1328

1329

return Client.checker_callback(self, pid, condition, command,

1330

*args, **kwargs)

1793

1331

1794

1332

def start_checker(self, *args, **kwargs):

1795

1333

old_checker_pid = getattr(self.checker, "pid", None)

1807

1345

1808

1346

def approve(self, value=True):

1809

1347

self.approved = value

1810

GObject.timeout_add(int(self.approval_duration.total_seconds()

1348

gobject.timeout_add(int(self.approval_duration.total_seconds()

1811

1349

* 1000), self._reset_approved)

1812

1350

self.send_changedstate()

1813

1351

1814

1352

## D-Bus methods, signals & properties

1353

_interface = "se.recompile.Mandos.Client"

1815

1354

1816

1355

## Interfaces

1817

1356

1357

@dbus_interface_annotations(_interface)

1358

def _foo(self):

1359

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1360

"false"}

1361

1818

1362

## Signals

1819

1363

1820

1364

# CheckerCompleted - signal

1830

1374

pass

1831

1375

1832

1376

# PropertyChanged - signal

1833

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1834

1377

@dbus.service.signal(_interface, signature="sv")

1835

1378

def PropertyChanged(self, property, value):

1836

1379

"D-Bus signal"

1870

1413

self.checked_ok()

1871

1414

1872

1415

# Enable - method

1873

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1874

1416

@dbus.service.method(_interface)

1875

1417

def Enable(self):

1876

1418

"D-Bus method"

1877

1419

self.enable()

1878

1420

1879

1421

# StartChecker - method

1880

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1881

1422

@dbus.service.method(_interface)

1882

1423

def StartChecker(self):

1883

1424

"D-Bus method"

1884

1425

self.start_checker()

1885

1426

1886

1427

# Disable - method

1887

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1888

1428

@dbus.service.method(_interface)

1889

1429

def Disable(self):

1890

1430

"D-Bus method"

1891

1431

self.disable()

1892

1432

1893

1433

# StopChecker - method

1894

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1895

1434

@dbus.service.method(_interface)

1896

1435

def StopChecker(self):

1897

1436

self.stop_checker()

1904

1443

return dbus.Boolean(bool(self.approvals_pending))

1905

1444

1906

1445

# ApprovedByDefault - property

1907

@dbus_service_property(_interface,

1908

signature="b",

1446

@dbus_service_property(_interface, signature="b",

1909

1447

access="readwrite")

1910

1448

def ApprovedByDefault_dbus_property(self, value=None):

1911

1449

if value is None: # get

1913

1451

self.approved_by_default = bool(value)

1914

1452

1915

1453

# ApprovalDelay - property

1916

@dbus_service_property(_interface,

1917

signature="t",

1454

@dbus_service_property(_interface, signature="t",

1918

1455

access="readwrite")

1919

1456

def ApprovalDelay_dbus_property(self, value=None):

1920

1457

if value is None: # get

1923

1460

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1924

1461

1925

1462

# ApprovalDuration - property

1926

@dbus_service_property(_interface,

1927

signature="t",

1463

@dbus_service_property(_interface, signature="t",

1928

1464

access="readwrite")

1929

1465

def ApprovalDuration_dbus_property(self, value=None):

1930

1466

if value is None: # get

1933

1469

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1934

1470

1935

1471

# Name - property

1936

@dbus_annotations(

1937

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1938

1472

@dbus_service_property(_interface, signature="s", access="read")

1939

1473

def Name_dbus_property(self):

1940

1474

return dbus.String(self.name)

1941

1475

1942

1476

# Fingerprint - property

1943

@dbus_annotations(

1944

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1945

1477

@dbus_service_property(_interface, signature="s", access="read")

1946

1478

def Fingerprint_dbus_property(self):

1947

1479

return dbus.String(self.fingerprint)

1948

1480

1949

1481

# Host - property

1950

@dbus_service_property(_interface,

1951

signature="s",

1482

@dbus_service_property(_interface, signature="s",

1952

1483

access="readwrite")

1953

1484

def Host_dbus_property(self, value=None):

1954

1485

if value is None: # get

1955

1486

return dbus.String(self.host)

1956

self.host = str(value)

1487

self.host = unicode(value)

1957

1488

1958

1489

# Created - property

1959

@dbus_annotations(

1960

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1961

1490

@dbus_service_property(_interface, signature="s", access="read")

1962

1491

def Created_dbus_property(self):

1963

1492

return datetime_to_dbus(self.created)

1968

1497

return datetime_to_dbus(self.last_enabled)

1969

1498

1970

1499

# Enabled - property

1971

@dbus_service_property(_interface,

1972

signature="b",

1500

@dbus_service_property(_interface, signature="b",

1973

1501

access="readwrite")

1974

1502

def Enabled_dbus_property(self, value=None):

1975

1503

if value is None: # get

1980

1508

self.disable()

1981

1509

1982

1510

# LastCheckedOK - property

1983

@dbus_service_property(_interface,

1984

signature="s",

1511

@dbus_service_property(_interface, signature="s",

1985

1512

access="readwrite")

1986

1513

def LastCheckedOK_dbus_property(self, value=None):

1987

1514

if value is not None:

1990

1517

return datetime_to_dbus(self.last_checked_ok)

1991

1518

1992

1519

# LastCheckerStatus - property

1993

@dbus_service_property(_interface, signature="n", access="read")

1520

@dbus_service_property(_interface, signature="n",

1521

access="read")

1994

1522

def LastCheckerStatus_dbus_property(self):

1995

1523

return dbus.Int16(self.last_checker_status)

1996

1524

2005

1533

return datetime_to_dbus(self.last_approval_request)

2006

1534

2007

1535

# Timeout - property

2008

@dbus_service_property(_interface,

2009

signature="t",

1536

@dbus_service_property(_interface, signature="t",

2010

1537

access="readwrite")

2011

1538

def Timeout_dbus_property(self, value=None):

2012

1539

if value is None: # get

2024

1551

if (getattr(self, "disable_initiator_tag", None)

2025

1552

is None):

2026

1553

return

2027

GObject.source_remove(self.disable_initiator_tag)

2028

self.disable_initiator_tag = GObject.timeout_add(

2029

int((self.expires - now).total_seconds() * 1000),

2030

self.disable)

1554

gobject.source_remove(self.disable_initiator_tag)

1555

self.disable_initiator_tag = (

1556

gobject.timeout_add(

1557

int((self.expires - now).total_seconds()

1558

* 1000), self.disable))

2031

1559

2032

1560

# ExtendedTimeout - property

2033

@dbus_service_property(_interface,

2034

signature="t",

1561

@dbus_service_property(_interface, signature="t",

2035

1562

access="readwrite")

2036

1563

def ExtendedTimeout_dbus_property(self, value=None):

2037

1564

if value is None: # get

2040

1567

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2041

1568

2042

1569

# Interval - property

2043

@dbus_service_property(_interface,

2044

signature="t",

1570

@dbus_service_property(_interface, signature="t",

2045

1571

access="readwrite")

2046

1572

def Interval_dbus_property(self, value=None):

2047

1573

if value is None: # get

2051

1577

return

2052

1578

if self.enabled:

2053

1579

# Reschedule checker run

2054

GObject.source_remove(self.checker_initiator_tag)

2055

self.checker_initiator_tag = GObject.timeout_add(

2056

value, self.start_checker)

2057

self.start_checker() # Start one now, too

1580

gobject.source_remove(self.checker_initiator_tag)

1581

self.checker_initiator_tag = (gobject.timeout_add

1582

(value, self.start_checker))

1583

self.start_checker() # Start one now, too

2058

1584

2059

1585

# Checker - property

2060

@dbus_service_property(_interface,

2061

signature="s",

1586

@dbus_service_property(_interface, signature="s",

2062

1587

access="readwrite")

2063

1588

def Checker_dbus_property(self, value=None):

2064

1589

if value is None: # get

2065

1590

return dbus.String(self.checker_command)

2066

self.checker_command = str(value)

1591

self.checker_command = unicode(value)

2067

1592

2068

1593

# CheckerRunning - property

2069

@dbus_service_property(_interface,

2070

signature="b",

1594

@dbus_service_property(_interface, signature="b",

2071

1595

access="readwrite")

2072

1596

def CheckerRunning_dbus_property(self, value=None):

2073

1597

if value is None: # get

2078

1602

self.stop_checker()

2079

1603

2080

1604

# ObjectPath - property

2081

@dbus_annotations(

2082

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

"org.freedesktop.DBus.Deprecated": "true"})

2084

1605

@dbus_service_property(_interface, signature="o", access="read")

2085

1606

def ObjectPath_dbus_property(self):

2086

1607

return self.dbus_object_path # is already a dbus.ObjectPath

2087

1608

2088

1609

# Secret = property

2089

@dbus_annotations(

2090

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2091

"invalidates"})

2092

@dbus_service_property(_interface,

2093

signature="ay",

2094

access="write",

2095

byte_arrays=True)

1610

@dbus_service_property(_interface, signature="ay",

1611

access="write", byte_arrays=True)

2096

1612

def Secret_dbus_property(self, value):

2097

1613

self.secret = bytes(value)

2098

1614

2104

1620

self._pipe = child_pipe

2105

1621

self._pipe.send(('init', fpr, address))

2106

1622

if not self._pipe.recv():

2107

raise KeyError(fpr)

1623

raise KeyError()

2108

1624

2109

1625

def __getattribute__(self, name):

2110

1626

if name == '_pipe':

2114

1630

if data[0] == 'data':

2115

1631

return data[1]

2116

1632

if data[0] == 'function':

2117

2118

1633

def func(*args, **kwargs):

2119

1634

self._pipe.send(('funcall', name, args, kwargs))

2120

1635

return self._pipe.recv()[1]

2121

2122

1636

return func

2123

1637

2124

1638

def __setattr__(self, name, value):

2136

1650

def handle(self):

2137

1651

with contextlib.closing(self.server.child_pipe) as child_pipe:

2138

1652

logger.info("TCP connection from: %s",

2139

str(self.client_address))

1653

unicode(self.client_address))

2140

1654

logger.debug("Pipe FD: %d",

2141

1655

self.server.child_pipe.fileno())

2142

1656

2143

session = gnutls.ClientSession(self.request)

1657

session = (gnutls.connection

1658

.ClientSession(self.request,

1659

gnutls.connection

1660

.X509Credentials()))

1661

1662

# Note: gnutls.connection.X509Credentials is really a

1663

# generic GnuTLS certificate credentials object so long as

1664

# no X.509 keys are added to it. Therefore, we can use it

1665

# here despite using OpenPGP certificates.

2144

1666

2145

1667

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2146

1668

# "+AES-256-CBC", "+SHA1",

2150

1672

priority = self.server.gnutls_priority

2151

1673

if priority is None:

2152

1674

priority = "NORMAL"

2153

gnutls.priority_set_direct(session._c_object, priority,

2154

None)

1675

(gnutls.library.functions

1676

.gnutls_priority_set_direct(session._c_object,

1677

priority, None))

2155

1678

2156

1679

# Start communication using the Mandos protocol

2157

1680

# Get protocol number

2167

1690

# Start GnuTLS connection

2168

1691

try:

2169

1692

session.handshake()

2170

except gnutls.Error as error:

1693

except gnutls.errors.GNUTLSError as error:

2171

1694

logger.warning("Handshake failed: %s", error)

2172

1695

# Do not run session.bye() here: the session is not

2173

1696

# established. Just abandon the request.

2177

1700

approval_required = False

2178

1701

try:

2179

1702

try:

2180

fpr = self.fingerprint(

2181

self.peer_certificate(session))

2182

except (TypeError, gnutls.Error) as error:

1703

fpr = self.fingerprint(self.peer_certificate

1704

(session))

1705

except (TypeError,

1706

gnutls.errors.GNUTLSError) as error:

2183

1707

logger.warning("Bad certificate: %s", error)

2184

1708

return

2185

1709

logger.debug("Fingerprint: %s", fpr)

2198

1722

while True:

2199

1723

if not client.enabled:

2200

1724

logger.info("Client %s is disabled",

2201

client.name)

1725

client.name)

2202

1726

if self.server.use_dbus:

2203

1727

# Emit D-Bus signal

2204

1728

client.Rejected("Disabled")

2243

1767

else:

2244

1768

delay -= time2 - time

2245

1769

2246

try:

2247

session.send(client.secret)

2248

except gnutls.Error as error:

2249

logger.warning("gnutls send failed",

2250

exc_info = error)

2251

return

1770

sent_size = 0

1771

while sent_size < len(client.secret):

1772

try:

1773

sent = session.send(client.secret[sent_size:])

1774

except gnutls.errors.GNUTLSError as error:

1775

logger.warning("gnutls send failed",

1776

exc_info=error)

1777

return

1778

logger.debug("Sent: %d, remaining: %d",

1779

sent, len(client.secret)

1780

- (sent_size + sent))

1781

sent_size += sent

2252

1782

2253

1783

logger.info("Sending secret to %s", client.name)

2254

1784

# bump the timeout using extended_timeout

2262

1792

client.approvals_pending -= 1

2263

1793

try:

2264

1794

session.bye()

2265

except gnutls.Error as error:

1795

except gnutls.errors.GNUTLSError as error:

2266

1796

logger.warning("GnuTLS bye failed",

2267

1797

exc_info=error)

2268

1798

2270

1800

def peer_certificate(session):

2271

1801

"Return the peer's OpenPGP certificate as a bytestring"

2272

1802

# If not an OpenPGP certificate...

2273

if (gnutls.certificate_type_get(session._c_object)

2274

!= gnutls.CRT_OPENPGP):

2275

# ...return invalid data

2276

return b""

1803

if (gnutls.library.functions

1804

.gnutls_certificate_type_get(session._c_object)

1805

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1806

# ...do the normal thing

1807

return session.peer_certificate

2277

1808

list_size = ctypes.c_uint(1)

2278

cert_list = (gnutls.certificate_get_peers

1809

cert_list = (gnutls.library.functions

1810

.gnutls_certificate_get_peers

2279

1811

(session._c_object, ctypes.byref(list_size)))

2280

1812

if not bool(cert_list) and list_size.value != 0:

2281

raise gnutls.Error("error getting peer certificate")

1813

raise gnutls.errors.GNUTLSError("error getting peer"

1814

" certificate")

2282

1815

if list_size.value == 0:

2283

1816

return None

2284

1817

cert = cert_list[0]

2288

1821

def fingerprint(openpgp):

2289

1822

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2290

1823

# New GnuTLS "datum" with the OpenPGP public key

2291

datum = gnutls.datum_t(

2292

ctypes.cast(ctypes.c_char_p(openpgp),

2293

ctypes.POINTER(ctypes.c_ubyte)),

2294

ctypes.c_uint(len(openpgp)))

1824

datum = (gnutls.library.types

1825

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1826

ctypes.POINTER

1827

(ctypes.c_ubyte)),

1828

ctypes.c_uint(len(openpgp))))

2295

1829

# New empty GnuTLS certificate

2296

crt = gnutls.openpgp_crt_t()

2297

gnutls.openpgp_crt_init(ctypes.byref(crt))

1830

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1831

(gnutls.library.functions

1832

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2298

1833

# Import the OpenPGP public key into the certificate

2299

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2300

gnutls.OPENPGP_FMT_RAW)

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1836

gnutls.library.constants

1837

.GNUTLS_OPENPGP_FMT_RAW))

2301

1838

# Verify the self signature in the key

2302

1839

crtverify = ctypes.c_uint()

2303

gnutls.openpgp_crt_verify_self(crt, 0,

2304

ctypes.byref(crtverify))

1840

(gnutls.library.functions

1841

.gnutls_openpgp_crt_verify_self(crt, 0,

1842

ctypes.byref(crtverify)))

2305

1843

if crtverify.value != 0:

2306

gnutls.openpgp_crt_deinit(crt)

2307

raise gnutls.CertificateSecurityError("Verify failed")

1844

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1845

raise (gnutls.errors.CertificateSecurityError

1846

("Verify failed"))

2308

1847

# New buffer for the fingerprint

2309

1848

buf = ctypes.create_string_buffer(20)

2310

1849

buf_len = ctypes.c_size_t()

2311

1850

# Get the fingerprint from the certificate into the buffer

2312

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2313

ctypes.byref(buf_len))

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1853

ctypes.byref(buf_len)))

2314

1854

# Deinit the certificate

2315

gnutls.openpgp_crt_deinit(crt)

1855

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2316

1856

# Convert the buffer to a Python bytestring

2317

1857

fpr = ctypes.string_at(buf, buf_len.value)

2318

1858

# Convert the bytestring to hexadecimal notation

2322

1862

2323

1863

class MultiprocessingMixIn(object):

2324

1864

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2325

2326

1865

def sub_process_main(self, request, address):

2327

1866

try:

2328

1867

self.finish_request(request, address)

2340

1879

2341

1880

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2342

1881

""" adds a pipe to the MixIn """

2343

2344

1882

def process_request(self, request, client_address):

2345

1883

"""Overrides and wraps the original process_request().

2346

1884

2367

1905

interface: None or a network interface name (string)

2368

1906

use_ipv6: Boolean; to use IPv6 or not

2369

1907

"""

2370

2371

1908

def __init__(self, server_address, RequestHandlerClass,

2372

interface=None,

2373

use_ipv6=True,

2374

socketfd=None):

1909

interface=None, use_ipv6=True, socketfd=None):

2375

1910

"""If socketfd is set, use that file descriptor instead of

2376

1911

creating a new one with socket.socket().

2377

1912

"""

2418

1953

self.interface)

2419

1954

else:

2420

1955

try:

2421

self.socket.setsockopt(

2422

socket.SOL_SOCKET, SO_BINDTODEVICE,

2423

(self.interface + "\0").encode("utf-8"))

1956

self.socket.setsockopt(socket.SOL_SOCKET,

1957

SO_BINDTODEVICE,

1958

(self.interface + "\0")

1959

.encode("utf-8"))

2424

1960

except socket.error as error:

2425

1961

if error.errno == errno.EPERM:

2426

1962

logger.error("No permission to bind to"

2444

1980

self.server_address = (any_address,

2445

1981

self.server_address[1])

2446

1982

elif not self.server_address[1]:

2447

self.server_address = (self.server_address[0], 0)

1983

self.server_address = (self.server_address[0],

1984

0)

2448

1985

# if self.interface:

2449

1986

# self.server_address = (self.server_address[0],

2450

1987

# 0, # port

2462

1999

gnutls_priority GnuTLS priority string

2463

2000

use_dbus: Boolean; to emit D-Bus signals or not

2464

2001

2465

Assumes a GObject.MainLoop event loop.

2002

Assumes a gobject.MainLoop event loop.

2466

2003

"""

2467

2468

2004

def __init__(self, server_address, RequestHandlerClass,

2469

interface=None,

2470

use_ipv6=True,

2471

clients=None,

2472

gnutls_priority=None,

2473

use_dbus=True,

2474

socketfd=None):

2005

interface=None, use_ipv6=True, clients=None,

2006

gnutls_priority=None, use_dbus=True, socketfd=None):

2475

2007

self.enabled = False

2476

2008

self.clients = clients

2477

2009

if self.clients is None:

2483

2015

interface = interface,

2484

2016

use_ipv6 = use_ipv6,

2485

2017

socketfd = socketfd)

2486

2487

2018

def server_activate(self):

2488

2019

if self.enabled:

2489

2020

return socketserver.TCPServer.server_activate(self)

2493

2024

2494

2025

def add_pipe(self, parent_pipe, proc):

2495

2026

# Call "handle_ipc" for both data and EOF events

2496

GObject.io_add_watch(

2497

parent_pipe.fileno(),

2498

GObject.IO_IN | GObject.IO_HUP,

2499

functools.partial(self.handle_ipc,

2500

parent_pipe = parent_pipe,

2501

proc = proc))

2027

gobject.io_add_watch(parent_pipe.fileno(),

2028

gobject.IO_IN | gobject.IO_HUP,

2029

functools.partial(self.handle_ipc,

2030

parent_pipe =

2031

parent_pipe,

2032

proc = proc))

2502

2033

2503

def handle_ipc(self, source, condition,

2504

parent_pipe=None,

2505

proc = None,

2506

client_object=None):

2034

def handle_ipc(self, source, condition, parent_pipe=None,

2035

proc = None, client_object=None):

2507

2036

# error, or the other end of multiprocessing.Pipe has closed

2508

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2037

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2509

2038

# Wait for other process to exit

2510

2039

proc.join()

2511

2040

return False

2532

2061

parent_pipe.send(False)

2533

2062

return False

2534

2063

2535

GObject.io_add_watch(

2536

parent_pipe.fileno(),

2537

GObject.IO_IN | GObject.IO_HUP,

2538

functools.partial(self.handle_ipc,

2539

parent_pipe = parent_pipe,

2540

proc = proc,

2541

client_object = client))

2064

gobject.io_add_watch(parent_pipe.fileno(),

2065

gobject.IO_IN | gobject.IO_HUP,

2066

functools.partial(self.handle_ipc,

2067

parent_pipe =

2068

parent_pipe,

2069

proc = proc,

2070

client_object =

2071

client))

2542

2072

parent_pipe.send(True)

2543

2073

# remove the old hook in favor of the new above hook on

2544

2074

# same fileno

2550

2080

2551

2081

parent_pipe.send(('data', getattr(client_object,

2552

2082

funcname)(*args,

2553

**kwargs)))

2083

**kwargs)))

2554

2084

2555

2085

if command == 'getattr':

2556

2086

attrname = request[1]

2557

if isinstance(client_object.__getattribute__(attrname),

2558

collections.Callable):

2559

parent_pipe.send(('function', ))

2087

if callable(client_object.__getattribute__(attrname)):

2088

parent_pipe.send(('function',))

2560

2089

else:

2561

parent_pipe.send((

2562

'data', client_object.__getattribute__(attrname)))

2090

parent_pipe.send(('data', client_object

2091

.__getattribute__(attrname)))

2563

2092

2564

2093

if command == 'setattr':

2565

2094

attrname = request[1]

2596

2125

# avoid excessive use of external libraries.

2597

2126

2598

2127

# New type for defining tokens, syntax, and semantics all-in-one

2599

Token = collections.namedtuple("Token", (

2600

"regexp", # To match token; if "value" is not None, must have

2601

# a "group" containing digits

2602

"value", # datetime.timedelta or None

2603

"followers")) # Tokens valid after this token

2128

Token = collections.namedtuple("Token",

2129

("regexp", # To match token; if

2130

# "value" is not None,

2131

# must have a "group"

2132

# containing digits

2133

"value", # datetime.timedelta or

2134

# None

2135

"followers")) # Tokens valid after

2136

# this token

2604

2137

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2605

2138

# the "duration" ABNF definition in RFC 3339, Appendix A.

2606

2139

token_end = Token(re.compile(r"$"), None, frozenset())

2607

2140

token_second = Token(re.compile(r"(\d+)S"),

2608

2141

datetime.timedelta(seconds=1),

2609

frozenset((token_end, )))

2142

frozenset((token_end,)))

2610

2143

token_minute = Token(re.compile(r"(\d+)M"),

2611

2144

datetime.timedelta(minutes=1),

2612

2145

frozenset((token_second, token_end)))

2628

2161

frozenset((token_month, token_end)))

2629

2162

token_week = Token(re.compile(r"(\d+)W"),

2630

2163

datetime.timedelta(weeks=1),

2631

frozenset((token_end, )))

2164

frozenset((token_end,)))

2632

2165

token_duration = Token(re.compile(r"P"), None,

2633

2166

frozenset((token_year, token_month,

2634

2167

token_day, token_time,

2636

2169

# Define starting values

2637

2170

value = datetime.timedelta() # Value so far

2638

2171

found_token = None

2639

followers = frozenset((token_duration, )) # Following valid tokens

2172

followers = frozenset((token_duration,)) # Following valid tokens

2640

2173

s = duration # String left to parse

2641

2174

# Loop until end token is found

2642

2175

while found_token is not token_end:

2659

2192

break

2660

2193

else:

2661

2194

# No currently valid tokens were found

2662

raise ValueError("Invalid RFC 3339 duration: {!r}"

2663

.format(duration))

2195

raise ValueError("Invalid RFC 3339 duration")

2664

2196

# End token found

2665

2197

return value

2666

2198

2703

2235

elif suffix == "w":

2704

2236

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2705

2237

else:

2706

raise ValueError("Unknown suffix {!r}".format(suffix))

2238

raise ValueError("Unknown suffix {!r}"

2239

.format(suffix))

2707

2240

except IndexError as e:

2708

2241

raise ValueError(*(e.args))

2709

2242

timevalue += delta

2725

2258

# Close all standard open file descriptors

2726

2259

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2727

2260

if not stat.S_ISCHR(os.fstat(null).st_mode):

2728

raise OSError(errno.ENODEV,

2729

"{} not a character device"

2261

raise OSError(errno.ENODEV, "{} not a character device"

2730

2262

.format(os.devnull))

2731

2263

os.dup2(null, sys.stdin.fileno())

2732

2264

os.dup2(null, sys.stdout.fileno())

2798

2330

"port": "",

2799

2331

"debug": "False",

2800

2332

"priority":

2801

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2333

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2803

2334

"servicename": "Mandos",

2804

2335

"use_dbus": "True",

2805

2336

"use_ipv6": "True",

2809

2340

"statedir": "/var/lib/mandos",

2810

2341

"foreground": "False",

2811

2342

"zeroconf": "True",

2812

}

2343

}

2813

2344

2814

2345

# Parse config file for server-global settings

2815

2346

server_config = configparser.SafeConfigParser(server_defaults)

2816

2347

del server_defaults

2817

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2348

server_config.read(os.path.join(options.configdir,

2349

"mandos.conf"))

2818

2350

# Convert the SafeConfigParser object to a dict

2819

2351

server_settings = server_config.defaults()

2820

2352

# Use the appropriate methods on the non-string config options

2838

2370

# Override the settings from the config file with command line

2839

2371

# options, if set.

2840

2372

for option in ("interface", "address", "port", "debug",

2841

"priority", "servicename", "configdir", "use_dbus",

2842

"use_ipv6", "debuglevel", "restore", "statedir",

2843

"socket", "foreground", "zeroconf"):

2373

"priority", "servicename", "configdir",

2374

"use_dbus", "use_ipv6", "debuglevel", "restore",

2375

"statedir", "socket", "foreground", "zeroconf"):

2844

2376

value = getattr(options, option)

2845

2377

if value is not None:

2846

2378

server_settings[option] = value

2861

2393

2862

2394

##################################################################

2863

2395

2864

if (not server_settings["zeroconf"]

2865

and not (server_settings["port"]

2866

or server_settings["socket"] != "")):

2867

parser.error("Needs port or socket to work without Zeroconf")

2396

if (not server_settings["zeroconf"] and

2397

not (server_settings["port"]

2398

or server_settings["socket"] != "")):

2399

parser.error("Needs port or socket to work without"

2400

" Zeroconf")

2868

2401

2869

2402

# For convenience

2870

2403

debug = server_settings["debug"]

2886

2419

initlogger(debug, level)

2887

2420

2888

2421

if server_settings["servicename"] != "Mandos":

2889

syslogger.setFormatter(

2890

logging.Formatter('Mandos ({}) [%(process)d]:'

2891

' %(levelname)s: %(message)s'.format(

2892

server_settings["servicename"])))

2422

syslogger.setFormatter(logging.Formatter

2423

('Mandos ({}) [%(process)d]:'

2424

' %(levelname)s: %(message)s'

2425

.format(server_settings

2426

["servicename"])))

2893

2427

2894

2428

# Parse config file with clients

2895

2429

client_config = configparser.SafeConfigParser(Client

2903

2437

socketfd = None

2904

2438

if server_settings["socket"] != "":

2905

2439

socketfd = server_settings["socket"]

2906

tcp_server = MandosServer(

2907

(server_settings["address"], server_settings["port"]),

2908

ClientHandler,

2909

interface=(server_settings["interface"] or None),

2910

use_ipv6=use_ipv6,

2911

gnutls_priority=server_settings["priority"],

2912

use_dbus=use_dbus,

2913

socketfd=socketfd)

2440

tcp_server = MandosServer((server_settings["address"],

2441

server_settings["port"]),

2442

ClientHandler,

2443

interface=(server_settings["interface"]

2444

or None),

2445

use_ipv6=use_ipv6,

2446

gnutls_priority=

2447

server_settings["priority"],

2448

use_dbus=use_dbus,

2449

socketfd=socketfd)

2914

2450

if not foreground:

2915

2451

pidfilename = "/run/mandos.pid"

2916

2452

if not os.path.isdir("/run/."):

2917

2453

pidfilename = "/var/run/mandos.pid"

2918

2454

pidfile = None

2919

2455

try:

2920

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2456

pidfile = open(pidfilename, "w")

2921

2457

except IOError as e:

2922

2458

logger.error("Could not open file %r", pidfilename,

2923

2459

exc_info=e)

2924

2460

2925

for name, group in (("_mandos", "_mandos"),

2926

("mandos", "mandos"),

2927

("nobody", "nogroup")):

2461

for name in ("_mandos", "mandos", "nobody"):

2928

2462

try:

2929

2463

uid = pwd.getpwnam(name).pw_uid

2930

gid = pwd.getpwnam(group).pw_gid

2464

gid = pwd.getpwnam(name).pw_gid

2931

2465

break

2932

2466

except KeyError:

2933

2467

continue

2946

2480

2947

2481

# "Use a log level over 10 to enable all debugging options."

2948

2482

# - GnuTLS manual

2949

gnutls.global_set_log_level(11)

2483

gnutls.library.functions.gnutls_global_set_log_level(11)

2950

2484

2951

@gnutls.log_func

2485

@gnutls.library.types.gnutls_log_func

2952

2486

def debug_gnutls(level, string):

2953

2487

logger.debug("GnuTLS: %s", string[:-1])

2954

2488

2955

gnutls.global_set_log_function(debug_gnutls)

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2956

2491

2957

2492

# Redirect stdin so all checkers get /dev/null

2958

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2965

2500

# Close all input and output, do double fork, etc.

2966

2501

daemon()

2967

2502

2968

# multiprocessing will use threads, so before we use GObject we

2969

# need to inform GObject that threads will be used.

2970

GObject.threads_init()

2503

# multiprocessing will use threads, so before we use gobject we

2504

# need to inform gobject that threads will be used.

2505

gobject.threads_init()

2971

2506

2972

2507

global main_loop

2973

2508

# From the Avahi example code

2974

2509

DBusGMainLoop(set_as_default=True)

2975

main_loop = GObject.MainLoop()

2510

main_loop = gobject.MainLoop()

2976

2511

bus = dbus.SystemBus()

2977

2512

# End of Avahi example code

2978

2513

if use_dbus:

2979

2514

try:

2980

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

2981

bus,

2982

do_not_queue=True)

2983

old_bus_name = dbus.service.BusName(

2984

"se.bsnet.fukt.Mandos", bus,

2985

do_not_queue=True)

2986

except dbus.exceptions.DBusException as e:

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

2987

2521

logger.error("Disabling D-Bus:", exc_info=e)

2988

2522

use_dbus = False

2989

2523

server_settings["use_dbus"] = False

2990

2524

tcp_server.use_dbus = False

2991

2525

if zeroconf:

2992

2526

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2993

service = AvahiServiceToSyslog(

2994

name = server_settings["servicename"],

2995

servicetype = "_mandos._tcp",

2996

protocol = protocol,

2997

bus = bus)

2527

service = AvahiServiceToSyslog(name =

2528

server_settings["servicename"],

2529

servicetype = "_mandos._tcp",

2530

protocol = protocol, bus = bus)

2998

2531

if server_settings["interface"]:

2999

service.interface = if_nametoindex(

3000

server_settings["interface"].encode("utf-8"))

2532

service.interface = (if_nametoindex

2533

(server_settings["interface"]

2534

.encode("utf-8")))

3001

2535

3002

2536

global multiprocessing_manager

3003

2537

multiprocessing_manager = multiprocessing.Manager()

3022

2556

if server_settings["restore"]:

3023

2557

try:

3024

2558

with open(stored_state_path, "rb") as stored_state:

3025

clients_data, old_client_settings = pickle.load(

3026

stored_state)

2559

clients_data, old_client_settings = (pickle.load

2560

(stored_state))

3027

2561

os.remove(stored_state_path)

3028

2562

except IOError as e:

3029

2563

if e.errno == errno.ENOENT:

3030

logger.warning("Could not load persistent state:"

3031

" {}".format(os.strerror(e.errno)))

2564

logger.warning("Could not load persistent state: {}"

2565

.format(os.strerror(e.errno)))

3032

2566

else:

3033

2567

logger.critical("Could not load persistent state:",

3034

2568

exc_info=e)

3035

2569

raise

3036

2570

except EOFError as e:

3037

2571

logger.warning("Could not load persistent state: "

3038

"EOFError:",

3039

exc_info=e)

2572

"EOFError:", exc_info=e)

3040

2573

3041

2574

with PGPEngine() as pgp:

3042

2575

for client_name, client in clients_data.items():

3054

2587

# For each value in new config, check if it

3055

2588

# differs from the old config value (Except for

3056

2589

# the "secret" attribute)

3057

if (name != "secret"

3058

and (value !=

3059

old_client_settings[client_name][name])):

2590

if (name != "secret" and

2591

value != old_client_settings[client_name]

2592

[name]):

3060

2593

client[name] = value

3061

2594

except KeyError:

3062

2595

pass

3063

2596

3064

2597

# Clients who has passed its expire date can still be

3065

# enabled if its last checker was successful. A Client

2598

# enabled if its last checker was successful. Clients

3066

2599

# whose checker succeeded before we stored its state is

3067

2600

# assumed to have successfully run all checkers during

3068

2601

# downtime.

3071

2604

if not client["last_checked_ok"]:

3072

2605

logger.warning(

3073

2606

"disabling client {} - Client never "

3074

"performed a successful checker".format(

3075

client_name))

2607

"performed a successful checker"

2608

.format(client_name))

3076

2609

client["enabled"] = False

3077

2610

elif client["last_checker_status"] != 0:

3078

2611

logger.warning(

3079

2612

"disabling client {} - Client last"

3080

" checker failed with error code"

3081

" {}".format(

3082

client_name,

3083

client["last_checker_status"]))

2613

" checker failed with error code {}"

2614

.format(client_name,

2615

client["last_checker_status"]))

3084

2616

client["enabled"] = False

3085

2617

else:

3086

client["expires"] = (

3087

datetime.datetime.utcnow()

3088

+ client["timeout"])

2618

client["expires"] = (datetime.datetime

2619

.utcnow()

2620

+ client["timeout"])

3089

2621

logger.debug("Last checker succeeded,"

3090

" keeping {} enabled".format(

3091

client_name))

2622

" keeping {} enabled"

2623

.format(client_name))

3092

2624

try:

3093

client["secret"] = pgp.decrypt(

3094

client["encrypted_secret"],

3095

client_settings[client_name]["secret"])

2625

client["secret"] = (

2626

pgp.decrypt(client["encrypted_secret"],

2627

client_settings[client_name]

2628

["secret"]))

3096

2629

except PGPError:

3097

2630

# If decryption fails, we use secret from new settings

3098

logger.debug("Failed to decrypt {} old secret".format(

3099

client_name))

3100

client["secret"] = (client_settings[client_name]

3101

["secret"])

2631

logger.debug("Failed to decrypt {} old secret"

2632

.format(client_name))

2633

client["secret"] = (

2634

client_settings[client_name]["secret"])

3102

2635

3103

2636

# Add/remove clients based on new changes made to config

3104

2637

for client_name in (set(old_client_settings)

3111

2644

# Create all client objects

3112

2645

for client_name, client in clients_data.items():

3113

2646

tcp_server.clients[client_name] = client_class(

3114

name = client_name,

3115

settings = client,

2647

name = client_name, settings = client,

3116

2648

server_settings = server_settings)

3117

2649

3118

2650

if not tcp_server.clients:

3120

2652

3121

2653

if not foreground:

3122

2654

if pidfile is not None:

3123

pid = os.getpid()

3124

2655

try:

3125

2656

with pidfile:

3126

print(pid, file=pidfile)

2657

pid = os.getpid()

2658

pidfile.write("{}\n".format(pid).encode("utf-8"))

3127

2659

except IOError:

3128

2660

logger.error("Could not write to file %r with PID %d",

3129

2661

pidfilename, pid)

3134

2666

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3135

2667

3136

2668

if use_dbus:

3137

3138

@alternate_dbus_interfaces(

3139

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3140

class MandosDBusService(DBusObjectWithObjectManager):

2669

@alternate_dbus_interfaces({"se.recompile.Mandos":

2670

"se.bsnet.fukt.Mandos"})

2671

class MandosDBusService(DBusObjectWithProperties):

3141

2672

"""A D-Bus proxy object"""

3142

3143

2673

def __init__(self):

3144

2674

dbus.service.Object.__init__(self, bus, "/")

3145

3146

2675

_interface = "se.recompile.Mandos"

3147

2676

2677

@dbus_interface_annotations(_interface)

2678

def _foo(self):

2679

return { "org.freedesktop.DBus.Property"

2680

".EmitsChangedSignal":

2681

"false"}

2682

3148

2683

@dbus.service.signal(_interface, signature="o")

3149

2684

def ClientAdded(self, objpath):

3150

2685

"D-Bus signal"

3155

2690

"D-Bus signal"

3156

2691

pass

3157

2692

3158

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3159

"true"})

3160

2693

@dbus.service.signal(_interface, signature="os")

3161

2694

def ClientRemoved(self, objpath, name):

3162

2695

"D-Bus signal"

3163

2696

pass

3164

2697

3165

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3166

"true"})

3167

2698

@dbus.service.method(_interface, out_signature="ao")

3168

2699

def GetAllClients(self):

3169

2700

"D-Bus method"

3170

return dbus.Array(c.dbus_object_path for c in

2701

return dbus.Array(c.dbus_object_path

2702

for c in

3171

2703

tcp_server.clients.itervalues())

3172

2704

3173

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3174

"true"})

3175

2705

@dbus.service.method(_interface,

3176

2706

out_signature="a{oa{sv}}")

3177

2707

def GetAllClientsWithProperties(self):

3178

2708

"D-Bus method"

3179

2709

return dbus.Dictionary(

3180

{ c.dbus_object_path: c.GetAll(

3181

"se.recompile.Mandos.Client")

3182

for c in tcp_server.clients.itervalues() },

2710

((c.dbus_object_path, c.GetAll(""))

2711

for c in tcp_server.clients.itervalues()),

3183

2712

signature="oa{sv}")

3184

2713

3185

2714

@dbus.service.method(_interface, in_signature="o")

3189

2718

if c.dbus_object_path == object_path:

3190

2719

del tcp_server.clients[c.name]

3191

2720

c.remove_from_connection()

3192

# Don't signal the disabling

2721

# Don't signal anything except ClientRemoved

3193

2722

c.disable(quiet=True)

3194

# Emit D-Bus signal for removal

3195

self.client_removed_signal(c)

2723

# Emit D-Bus signal

2724

self.ClientRemoved(object_path, c.name)

3196

2725

return

3197

2726

raise KeyError(object_path)

3198

2727

3199

2728

del _interface

3200

3201

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3202

out_signature = "a{oa{sa{sv}}}")

3203

def GetManagedObjects(self):

3204

"""D-Bus method"""

3205

return dbus.Dictionary(

3206

{ client.dbus_object_path:

3207

dbus.Dictionary(

3208

{ interface: client.GetAll(interface)

3209

for interface in

3210

client._get_all_interface_names()})

3211

for client in tcp_server.clients.values()})

3212

3213

def client_added_signal(self, client):

3214

"""Send the new standard signal and the old signal"""

3215

if use_dbus:

3216

# New standard signal

3217

self.InterfacesAdded(

3218

client.dbus_object_path,

3219

dbus.Dictionary(

3220

{ interface: client.GetAll(interface)

3221

for interface in

3222

client._get_all_interface_names()}))

3223

# Old signal

3224

self.ClientAdded(client.dbus_object_path)

3225

3226

def client_removed_signal(self, client):

3227

"""Send the new standard signal and the old signal"""

3228

if use_dbus:

3229

# New standard signal

3230

self.InterfacesRemoved(

3231

client.dbus_object_path,

3232

client._get_all_interface_names())

3233

# Old signal

3234

self.ClientRemoved(client.dbus_object_path,

3235

client.name)

3236

2729

3237

2730

mandos_dbus_service = MandosDBusService()

3238

2731

3261

2754

# + secret.

3262

2755

exclude = { "bus", "changedstate", "secret",

3263

2756

"checker", "server_settings" }

3264

for name, typ in inspect.getmembers(dbus.service

3265

.Object):

2757

for name, typ in (inspect.getmembers

2758

(dbus.service.Object)):

3266

2759

exclude.add(name)

3267

2760

3268

2761

client_dict["encrypted_secret"] = (client

3275

2768

del client_settings[client.name]["secret"]

3276

2769

3277

2770

try:

3278

with tempfile.NamedTemporaryFile(

3279

mode='wb',

3280

suffix=".pickle",

3281

prefix='clients-',

3282

dir=os.path.dirname(stored_state_path),

3283

delete=False) as stored_state:

2771

with (tempfile.NamedTemporaryFile

2772

(mode='wb', suffix=".pickle", prefix='clients-',

2773

dir=os.path.dirname(stored_state_path),

2774

delete=False)) as stored_state:

3284

2775

pickle.dump((clients, client_settings), stored_state)

3285

tempname = stored_state.name

2776

tempname=stored_state.name

3286

2777

os.rename(tempname, stored_state_path)

3287

2778

except (IOError, OSError) as e:

3288

2779

if not debug:

3303

2794

name, client = tcp_server.clients.popitem()

3304

2795

if use_dbus:

3305

2796

client.remove_from_connection()

3306

# Don't signal the disabling

2797

# Don't signal anything except ClientRemoved

3307

2798

client.disable(quiet=True)

3308

# Emit D-Bus signal for removal

3309

2799

if use_dbus:

3310

mandos_dbus_service.client_removed_signal(client)

2800

# Emit D-Bus signal

2801

mandos_dbus_service.ClientRemoved(client

2802

.dbus_object_path,

2803

client.name)

3311

2804

client_settings.clear()

3312

2805

3313

2806

atexit.register(cleanup)

3314

2807

3315

2808

for client in tcp_server.clients.itervalues():

3316

2809

if use_dbus:

3317

# Emit D-Bus signal for adding

3318

mandos_dbus_service.client_added_signal(client)

2810

# Emit D-Bus signal

2811

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3319

2812

# Need to initiate checking of clients

3320

2813

if client.enabled:

3321

2814

client.init_checker()

3347

2840

sys.exit(1)

3348

2841

# End of Avahi example code

3349

2842

3350

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2843

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3351

2844

lambda *args, **kwargs:

3352

2845

(tcp_server.handle_request

3353

2846

(*args[2:], **kwargs) or True))

3366

2859

# Must run before the D-Bus bus name gets deregistered

3367

2860

cleanup()

3368

2861

3369

3370

2862

if __name__ == '__main__':

3371

2863

main()