To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 730
- compare with another revision
- download diff
- download tarball
- view history from revision 730
- Committer: Teddy Hogeborn
- Date: 2014-08-09 13:18:46 UTC
- Revision ID: teddy@recompile.se-20140809131846-2emd272mf9c9wihe
mandos: Replace unicode() with str().
This is in preparation for the coming Python 3 conversion.
* mandos: Replace "str" with "unicode". All callers changed.
This is in preparation for the coming Python 3 conversion.
* mandos: Replace "str" with "unicode". All callers changed.
- files removed:
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
46
43
import errno
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
51
import sys
52
52
import re
53
53
import os
62
62
import struct
63
63
import fcntl
64
64
import functools
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
65
import cPickle as pickle
69
66
import multiprocessing
70
67
import types
71
68
import binascii
72
69
import tempfile
73
70
import itertools
74
71
import collections
75
import codecs
76
72
77
73
import dbus
78
74
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
75
import gobject
83
76
import avahi
84
77
from dbus.mainloop.glib import DBusGMainLoop
85
78
import ctypes
98
91
if sys.version_info.major == 2:
99
92
str = unicode
100
93
101
version = "1.7.3"
94
version = "1.6.8"
102
95
stored_state_file = "clients.pickle"
103
96
104
97
logger = logging.getLogger()
105
98
syslogger = None
106
99
107
100
try:
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
110
104
except (OSError, AttributeError):
111
112
105
def if_nametoindex(interface):
113
106
"Get an interface index the hard way, i.e. using fcntl()"
114
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
123
116
"""init logger and add loglevel"""
124
117
125
118
global syslogger
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
129
123
syslogger.setFormatter(logging.Formatter
130
124
('Mandos [%(process)d]: %(levelname)s:'
131
125
' %(message)s'))
148
142
149
143
class PGPEngine(object):
150
144
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
152
145
def __init__(self):
153
146
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
self.gpg = "gpg"
155
try:
156
output = subprocess.check_output(["gpgconf"])
157
for line in output.splitlines():
158
name, text, path = line.split(":")
159
if name == "gpg":
160
self.gpg = path
161
break
162
except OSError as e:
163
if e.errno != errno.ENOENT:
164
raise
165
147
self.gnupgargs = ['--batch',
166
'--homedir', self.tempdir,
148
'--home', self.tempdir,
167
149
'--force-mdc',
168
150
'--quiet',
169
151
'--no-use-agent']
204
186
205
187
def encrypt(self, data, password):
206
188
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(
208
dir=self.tempdir) as passfile:
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
209
191
passfile.write(passphrase)
210
192
passfile.flush()
211
proc = subprocess.Popen([self.gpg, '--symmetric',
193
proc = subprocess.Popen(['gpg', '--symmetric',
212
194
'--passphrase-file',
213
195
passfile.name]
214
196
+ self.gnupgargs,
222
204
223
205
def decrypt(self, data, password):
224
206
passphrase = self.password_encode(password)
225
with tempfile.NamedTemporaryFile(
226
dir = self.tempdir) as passfile:
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
227
209
passfile.write(passphrase)
228
210
passfile.flush()
229
proc = subprocess.Popen([self.gpg, '--decrypt',
211
proc = subprocess.Popen(['gpg', '--decrypt',
230
212
'--passphrase-file',
231
213
passfile.name]
232
214
+ self.gnupgargs,
233
215
stdin = subprocess.PIPE,
234
216
stdout = subprocess.PIPE,
235
217
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
237
220
if proc.returncode != 0:
238
221
raise PGPError(err)
239
222
return decrypted_plaintext
245
228
return super(AvahiError, self).__init__(value, *args,
246
229
**kwargs)
247
230
248
249
231
class AvahiServiceError(AvahiError):
250
232
pass
251
233
252
253
234
class AvahiGroupError(AvahiError):
254
235
pass
255
236
275
256
bus: dbus.SystemBus()
276
257
"""
277
258
278
def __init__(self,
279
interface = avahi.IF_UNSPEC,
280
name = None,
281
servicetype = None,
282
port = None,
283
TXT = None,
284
domain = "",
285
host = "",
286
max_renames = 32768,
287
protocol = avahi.PROTO_UNSPEC,
288
bus = None):
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
289
263
self.interface = interface
290
264
self.name = name
291
265
self.type = servicetype
301
275
self.bus = bus
302
276
self.entry_group_state_changed_match = None
303
277
304
def rename(self, remove=True):
278
def rename(self):
305
279
"""Derived from the Avahi example code"""
306
280
if self.rename_count >= self.max_renames:
307
281
logger.critical("No suitable Zeroconf service name found"
308
282
" after %i retries, exiting.",
309
283
self.rename_count)
310
284
raise AvahiServiceError("Too many renames")
311
self.name = str(
312
self.server.GetAlternativeServiceName(self.name))
313
self.rename_count += 1
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
314
287
logger.info("Changing Zeroconf service name to %r ...",
315
288
self.name)
316
if remove:
317
self.remove()
289
self.remove()
318
290
try:
319
291
self.add()
320
292
except dbus.exceptions.DBusException as error:
321
if (error.get_dbus_name()
322
== "org.freedesktop.Avahi.CollisionError"):
323
logger.info("Local Zeroconf service name collision.")
324
return self.rename(remove=False)
325
else:
326
logger.critical("D-Bus Exception", exc_info=error)
327
self.cleanup()
328
os._exit(1)
293
logger.critical("D-Bus Exception", exc_info=error)
294
self.cleanup()
295
os._exit(1)
296
self.rename_count += 1
329
297
330
298
def remove(self):
331
299
"""Derived from the Avahi example code"""
370
338
elif state == avahi.ENTRY_GROUP_FAILURE:
371
339
logger.critical("Avahi: Error in group state changed %s",
372
340
str(error))
373
raise AvahiGroupError("State changed: {!s}".format(error))
341
raise AvahiGroupError("State changed: {!s}"
342
.format(error))
374
343
375
344
def cleanup(self):
376
345
"""Derived from the Avahi example code"""
386
355
def server_state_changed(self, state, error=None):
387
356
"""Derived from the Avahi example code"""
388
357
logger.debug("Avahi server state change: %i", state)
389
bad_states = {
390
avahi.SERVER_INVALID: "Zeroconf server invalid",
391
avahi.SERVER_REGISTERING: None,
392
avahi.SERVER_COLLISION: "Zeroconf server name collision",
393
avahi.SERVER_FAILURE: "Zeroconf server failure",
394
}
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
395
365
if state in bad_states:
396
366
if bad_states[state] is not None:
397
367
if error is None:
400
370
logger.error(bad_states[state] + ": %r", error)
401
371
self.cleanup()
402
372
elif state == avahi.SERVER_RUNNING:
403
try:
404
self.add()
405
except dbus.exceptions.DBusException as error:
406
if (error.get_dbus_name()
407
== "org.freedesktop.Avahi.CollisionError"):
408
logger.info("Local Zeroconf service name"
409
" collision.")
410
return self.rename(remove=False)
411
else:
412
logger.critical("D-Bus Exception", exc_info=error)
413
self.cleanup()
414
os._exit(1)
373
self.add()
415
374
else:
416
375
if error is None:
417
376
logger.debug("Unknown state: %r", state)
427
386
follow_name_owner_changes=True),
428
387
avahi.DBUS_INTERFACE_SERVER)
429
388
self.server.connect_to_signal("StateChanged",
430
self.server_state_changed)
389
self.server_state_changed)
431
390
self.server_state_changed(self.server.GetState())
432
391
433
392
434
393
class AvahiServiceToSyslog(AvahiService):
435
def rename(self, *args, **kwargs):
394
def rename(self):
436
395
"""Add the new name to the syslog messages"""
437
ret = AvahiService.rename(self, *args, **kwargs)
438
syslogger.setFormatter(logging.Formatter(
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
440
.format(self.name)))
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
441
401
return ret
442
402
443
# Pretend that we have a GnuTLS module
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
447
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
451
def __init__(self):
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
454
# happens.
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
458
459
# Unless otherwise indicated, the constants and types below are
460
# all from the gnutls/gnutls.h C header file.
461
462
# Constants
463
E_SUCCESS = 0
464
E_INTERRUPTED = -52
465
E_AGAIN = -28
466
CRT_OPENPGP = 2
467
CLIENT = 2
468
SHUT_RDWR = 0
469
CRD_CERTIFICATE = 1
470
E_NO_CERTIFICATE_FOUND = -49
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
472
473
# Types
474
class session_int(ctypes.Structure):
475
_fields_ = []
476
session_t = ctypes.POINTER(session_int)
477
class certificate_credentials_st(ctypes.Structure):
478
_fields_ = []
479
certificate_credentials_t = ctypes.POINTER(
480
certificate_credentials_st)
481
certificate_type_t = ctypes.c_int
482
class datum_t(ctypes.Structure):
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
('size', ctypes.c_uint)]
485
class openpgp_crt_int(ctypes.Structure):
486
_fields_ = []
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
credentials_type_t = ctypes.c_int #
491
transport_ptr_t = ctypes.c_void_p
492
close_request_t = ctypes.c_int
493
494
# Exceptions
495
class Error(Exception):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
501
# Default usage is by a message string, but if a return
502
# code is passed, convert it to a string with
503
# gnutls.strerror()
504
self.code = code
505
if message is None and code is not None:
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
508
message, *args)
509
510
class CertificateSecurityError(Error):
511
pass
512
513
# Classes
514
class Credentials(object):
515
def __init__(self):
516
self._c_object = gnutls.certificate_credentials_t()
517
gnutls.certificate_allocate_credentials(
518
ctypes.byref(self._c_object))
519
self.type = gnutls.CRD_CERTIFICATE
520
521
def __del__(self):
522
gnutls.certificate_free_credentials(self._c_object)
523
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
526
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
528
gnutls.set_default_priority(self._c_object)
529
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
gnutls.handshake_set_private_extensions(self._c_object,
531
True)
532
self.socket = socket
533
if credentials is None:
534
credentials = gnutls.Credentials()
535
gnutls.credentials_set(self._c_object, credentials.type,
536
ctypes.cast(credentials._c_object,
537
ctypes.c_void_p))
538
self.credentials = credentials
539
540
def __del__(self):
541
gnutls.deinit(self._c_object)
542
543
def handshake(self):
544
return gnutls.handshake(self._c_object)
545
546
def send(self, data):
547
data = bytes(data)
548
data_len = len(data)
549
while data_len > 0:
550
data_len -= gnutls.record_send(self._c_object,
551
data[-data_len:],
552
data_len)
553
554
def bye(self):
555
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
557
# Error handling functions
558
def _error_code(result):
559
"""A function to raise exceptions on errors, suitable
560
for the 'restype' attribute on ctypes functions"""
561
if result >= 0:
562
return result
563
if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
566
567
def _retry_on_error(result, func, arguments):
568
"""A function to retry on some errors, suitable
569
for the 'errcheck' attribute on ctypes functions"""
570
while result < 0:
571
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
572
return _error_code(result)
573
result = func(*arguments)
574
return result
575
576
# Unless otherwise indicated, the function declarations below are
577
# all from the gnutls/gnutls.h C header file.
578
579
# Functions
580
priority_set_direct = _library.gnutls_priority_set_direct
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
ctypes.POINTER(ctypes.c_char_p)]
583
priority_set_direct.restype = _error_code
584
585
init = _library.gnutls_init
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
init.restype = _error_code
588
589
set_default_priority = _library.gnutls_set_default_priority
590
set_default_priority.argtypes = [session_t]
591
set_default_priority.restype = _error_code
592
593
record_send = _library.gnutls_record_send
594
record_send.argtypes = [session_t, ctypes.c_void_p,
595
ctypes.c_size_t]
596
record_send.restype = ctypes.c_ssize_t
597
record_send.errcheck = _retry_on_error
598
599
certificate_allocate_credentials = (
600
_library.gnutls_certificate_allocate_credentials)
601
certificate_allocate_credentials.argtypes = [
602
ctypes.POINTER(certificate_credentials_t)]
603
certificate_allocate_credentials.restype = _error_code
604
605
certificate_free_credentials = (
606
_library.gnutls_certificate_free_credentials)
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
608
certificate_free_credentials.restype = None
609
610
handshake_set_private_extensions = (
611
_library.gnutls_handshake_set_private_extensions)
612
handshake_set_private_extensions.argtypes = [session_t,
613
ctypes.c_int]
614
handshake_set_private_extensions.restype = None
615
616
credentials_set = _library.gnutls_credentials_set
617
credentials_set.argtypes = [session_t, credentials_type_t,
618
ctypes.c_void_p]
619
credentials_set.restype = _error_code
620
621
strerror = _library.gnutls_strerror
622
strerror.argtypes = [ctypes.c_int]
623
strerror.restype = ctypes.c_char_p
624
625
certificate_type_get = _library.gnutls_certificate_type_get
626
certificate_type_get.argtypes = [session_t]
627
certificate_type_get.restype = _error_code
628
629
certificate_get_peers = _library.gnutls_certificate_get_peers
630
certificate_get_peers.argtypes = [session_t,
631
ctypes.POINTER(ctypes.c_uint)]
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
634
global_set_log_level = _library.gnutls_global_set_log_level
635
global_set_log_level.argtypes = [ctypes.c_int]
636
global_set_log_level.restype = None
637
638
global_set_log_function = _library.gnutls_global_set_log_function
639
global_set_log_function.argtypes = [log_func]
640
global_set_log_function.restype = None
641
642
deinit = _library.gnutls_deinit
643
deinit.argtypes = [session_t]
644
deinit.restype = None
645
646
handshake = _library.gnutls_handshake
647
handshake.argtypes = [session_t]
648
handshake.restype = _error_code
649
handshake.errcheck = _retry_on_error
650
651
transport_set_ptr = _library.gnutls_transport_set_ptr
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
transport_set_ptr.restype = None
654
655
bye = _library.gnutls_bye
656
bye.argtypes = [session_t, close_request_t]
657
bye.restype = _error_code
658
bye.errcheck = _retry_on_error
659
660
check_version = _library.gnutls_check_version
661
check_version.argtypes = [ctypes.c_char_p]
662
check_version.restype = ctypes.c_char_p
663
664
# All the function declarations below are from gnutls/openpgp.h
665
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
669
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
673
openpgp_crt_fmt_t]
674
openpgp_crt_import.restype = _error_code
675
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
680
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
684
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
ctypes.c_void_p,
689
ctypes.POINTER(
690
ctypes.c_size_t)]
691
openpgp_crt_get_fingerprint.restype = _error_code
692
693
# Remove non-public functions
694
del _error_code, _retry_on_error
695
# Create the global "gnutls" object, simulating a module
696
gnutls = GnuTLS()
697
698
def call_pipe(connection, # : multiprocessing.Connection
699
func, *args, **kwargs):
700
"""This function is meant to be called by multiprocessing.Process
701
702
This function runs func(*args, **kwargs), and writes the resulting
703
return value on the provided multiprocessing.Connection.
704
"""
705
connection.send(func(*args, **kwargs))
706
connection.close()
707
403
708
404
class Client(object):
709
405
"""A representation of a client host served by this server.
736
432
last_checker_status: integer between 0 and 255 reflecting exit
737
433
status of last checker. -1 reflects crashed
738
434
checker, -2 means no checker completed yet.
739
last_checker_signal: The signal which killed the last checker, if
740
last_checker_status is -1
741
435
last_enabled: datetime.datetime(); (UTC) or None
742
436
name: string; from the config file, used in log messages and
743
437
D-Bus identifiers
756
450
"fingerprint", "host", "interval",
757
451
"last_approval_request", "last_checked_ok",
758
452
"last_enabled", "name", "timeout")
759
client_defaults = {
760
"timeout": "PT5M",
761
"extended_timeout": "PT15M",
762
"interval": "PT2M",
763
"checker": "fping -q -- %%(host)s",
764
"host": "",
765
"approval_delay": "PT0S",
766
"approval_duration": "PT1S",
767
"approved_by_default": "True",
768
"enabled": "True",
769
}
453
client_defaults = { "timeout": "PT5M",
454
"extended_timeout": "PT15M",
455
"interval": "PT2M",
456
"checker": "fping -q -- %%(host)s",
457
"host": "",
458
"approval_delay": "PT0S",
459
"approval_duration": "PT1S",
460
"approved_by_default": "True",
461
"enabled": "True",
462
}
770
463
771
464
@staticmethod
772
465
def config_parser(config):
788
481
client["enabled"] = config.getboolean(client_name,
789
482
"enabled")
790
483
791
# Uppercase and remove spaces from fingerprint for later
792
# comparison purposes with return value from the
793
# fingerprint() function
794
484
client["fingerprint"] = (section["fingerprint"].upper()
795
485
.replace(" ", ""))
796
486
if "secret" in section:
838
528
self.expires = None
839
529
840
530
logger.debug("Creating client %r", self.name)
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the fingerprint()
533
# function
841
534
logger.debug(" Fingerprint: %s", self.fingerprint)
842
535
self.created = settings.get("created",
843
536
datetime.datetime.utcnow())
850
543
self.current_checker_command = None
851
544
self.approved = None
852
545
self.approvals_pending = 0
853
self.changedstate = multiprocessing_manager.Condition(
854
multiprocessing_manager.Lock())
855
self.client_structure = [attr
856
for attr in self.__dict__.iterkeys()
546
self.changedstate = (multiprocessing_manager
547
.Condition(multiprocessing_manager
548
.Lock()))
549
self.client_structure = [attr for attr in
550
self.__dict__.iterkeys()
857
551
if not attr.startswith("_")]
858
552
self.client_structure.append("client_structure")
859
553
860
for name, t in inspect.getmembers(
861
type(self), lambda obj: isinstance(obj, property)):
554
for name, t in inspect.getmembers(type(self),
555
lambda obj:
556
isinstance(obj,
557
property)):
862
558
if not name.startswith("_"):
863
559
self.client_structure.append(name)
864
560
906
602
# and every interval from then on.
907
603
if self.checker_initiator_tag is not None:
908
604
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
910
int(self.interval.total_seconds() * 1000),
911
self.start_checker)
605
self.checker_initiator_tag = (gobject.timeout_add
606
(int(self.interval
607
.total_seconds() * 1000),
608
self.start_checker))
912
609
# Schedule a disable() when 'timeout' has passed
913
610
if self.disable_initiator_tag is not None:
914
611
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
916
int(self.timeout.total_seconds() * 1000), self.disable)
612
self.disable_initiator_tag = (gobject.timeout_add
613
(int(self.timeout
614
.total_seconds() * 1000),
615
self.disable))
917
616
# Also start a new checker *right now*.
918
617
self.start_checker()
919
618
920
def checker_callback(self, source, condition, connection,
921
command):
619
def checker_callback(self, pid, condition, command):
922
620
"""The checker has completed, so take appropriate actions."""
923
621
self.checker_callback_tag = None
924
622
self.checker = None
925
# Read return code from connection (see call_pipe)
926
returncode = connection.recv()
927
connection.close()
928
929
if returncode >= 0:
930
self.last_checker_status = returncode
931
self.last_checker_signal = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
932
625
if self.last_checker_status == 0:
933
626
logger.info("Checker for %(name)s succeeded",
934
627
vars(self))
935
628
self.checked_ok()
936
629
else:
937
logger.info("Checker for %(name)s failed", vars(self))
630
logger.info("Checker for %(name)s failed",
631
vars(self))
938
632
else:
939
633
self.last_checker_status = -1
940
self.last_checker_signal = -returncode
941
634
logger.warning("Checker for %(name)s crashed?",
942
635
vars(self))
943
return False
944
636
945
637
def checked_ok(self):
946
638
"""Assert that the client has been seen, alive and well."""
947
639
self.last_checked_ok = datetime.datetime.utcnow()
948
640
self.last_checker_status = 0
949
self.last_checker_signal = None
950
641
self.bump_timeout()
951
642
952
643
def bump_timeout(self, timeout=None):
957
648
gobject.source_remove(self.disable_initiator_tag)
958
649
self.disable_initiator_tag = None
959
650
if getattr(self, "enabled", False):
960
self.disable_initiator_tag = gobject.timeout_add(
961
int(timeout.total_seconds() * 1000), self.disable)
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
962
654
self.expires = datetime.datetime.utcnow() + timeout
963
655
964
656
def need_approval(self):
978
670
# than 'timeout' for the client to be disabled, which is as it
979
671
# should be.
980
672
981
if self.checker is not None and not self.checker.is_alive():
982
logger.warning("Checker was not alive; joining")
983
self.checker.join()
984
self.checker = None
673
# If a checker exists, make sure it is not a zombie
674
try:
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
677
pass
678
except OSError as error:
679
if error.errno != errno.ECHILD:
680
raise
681
else:
682
if pid:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
985
687
# Start a new checker if needed
986
688
if self.checker is None:
987
689
# Escape attributes for the shell
988
escaped_attrs = {
989
attr: re.escape(str(getattr(self, attr)))
990
for attr in self.runtime_expansions }
690
escaped_attrs = { attr:
691
re.escape(str(getattr(self, attr)))
692
for attr in self.runtime_expansions }
991
693
try:
992
694
command = self.checker_command % escaped_attrs
993
695
except TypeError as error:
994
696
logger.error('Could not format string "%s"',
995
self.checker_command,
697
self.checker_command, exc_info=error)
698
return True # Try again later
699
self.current_checker_command = command
700
try:
701
logger.info("Starting checker %r for %s",
702
command, self.name)
703
# We don't need to redirect stdout and stderr, since
704
# in normal mode, that is already done by daemon(),
705
# and in debug mode we don't want to. (Stdin is
706
# always replaced by /dev/null.)
707
# The exception is when not debugging but nevertheless
708
# running in the foreground; use the previously
709
# created wnull.
710
popen_args = {}
711
if (not self.server_settings["debug"]
712
and self.server_settings["foreground"]):
713
popen_args.update({"stdout": wnull,
714
"stderr": wnull })
715
self.checker = subprocess.Popen(command,
716
close_fds=True,
717
shell=True, cwd="/",
718
**popen_args)
719
except OSError as error:
720
logger.error("Failed to start subprocess",
996
721
exc_info=error)
997
return True # Try again later
998
self.current_checker_command = command
999
logger.info("Starting checker %r for %s", command,
1000
self.name)
1001
# We don't need to redirect stdout and stderr, since
1002
# in normal mode, that is already done by daemon(),
1003
# and in debug mode we don't want to. (Stdin is
1004
# always replaced by /dev/null.)
1005
# The exception is when not debugging but nevertheless
1006
# running in the foreground; use the previously
1007
# created wnull.
1008
popen_args = { "close_fds": True,
1009
"shell": True,
1010
"cwd": "/" }
1011
if (not self.server_settings["debug"]
1012
and self.server_settings["foreground"]):
1013
popen_args.update({"stdout": wnull,
1014
"stderr": wnull })
1015
pipe = multiprocessing.Pipe(duplex = False)
1016
self.checker = multiprocessing.Process(
1017
target = call_pipe,
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1020
self.checker.start()
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1023
self.checker_callback, pipe[0], command)
722
return True
723
self.checker_callback_tag = (gobject.child_watch_add
724
(self.checker.pid,
725
self.checker_callback,
726
data=command))
727
# The checker may have completed before the gobject
728
# watch was added. Check for this.
729
try:
730
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
731
except OSError as error:
732
if error.errno == errno.ECHILD:
733
# This should never happen
734
logger.error("Child process vanished",
735
exc_info=error)
736
return True
737
raise
738
if pid:
739
gobject.source_remove(self.checker_callback_tag)
740
self.checker_callback(pid, status, command)
1024
741
# Re-run this periodically if run by gobject.timeout_add
1025
742
return True
1026
743
1032
749
if getattr(self, "checker", None) is None:
1033
750
return
1034
751
logger.debug("Stopping checker for %(name)s", vars(self))
1035
self.checker.terminate()
752
try:
753
self.checker.terminate()
754
#time.sleep(0.5)
755
#if self.checker.poll() is None:
756
# self.checker.kill()
757
except OSError as error:
758
if error.errno != errno.ESRCH: # No such process
759
raise
1036
760
self.checker = None
1037
761
1038
762
1039
def dbus_service_property(dbus_interface,
1040
signature="v",
1041
access="readwrite",
1042
byte_arrays=False):
763
def dbus_service_property(dbus_interface, signature="v",
764
access="readwrite", byte_arrays=False):
1043
765
"""Decorators for marking methods of a DBusObjectWithProperties to
1044
766
become properties on the D-Bus.
1045
767
1055
777
if byte_arrays and signature != "ay":
1056
778
raise ValueError("Byte arrays not supported for non-'ay'"
1057
779
" signature {!r}".format(signature))
1058
1059
780
def decorator(func):
1060
781
func._dbus_is_property = True
1061
782
func._dbus_interface = dbus_interface
1066
787
func._dbus_name = func._dbus_name[:-14]
1067
788
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1068
789
return func
1069
1070
790
return decorator
1071
791
1072
792
1081
801
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1082
802
"false"}
1083
803
"""
1084
1085
804
def decorator(func):
1086
805
func._dbus_is_interface = True
1087
806
func._dbus_interface = dbus_interface
1088
807
func._dbus_name = dbus_interface
1089
808
return func
1090
1091
809
return decorator
1092
810
1093
811
1095
813
"""Decorator to annotate D-Bus methods, signals or properties
1096
814
Usage:
1097
815
1098
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1099
"org.freedesktop.DBus.Property."
1100
"EmitsChangedSignal": "false"})
1101
816
@dbus_service_property("org.example.Interface", signature="b",
1102
817
access="r")
818
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
819
"org.freedesktop.DBus.Property."
820
"EmitsChangedSignal": "false"})
1103
821
def Property_dbus_property(self):
1104
822
return dbus.Boolean(False)
1105
1106
See also the DBusObjectWithAnnotations class.
1107
823
"""
1108
1109
824
def decorator(func):
1110
825
func._dbus_annotations = annotations
1111
826
return func
1112
1113
827
return decorator
1114
828
1115
829
1118
832
"""
1119
833
pass
1120
834
1121
1122
835
class DBusPropertyAccessException(DBusPropertyException):
1123
836
"""A property's access permissions disallows an operation.
1124
837
"""
1131
844
pass
1132
845
1133
846
1134
class DBusObjectWithAnnotations(dbus.service.Object):
1135
"""A D-Bus object with annotations.
847
class DBusObjectWithProperties(dbus.service.Object):
848
"""A D-Bus object with properties.
1136
849
1137
Classes inheriting from this can use the dbus_annotations
1138
decorator to add annotations to methods or signals.
850
Classes inheriting from this can use the dbus_service_property
851
decorator to expose methods as D-Bus properties. It exposes the
852
standard Get(), Set(), and GetAll() methods on the D-Bus.
1139
853
"""
1140
854
1141
855
@staticmethod
1151
865
def _get_all_dbus_things(self, thing):
1152
866
"""Returns a generator of (name, attribute) pairs
1153
867
"""
1154
return ((getattr(athing.__get__(self), "_dbus_name", name),
868
return ((getattr(athing.__get__(self), "_dbus_name",
869
name),
1155
870
athing.__get__(self))
1156
871
for cls in self.__class__.__mro__
1157
872
for name, athing in
1158
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1164
def Introspect(self, object_path, connection):
1165
"""Overloading of standard D-Bus method.
1166
1167
Inserts annotation tags on methods and signals.
1168
"""
1169
xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
connection)
1171
try:
1172
document = xml.dom.minidom.parseString(xmlstring)
1173
1174
for if_tag in document.getElementsByTagName("interface"):
1175
# Add annotation tags
1176
for typ in ("method", "signal"):
1177
for tag in if_tag.getElementsByTagName(typ):
1178
annots = dict()
1179
for name, prop in (self.
1180
_get_all_dbus_things(typ)):
1181
if (name == tag.getAttribute("name")
1182
and prop._dbus_interface
1183
== if_tag.getAttribute("name")):
1184
annots.update(getattr(
1185
prop, "_dbus_annotations", {}))
1186
for name, value in annots.items():
1187
ann_tag = document.createElement(
1188
"annotation")
1189
ann_tag.setAttribute("name", name)
1190
ann_tag.setAttribute("value", value)
1191
tag.appendChild(ann_tag)
1192
# Add interface annotation tags
1193
for annotation, value in dict(
1194
itertools.chain.from_iterable(
1195
annotations().items()
1196
for name, annotations
1197
in self._get_all_dbus_things("interface")
1198
if name == if_tag.getAttribute("name")
1199
)).items():
1200
ann_tag = document.createElement("annotation")
1201
ann_tag.setAttribute("name", annotation)
1202
ann_tag.setAttribute("value", value)
1203
if_tag.appendChild(ann_tag)
1204
# Fix argument name for the Introspect method itself
1205
if (if_tag.getAttribute("name")
1206
== dbus.INTROSPECTABLE_IFACE):
1207
for cn in if_tag.getElementsByTagName("method"):
1208
if cn.getAttribute("name") == "Introspect":
1209
for arg in cn.getElementsByTagName("arg"):
1210
if (arg.getAttribute("direction")
1211
== "out"):
1212
arg.setAttribute("name",
1213
"xml_data")
1214
xmlstring = document.toxml("utf-8")
1215
document.unlink()
1216
except (AttributeError, xml.dom.DOMException,
1217
xml.parsers.expat.ExpatError) as error:
1218
logger.error("Failed to override Introspection method",
1219
exc_info=error)
1220
return xmlstring
1221
1222
1223
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
"""A D-Bus object with properties.
1225
1226
Classes inheriting from this can use the dbus_service_property
1227
decorator to expose methods as D-Bus properties. It exposes the
1228
standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
"""
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
1230
875
1231
876
def _get_dbus_property(self, interface_name, property_name):
1232
877
"""Returns a bound method if one exists which is a D-Bus
1233
878
property with the specified name and interface.
1234
879
"""
1235
for cls in self.__class__.__mro__:
1236
for name, value in inspect.getmembers(
1237
cls, self._is_dbus_thing("property")):
880
for cls in self.__class__.__mro__:
881
for name, value in (inspect.getmembers
882
(cls,
883
self._is_dbus_thing("property"))):
1238
884
if (value._dbus_name == property_name
1239
885
and value._dbus_interface == interface_name):
1240
886
return value.__get__(self)
1241
887
1242
888
# No such property
1243
raise DBusPropertyNotFound("{}:{}.{}".format(
1244
self.dbus_object_path, interface_name, property_name))
1245
1246
@classmethod
1247
def _get_all_interface_names(cls):
1248
"""Get a sequence of all interfaces supported by an object"""
1249
return (name for name in set(getattr(getattr(x, attr),
1250
"_dbus_interface", None)
1251
for x in (inspect.getmro(cls))
1252
for attr in dir(x))
1253
if name is not None)
1254
1255
@dbus.service.method(dbus.PROPERTIES_IFACE,
1256
in_signature="ss",
889
raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
+ interface_name + "."
891
+ property_name)
892
893
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1257
894
out_signature="v")
1258
895
def Get(self, interface_name, property_name):
1259
896
"""Standard D-Bus property Get() method, see D-Bus standard.
1284
921
for byte in value))
1285
922
prop(value)
1286
923
1287
@dbus.service.method(dbus.PROPERTIES_IFACE,
1288
in_signature="s",
924
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1289
925
out_signature="a{sv}")
1290
926
def GetAll(self, interface_name):
1291
927
"""Standard D-Bus property GetAll() method, see D-Bus
1306
942
if not hasattr(value, "variant_level"):
1307
943
properties[name] = value
1308
944
continue
1309
properties[name] = type(value)(
1310
value, variant_level = value.variant_level + 1)
945
properties[name] = type(value)(value, variant_level=
946
value.variant_level+1)
1311
947
return dbus.Dictionary(properties, signature="sv")
1312
948
1313
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1314
def PropertiesChanged(self, interface_name, changed_properties,
1315
invalidated_properties):
1316
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1317
standard.
1318
"""
1319
pass
1320
1321
949
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1322
950
out_signature="s",
1323
951
path_keyword='object_path',
1327
955
1328
956
Inserts property tags and interface annotation tags.
1329
957
"""
1330
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1331
object_path,
1332
connection)
958
xmlstring = dbus.service.Object.Introspect(self, object_path,
959
connection)
1333
960
try:
1334
961
document = xml.dom.minidom.parseString(xmlstring)
1335
1336
962
def make_tag(document, name, prop):
1337
963
e = document.createElement("property")
1338
964
e.setAttribute("name", name)
1339
965
e.setAttribute("type", prop._dbus_signature)
1340
966
e.setAttribute("access", prop._dbus_access)
1341
967
return e
1342
1343
968
for if_tag in document.getElementsByTagName("interface"):
1344
969
# Add property tags
1345
970
for tag in (make_tag(document, name, prop)
1348
973
if prop._dbus_interface
1349
974
== if_tag.getAttribute("name")):
1350
975
if_tag.appendChild(tag)
1351
# Add annotation tags for properties
1352
for tag in if_tag.getElementsByTagName("property"):
1353
annots = dict()
1354
for name, prop in self._get_all_dbus_things(
1355
"property"):
1356
if (name == tag.getAttribute("name")
1357
and prop._dbus_interface
1358
== if_tag.getAttribute("name")):
1359
annots.update(getattr(
1360
prop, "_dbus_annotations", {}))
1361
for name, value in annots.items():
1362
ann_tag = document.createElement(
1363
"annotation")
1364
ann_tag.setAttribute("name", name)
1365
ann_tag.setAttribute("value", value)
1366
tag.appendChild(ann_tag)
976
# Add annotation tags
977
for typ in ("method", "signal", "property"):
978
for tag in if_tag.getElementsByTagName(typ):
979
annots = dict()
980
for name, prop in (self.
981
_get_all_dbus_things(typ)):
982
if (name == tag.getAttribute("name")
983
and prop._dbus_interface
984
== if_tag.getAttribute("name")):
985
annots.update(getattr
986
(prop,
987
"_dbus_annotations",
988
{}))
989
for name, value in annots.items():
990
ann_tag = document.createElement(
991
"annotation")
992
ann_tag.setAttribute("name", name)
993
ann_tag.setAttribute("value", value)
994
tag.appendChild(ann_tag)
995
# Add interface annotation tags
996
for annotation, value in dict(
997
itertools.chain.from_iterable(
998
annotations().items()
999
for name, annotations in
1000
self._get_all_dbus_things("interface")
1001
if name == if_tag.getAttribute("name")
1002
)).items():
1003
ann_tag = document.createElement("annotation")
1004
ann_tag.setAttribute("name", annotation)
1005
ann_tag.setAttribute("value", value)
1006
if_tag.appendChild(ann_tag)
1367
1007
# Add the names to the return values for the
1368
1008
# "org.freedesktop.DBus.Properties" methods
1369
1009
if (if_tag.getAttribute("name")
1387
1027
exc_info=error)
1388
1028
return xmlstring
1389
1029
1390
try:
1391
dbus.OBJECT_MANAGER_IFACE
1392
except AttributeError:
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
"""A D-Bus object with an ObjectManager.
1397
1398
Classes inheriting from this exposes the standard
1399
GetManagedObjects call and the InterfacesAdded and
1400
InterfacesRemoved signals on the standard
1401
"org.freedesktop.DBus.ObjectManager" interface.
1402
1403
Note: No signals are sent automatically; they must be sent
1404
manually.
1405
"""
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
out_signature = "a{oa{sa{sv}}}")
1408
def GetManagedObjects(self):
1409
"""This function must be overridden"""
1410
raise NotImplementedError()
1411
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
signature = "oa{sa{sv}}")
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
pass
1416
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1418
def InterfacesRemoved(self, object_path, interfaces):
1419
pass
1420
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1425
def Introspect(self, object_path, connection):
1426
"""Overloading of standard D-Bus method.
1427
1428
Override return argument name of GetManagedObjects to be
1429
"objpath_interfaces_and_properties"
1430
"""
1431
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1432
object_path,
1433
connection)
1434
try:
1435
document = xml.dom.minidom.parseString(xmlstring)
1436
1437
for if_tag in document.getElementsByTagName("interface"):
1438
# Fix argument name for the GetManagedObjects method
1439
if (if_tag.getAttribute("name")
1440
== dbus.OBJECT_MANAGER_IFACE):
1441
for cn in if_tag.getElementsByTagName("method"):
1442
if (cn.getAttribute("name")
1443
== "GetManagedObjects"):
1444
for arg in cn.getElementsByTagName("arg"):
1445
if (arg.getAttribute("direction")
1446
== "out"):
1447
arg.setAttribute(
1448
"name",
1449
"objpath_interfaces"
1450
"_and_properties")
1451
xmlstring = document.toxml("utf-8")
1452
document.unlink()
1453
except (AttributeError, xml.dom.DOMException,
1454
xml.parsers.expat.ExpatError) as error:
1455
logger.error("Failed to override Introspection method",
1456
exc_info = error)
1457
return xmlstring
1458
1030
1459
1031
def datetime_to_dbus(dt, variant_level=0):
1460
1032
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1461
1033
if dt is None:
1462
1034
return dbus.String("", variant_level = variant_level)
1463
return dbus.String(dt.isoformat(), variant_level=variant_level)
1035
return dbus.String(dt.isoformat(),
1036
variant_level=variant_level)
1464
1037
1465
1038
1466
1039
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1486
1059
(from DBusObjectWithProperties) and interfaces (from the
1487
1060
dbus_interface_annotations decorator).
1488
1061
"""
1489
1490
1062
def wrapper(cls):
1491
1063
for orig_interface_name, alt_interface_name in (
1492
alt_interface_names.items()):
1064
alt_interface_names.items()):
1493
1065
attr = {}
1494
1066
interface_names = set()
1495
1067
# Go though all attributes of the class
1497
1069
# Ignore non-D-Bus attributes, and D-Bus attributes
1498
1070
# with the wrong interface name
1499
1071
if (not hasattr(attribute, "_dbus_interface")
1500
or not attribute._dbus_interface.startswith(
1501
orig_interface_name)):
1072
or not attribute._dbus_interface
1073
.startswith(orig_interface_name)):
1502
1074
continue
1503
1075
# Create an alternate D-Bus interface name based on
1504
1076
# the current name
1505
alt_interface = attribute._dbus_interface.replace(
1506
orig_interface_name, alt_interface_name)
1077
alt_interface = (attribute._dbus_interface
1078
.replace(orig_interface_name,
1079
alt_interface_name))
1507
1080
interface_names.add(alt_interface)
1508
1081
# Is this a D-Bus signal?
1509
1082
if getattr(attribute, "_dbus_is_signal", False):
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1513
nonmethod_func = (dict(
1083
# Extract the original non-method undecorated
1084
# function by black magic
1085
nonmethod_func = (dict(
1514
1086
zip(attribute.func_code.co_freevars,
1515
attribute.__closure__))
1516
["func"].cell_contents)
1517
else:
1518
nonmethod_func = attribute
1087
attribute.__closure__))["func"]
1088
.cell_contents)
1519
1089
# Create a new, but exactly alike, function
1520
1090
# object, and decorate it to be a new D-Bus signal
1521
1091
# with the alternate D-Bus interface name
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1529
else:
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1536
new_function = (dbus.service.signal(
1537
alt_interface,
1538
attribute._dbus_signature)(new_function))
1092
new_function = (dbus.service.signal
1093
(alt_interface,
1094
attribute._dbus_signature)
1095
(types.FunctionType(
1096
nonmethod_func.func_code,
1097
nonmethod_func.func_globals,
1098
nonmethod_func.func_name,
1099
nonmethod_func.func_defaults,
1100
nonmethod_func.func_closure)))
1539
1101
# Copy annotations, if any
1540
1102
try:
1541
new_function._dbus_annotations = dict(
1542
attribute._dbus_annotations)
1103
new_function._dbus_annotations = (
1104
dict(attribute._dbus_annotations))
1543
1105
except AttributeError:
1544
1106
pass
1545
1107
# Define a creator of a function to call both the
1550
1112
"""This function is a scope container to pass
1551
1113
func1 and func2 to the "call_both" function
1552
1114
outside of its arguments"""
1553
1554
@functools.wraps(func2)
1555
1115
def call_both(*args, **kwargs):
1556
1116
"""This function will emit two D-Bus
1557
1117
signals by calling func1 and func2"""
1558
1118
func1(*args, **kwargs)
1559
1119
func2(*args, **kwargs)
1560
# Make wrapper function look like a D-Bus signal
1561
for name, attr in inspect.getmembers(func2):
1562
if name.startswith("_dbus_"):
1563
setattr(call_both, name, attr)
1564
1565
1120
return call_both
1566
1121
# Create the "call_both" function and add it to
1567
1122
# the class
1572
1127
# object. Decorate it to be a new D-Bus method
1573
1128
# with the alternate D-Bus interface name. Add it
1574
1129
# to the class.
1575
attr[attrname] = (
1576
dbus.service.method(
1577
alt_interface,
1578
attribute._dbus_in_signature,
1579
attribute._dbus_out_signature)
1580
(types.FunctionType(attribute.func_code,
1581
attribute.func_globals,
1582
attribute.func_name,
1583
attribute.func_defaults,
1584
attribute.func_closure)))
1130
attr[attrname] = (dbus.service.method
1131
(alt_interface,
1132
attribute._dbus_in_signature,
1133
attribute._dbus_out_signature)
1134
(types.FunctionType
1135
(attribute.func_code,
1136
attribute.func_globals,
1137
attribute.func_name,
1138
attribute.func_defaults,
1139
attribute.func_closure)))
1585
1140
# Copy annotations, if any
1586
1141
try:
1587
attr[attrname]._dbus_annotations = dict(
1588
attribute._dbus_annotations)
1142
attr[attrname]._dbus_annotations = (
1143
dict(attribute._dbus_annotations))
1589
1144
except AttributeError:
1590
1145
pass
1591
1146
# Is this a D-Bus property?
1594
1149
# object, and decorate it to be a new D-Bus
1595
1150
# property with the alternate D-Bus interface
1596
1151
# name. Add it to the class.
1597
attr[attrname] = (dbus_service_property(
1598
alt_interface, attribute._dbus_signature,
1599
attribute._dbus_access,
1600
attribute._dbus_get_args_options
1601
["byte_arrays"])
1602
(types.FunctionType(
1603
attribute.func_code,
1604
attribute.func_globals,
1605
attribute.func_name,
1606
attribute.func_defaults,
1607
attribute.func_closure)))
1152
attr[attrname] = (dbus_service_property
1153
(alt_interface,
1154
attribute._dbus_signature,
1155
attribute._dbus_access,
1156
attribute
1157
._dbus_get_args_options
1158
["byte_arrays"])
1159
(types.FunctionType
1160
(attribute.func_code,
1161
attribute.func_globals,
1162
attribute.func_name,
1163
attribute.func_defaults,
1164
attribute.func_closure)))
1608
1165
# Copy annotations, if any
1609
1166
try:
1610
attr[attrname]._dbus_annotations = dict(
1611
attribute._dbus_annotations)
1167
attr[attrname]._dbus_annotations = (
1168
dict(attribute._dbus_annotations))
1612
1169
except AttributeError:
1613
1170
pass
1614
1171
# Is this a D-Bus interface?
1617
1174
# object. Decorate it to be a new D-Bus interface
1618
1175
# with the alternate D-Bus interface name. Add it
1619
1176
# to the class.
1620
attr[attrname] = (
1621
dbus_interface_annotations(alt_interface)
1622
(types.FunctionType(attribute.func_code,
1623
attribute.func_globals,
1624
attribute.func_name,
1625
attribute.func_defaults,
1626
attribute.func_closure)))
1177
attr[attrname] = (dbus_interface_annotations
1178
(alt_interface)
1179
(types.FunctionType
1180
(attribute.func_code,
1181
attribute.func_globals,
1182
attribute.func_name,
1183
attribute.func_defaults,
1184
attribute.func_closure)))
1627
1185
if deprecate:
1628
1186
# Deprecate all alternate interfaces
1629
1187
iname="_AlternateDBusNames_interface_annotation{}"
1630
1188
for interface_name in interface_names:
1631
1632
1189
@dbus_interface_annotations(interface_name)
1633
1190
def func(self):
1634
1191
return { "org.freedesktop.DBus.Deprecated":
1635
"true" }
1192
"true" }
1636
1193
# Find an unused name
1637
1194
for aname in (iname.format(i)
1638
1195
for i in itertools.count()):
1643
1200
# Replace the class with a new subclass of it with
1644
1201
# methods, signals, etc. as created above.
1645
1202
cls = type(b"{}Alternate".format(cls.__name__),
1646
(cls, ), attr)
1203
(cls,), attr)
1647
1204
return cls
1648
1649
1205
return wrapper
1650
1206
1651
1207
1652
1208
@alternate_dbus_interfaces({"se.recompile.Mandos":
1653
"se.bsnet.fukt.Mandos"})
1209
"se.bsnet.fukt.Mandos"})
1654
1210
class ClientDBus(Client, DBusObjectWithProperties):
1655
1211
"""A Client class using D-Bus
1656
1212
1660
1216
"""
1661
1217
1662
1218
runtime_expansions = (Client.runtime_expansions
1663
+ ("dbus_object_path", ))
1664
1665
_interface = "se.recompile.Mandos.Client"
1219
+ ("dbus_object_path",))
1666
1220
1667
1221
# dbus.service.Object doesn't use super(), so we can't either.
1668
1222
1674
1228
client_object_name = str(self.name).translate(
1675
1229
{ord("."): ord("_"),
1676
1230
ord("-"): ord("_")})
1677
self.dbus_object_path = dbus.ObjectPath(
1678
"/clients/" + client_object_name)
1231
self.dbus_object_path = (dbus.ObjectPath
1232
("/clients/" + client_object_name))
1679
1233
DBusObjectWithProperties.__init__(self, self.bus,
1680
1234
self.dbus_object_path)
1681
1235
1682
def notifychangeproperty(transform_func, dbus_name,
1683
type_func=lambda x: x,
1684
variant_level=1,
1685
invalidate_only=False,
1686
_interface=_interface):
1236
def notifychangeproperty(transform_func,
1237
dbus_name, type_func=lambda x: x,
1238
variant_level=1):
1687
1239
""" Modify a variable so that it's a property which announces
1688
1240
its changes to DBus.
1689
1241
1695
1247
variant_level: D-Bus variant level. Default: 1
1696
1248
"""
1697
1249
attrname = "_{}".format(dbus_name)
1698
1699
1250
def setter(self, value):
1700
1251
if hasattr(self, "dbus_object_path"):
1701
1252
if (not hasattr(self, attrname) or
1702
1253
type_func(getattr(self, attrname, None))
1703
1254
!= type_func(value)):
1704
if invalidate_only:
1705
self.PropertiesChanged(
1706
_interface, dbus.Dictionary(),
1707
dbus.Array((dbus_name, )))
1708
else:
1709
dbus_value = transform_func(
1710
type_func(value),
1711
variant_level = variant_level)
1712
self.PropertyChanged(dbus.String(dbus_name),
1713
dbus_value)
1714
self.PropertiesChanged(
1715
_interface,
1716
dbus.Dictionary({ dbus.String(dbus_name):
1717
dbus_value }),
1718
dbus.Array())
1255
dbus_value = transform_func(type_func(value),
1256
variant_level
1257
=variant_level)
1258
self.PropertyChanged(dbus.String(dbus_name),
1259
dbus_value)
1719
1260
setattr(self, attrname, value)
1720
1261
1721
1262
return property(lambda self: getattr(self, attrname), setter)
1727
1268
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1728
1269
last_enabled = notifychangeproperty(datetime_to_dbus,
1729
1270
"LastEnabled")
1730
checker = notifychangeproperty(
1731
dbus.Boolean, "CheckerRunning",
1732
type_func = lambda checker: checker is not None)
1271
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1272
type_func = lambda checker:
1273
checker is not None)
1733
1274
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1734
1275
"LastCheckedOK")
1735
1276
last_checker_status = notifychangeproperty(dbus.Int16,
1738
1279
datetime_to_dbus, "LastApprovalRequest")
1739
1280
approved_by_default = notifychangeproperty(dbus.Boolean,
1740
1281
"ApprovedByDefault")
1741
approval_delay = notifychangeproperty(
1742
dbus.UInt64, "ApprovalDelay",
1743
type_func = lambda td: td.total_seconds() * 1000)
1282
approval_delay = notifychangeproperty(dbus.UInt64,
1283
"ApprovalDelay",
1284
type_func =
1285
lambda td: td.total_seconds()
1286
* 1000)
1744
1287
approval_duration = notifychangeproperty(
1745
1288
dbus.UInt64, "ApprovalDuration",
1746
1289
type_func = lambda td: td.total_seconds() * 1000)
1747
1290
host = notifychangeproperty(dbus.String, "Host")
1748
timeout = notifychangeproperty(
1749
dbus.UInt64, "Timeout",
1750
type_func = lambda td: td.total_seconds() * 1000)
1291
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1292
type_func = lambda td:
1293
td.total_seconds() * 1000)
1751
1294
extended_timeout = notifychangeproperty(
1752
1295
dbus.UInt64, "ExtendedTimeout",
1753
1296
type_func = lambda td: td.total_seconds() * 1000)
1754
interval = notifychangeproperty(
1755
dbus.UInt64, "Interval",
1756
type_func = lambda td: td.total_seconds() * 1000)
1297
interval = notifychangeproperty(dbus.UInt64,
1298
"Interval",
1299
type_func =
1300
lambda td: td.total_seconds()
1301
* 1000)
1757
1302
checker_command = notifychangeproperty(dbus.String, "Checker")
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1759
invalidate_only=True)
1760
1303
1761
1304
del notifychangeproperty
1762
1305
1769
1312
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1770
1313
Client.__del__(self, *args, **kwargs)
1771
1314
1772
def checker_callback(self, source, condition,
1773
connection, command, *args, **kwargs):
1774
ret = Client.checker_callback(self, source, condition,
1775
connection, command, *args,
1776
**kwargs)
1777
exitstatus = self.last_checker_status
1778
if exitstatus >= 0:
1315
def checker_callback(self, pid, condition, command,
1316
*args, **kwargs):
1317
self.checker_callback_tag = None
1318
self.checker = None
1319
if os.WIFEXITED(condition):
1320
exitstatus = os.WEXITSTATUS(condition)
1779
1321
# Emit D-Bus signal
1780
1322
self.CheckerCompleted(dbus.Int16(exitstatus),
1781
# This is specific to GNU libC
1782
dbus.Int64(exitstatus << 8),
1323
dbus.Int64(condition),
1783
1324
dbus.String(command))
1784
1325
else:
1785
1326
# Emit D-Bus signal
1786
1327
self.CheckerCompleted(dbus.Int16(-1),
1787
dbus.Int64(
1788
# This is specific to GNU libC
1789
(exitstatus << 8)
1790
| self.last_checker_signal),
1328
dbus.Int64(condition),
1791
1329
dbus.String(command))
1792
return ret
1330
1331
return Client.checker_callback(self, pid, condition, command,
1332
*args, **kwargs)
1793
1333
1794
1334
def start_checker(self, *args, **kwargs):
1795
1335
old_checker_pid = getattr(self.checker, "pid", None)
1812
1352
self.send_changedstate()
1813
1353
1814
1354
## D-Bus methods, signals & properties
1355
_interface = "se.recompile.Mandos.Client"
1815
1356
1816
1357
## Interfaces
1817
1358
1359
@dbus_interface_annotations(_interface)
1360
def _foo(self):
1361
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1362
"false"}
1363
1818
1364
## Signals
1819
1365
1820
1366
# CheckerCompleted - signal
1830
1376
pass
1831
1377
1832
1378
# PropertyChanged - signal
1833
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1834
1379
@dbus.service.signal(_interface, signature="sv")
1835
1380
def PropertyChanged(self, property, value):
1836
1381
"D-Bus signal"
1870
1415
self.checked_ok()
1871
1416
1872
1417
# Enable - method
1873
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
1418
@dbus.service.method(_interface)
1875
1419
def Enable(self):
1876
1420
"D-Bus method"
1877
1421
self.enable()
1878
1422
1879
1423
# StartChecker - method
1880
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
1424
@dbus.service.method(_interface)
1882
1425
def StartChecker(self):
1883
1426
"D-Bus method"
1884
1427
self.start_checker()
1885
1428
1886
1429
# Disable - method
1887
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
1430
@dbus.service.method(_interface)
1889
1431
def Disable(self):
1890
1432
"D-Bus method"
1891
1433
self.disable()
1892
1434
1893
1435
# StopChecker - method
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
1436
@dbus.service.method(_interface)
1896
1437
def StopChecker(self):
1897
1438
self.stop_checker()
1904
1445
return dbus.Boolean(bool(self.approvals_pending))
1905
1446
1906
1447
# ApprovedByDefault - property
1907
@dbus_service_property(_interface,
1908
signature="b",
1448
@dbus_service_property(_interface, signature="b",
1909
1449
access="readwrite")
1910
1450
def ApprovedByDefault_dbus_property(self, value=None):
1911
1451
if value is None: # get
1913
1453
self.approved_by_default = bool(value)
1914
1454
1915
1455
# ApprovalDelay - property
1916
@dbus_service_property(_interface,
1917
signature="t",
1456
@dbus_service_property(_interface, signature="t",
1918
1457
access="readwrite")
1919
1458
def ApprovalDelay_dbus_property(self, value=None):
1920
1459
if value is None: # get
1923
1462
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1924
1463
1925
1464
# ApprovalDuration - property
1926
@dbus_service_property(_interface,
1927
signature="t",
1465
@dbus_service_property(_interface, signature="t",
1928
1466
access="readwrite")
1929
1467
def ApprovalDuration_dbus_property(self, value=None):
1930
1468
if value is None: # get
1933
1471
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
1472
1935
1473
# Name - property
1936
@dbus_annotations(
1937
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
1474
@dbus_service_property(_interface, signature="s", access="read")
1939
1475
def Name_dbus_property(self):
1940
1476
return dbus.String(self.name)
1941
1477
1942
1478
# Fingerprint - property
1943
@dbus_annotations(
1944
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
1479
@dbus_service_property(_interface, signature="s", access="read")
1946
1480
def Fingerprint_dbus_property(self):
1947
1481
return dbus.String(self.fingerprint)
1948
1482
1949
1483
# Host - property
1950
@dbus_service_property(_interface,
1951
signature="s",
1484
@dbus_service_property(_interface, signature="s",
1952
1485
access="readwrite")
1953
1486
def Host_dbus_property(self, value=None):
1954
1487
if value is None: # get
1956
1489
self.host = str(value)
1957
1490
1958
1491
# Created - property
1959
@dbus_annotations(
1960
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
1492
@dbus_service_property(_interface, signature="s", access="read")
1962
1493
def Created_dbus_property(self):
1963
1494
return datetime_to_dbus(self.created)
1968
1499
return datetime_to_dbus(self.last_enabled)
1969
1500
1970
1501
# Enabled - property
1971
@dbus_service_property(_interface,
1972
signature="b",
1502
@dbus_service_property(_interface, signature="b",
1973
1503
access="readwrite")
1974
1504
def Enabled_dbus_property(self, value=None):
1975
1505
if value is None: # get
1980
1510
self.disable()
1981
1511
1982
1512
# LastCheckedOK - property
1983
@dbus_service_property(_interface,
1984
signature="s",
1513
@dbus_service_property(_interface, signature="s",
1985
1514
access="readwrite")
1986
1515
def LastCheckedOK_dbus_property(self, value=None):
1987
1516
if value is not None:
1990
1519
return datetime_to_dbus(self.last_checked_ok)
1991
1520
1992
1521
# LastCheckerStatus - property
1993
@dbus_service_property(_interface, signature="n", access="read")
1522
@dbus_service_property(_interface, signature="n",
1523
access="read")
1994
1524
def LastCheckerStatus_dbus_property(self):
1995
1525
return dbus.Int16(self.last_checker_status)
1996
1526
2005
1535
return datetime_to_dbus(self.last_approval_request)
2006
1536
2007
1537
# Timeout - property
2008
@dbus_service_property(_interface,
2009
signature="t",
1538
@dbus_service_property(_interface, signature="t",
2010
1539
access="readwrite")
2011
1540
def Timeout_dbus_property(self, value=None):
2012
1541
if value is None: # get
2025
1554
is None):
2026
1555
return
2027
1556
gobject.source_remove(self.disable_initiator_tag)
2028
self.disable_initiator_tag = gobject.timeout_add(
2029
int((self.expires - now).total_seconds() * 1000),
2030
self.disable)
1557
self.disable_initiator_tag = (
1558
gobject.timeout_add(
1559
int((self.expires - now).total_seconds()
1560
* 1000), self.disable))
2031
1561
2032
1562
# ExtendedTimeout - property
2033
@dbus_service_property(_interface,
2034
signature="t",
1563
@dbus_service_property(_interface, signature="t",
2035
1564
access="readwrite")
2036
1565
def ExtendedTimeout_dbus_property(self, value=None):
2037
1566
if value is None: # get
2040
1569
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2041
1570
2042
1571
# Interval - property
2043
@dbus_service_property(_interface,
2044
signature="t",
1572
@dbus_service_property(_interface, signature="t",
2045
1573
access="readwrite")
2046
1574
def Interval_dbus_property(self, value=None):
2047
1575
if value is None: # get
2052
1580
if self.enabled:
2053
1581
# Reschedule checker run
2054
1582
gobject.source_remove(self.checker_initiator_tag)
2055
self.checker_initiator_tag = gobject.timeout_add(
2056
value, self.start_checker)
2057
self.start_checker() # Start one now, too
1583
self.checker_initiator_tag = (gobject.timeout_add
1584
(value, self.start_checker))
1585
self.start_checker() # Start one now, too
2058
1586
2059
1587
# Checker - property
2060
@dbus_service_property(_interface,
2061
signature="s",
1588
@dbus_service_property(_interface, signature="s",
2062
1589
access="readwrite")
2063
1590
def Checker_dbus_property(self, value=None):
2064
1591
if value is None: # get
2066
1593
self.checker_command = str(value)
2067
1594
2068
1595
# CheckerRunning - property
2069
@dbus_service_property(_interface,
2070
signature="b",
1596
@dbus_service_property(_interface, signature="b",
2071
1597
access="readwrite")
2072
1598
def CheckerRunning_dbus_property(self, value=None):
2073
1599
if value is None: # get
2078
1604
self.stop_checker()
2079
1605
2080
1606
# ObjectPath - property
2081
@dbus_annotations(
2082
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
"org.freedesktop.DBus.Deprecated": "true"})
2084
1607
@dbus_service_property(_interface, signature="o", access="read")
2085
1608
def ObjectPath_dbus_property(self):
2086
1609
return self.dbus_object_path # is already a dbus.ObjectPath
2087
1610
2088
1611
# Secret = property
2089
@dbus_annotations(
2090
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2091
"invalidates"})
2092
@dbus_service_property(_interface,
2093
signature="ay",
2094
access="write",
2095
byte_arrays=True)
1612
@dbus_service_property(_interface, signature="ay",
1613
access="write", byte_arrays=True)
2096
1614
def Secret_dbus_property(self, value):
2097
1615
self.secret = bytes(value)
2098
1616
2104
1622
self._pipe = child_pipe
2105
1623
self._pipe.send(('init', fpr, address))
2106
1624
if not self._pipe.recv():
2107
raise KeyError(fpr)
1625
raise KeyError()
2108
1626
2109
1627
def __getattribute__(self, name):
2110
1628
if name == '_pipe':
2114
1632
if data[0] == 'data':
2115
1633
return data[1]
2116
1634
if data[0] == 'function':
2117
2118
1635
def func(*args, **kwargs):
2119
1636
self._pipe.send(('funcall', name, args, kwargs))
2120
1637
return self._pipe.recv()[1]
2121
2122
1638
return func
2123
1639
2124
1640
def __setattr__(self, name, value):
2140
1656
logger.debug("Pipe FD: %d",
2141
1657
self.server.child_pipe.fileno())
2142
1658
2143
session = gnutls.ClientSession(self.request)
1659
session = (gnutls.connection
1660
.ClientSession(self.request,
1661
gnutls.connection
1662
.X509Credentials()))
1663
1664
# Note: gnutls.connection.X509Credentials is really a
1665
# generic GnuTLS certificate credentials object so long as
1666
# no X.509 keys are added to it. Therefore, we can use it
1667
# here despite using OpenPGP certificates.
2144
1668
2145
1669
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
1670
# "+AES-256-CBC", "+SHA1",
2150
1674
priority = self.server.gnutls_priority
2151
1675
if priority is None:
2152
1676
priority = "NORMAL"
2153
gnutls.priority_set_direct(session._c_object, priority,
2154
None)
1677
(gnutls.library.functions
1678
.gnutls_priority_set_direct(session._c_object,
1679
priority, None))
2155
1680
2156
1681
# Start communication using the Mandos protocol
2157
1682
# Get protocol number
2167
1692
# Start GnuTLS connection
2168
1693
try:
2169
1694
session.handshake()
2170
except gnutls.Error as error:
1695
except gnutls.errors.GNUTLSError as error:
2171
1696
logger.warning("Handshake failed: %s", error)
2172
1697
# Do not run session.bye() here: the session is not
2173
1698
# established. Just abandon the request.
2177
1702
approval_required = False
2178
1703
try:
2179
1704
try:
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
1705
fpr = self.fingerprint(self.peer_certificate
1706
(session))
1707
except (TypeError,
1708
gnutls.errors.GNUTLSError) as error:
2183
1709
logger.warning("Bad certificate: %s", error)
2184
1710
return
2185
1711
logger.debug("Fingerprint: %s", fpr)
2198
1724
while True:
2199
1725
if not client.enabled:
2200
1726
logger.info("Client %s is disabled",
2201
client.name)
1727
client.name)
2202
1728
if self.server.use_dbus:
2203
1729
# Emit D-Bus signal
2204
1730
client.Rejected("Disabled")
2243
1769
else:
2244
1770
delay -= time2 - time
2245
1771
2246
try:
2247
session.send(client.secret)
2248
except gnutls.Error as error:
2249
logger.warning("gnutls send failed",
2250
exc_info = error)
2251
return
1772
sent_size = 0
1773
while sent_size < len(client.secret):
1774
try:
1775
sent = session.send(client.secret[sent_size:])
1776
except gnutls.errors.GNUTLSError as error:
1777
logger.warning("gnutls send failed",
1778
exc_info=error)
1779
return
1780
logger.debug("Sent: %d, remaining: %d",
1781
sent, len(client.secret)
1782
- (sent_size + sent))
1783
sent_size += sent
2252
1784
2253
1785
logger.info("Sending secret to %s", client.name)
2254
1786
# bump the timeout using extended_timeout
2262
1794
client.approvals_pending -= 1
2263
1795
try:
2264
1796
session.bye()
2265
except gnutls.Error as error:
1797
except gnutls.errors.GNUTLSError as error:
2266
1798
logger.warning("GnuTLS bye failed",
2267
1799
exc_info=error)
2268
1800
2270
1802
def peer_certificate(session):
2271
1803
"Return the peer's OpenPGP certificate as a bytestring"
2272
1804
# If not an OpenPGP certificate...
2273
if (gnutls.certificate_type_get(session._c_object)
2274
!= gnutls.CRT_OPENPGP):
2275
# ...return invalid data
2276
return b""
1805
if (gnutls.library.functions
1806
.gnutls_certificate_type_get(session._c_object)
1807
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1808
# ...do the normal thing
1809
return session.peer_certificate
2277
1810
list_size = ctypes.c_uint(1)
2278
cert_list = (gnutls.certificate_get_peers
1811
cert_list = (gnutls.library.functions
1812
.gnutls_certificate_get_peers
2279
1813
(session._c_object, ctypes.byref(list_size)))
2280
1814
if not bool(cert_list) and list_size.value != 0:
2281
raise gnutls.Error("error getting peer certificate")
1815
raise gnutls.errors.GNUTLSError("error getting peer"
1816
" certificate")
2282
1817
if list_size.value == 0:
2283
1818
return None
2284
1819
cert = cert_list[0]
2288
1823
def fingerprint(openpgp):
2289
1824
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2290
1825
# New GnuTLS "datum" with the OpenPGP public key
2291
datum = gnutls.datum_t(
2292
ctypes.cast(ctypes.c_char_p(openpgp),
2293
ctypes.POINTER(ctypes.c_ubyte)),
2294
ctypes.c_uint(len(openpgp)))
1826
datum = (gnutls.library.types
1827
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1828
ctypes.POINTER
1829
(ctypes.c_ubyte)),
1830
ctypes.c_uint(len(openpgp))))
2295
1831
# New empty GnuTLS certificate
2296
crt = gnutls.openpgp_crt_t()
2297
gnutls.openpgp_crt_init(ctypes.byref(crt))
1832
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2298
1835
# Import the OpenPGP public key into the certificate
2299
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2300
gnutls.OPENPGP_FMT_RAW)
1836
(gnutls.library.functions
1837
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1838
gnutls.library.constants
1839
.GNUTLS_OPENPGP_FMT_RAW))
2301
1840
# Verify the self signature in the key
2302
1841
crtverify = ctypes.c_uint()
2303
gnutls.openpgp_crt_verify_self(crt, 0,
2304
ctypes.byref(crtverify))
1842
(gnutls.library.functions
1843
.gnutls_openpgp_crt_verify_self(crt, 0,
1844
ctypes.byref(crtverify)))
2305
1845
if crtverify.value != 0:
2306
gnutls.openpgp_crt_deinit(crt)
2307
raise gnutls.CertificateSecurityError("Verify failed")
1846
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1847
raise (gnutls.errors.CertificateSecurityError
1848
("Verify failed"))
2308
1849
# New buffer for the fingerprint
2309
1850
buf = ctypes.create_string_buffer(20)
2310
1851
buf_len = ctypes.c_size_t()
2311
1852
# Get the fingerprint from the certificate into the buffer
2312
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2313
ctypes.byref(buf_len))
1853
(gnutls.library.functions
1854
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1855
ctypes.byref(buf_len)))
2314
1856
# Deinit the certificate
2315
gnutls.openpgp_crt_deinit(crt)
1857
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2316
1858
# Convert the buffer to a Python bytestring
2317
1859
fpr = ctypes.string_at(buf, buf_len.value)
2318
1860
# Convert the bytestring to hexadecimal notation
2322
1864
2323
1865
class MultiprocessingMixIn(object):
2324
1866
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2325
2326
1867
def sub_process_main(self, request, address):
2327
1868
try:
2328
1869
self.finish_request(request, address)
2340
1881
2341
1882
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2342
1883
""" adds a pipe to the MixIn """
2343
2344
1884
def process_request(self, request, client_address):
2345
1885
"""Overrides and wraps the original process_request().
2346
1886
2367
1907
interface: None or a network interface name (string)
2368
1908
use_ipv6: Boolean; to use IPv6 or not
2369
1909
"""
2370
2371
1910
def __init__(self, server_address, RequestHandlerClass,
2372
interface=None,
2373
use_ipv6=True,
2374
socketfd=None):
1911
interface=None, use_ipv6=True, socketfd=None):
2375
1912
"""If socketfd is set, use that file descriptor instead of
2376
1913
creating a new one with socket.socket().
2377
1914
"""
2418
1955
self.interface)
2419
1956
else:
2420
1957
try:
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
1958
self.socket.setsockopt(socket.SOL_SOCKET,
1959
SO_BINDTODEVICE,
1960
(self.interface + "\0")
1961
.encode("utf-8"))
2424
1962
except socket.error as error:
2425
1963
if error.errno == errno.EPERM:
2426
1964
logger.error("No permission to bind to"
2444
1982
self.server_address = (any_address,
2445
1983
self.server_address[1])
2446
1984
elif not self.server_address[1]:
2447
self.server_address = (self.server_address[0], 0)
1985
self.server_address = (self.server_address[0],
1986
0)
2448
1987
# if self.interface:
2449
1988
# self.server_address = (self.server_address[0],
2450
1989
# 0, # port
2464
2003
2465
2004
Assumes a gobject.MainLoop event loop.
2466
2005
"""
2467
2468
2006
def __init__(self, server_address, RequestHandlerClass,
2469
interface=None,
2470
use_ipv6=True,
2471
clients=None,
2472
gnutls_priority=None,
2473
use_dbus=True,
2474
socketfd=None):
2007
interface=None, use_ipv6=True, clients=None,
2008
gnutls_priority=None, use_dbus=True, socketfd=None):
2475
2009
self.enabled = False
2476
2010
self.clients = clients
2477
2011
if self.clients is None:
2483
2017
interface = interface,
2484
2018
use_ipv6 = use_ipv6,
2485
2019
socketfd = socketfd)
2486
2487
2020
def server_activate(self):
2488
2021
if self.enabled:
2489
2022
return socketserver.TCPServer.server_activate(self)
2493
2026
2494
2027
def add_pipe(self, parent_pipe, proc):
2495
2028
# Call "handle_ipc" for both data and EOF events
2496
gobject.io_add_watch(
2497
parent_pipe.fileno(),
2498
gobject.IO_IN | gobject.IO_HUP,
2499
functools.partial(self.handle_ipc,
2500
parent_pipe = parent_pipe,
2501
proc = proc))
2029
gobject.io_add_watch(parent_pipe.fileno(),
2030
gobject.IO_IN | gobject.IO_HUP,
2031
functools.partial(self.handle_ipc,
2032
parent_pipe =
2033
parent_pipe,
2034
proc = proc))
2502
2035
2503
def handle_ipc(self, source, condition,
2504
parent_pipe=None,
2505
proc = None,
2506
client_object=None):
2036
def handle_ipc(self, source, condition, parent_pipe=None,
2037
proc = None, client_object=None):
2507
2038
# error, or the other end of multiprocessing.Pipe has closed
2508
2039
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2509
2040
# Wait for other process to exit
2532
2063
parent_pipe.send(False)
2533
2064
return False
2534
2065
2535
gobject.io_add_watch(
2536
parent_pipe.fileno(),
2537
gobject.IO_IN | gobject.IO_HUP,
2538
functools.partial(self.handle_ipc,
2539
parent_pipe = parent_pipe,
2540
proc = proc,
2541
client_object = client))
2066
gobject.io_add_watch(parent_pipe.fileno(),
2067
gobject.IO_IN | gobject.IO_HUP,
2068
functools.partial(self.handle_ipc,
2069
parent_pipe =
2070
parent_pipe,
2071
proc = proc,
2072
client_object =
2073
client))
2542
2074
parent_pipe.send(True)
2543
2075
# remove the old hook in favor of the new above hook on
2544
2076
# same fileno
2550
2082
2551
2083
parent_pipe.send(('data', getattr(client_object,
2552
2084
funcname)(*args,
2553
**kwargs)))
2085
**kwargs)))
2554
2086
2555
2087
if command == 'getattr':
2556
2088
attrname = request[1]
2557
if isinstance(client_object.__getattribute__(attrname),
2558
collections.Callable):
2559
parent_pipe.send(('function', ))
2089
if callable(client_object.__getattribute__(attrname)):
2090
parent_pipe.send(('function',))
2560
2091
else:
2561
parent_pipe.send((
2562
'data', client_object.__getattribute__(attrname)))
2092
parent_pipe.send(('data', client_object
2093
.__getattribute__(attrname)))
2563
2094
2564
2095
if command == 'setattr':
2565
2096
attrname = request[1]
2596
2127
# avoid excessive use of external libraries.
2597
2128
2598
2129
# New type for defining tokens, syntax, and semantics all-in-one
2599
Token = collections.namedtuple("Token", (
2600
"regexp", # To match token; if "value" is not None, must have
2601
# a "group" containing digits
2602
"value", # datetime.timedelta or None
2603
"followers")) # Tokens valid after this token
2130
Token = collections.namedtuple("Token",
2131
("regexp", # To match token; if
2132
# "value" is not None,
2133
# must have a "group"
2134
# containing digits
2135
"value", # datetime.timedelta or
2136
# None
2137
"followers")) # Tokens valid after
2138
# this token
2604
2139
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2605
2140
# the "duration" ABNF definition in RFC 3339, Appendix A.
2606
2141
token_end = Token(re.compile(r"$"), None, frozenset())
2607
2142
token_second = Token(re.compile(r"(\d+)S"),
2608
2143
datetime.timedelta(seconds=1),
2609
frozenset((token_end, )))
2144
frozenset((token_end,)))
2610
2145
token_minute = Token(re.compile(r"(\d+)M"),
2611
2146
datetime.timedelta(minutes=1),
2612
2147
frozenset((token_second, token_end)))
2628
2163
frozenset((token_month, token_end)))
2629
2164
token_week = Token(re.compile(r"(\d+)W"),
2630
2165
datetime.timedelta(weeks=1),
2631
frozenset((token_end, )))
2166
frozenset((token_end,)))
2632
2167
token_duration = Token(re.compile(r"P"), None,
2633
2168
frozenset((token_year, token_month,
2634
2169
token_day, token_time,
2636
2171
# Define starting values
2637
2172
value = datetime.timedelta() # Value so far
2638
2173
found_token = None
2639
followers = frozenset((token_duration, )) # Following valid tokens
2174
followers = frozenset((token_duration,)) # Following valid tokens
2640
2175
s = duration # String left to parse
2641
2176
# Loop until end token is found
2642
2177
while found_token is not token_end:
2659
2194
break
2660
2195
else:
2661
2196
# No currently valid tokens were found
2662
raise ValueError("Invalid RFC 3339 duration: {!r}"
2663
.format(duration))
2197
raise ValueError("Invalid RFC 3339 duration")
2664
2198
# End token found
2665
2199
return value
2666
2200
2703
2237
elif suffix == "w":
2704
2238
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2705
2239
else:
2706
raise ValueError("Unknown suffix {!r}".format(suffix))
2240
raise ValueError("Unknown suffix {!r}"
2241
.format(suffix))
2707
2242
except IndexError as e:
2708
2243
raise ValueError(*(e.args))
2709
2244
timevalue += delta
2725
2260
# Close all standard open file descriptors
2726
2261
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2727
2262
if not stat.S_ISCHR(os.fstat(null).st_mode):
2728
raise OSError(errno.ENODEV,
2729
"{} not a character device"
2263
raise OSError(errno.ENODEV, "{} not a character device"
2730
2264
.format(os.devnull))
2731
2265
os.dup2(null, sys.stdin.fileno())
2732
2266
os.dup2(null, sys.stdout.fileno())
2798
2332
"port": "",
2799
2333
"debug": "False",
2800
2334
"priority":
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2335
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2803
2336
"servicename": "Mandos",
2804
2337
"use_dbus": "True",
2805
2338
"use_ipv6": "True",
2809
2342
"statedir": "/var/lib/mandos",
2810
2343
"foreground": "False",
2811
2344
"zeroconf": "True",
2812
}
2345
}
2813
2346
2814
2347
# Parse config file for server-global settings
2815
2348
server_config = configparser.SafeConfigParser(server_defaults)
2816
2349
del server_defaults
2817
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2350
server_config.read(os.path.join(options.configdir,
2351
"mandos.conf"))
2818
2352
# Convert the SafeConfigParser object to a dict
2819
2353
server_settings = server_config.defaults()
2820
2354
# Use the appropriate methods on the non-string config options
2838
2372
# Override the settings from the config file with command line
2839
2373
# options, if set.
2840
2374
for option in ("interface", "address", "port", "debug",
2841
"priority", "servicename", "configdir", "use_dbus",
2842
"use_ipv6", "debuglevel", "restore", "statedir",
2843
"socket", "foreground", "zeroconf"):
2375
"priority", "servicename", "configdir",
2376
"use_dbus", "use_ipv6", "debuglevel", "restore",
2377
"statedir", "socket", "foreground", "zeroconf"):
2844
2378
value = getattr(options, option)
2845
2379
if value is not None:
2846
2380
server_settings[option] = value
2861
2395
2862
2396
##################################################################
2863
2397
2864
if (not server_settings["zeroconf"]
2865
and not (server_settings["port"]
2866
or server_settings["socket"] != "")):
2867
parser.error("Needs port or socket to work without Zeroconf")
2398
if (not server_settings["zeroconf"] and
2399
not (server_settings["port"]
2400
or server_settings["socket"] != "")):
2401
parser.error("Needs port or socket to work without"
2402
" Zeroconf")
2868
2403
2869
2404
# For convenience
2870
2405
debug = server_settings["debug"]
2886
2421
initlogger(debug, level)
2887
2422
2888
2423
if server_settings["servicename"] != "Mandos":
2889
syslogger.setFormatter(
2890
logging.Formatter('Mandos ({}) [%(process)d]:'
2891
' %(levelname)s: %(message)s'.format(
2892
server_settings["servicename"])))
2424
syslogger.setFormatter(logging.Formatter
2425
('Mandos ({}) [%(process)d]:'
2426
' %(levelname)s: %(message)s'
2427
.format(server_settings
2428
["servicename"])))
2893
2429
2894
2430
# Parse config file with clients
2895
2431
client_config = configparser.SafeConfigParser(Client
2903
2439
socketfd = None
2904
2440
if server_settings["socket"] != "":
2905
2441
socketfd = server_settings["socket"]
2906
tcp_server = MandosServer(
2907
(server_settings["address"], server_settings["port"]),
2908
ClientHandler,
2909
interface=(server_settings["interface"] or None),
2910
use_ipv6=use_ipv6,
2911
gnutls_priority=server_settings["priority"],
2912
use_dbus=use_dbus,
2913
socketfd=socketfd)
2442
tcp_server = MandosServer((server_settings["address"],
2443
server_settings["port"]),
2444
ClientHandler,
2445
interface=(server_settings["interface"]
2446
or None),
2447
use_ipv6=use_ipv6,
2448
gnutls_priority=
2449
server_settings["priority"],
2450
use_dbus=use_dbus,
2451
socketfd=socketfd)
2914
2452
if not foreground:
2915
2453
pidfilename = "/run/mandos.pid"
2916
2454
if not os.path.isdir("/run/."):
2917
2455
pidfilename = "/var/run/mandos.pid"
2918
2456
pidfile = None
2919
2457
try:
2920
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2458
pidfile = open(pidfilename, "w")
2921
2459
except IOError as e:
2922
2460
logger.error("Could not open file %r", pidfilename,
2923
2461
exc_info=e)
2944
2482
2945
2483
# "Use a log level over 10 to enable all debugging options."
2946
2484
# - GnuTLS manual
2947
gnutls.global_set_log_level(11)
2485
gnutls.library.functions.gnutls_global_set_log_level(11)
2948
2486
2949
@gnutls.log_func
2487
@gnutls.library.types.gnutls_log_func
2950
2488
def debug_gnutls(level, string):
2951
2489
logger.debug("GnuTLS: %s", string[:-1])
2952
2490
2953
gnutls.global_set_log_function(debug_gnutls)
2491
(gnutls.library.functions
2492
.gnutls_global_set_log_function(debug_gnutls))
2954
2493
2955
2494
# Redirect stdin so all checkers get /dev/null
2956
2495
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2976
2515
if use_dbus:
2977
2516
try:
2978
2517
bus_name = dbus.service.BusName("se.recompile.Mandos",
2979
bus,
2980
do_not_queue=True)
2981
old_bus_name = dbus.service.BusName(
2982
"se.bsnet.fukt.Mandos", bus,
2983
do_not_queue=True)
2984
except dbus.exceptions.DBusException as e:
2518
bus, do_not_queue=True)
2519
old_bus_name = (dbus.service.BusName
2520
("se.bsnet.fukt.Mandos", bus,
2521
do_not_queue=True))
2522
except dbus.exceptions.NameExistsException as e:
2985
2523
logger.error("Disabling D-Bus:", exc_info=e)
2986
2524
use_dbus = False
2987
2525
server_settings["use_dbus"] = False
2988
2526
tcp_server.use_dbus = False
2989
2527
if zeroconf:
2990
2528
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2991
service = AvahiServiceToSyslog(
2992
name = server_settings["servicename"],
2993
servicetype = "_mandos._tcp",
2994
protocol = protocol,
2995
bus = bus)
2529
service = AvahiServiceToSyslog(name =
2530
server_settings["servicename"],
2531
servicetype = "_mandos._tcp",
2532
protocol = protocol, bus = bus)
2996
2533
if server_settings["interface"]:
2997
service.interface = if_nametoindex(
2998
server_settings["interface"].encode("utf-8"))
2534
service.interface = (if_nametoindex
2535
(server_settings["interface"]
2536
.encode("utf-8")))
2999
2537
3000
2538
global multiprocessing_manager
3001
2539
multiprocessing_manager = multiprocessing.Manager()
3020
2558
if server_settings["restore"]:
3021
2559
try:
3022
2560
with open(stored_state_path, "rb") as stored_state:
3023
clients_data, old_client_settings = pickle.load(
3024
stored_state)
2561
clients_data, old_client_settings = (pickle.load
2562
(stored_state))
3025
2563
os.remove(stored_state_path)
3026
2564
except IOError as e:
3027
2565
if e.errno == errno.ENOENT:
3028
logger.warning("Could not load persistent state:"
3029
" {}".format(os.strerror(e.errno)))
2566
logger.warning("Could not load persistent state: {}"
2567
.format(os.strerror(e.errno)))
3030
2568
else:
3031
2569
logger.critical("Could not load persistent state:",
3032
2570
exc_info=e)
3033
2571
raise
3034
2572
except EOFError as e:
3035
2573
logger.warning("Could not load persistent state: "
3036
"EOFError:",
3037
exc_info=e)
2574
"EOFError:", exc_info=e)
3038
2575
3039
2576
with PGPEngine() as pgp:
3040
2577
for client_name, client in clients_data.items():
3052
2589
# For each value in new config, check if it
3053
2590
# differs from the old config value (Except for
3054
2591
# the "secret" attribute)
3055
if (name != "secret"
3056
and (value !=
3057
old_client_settings[client_name][name])):
2592
if (name != "secret" and
2593
value != old_client_settings[client_name]
2594
[name]):
3058
2595
client[name] = value
3059
2596
except KeyError:
3060
2597
pass
3061
2598
3062
2599
# Clients who has passed its expire date can still be
3063
# enabled if its last checker was successful. A Client
2600
# enabled if its last checker was successful. Clients
3064
2601
# whose checker succeeded before we stored its state is
3065
2602
# assumed to have successfully run all checkers during
3066
2603
# downtime.
3069
2606
if not client["last_checked_ok"]:
3070
2607
logger.warning(
3071
2608
"disabling client {} - Client never "
3072
"performed a successful checker".format(
3073
client_name))
2609
"performed a successful checker"
2610
.format(client_name))
3074
2611
client["enabled"] = False
3075
2612
elif client["last_checker_status"] != 0:
3076
2613
logger.warning(
3077
2614
"disabling client {} - Client last"
3078
" checker failed with error code"
3079
" {}".format(
3080
client_name,
3081
client["last_checker_status"]))
2615
" checker failed with error code {}"
2616
.format(client_name,
2617
client["last_checker_status"]))
3082
2618
client["enabled"] = False
3083
2619
else:
3084
client["expires"] = (
3085
datetime.datetime.utcnow()
3086
+ client["timeout"])
2620
client["expires"] = (datetime.datetime
2621
.utcnow()
2622
+ client["timeout"])
3087
2623
logger.debug("Last checker succeeded,"
3088
" keeping {} enabled".format(
3089
client_name))
2624
" keeping {} enabled"
2625
.format(client_name))
3090
2626
try:
3091
client["secret"] = pgp.decrypt(
3092
client["encrypted_secret"],
3093
client_settings[client_name]["secret"])
2627
client["secret"] = (
2628
pgp.decrypt(client["encrypted_secret"],
2629
client_settings[client_name]
2630
["secret"]))
3094
2631
except PGPError:
3095
2632
# If decryption fails, we use secret from new settings
3096
logger.debug("Failed to decrypt {} old secret".format(
3097
client_name))
3098
client["secret"] = (client_settings[client_name]
3099
["secret"])
2633
logger.debug("Failed to decrypt {} old secret"
2634
.format(client_name))
2635
client["secret"] = (
2636
client_settings[client_name]["secret"])
3100
2637
3101
2638
# Add/remove clients based on new changes made to config
3102
2639
for client_name in (set(old_client_settings)
3109
2646
# Create all client objects
3110
2647
for client_name, client in clients_data.items():
3111
2648
tcp_server.clients[client_name] = client_class(
3112
name = client_name,
3113
settings = client,
2649
name = client_name, settings = client,
3114
2650
server_settings = server_settings)
3115
2651
3116
2652
if not tcp_server.clients:
3118
2654
3119
2655
if not foreground:
3120
2656
if pidfile is not None:
3121
pid = os.getpid()
3122
2657
try:
3123
2658
with pidfile:
3124
print(pid, file=pidfile)
2659
pid = os.getpid()
2660
pidfile.write("{}\n".format(pid).encode("utf-8"))
3125
2661
except IOError:
3126
2662
logger.error("Could not write to file %r with PID %d",
3127
2663
pidfilename, pid)
3132
2668
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3133
2669
3134
2670
if use_dbus:
3135
3136
@alternate_dbus_interfaces(
3137
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3138
class MandosDBusService(DBusObjectWithObjectManager):
2671
@alternate_dbus_interfaces({"se.recompile.Mandos":
2672
"se.bsnet.fukt.Mandos"})
2673
class MandosDBusService(DBusObjectWithProperties):
3139
2674
"""A D-Bus proxy object"""
3140
3141
2675
def __init__(self):
3142
2676
dbus.service.Object.__init__(self, bus, "/")
3143
3144
2677
_interface = "se.recompile.Mandos"
3145
2678
2679
@dbus_interface_annotations(_interface)
2680
def _foo(self):
2681
return { "org.freedesktop.DBus.Property"
2682
".EmitsChangedSignal":
2683
"false"}
2684
3146
2685
@dbus.service.signal(_interface, signature="o")
3147
2686
def ClientAdded(self, objpath):
3148
2687
"D-Bus signal"
3153
2692
"D-Bus signal"
3154
2693
pass
3155
2694
3156
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3157
"true"})
3158
2695
@dbus.service.signal(_interface, signature="os")
3159
2696
def ClientRemoved(self, objpath, name):
3160
2697
"D-Bus signal"
3161
2698
pass
3162
2699
3163
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3164
"true"})
3165
2700
@dbus.service.method(_interface, out_signature="ao")
3166
2701
def GetAllClients(self):
3167
2702
"D-Bus method"
3168
return dbus.Array(c.dbus_object_path for c in
2703
return dbus.Array(c.dbus_object_path
2704
for c in
3169
2705
tcp_server.clients.itervalues())
3170
2706
3171
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3172
"true"})
3173
2707
@dbus.service.method(_interface,
3174
2708
out_signature="a{oa{sv}}")
3175
2709
def GetAllClientsWithProperties(self):
3176
2710
"D-Bus method"
3177
2711
return dbus.Dictionary(
3178
{ c.dbus_object_path: c.GetAll(
3179
"se.recompile.Mandos.Client")
3180
for c in tcp_server.clients.itervalues() },
2712
((c.dbus_object_path, c.GetAll(""))
2713
for c in tcp_server.clients.itervalues()),
3181
2714
signature="oa{sv}")
3182
2715
3183
2716
@dbus.service.method(_interface, in_signature="o")
3187
2720
if c.dbus_object_path == object_path:
3188
2721
del tcp_server.clients[c.name]
3189
2722
c.remove_from_connection()
3190
# Don't signal the disabling
2723
# Don't signal anything except ClientRemoved
3191
2724
c.disable(quiet=True)
3192
# Emit D-Bus signal for removal
3193
self.client_removed_signal(c)
2725
# Emit D-Bus signal
2726
self.ClientRemoved(object_path, c.name)
3194
2727
return
3195
2728
raise KeyError(object_path)
3196
2729
3197
2730
del _interface
3198
3199
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3200
out_signature = "a{oa{sa{sv}}}")
3201
def GetManagedObjects(self):
3202
"""D-Bus method"""
3203
return dbus.Dictionary(
3204
{ client.dbus_object_path:
3205
dbus.Dictionary(
3206
{ interface: client.GetAll(interface)
3207
for interface in
3208
client._get_all_interface_names()})
3209
for client in tcp_server.clients.values()})
3210
3211
def client_added_signal(self, client):
3212
"""Send the new standard signal and the old signal"""
3213
if use_dbus:
3214
# New standard signal
3215
self.InterfacesAdded(
3216
client.dbus_object_path,
3217
dbus.Dictionary(
3218
{ interface: client.GetAll(interface)
3219
for interface in
3220
client._get_all_interface_names()}))
3221
# Old signal
3222
self.ClientAdded(client.dbus_object_path)
3223
3224
def client_removed_signal(self, client):
3225
"""Send the new standard signal and the old signal"""
3226
if use_dbus:
3227
# New standard signal
3228
self.InterfacesRemoved(
3229
client.dbus_object_path,
3230
client._get_all_interface_names())
3231
# Old signal
3232
self.ClientRemoved(client.dbus_object_path,
3233
client.name)
3234
2731
3235
2732
mandos_dbus_service = MandosDBusService()
3236
2733
3259
2756
# + secret.
3260
2757
exclude = { "bus", "changedstate", "secret",
3261
2758
"checker", "server_settings" }
3262
for name, typ in inspect.getmembers(dbus.service
3263
.Object):
2759
for name, typ in (inspect.getmembers
2760
(dbus.service.Object)):
3264
2761
exclude.add(name)
3265
2762
3266
2763
client_dict["encrypted_secret"] = (client
3273
2770
del client_settings[client.name]["secret"]
3274
2771
3275
2772
try:
3276
with tempfile.NamedTemporaryFile(
3277
mode='wb',
3278
suffix=".pickle",
3279
prefix='clients-',
3280
dir=os.path.dirname(stored_state_path),
3281
delete=False) as stored_state:
2773
with (tempfile.NamedTemporaryFile
2774
(mode='wb', suffix=".pickle", prefix='clients-',
2775
dir=os.path.dirname(stored_state_path),
2776
delete=False)) as stored_state:
3282
2777
pickle.dump((clients, client_settings), stored_state)
3283
tempname = stored_state.name
2778
tempname=stored_state.name
3284
2779
os.rename(tempname, stored_state_path)
3285
2780
except (IOError, OSError) as e:
3286
2781
if not debug:
3301
2796
name, client = tcp_server.clients.popitem()
3302
2797
if use_dbus:
3303
2798
client.remove_from_connection()
3304
# Don't signal the disabling
2799
# Don't signal anything except ClientRemoved
3305
2800
client.disable(quiet=True)
3306
# Emit D-Bus signal for removal
3307
2801
if use_dbus:
3308
mandos_dbus_service.client_removed_signal(client)
2802
# Emit D-Bus signal
2803
mandos_dbus_service.ClientRemoved(client
2804
.dbus_object_path,
2805
client.name)
3309
2806
client_settings.clear()
3310
2807
3311
2808
atexit.register(cleanup)
3312
2809
3313
2810
for client in tcp_server.clients.itervalues():
3314
2811
if use_dbus:
3315
# Emit D-Bus signal for adding
3316
mandos_dbus_service.client_added_signal(client)
2812
# Emit D-Bus signal
2813
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3317
2814
# Need to initiate checking of clients
3318
2815
if client.enabled:
3319
2816
client.init_checker()
3364
2861
# Must run before the D-Bus bus name gets deregistered
3365
2862
cleanup()
3366
2863
3367
3368
2864
if __name__ == '__main__':
3369
2865
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0