To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 731
- compare with another revision
- download diff
- download tarball
- view history from revision 731
- Committer: Teddy Hogeborn
- Date: 2014-08-09 23:37:07 UTC
- Revision ID: teddy@recompile.se-20140809233707-6c5qyievp78lnzf1
askpass-fifo: Lower privileges after opening FIFO.
* plugins.d/askpass-fifo.c (main): Lower privileges after opening FIFO.
* plugins.d/askpass-fifo.c (main): Lower privileges after opening FIFO.
- files removed:
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
46
43
import errno
47
try:
48
import ConfigParser as configparser
49
except ImportError:
50
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
51
51
import sys
52
52
import re
53
53
import os
62
62
import struct
63
63
import fcntl
64
64
import functools
65
try:
66
import cPickle as pickle
67
except ImportError:
68
import pickle
65
import cPickle as pickle
69
66
import multiprocessing
70
67
import types
71
68
import binascii
72
69
import tempfile
73
70
import itertools
74
71
import collections
75
import codecs
76
72
77
73
import dbus
78
74
import dbus.service
79
try:
80
import gobject
81
except ImportError:
82
from gi.repository import GObject as gobject
75
import gobject
83
76
import avahi
84
77
from dbus.mainloop.glib import DBusGMainLoop
85
78
import ctypes
98
91
if sys.version_info.major == 2:
99
92
str = unicode
100
93
101
version = "1.7.1"
94
version = "1.6.8"
102
95
stored_state_file = "clients.pickle"
103
96
104
97
logger = logging.getLogger()
105
98
syslogger = None
106
99
107
100
try:
108
if_nametoindex = ctypes.cdll.LoadLibrary(
109
ctypes.util.find_library("c")).if_nametoindex
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
110
104
except (OSError, AttributeError):
111
112
105
def if_nametoindex(interface):
113
106
"Get an interface index the hard way, i.e. using fcntl()"
114
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
123
116
"""init logger and add loglevel"""
124
117
125
118
global syslogger
126
syslogger = (logging.handlers.SysLogHandler(
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
129
123
syslogger.setFormatter(logging.Formatter
130
124
('Mandos [%(process)d]: %(levelname)s:'
131
125
' %(message)s'))
148
142
149
143
class PGPEngine(object):
150
144
"""A simple class for OpenPGP symmetric encryption & decryption"""
151
152
145
def __init__(self):
153
146
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
147
self.gnupgargs = ['--batch',
193
186
194
187
def encrypt(self, data, password):
195
188
passphrase = self.password_encode(password)
196
with tempfile.NamedTemporaryFile(
197
dir=self.tempdir) as passfile:
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
198
191
passfile.write(passphrase)
199
192
passfile.flush()
200
193
proc = subprocess.Popen(['gpg', '--symmetric',
211
204
212
205
def decrypt(self, data, password):
213
206
passphrase = self.password_encode(password)
214
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
216
209
passfile.write(passphrase)
217
210
passfile.flush()
218
211
proc = subprocess.Popen(['gpg', '--decrypt',
222
215
stdin = subprocess.PIPE,
223
216
stdout = subprocess.PIPE,
224
217
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
226
220
if proc.returncode != 0:
227
221
raise PGPError(err)
228
222
return decrypted_plaintext
234
228
return super(AvahiError, self).__init__(value, *args,
235
229
**kwargs)
236
230
237
238
231
class AvahiServiceError(AvahiError):
239
232
pass
240
233
241
242
234
class AvahiGroupError(AvahiError):
243
235
pass
244
236
264
256
bus: dbus.SystemBus()
265
257
"""
266
258
267
def __init__(self,
268
interface = avahi.IF_UNSPEC,
269
name = None,
270
servicetype = None,
271
port = None,
272
TXT = None,
273
domain = "",
274
host = "",
275
max_renames = 32768,
276
protocol = avahi.PROTO_UNSPEC,
277
bus = None):
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
278
263
self.interface = interface
279
264
self.name = name
280
265
self.type = servicetype
290
275
self.bus = bus
291
276
self.entry_group_state_changed_match = None
292
277
293
def rename(self, remove=True):
278
def rename(self):
294
279
"""Derived from the Avahi example code"""
295
280
if self.rename_count >= self.max_renames:
296
281
logger.critical("No suitable Zeroconf service name found"
297
282
" after %i retries, exiting.",
298
283
self.rename_count)
299
284
raise AvahiServiceError("Too many renames")
300
self.name = str(
301
self.server.GetAlternativeServiceName(self.name))
302
self.rename_count += 1
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
303
287
logger.info("Changing Zeroconf service name to %r ...",
304
288
self.name)
305
if remove:
306
self.remove()
289
self.remove()
307
290
try:
308
291
self.add()
309
292
except dbus.exceptions.DBusException as error:
310
if (error.get_dbus_name()
311
== "org.freedesktop.Avahi.CollisionError"):
312
logger.info("Local Zeroconf service name collision.")
313
return self.rename(remove=False)
314
else:
315
logger.critical("D-Bus Exception", exc_info=error)
316
self.cleanup()
317
os._exit(1)
293
logger.critical("D-Bus Exception", exc_info=error)
294
self.cleanup()
295
os._exit(1)
296
self.rename_count += 1
318
297
319
298
def remove(self):
320
299
"""Derived from the Avahi example code"""
359
338
elif state == avahi.ENTRY_GROUP_FAILURE:
360
339
logger.critical("Avahi: Error in group state changed %s",
361
340
str(error))
362
raise AvahiGroupError("State changed: {!s}".format(error))
341
raise AvahiGroupError("State changed: {!s}"
342
.format(error))
363
343
364
344
def cleanup(self):
365
345
"""Derived from the Avahi example code"""
375
355
def server_state_changed(self, state, error=None):
376
356
"""Derived from the Avahi example code"""
377
357
logger.debug("Avahi server state change: %i", state)
378
bad_states = {
379
avahi.SERVER_INVALID: "Zeroconf server invalid",
380
avahi.SERVER_REGISTERING: None,
381
avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
avahi.SERVER_FAILURE: "Zeroconf server failure",
383
}
358
bad_states = { avahi.SERVER_INVALID:
359
"Zeroconf server invalid",
360
avahi.SERVER_REGISTERING: None,
361
avahi.SERVER_COLLISION:
362
"Zeroconf server name collision",
363
avahi.SERVER_FAILURE:
364
"Zeroconf server failure" }
384
365
if state in bad_states:
385
366
if bad_states[state] is not None:
386
367
if error is None:
389
370
logger.error(bad_states[state] + ": %r", error)
390
371
self.cleanup()
391
372
elif state == avahi.SERVER_RUNNING:
392
try:
393
self.add()
394
except dbus.exceptions.DBusException as error:
395
if (error.get_dbus_name()
396
== "org.freedesktop.Avahi.CollisionError"):
397
logger.info("Local Zeroconf service name"
398
" collision.")
399
return self.rename(remove=False)
400
else:
401
logger.critical("D-Bus Exception", exc_info=error)
402
self.cleanup()
403
os._exit(1)
373
self.add()
404
374
else:
405
375
if error is None:
406
376
logger.debug("Unknown state: %r", state)
416
386
follow_name_owner_changes=True),
417
387
avahi.DBUS_INTERFACE_SERVER)
418
388
self.server.connect_to_signal("StateChanged",
419
self.server_state_changed)
389
self.server_state_changed)
420
390
self.server_state_changed(self.server.GetState())
421
391
422
392
423
393
class AvahiServiceToSyslog(AvahiService):
424
def rename(self, *args, **kwargs):
394
def rename(self):
425
395
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
427
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
.format(self.name)))
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
400
.format(self.name)))
430
401
return ret
431
402
432
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
436
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
440
def __init__(self):
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
443
# happens.
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
447
448
# Unless otherwise indicated, the constants and types below are
449
# all from the gnutls/gnutls.h C header file.
450
451
# Constants
452
E_SUCCESS = 0
453
CRT_OPENPGP = 2
454
CLIENT = 2
455
SHUT_RDWR = 0
456
CRD_CERTIFICATE = 1
457
E_NO_CERTIFICATE_FOUND = -49
458
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
459
460
# Types
461
class session_int(ctypes.Structure):
462
_fields_ = []
463
session_t = ctypes.POINTER(session_int)
464
class certificate_credentials_st(ctypes.Structure):
465
_fields_ = []
466
certificate_credentials_t = ctypes.POINTER(
467
certificate_credentials_st)
468
certificate_type_t = ctypes.c_int
469
class datum_t(ctypes.Structure):
470
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
471
('size', ctypes.c_uint)]
472
class openpgp_crt_int(ctypes.Structure):
473
_fields_ = []
474
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
475
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
476
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
477
credentials_type_t = ctypes.c_int #
478
transport_ptr_t = ctypes.c_void_p
479
close_request_t = ctypes.c_int
480
481
# Exceptions
482
class Error(Exception):
483
# We need to use the class name "GnuTLS" here, since this
484
# exception might be raised from within GnuTLS.__init__,
485
# which is called before the assignment to the "gnutls"
486
# global variable happens.
487
def __init__(self, message = None, code = None, args=()):
488
# Default usage is by a message string, but if a return
489
# code is passed, convert it to a string with
490
# gnutls.strerror()
491
if message is None and code is not None:
492
message = GnuTLS.strerror(code)
493
return super(GnuTLS.Error, self).__init__(
494
message, *args)
495
496
class CertificateSecurityError(Error):
497
pass
498
499
# Classes
500
class Credentials(object):
501
def __init__(self):
502
self._c_object = gnutls.certificate_credentials_t()
503
gnutls.certificate_allocate_credentials(
504
ctypes.byref(self._c_object))
505
self.type = gnutls.CRD_CERTIFICATE
506
507
def __del__(self):
508
gnutls.certificate_free_credentials(self._c_object)
509
510
class ClientSession(object):
511
def __init__(self, socket, credentials = None):
512
self._c_object = gnutls.session_t()
513
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
514
gnutls.set_default_priority(self._c_object)
515
gnutls.transport_set_ptr(self._c_object, socket.fileno())
516
gnutls.handshake_set_private_extensions(self._c_object,
517
True)
518
self.socket = socket
519
if credentials is None:
520
credentials = gnutls.Credentials()
521
gnutls.credentials_set(self._c_object, credentials.type,
522
ctypes.cast(credentials._c_object,
523
ctypes.c_void_p))
524
self.credentials = credentials
525
526
def __del__(self):
527
gnutls.deinit(self._c_object)
528
529
def handshake(self):
530
return gnutls.handshake(self._c_object)
531
532
def send(self, data):
533
data = bytes(data)
534
if not data:
535
return 0
536
return gnutls.record_send(self._c_object, data, len(data))
537
538
def bye(self):
539
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
540
541
# Error handling function
542
def _error_code(result):
543
"""A function to raise exceptions on errors, suitable
544
for the 'restype' attribute on ctypes functions"""
545
if result >= 0:
546
return result
547
if result == gnutls.E_NO_CERTIFICATE_FOUND:
548
raise gnutls.CertificateSecurityError(code = result)
549
raise gnutls.Error(code = result)
550
551
# Unless otherwise indicated, the function declarations below are
552
# all from the gnutls/gnutls.h C header file.
553
554
# Functions
555
priority_set_direct = _library.gnutls_priority_set_direct
556
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
557
ctypes.POINTER(ctypes.c_char_p)]
558
priority_set_direct.restype = _error_code
559
560
init = _library.gnutls_init
561
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
562
init.restype = _error_code
563
564
set_default_priority = _library.gnutls_set_default_priority
565
set_default_priority.argtypes = [session_t]
566
set_default_priority.restype = _error_code
567
568
record_send = _library.gnutls_record_send
569
record_send.argtypes = [session_t, ctypes.c_void_p,
570
ctypes.c_size_t]
571
record_send.restype = ctypes.c_ssize_t
572
573
certificate_allocate_credentials = (
574
_library.gnutls_certificate_allocate_credentials)
575
certificate_allocate_credentials.argtypes = [
576
ctypes.POINTER(certificate_credentials_t)]
577
certificate_allocate_credentials.restype = _error_code
578
579
certificate_free_credentials = (
580
_library.gnutls_certificate_free_credentials)
581
certificate_free_credentials.argtypes = [certificate_credentials_t]
582
certificate_free_credentials.restype = None
583
584
handshake_set_private_extensions = (
585
_library.gnutls_handshake_set_private_extensions)
586
handshake_set_private_extensions.argtypes = [session_t,
587
ctypes.c_int]
588
handshake_set_private_extensions.restype = None
589
590
credentials_set = _library.gnutls_credentials_set
591
credentials_set.argtypes = [session_t, credentials_type_t,
592
ctypes.c_void_p]
593
credentials_set.restype = _error_code
594
595
strerror = _library.gnutls_strerror
596
strerror.argtypes = [ctypes.c_int]
597
strerror.restype = ctypes.c_char_p
598
599
certificate_type_get = _library.gnutls_certificate_type_get
600
certificate_type_get.argtypes = [session_t]
601
certificate_type_get.restype = _error_code
602
603
certificate_get_peers = _library.gnutls_certificate_get_peers
604
certificate_get_peers.argtypes = [session_t,
605
ctypes.POINTER(ctypes.c_uint)]
606
certificate_get_peers.restype = ctypes.POINTER(datum_t)
607
608
global_set_log_level = _library.gnutls_global_set_log_level
609
global_set_log_level.argtypes = [ctypes.c_int]
610
global_set_log_level.restype = None
611
612
global_set_log_function = _library.gnutls_global_set_log_function
613
global_set_log_function.argtypes = [log_func]
614
global_set_log_function.restype = None
615
616
deinit = _library.gnutls_deinit
617
deinit.argtypes = [session_t]
618
deinit.restype = None
619
620
handshake = _library.gnutls_handshake
621
handshake.argtypes = [session_t]
622
handshake.restype = _error_code
623
624
transport_set_ptr = _library.gnutls_transport_set_ptr
625
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
626
transport_set_ptr.restype = None
627
628
bye = _library.gnutls_bye
629
bye.argtypes = [session_t, close_request_t]
630
bye.restype = _error_code
631
632
check_version = _library.gnutls_check_version
633
check_version.argtypes = [ctypes.c_char_p]
634
check_version.restype = ctypes.c_char_p
635
636
# All the function declarations below are from gnutls/openpgp.h
637
638
openpgp_crt_init = _library.gnutls_openpgp_crt_init
639
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
640
openpgp_crt_init.restype = _error_code
641
642
openpgp_crt_import = _library.gnutls_openpgp_crt_import
643
openpgp_crt_import.argtypes = [openpgp_crt_t,
644
ctypes.POINTER(datum_t),
645
openpgp_crt_fmt_t]
646
openpgp_crt_import.restype = _error_code
647
648
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
649
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
650
ctypes.POINTER(ctypes.c_uint)]
651
openpgp_crt_verify_self.restype = _error_code
652
653
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
654
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
655
openpgp_crt_deinit.restype = None
656
657
openpgp_crt_get_fingerprint = (
658
_library.gnutls_openpgp_crt_get_fingerprint)
659
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
660
ctypes.c_void_p,
661
ctypes.POINTER(
662
ctypes.c_size_t)]
663
openpgp_crt_get_fingerprint.restype = _error_code
664
665
# Remove non-public function
666
del _error_code
667
# Create the global "gnutls" object, simulating a module
668
gnutls = GnuTLS()
669
670
def call_pipe(connection, # : multiprocessing.Connection
671
func, *args, **kwargs):
672
"""This function is meant to be called by multiprocessing.Process
673
674
This function runs func(*args, **kwargs), and writes the resulting
675
return value on the provided multiprocessing.Connection.
676
"""
677
connection.send(func(*args, **kwargs))
678
connection.close()
679
403
680
404
class Client(object):
681
405
"""A representation of a client host served by this server.
708
432
last_checker_status: integer between 0 and 255 reflecting exit
709
433
status of last checker. -1 reflects crashed
710
434
checker, -2 means no checker completed yet.
711
last_checker_signal: The signal which killed the last checker, if
712
last_checker_status is -1
713
435
last_enabled: datetime.datetime(); (UTC) or None
714
436
name: string; from the config file, used in log messages and
715
437
D-Bus identifiers
728
450
"fingerprint", "host", "interval",
729
451
"last_approval_request", "last_checked_ok",
730
452
"last_enabled", "name", "timeout")
731
client_defaults = {
732
"timeout": "PT5M",
733
"extended_timeout": "PT15M",
734
"interval": "PT2M",
735
"checker": "fping -q -- %%(host)s",
736
"host": "",
737
"approval_delay": "PT0S",
738
"approval_duration": "PT1S",
739
"approved_by_default": "True",
740
"enabled": "True",
741
}
453
client_defaults = { "timeout": "PT5M",
454
"extended_timeout": "PT15M",
455
"interval": "PT2M",
456
"checker": "fping -q -- %%(host)s",
457
"host": "",
458
"approval_delay": "PT0S",
459
"approval_duration": "PT1S",
460
"approved_by_default": "True",
461
"enabled": "True",
462
}
742
463
743
464
@staticmethod
744
465
def config_parser(config):
760
481
client["enabled"] = config.getboolean(client_name,
761
482
"enabled")
762
483
763
# Uppercase and remove spaces from fingerprint for later
764
# comparison purposes with return value from the
765
# fingerprint() function
766
484
client["fingerprint"] = (section["fingerprint"].upper()
767
485
.replace(" ", ""))
768
486
if "secret" in section:
810
528
self.expires = None
811
529
812
530
logger.debug("Creating client %r", self.name)
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the fingerprint()
533
# function
813
534
logger.debug(" Fingerprint: %s", self.fingerprint)
814
535
self.created = settings.get("created",
815
536
datetime.datetime.utcnow())
822
543
self.current_checker_command = None
823
544
self.approved = None
824
545
self.approvals_pending = 0
825
self.changedstate = multiprocessing_manager.Condition(
826
multiprocessing_manager.Lock())
827
self.client_structure = [attr
828
for attr in self.__dict__.iterkeys()
546
self.changedstate = (multiprocessing_manager
547
.Condition(multiprocessing_manager
548
.Lock()))
549
self.client_structure = [attr for attr in
550
self.__dict__.iterkeys()
829
551
if not attr.startswith("_")]
830
552
self.client_structure.append("client_structure")
831
553
832
for name, t in inspect.getmembers(
833
type(self), lambda obj: isinstance(obj, property)):
554
for name, t in inspect.getmembers(type(self),
555
lambda obj:
556
isinstance(obj,
557
property)):
834
558
if not name.startswith("_"):
835
559
self.client_structure.append(name)
836
560
878
602
# and every interval from then on.
879
603
if self.checker_initiator_tag is not None:
880
604
gobject.source_remove(self.checker_initiator_tag)
881
self.checker_initiator_tag = gobject.timeout_add(
882
int(self.interval.total_seconds() * 1000),
883
self.start_checker)
605
self.checker_initiator_tag = (gobject.timeout_add
606
(int(self.interval
607
.total_seconds() * 1000),
608
self.start_checker))
884
609
# Schedule a disable() when 'timeout' has passed
885
610
if self.disable_initiator_tag is not None:
886
611
gobject.source_remove(self.disable_initiator_tag)
887
self.disable_initiator_tag = gobject.timeout_add(
888
int(self.timeout.total_seconds() * 1000), self.disable)
612
self.disable_initiator_tag = (gobject.timeout_add
613
(int(self.timeout
614
.total_seconds() * 1000),
615
self.disable))
889
616
# Also start a new checker *right now*.
890
617
self.start_checker()
891
618
892
def checker_callback(self, source, condition, connection,
893
command):
619
def checker_callback(self, pid, condition, command):
894
620
"""The checker has completed, so take appropriate actions."""
895
621
self.checker_callback_tag = None
896
622
self.checker = None
897
# Read return code from connection (see call_pipe)
898
returncode = connection.recv()
899
connection.close()
900
901
if returncode >= 0:
902
self.last_checker_status = returncode
903
self.last_checker_signal = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
904
625
if self.last_checker_status == 0:
905
626
logger.info("Checker for %(name)s succeeded",
906
627
vars(self))
907
628
self.checked_ok()
908
629
else:
909
logger.info("Checker for %(name)s failed", vars(self))
630
logger.info("Checker for %(name)s failed",
631
vars(self))
910
632
else:
911
633
self.last_checker_status = -1
912
self.last_checker_signal = -returncode
913
634
logger.warning("Checker for %(name)s crashed?",
914
635
vars(self))
915
return False
916
636
917
637
def checked_ok(self):
918
638
"""Assert that the client has been seen, alive and well."""
919
639
self.last_checked_ok = datetime.datetime.utcnow()
920
640
self.last_checker_status = 0
921
self.last_checker_signal = None
922
641
self.bump_timeout()
923
642
924
643
def bump_timeout(self, timeout=None):
929
648
gobject.source_remove(self.disable_initiator_tag)
930
649
self.disable_initiator_tag = None
931
650
if getattr(self, "enabled", False):
932
self.disable_initiator_tag = gobject.timeout_add(
933
int(timeout.total_seconds() * 1000), self.disable)
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
934
654
self.expires = datetime.datetime.utcnow() + timeout
935
655
936
656
def need_approval(self):
950
670
# than 'timeout' for the client to be disabled, which is as it
951
671
# should be.
952
672
953
if self.checker is not None and not self.checker.is_alive():
954
logger.warning("Checker was not alive; joining")
955
self.checker.join()
956
self.checker = None
673
# If a checker exists, make sure it is not a zombie
674
try:
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
677
pass
678
except OSError as error:
679
if error.errno != errno.ECHILD:
680
raise
681
else:
682
if pid:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
957
687
# Start a new checker if needed
958
688
if self.checker is None:
959
689
# Escape attributes for the shell
960
escaped_attrs = {
961
attr: re.escape(str(getattr(self, attr)))
962
for attr in self.runtime_expansions }
690
escaped_attrs = { attr:
691
re.escape(str(getattr(self, attr)))
692
for attr in self.runtime_expansions }
963
693
try:
964
694
command = self.checker_command % escaped_attrs
965
695
except TypeError as error:
966
696
logger.error('Could not format string "%s"',
967
self.checker_command,
697
self.checker_command, exc_info=error)
698
return True # Try again later
699
self.current_checker_command = command
700
try:
701
logger.info("Starting checker %r for %s",
702
command, self.name)
703
# We don't need to redirect stdout and stderr, since
704
# in normal mode, that is already done by daemon(),
705
# and in debug mode we don't want to. (Stdin is
706
# always replaced by /dev/null.)
707
# The exception is when not debugging but nevertheless
708
# running in the foreground; use the previously
709
# created wnull.
710
popen_args = {}
711
if (not self.server_settings["debug"]
712
and self.server_settings["foreground"]):
713
popen_args.update({"stdout": wnull,
714
"stderr": wnull })
715
self.checker = subprocess.Popen(command,
716
close_fds=True,
717
shell=True, cwd="/",
718
**popen_args)
719
except OSError as error:
720
logger.error("Failed to start subprocess",
968
721
exc_info=error)
969
return True # Try again later
970
self.current_checker_command = command
971
logger.info("Starting checker %r for %s", command,
972
self.name)
973
# We don't need to redirect stdout and stderr, since
974
# in normal mode, that is already done by daemon(),
975
# and in debug mode we don't want to. (Stdin is
976
# always replaced by /dev/null.)
977
# The exception is when not debugging but nevertheless
978
# running in the foreground; use the previously
979
# created wnull.
980
popen_args = { "close_fds": True,
981
"shell": True,
982
"cwd": "/" }
983
if (not self.server_settings["debug"]
984
and self.server_settings["foreground"]):
985
popen_args.update({"stdout": wnull,
986
"stderr": wnull })
987
pipe = multiprocessing.Pipe(duplex = False)
988
self.checker = multiprocessing.Process(
989
target = call_pipe,
990
args = (pipe[1], subprocess.call, command),
991
kwargs = popen_args)
992
self.checker.start()
993
self.checker_callback_tag = gobject.io_add_watch(
994
pipe[0].fileno(), gobject.IO_IN,
995
self.checker_callback, pipe[0], command)
722
return True
723
self.checker_callback_tag = (gobject.child_watch_add
724
(self.checker.pid,
725
self.checker_callback,
726
data=command))
727
# The checker may have completed before the gobject
728
# watch was added. Check for this.
729
try:
730
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
731
except OSError as error:
732
if error.errno == errno.ECHILD:
733
# This should never happen
734
logger.error("Child process vanished",
735
exc_info=error)
736
return True
737
raise
738
if pid:
739
gobject.source_remove(self.checker_callback_tag)
740
self.checker_callback(pid, status, command)
996
741
# Re-run this periodically if run by gobject.timeout_add
997
742
return True
998
743
1004
749
if getattr(self, "checker", None) is None:
1005
750
return
1006
751
logger.debug("Stopping checker for %(name)s", vars(self))
1007
self.checker.terminate()
752
try:
753
self.checker.terminate()
754
#time.sleep(0.5)
755
#if self.checker.poll() is None:
756
# self.checker.kill()
757
except OSError as error:
758
if error.errno != errno.ESRCH: # No such process
759
raise
1008
760
self.checker = None
1009
761
1010
762
1011
def dbus_service_property(dbus_interface,
1012
signature="v",
1013
access="readwrite",
1014
byte_arrays=False):
763
def dbus_service_property(dbus_interface, signature="v",
764
access="readwrite", byte_arrays=False):
1015
765
"""Decorators for marking methods of a DBusObjectWithProperties to
1016
766
become properties on the D-Bus.
1017
767
1027
777
if byte_arrays and signature != "ay":
1028
778
raise ValueError("Byte arrays not supported for non-'ay'"
1029
779
" signature {!r}".format(signature))
1030
1031
780
def decorator(func):
1032
781
func._dbus_is_property = True
1033
782
func._dbus_interface = dbus_interface
1038
787
func._dbus_name = func._dbus_name[:-14]
1039
788
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1040
789
return func
1041
1042
790
return decorator
1043
791
1044
792
1053
801
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1054
802
"false"}
1055
803
"""
1056
1057
804
def decorator(func):
1058
805
func._dbus_is_interface = True
1059
806
func._dbus_interface = dbus_interface
1060
807
func._dbus_name = dbus_interface
1061
808
return func
1062
1063
809
return decorator
1064
810
1065
811
1067
813
"""Decorator to annotate D-Bus methods, signals or properties
1068
814
Usage:
1069
815
1070
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1071
"org.freedesktop.DBus.Property."
1072
"EmitsChangedSignal": "false"})
1073
816
@dbus_service_property("org.example.Interface", signature="b",
1074
817
access="r")
818
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
819
"org.freedesktop.DBus.Property."
820
"EmitsChangedSignal": "false"})
1075
821
def Property_dbus_property(self):
1076
822
return dbus.Boolean(False)
1077
1078
See also the DBusObjectWithAnnotations class.
1079
823
"""
1080
1081
824
def decorator(func):
1082
825
func._dbus_annotations = annotations
1083
826
return func
1084
1085
827
return decorator
1086
828
1087
829
1090
832
"""
1091
833
pass
1092
834
1093
1094
835
class DBusPropertyAccessException(DBusPropertyException):
1095
836
"""A property's access permissions disallows an operation.
1096
837
"""
1103
844
pass
1104
845
1105
846
1106
class DBusObjectWithAnnotations(dbus.service.Object):
1107
"""A D-Bus object with annotations.
847
class DBusObjectWithProperties(dbus.service.Object):
848
"""A D-Bus object with properties.
1108
849
1109
Classes inheriting from this can use the dbus_annotations
1110
decorator to add annotations to methods or signals.
850
Classes inheriting from this can use the dbus_service_property
851
decorator to expose methods as D-Bus properties. It exposes the
852
standard Get(), Set(), and GetAll() methods on the D-Bus.
1111
853
"""
1112
854
1113
855
@staticmethod
1123
865
def _get_all_dbus_things(self, thing):
1124
866
"""Returns a generator of (name, attribute) pairs
1125
867
"""
1126
return ((getattr(athing.__get__(self), "_dbus_name", name),
868
return ((getattr(athing.__get__(self), "_dbus_name",
869
name),
1127
870
athing.__get__(self))
1128
871
for cls in self.__class__.__mro__
1129
872
for name, athing in
1130
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1131
1132
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1133
out_signature = "s",
1134
path_keyword = 'object_path',
1135
connection_keyword = 'connection')
1136
def Introspect(self, object_path, connection):
1137
"""Overloading of standard D-Bus method.
1138
1139
Inserts annotation tags on methods and signals.
1140
"""
1141
xmlstring = dbus.service.Object.Introspect(self, object_path,
1142
connection)
1143
try:
1144
document = xml.dom.minidom.parseString(xmlstring)
1145
1146
for if_tag in document.getElementsByTagName("interface"):
1147
# Add annotation tags
1148
for typ in ("method", "signal"):
1149
for tag in if_tag.getElementsByTagName(typ):
1150
annots = dict()
1151
for name, prop in (self.
1152
_get_all_dbus_things(typ)):
1153
if (name == tag.getAttribute("name")
1154
and prop._dbus_interface
1155
== if_tag.getAttribute("name")):
1156
annots.update(getattr(
1157
prop, "_dbus_annotations", {}))
1158
for name, value in annots.items():
1159
ann_tag = document.createElement(
1160
"annotation")
1161
ann_tag.setAttribute("name", name)
1162
ann_tag.setAttribute("value", value)
1163
tag.appendChild(ann_tag)
1164
# Add interface annotation tags
1165
for annotation, value in dict(
1166
itertools.chain.from_iterable(
1167
annotations().items()
1168
for name, annotations
1169
in self._get_all_dbus_things("interface")
1170
if name == if_tag.getAttribute("name")
1171
)).items():
1172
ann_tag = document.createElement("annotation")
1173
ann_tag.setAttribute("name", annotation)
1174
ann_tag.setAttribute("value", value)
1175
if_tag.appendChild(ann_tag)
1176
# Fix argument name for the Introspect method itself
1177
if (if_tag.getAttribute("name")
1178
== dbus.INTROSPECTABLE_IFACE):
1179
for cn in if_tag.getElementsByTagName("method"):
1180
if cn.getAttribute("name") == "Introspect":
1181
for arg in cn.getElementsByTagName("arg"):
1182
if (arg.getAttribute("direction")
1183
== "out"):
1184
arg.setAttribute("name",
1185
"xml_data")
1186
xmlstring = document.toxml("utf-8")
1187
document.unlink()
1188
except (AttributeError, xml.dom.DOMException,
1189
xml.parsers.expat.ExpatError) as error:
1190
logger.error("Failed to override Introspection method",
1191
exc_info=error)
1192
return xmlstring
1193
1194
1195
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1196
"""A D-Bus object with properties.
1197
1198
Classes inheriting from this can use the dbus_service_property
1199
decorator to expose methods as D-Bus properties. It exposes the
1200
standard Get(), Set(), and GetAll() methods on the D-Bus.
1201
"""
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
1202
875
1203
876
def _get_dbus_property(self, interface_name, property_name):
1204
877
"""Returns a bound method if one exists which is a D-Bus
1205
878
property with the specified name and interface.
1206
879
"""
1207
for cls in self.__class__.__mro__:
1208
for name, value in inspect.getmembers(
1209
cls, self._is_dbus_thing("property")):
880
for cls in self.__class__.__mro__:
881
for name, value in (inspect.getmembers
882
(cls,
883
self._is_dbus_thing("property"))):
1210
884
if (value._dbus_name == property_name
1211
885
and value._dbus_interface == interface_name):
1212
886
return value.__get__(self)
1213
887
1214
888
# No such property
1215
raise DBusPropertyNotFound("{}:{}.{}".format(
1216
self.dbus_object_path, interface_name, property_name))
1217
1218
@classmethod
1219
def _get_all_interface_names(cls):
1220
"""Get a sequence of all interfaces supported by an object"""
1221
return (name for name in set(getattr(getattr(x, attr),
1222
"_dbus_interface", None)
1223
for x in (inspect.getmro(cls))
1224
for attr in dir(x))
1225
if name is not None)
1226
1227
@dbus.service.method(dbus.PROPERTIES_IFACE,
1228
in_signature="ss",
889
raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
+ interface_name + "."
891
+ property_name)
892
893
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1229
894
out_signature="v")
1230
895
def Get(self, interface_name, property_name):
1231
896
"""Standard D-Bus property Get() method, see D-Bus standard.
1256
921
for byte in value))
1257
922
prop(value)
1258
923
1259
@dbus.service.method(dbus.PROPERTIES_IFACE,
1260
in_signature="s",
924
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1261
925
out_signature="a{sv}")
1262
926
def GetAll(self, interface_name):
1263
927
"""Standard D-Bus property GetAll() method, see D-Bus
1278
942
if not hasattr(value, "variant_level"):
1279
943
properties[name] = value
1280
944
continue
1281
properties[name] = type(value)(
1282
value, variant_level = value.variant_level + 1)
945
properties[name] = type(value)(value, variant_level=
946
value.variant_level+1)
1283
947
return dbus.Dictionary(properties, signature="sv")
1284
948
1285
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1286
def PropertiesChanged(self, interface_name, changed_properties,
1287
invalidated_properties):
1288
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1289
standard.
1290
"""
1291
pass
1292
1293
949
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
950
out_signature="s",
1295
951
path_keyword='object_path',
1299
955
1300
956
Inserts property tags and interface annotation tags.
1301
957
"""
1302
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1303
object_path,
1304
connection)
958
xmlstring = dbus.service.Object.Introspect(self, object_path,
959
connection)
1305
960
try:
1306
961
document = xml.dom.minidom.parseString(xmlstring)
1307
1308
962
def make_tag(document, name, prop):
1309
963
e = document.createElement("property")
1310
964
e.setAttribute("name", name)
1311
965
e.setAttribute("type", prop._dbus_signature)
1312
966
e.setAttribute("access", prop._dbus_access)
1313
967
return e
1314
1315
968
for if_tag in document.getElementsByTagName("interface"):
1316
969
# Add property tags
1317
970
for tag in (make_tag(document, name, prop)
1320
973
if prop._dbus_interface
1321
974
== if_tag.getAttribute("name")):
1322
975
if_tag.appendChild(tag)
1323
# Add annotation tags for properties
1324
for tag in if_tag.getElementsByTagName("property"):
1325
annots = dict()
1326
for name, prop in self._get_all_dbus_things(
1327
"property"):
1328
if (name == tag.getAttribute("name")
1329
and prop._dbus_interface
1330
== if_tag.getAttribute("name")):
1331
annots.update(getattr(
1332
prop, "_dbus_annotations", {}))
1333
for name, value in annots.items():
1334
ann_tag = document.createElement(
1335
"annotation")
1336
ann_tag.setAttribute("name", name)
1337
ann_tag.setAttribute("value", value)
1338
tag.appendChild(ann_tag)
976
# Add annotation tags
977
for typ in ("method", "signal", "property"):
978
for tag in if_tag.getElementsByTagName(typ):
979
annots = dict()
980
for name, prop in (self.
981
_get_all_dbus_things(typ)):
982
if (name == tag.getAttribute("name")
983
and prop._dbus_interface
984
== if_tag.getAttribute("name")):
985
annots.update(getattr
986
(prop,
987
"_dbus_annotations",
988
{}))
989
for name, value in annots.items():
990
ann_tag = document.createElement(
991
"annotation")
992
ann_tag.setAttribute("name", name)
993
ann_tag.setAttribute("value", value)
994
tag.appendChild(ann_tag)
995
# Add interface annotation tags
996
for annotation, value in dict(
997
itertools.chain.from_iterable(
998
annotations().items()
999
for name, annotations in
1000
self._get_all_dbus_things("interface")
1001
if name == if_tag.getAttribute("name")
1002
)).items():
1003
ann_tag = document.createElement("annotation")
1004
ann_tag.setAttribute("name", annotation)
1005
ann_tag.setAttribute("value", value)
1006
if_tag.appendChild(ann_tag)
1339
1007
# Add the names to the return values for the
1340
1008
# "org.freedesktop.DBus.Properties" methods
1341
1009
if (if_tag.getAttribute("name")
1359
1027
exc_info=error)
1360
1028
return xmlstring
1361
1029
1362
try:
1363
dbus.OBJECT_MANAGER_IFACE
1364
except AttributeError:
1365
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1366
1367
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1368
"""A D-Bus object with an ObjectManager.
1369
1370
Classes inheriting from this exposes the standard
1371
GetManagedObjects call and the InterfacesAdded and
1372
InterfacesRemoved signals on the standard
1373
"org.freedesktop.DBus.ObjectManager" interface.
1374
1375
Note: No signals are sent automatically; they must be sent
1376
manually.
1377
"""
1378
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1379
out_signature = "a{oa{sa{sv}}}")
1380
def GetManagedObjects(self):
1381
"""This function must be overridden"""
1382
raise NotImplementedError()
1383
1384
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1385
signature = "oa{sa{sv}}")
1386
def InterfacesAdded(self, object_path, interfaces_and_properties):
1387
pass
1388
1389
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1390
def InterfacesRemoved(self, object_path, interfaces):
1391
pass
1392
1393
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1394
out_signature = "s",
1395
path_keyword = 'object_path',
1396
connection_keyword = 'connection')
1397
def Introspect(self, object_path, connection):
1398
"""Overloading of standard D-Bus method.
1399
1400
Override return argument name of GetManagedObjects to be
1401
"objpath_interfaces_and_properties"
1402
"""
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1404
object_path,
1405
connection)
1406
try:
1407
document = xml.dom.minidom.parseString(xmlstring)
1408
1409
for if_tag in document.getElementsByTagName("interface"):
1410
# Fix argument name for the GetManagedObjects method
1411
if (if_tag.getAttribute("name")
1412
== dbus.OBJECT_MANAGER_IFACE):
1413
for cn in if_tag.getElementsByTagName("method"):
1414
if (cn.getAttribute("name")
1415
== "GetManagedObjects"):
1416
for arg in cn.getElementsByTagName("arg"):
1417
if (arg.getAttribute("direction")
1418
== "out"):
1419
arg.setAttribute(
1420
"name",
1421
"objpath_interfaces"
1422
"_and_properties")
1423
xmlstring = document.toxml("utf-8")
1424
document.unlink()
1425
except (AttributeError, xml.dom.DOMException,
1426
xml.parsers.expat.ExpatError) as error:
1427
logger.error("Failed to override Introspection method",
1428
exc_info = error)
1429
return xmlstring
1430
1030
1431
1031
def datetime_to_dbus(dt, variant_level=0):
1432
1032
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1433
1033
if dt is None:
1434
1034
return dbus.String("", variant_level = variant_level)
1435
return dbus.String(dt.isoformat(), variant_level=variant_level)
1035
return dbus.String(dt.isoformat(),
1036
variant_level=variant_level)
1436
1037
1437
1038
1438
1039
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1458
1059
(from DBusObjectWithProperties) and interfaces (from the
1459
1060
dbus_interface_annotations decorator).
1460
1061
"""
1461
1462
1062
def wrapper(cls):
1463
1063
for orig_interface_name, alt_interface_name in (
1464
alt_interface_names.items()):
1064
alt_interface_names.items()):
1465
1065
attr = {}
1466
1066
interface_names = set()
1467
1067
# Go though all attributes of the class
1469
1069
# Ignore non-D-Bus attributes, and D-Bus attributes
1470
1070
# with the wrong interface name
1471
1071
if (not hasattr(attribute, "_dbus_interface")
1472
or not attribute._dbus_interface.startswith(
1473
orig_interface_name)):
1072
or not attribute._dbus_interface
1073
.startswith(orig_interface_name)):
1474
1074
continue
1475
1075
# Create an alternate D-Bus interface name based on
1476
1076
# the current name
1477
alt_interface = attribute._dbus_interface.replace(
1478
orig_interface_name, alt_interface_name)
1077
alt_interface = (attribute._dbus_interface
1078
.replace(orig_interface_name,
1079
alt_interface_name))
1479
1080
interface_names.add(alt_interface)
1480
1081
# Is this a D-Bus signal?
1481
1082
if getattr(attribute, "_dbus_is_signal", False):
1482
if sys.version_info.major == 2:
1483
# Extract the original non-method undecorated
1484
# function by black magic
1485
nonmethod_func = (dict(
1083
# Extract the original non-method undecorated
1084
# function by black magic
1085
nonmethod_func = (dict(
1486
1086
zip(attribute.func_code.co_freevars,
1487
attribute.__closure__))
1488
["func"].cell_contents)
1489
else:
1490
nonmethod_func = attribute
1087
attribute.__closure__))["func"]
1088
.cell_contents)
1491
1089
# Create a new, but exactly alike, function
1492
1090
# object, and decorate it to be a new D-Bus signal
1493
1091
# with the alternate D-Bus interface name
1494
if sys.version_info.major == 2:
1495
new_function = types.FunctionType(
1496
nonmethod_func.func_code,
1497
nonmethod_func.func_globals,
1498
nonmethod_func.func_name,
1499
nonmethod_func.func_defaults,
1500
nonmethod_func.func_closure)
1501
else:
1502
new_function = types.FunctionType(
1503
nonmethod_func.__code__,
1504
nonmethod_func.__globals__,
1505
nonmethod_func.__name__,
1506
nonmethod_func.__defaults__,
1507
nonmethod_func.__closure__)
1508
new_function = (dbus.service.signal(
1509
alt_interface,
1510
attribute._dbus_signature)(new_function))
1092
new_function = (dbus.service.signal
1093
(alt_interface,
1094
attribute._dbus_signature)
1095
(types.FunctionType(
1096
nonmethod_func.func_code,
1097
nonmethod_func.func_globals,
1098
nonmethod_func.func_name,
1099
nonmethod_func.func_defaults,
1100
nonmethod_func.func_closure)))
1511
1101
# Copy annotations, if any
1512
1102
try:
1513
new_function._dbus_annotations = dict(
1514
attribute._dbus_annotations)
1103
new_function._dbus_annotations = (
1104
dict(attribute._dbus_annotations))
1515
1105
except AttributeError:
1516
1106
pass
1517
1107
# Define a creator of a function to call both the
1522
1112
"""This function is a scope container to pass
1523
1113
func1 and func2 to the "call_both" function
1524
1114
outside of its arguments"""
1525
1526
@functools.wraps(func2)
1527
1115
def call_both(*args, **kwargs):
1528
1116
"""This function will emit two D-Bus
1529
1117
signals by calling func1 and func2"""
1530
1118
func1(*args, **kwargs)
1531
1119
func2(*args, **kwargs)
1532
# Make wrapper function look like a D-Bus signal
1533
for name, attr in inspect.getmembers(func2):
1534
if name.startswith("_dbus_"):
1535
setattr(call_both, name, attr)
1536
1537
1120
return call_both
1538
1121
# Create the "call_both" function and add it to
1539
1122
# the class
1544
1127
# object. Decorate it to be a new D-Bus method
1545
1128
# with the alternate D-Bus interface name. Add it
1546
1129
# to the class.
1547
attr[attrname] = (
1548
dbus.service.method(
1549
alt_interface,
1550
attribute._dbus_in_signature,
1551
attribute._dbus_out_signature)
1552
(types.FunctionType(attribute.func_code,
1553
attribute.func_globals,
1554
attribute.func_name,
1555
attribute.func_defaults,
1556
attribute.func_closure)))
1130
attr[attrname] = (dbus.service.method
1131
(alt_interface,
1132
attribute._dbus_in_signature,
1133
attribute._dbus_out_signature)
1134
(types.FunctionType
1135
(attribute.func_code,
1136
attribute.func_globals,
1137
attribute.func_name,
1138
attribute.func_defaults,
1139
attribute.func_closure)))
1557
1140
# Copy annotations, if any
1558
1141
try:
1559
attr[attrname]._dbus_annotations = dict(
1560
attribute._dbus_annotations)
1142
attr[attrname]._dbus_annotations = (
1143
dict(attribute._dbus_annotations))
1561
1144
except AttributeError:
1562
1145
pass
1563
1146
# Is this a D-Bus property?
1566
1149
# object, and decorate it to be a new D-Bus
1567
1150
# property with the alternate D-Bus interface
1568
1151
# name. Add it to the class.
1569
attr[attrname] = (dbus_service_property(
1570
alt_interface, attribute._dbus_signature,
1571
attribute._dbus_access,
1572
attribute._dbus_get_args_options
1573
["byte_arrays"])
1574
(types.FunctionType(
1575
attribute.func_code,
1576
attribute.func_globals,
1577
attribute.func_name,
1578
attribute.func_defaults,
1579
attribute.func_closure)))
1152
attr[attrname] = (dbus_service_property
1153
(alt_interface,
1154
attribute._dbus_signature,
1155
attribute._dbus_access,
1156
attribute
1157
._dbus_get_args_options
1158
["byte_arrays"])
1159
(types.FunctionType
1160
(attribute.func_code,
1161
attribute.func_globals,
1162
attribute.func_name,
1163
attribute.func_defaults,
1164
attribute.func_closure)))
1580
1165
# Copy annotations, if any
1581
1166
try:
1582
attr[attrname]._dbus_annotations = dict(
1583
attribute._dbus_annotations)
1167
attr[attrname]._dbus_annotations = (
1168
dict(attribute._dbus_annotations))
1584
1169
except AttributeError:
1585
1170
pass
1586
1171
# Is this a D-Bus interface?
1589
1174
# object. Decorate it to be a new D-Bus interface
1590
1175
# with the alternate D-Bus interface name. Add it
1591
1176
# to the class.
1592
attr[attrname] = (
1593
dbus_interface_annotations(alt_interface)
1594
(types.FunctionType(attribute.func_code,
1595
attribute.func_globals,
1596
attribute.func_name,
1597
attribute.func_defaults,
1598
attribute.func_closure)))
1177
attr[attrname] = (dbus_interface_annotations
1178
(alt_interface)
1179
(types.FunctionType
1180
(attribute.func_code,
1181
attribute.func_globals,
1182
attribute.func_name,
1183
attribute.func_defaults,
1184
attribute.func_closure)))
1599
1185
if deprecate:
1600
1186
# Deprecate all alternate interfaces
1601
1187
iname="_AlternateDBusNames_interface_annotation{}"
1602
1188
for interface_name in interface_names:
1603
1604
1189
@dbus_interface_annotations(interface_name)
1605
1190
def func(self):
1606
1191
return { "org.freedesktop.DBus.Deprecated":
1607
"true" }
1192
"true" }
1608
1193
# Find an unused name
1609
1194
for aname in (iname.format(i)
1610
1195
for i in itertools.count()):
1615
1200
# Replace the class with a new subclass of it with
1616
1201
# methods, signals, etc. as created above.
1617
1202
cls = type(b"{}Alternate".format(cls.__name__),
1618
(cls, ), attr)
1203
(cls,), attr)
1619
1204
return cls
1620
1621
1205
return wrapper
1622
1206
1623
1207
1624
1208
@alternate_dbus_interfaces({"se.recompile.Mandos":
1625
"se.bsnet.fukt.Mandos"})
1209
"se.bsnet.fukt.Mandos"})
1626
1210
class ClientDBus(Client, DBusObjectWithProperties):
1627
1211
"""A Client class using D-Bus
1628
1212
1632
1216
"""
1633
1217
1634
1218
runtime_expansions = (Client.runtime_expansions
1635
+ ("dbus_object_path", ))
1636
1637
_interface = "se.recompile.Mandos.Client"
1219
+ ("dbus_object_path",))
1638
1220
1639
1221
# dbus.service.Object doesn't use super(), so we can't either.
1640
1222
1646
1228
client_object_name = str(self.name).translate(
1647
1229
{ord("."): ord("_"),
1648
1230
ord("-"): ord("_")})
1649
self.dbus_object_path = dbus.ObjectPath(
1650
"/clients/" + client_object_name)
1231
self.dbus_object_path = (dbus.ObjectPath
1232
("/clients/" + client_object_name))
1651
1233
DBusObjectWithProperties.__init__(self, self.bus,
1652
1234
self.dbus_object_path)
1653
1235
1654
def notifychangeproperty(transform_func, dbus_name,
1655
type_func=lambda x: x,
1656
variant_level=1,
1657
invalidate_only=False,
1658
_interface=_interface):
1236
def notifychangeproperty(transform_func,
1237
dbus_name, type_func=lambda x: x,
1238
variant_level=1):
1659
1239
""" Modify a variable so that it's a property which announces
1660
1240
its changes to DBus.
1661
1241
1667
1247
variant_level: D-Bus variant level. Default: 1
1668
1248
"""
1669
1249
attrname = "_{}".format(dbus_name)
1670
1671
1250
def setter(self, value):
1672
1251
if hasattr(self, "dbus_object_path"):
1673
1252
if (not hasattr(self, attrname) or
1674
1253
type_func(getattr(self, attrname, None))
1675
1254
!= type_func(value)):
1676
if invalidate_only:
1677
self.PropertiesChanged(
1678
_interface, dbus.Dictionary(),
1679
dbus.Array((dbus_name, )))
1680
else:
1681
dbus_value = transform_func(
1682
type_func(value),
1683
variant_level = variant_level)
1684
self.PropertyChanged(dbus.String(dbus_name),
1685
dbus_value)
1686
self.PropertiesChanged(
1687
_interface,
1688
dbus.Dictionary({ dbus.String(dbus_name):
1689
dbus_value }),
1690
dbus.Array())
1255
dbus_value = transform_func(type_func(value),
1256
variant_level
1257
=variant_level)
1258
self.PropertyChanged(dbus.String(dbus_name),
1259
dbus_value)
1691
1260
setattr(self, attrname, value)
1692
1261
1693
1262
return property(lambda self: getattr(self, attrname), setter)
1699
1268
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1700
1269
last_enabled = notifychangeproperty(datetime_to_dbus,
1701
1270
"LastEnabled")
1702
checker = notifychangeproperty(
1703
dbus.Boolean, "CheckerRunning",
1704
type_func = lambda checker: checker is not None)
1271
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1272
type_func = lambda checker:
1273
checker is not None)
1705
1274
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1706
1275
"LastCheckedOK")
1707
1276
last_checker_status = notifychangeproperty(dbus.Int16,
1710
1279
datetime_to_dbus, "LastApprovalRequest")
1711
1280
approved_by_default = notifychangeproperty(dbus.Boolean,
1712
1281
"ApprovedByDefault")
1713
approval_delay = notifychangeproperty(
1714
dbus.UInt64, "ApprovalDelay",
1715
type_func = lambda td: td.total_seconds() * 1000)
1282
approval_delay = notifychangeproperty(dbus.UInt64,
1283
"ApprovalDelay",
1284
type_func =
1285
lambda td: td.total_seconds()
1286
* 1000)
1716
1287
approval_duration = notifychangeproperty(
1717
1288
dbus.UInt64, "ApprovalDuration",
1718
1289
type_func = lambda td: td.total_seconds() * 1000)
1719
1290
host = notifychangeproperty(dbus.String, "Host")
1720
timeout = notifychangeproperty(
1721
dbus.UInt64, "Timeout",
1722
type_func = lambda td: td.total_seconds() * 1000)
1291
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1292
type_func = lambda td:
1293
td.total_seconds() * 1000)
1723
1294
extended_timeout = notifychangeproperty(
1724
1295
dbus.UInt64, "ExtendedTimeout",
1725
1296
type_func = lambda td: td.total_seconds() * 1000)
1726
interval = notifychangeproperty(
1727
dbus.UInt64, "Interval",
1728
type_func = lambda td: td.total_seconds() * 1000)
1297
interval = notifychangeproperty(dbus.UInt64,
1298
"Interval",
1299
type_func =
1300
lambda td: td.total_seconds()
1301
* 1000)
1729
1302
checker_command = notifychangeproperty(dbus.String, "Checker")
1730
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1731
invalidate_only=True)
1732
1303
1733
1304
del notifychangeproperty
1734
1305
1741
1312
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1742
1313
Client.__del__(self, *args, **kwargs)
1743
1314
1744
def checker_callback(self, source, condition,
1745
connection, command, *args, **kwargs):
1746
ret = Client.checker_callback(self, source, condition,
1747
connection, command, *args,
1748
**kwargs)
1749
exitstatus = self.last_checker_status
1750
if exitstatus >= 0:
1315
def checker_callback(self, pid, condition, command,
1316
*args, **kwargs):
1317
self.checker_callback_tag = None
1318
self.checker = None
1319
if os.WIFEXITED(condition):
1320
exitstatus = os.WEXITSTATUS(condition)
1751
1321
# Emit D-Bus signal
1752
1322
self.CheckerCompleted(dbus.Int16(exitstatus),
1753
# This is specific to GNU libC
1754
dbus.Int64(exitstatus << 8),
1323
dbus.Int64(condition),
1755
1324
dbus.String(command))
1756
1325
else:
1757
1326
# Emit D-Bus signal
1758
1327
self.CheckerCompleted(dbus.Int16(-1),
1759
dbus.Int64(
1760
# This is specific to GNU libC
1761
(exitstatus << 8)
1762
| self.last_checker_signal),
1328
dbus.Int64(condition),
1763
1329
dbus.String(command))
1764
return ret
1330
1331
return Client.checker_callback(self, pid, condition, command,
1332
*args, **kwargs)
1765
1333
1766
1334
def start_checker(self, *args, **kwargs):
1767
1335
old_checker_pid = getattr(self.checker, "pid", None)
1784
1352
self.send_changedstate()
1785
1353
1786
1354
## D-Bus methods, signals & properties
1355
_interface = "se.recompile.Mandos.Client"
1787
1356
1788
1357
## Interfaces
1789
1358
1359
@dbus_interface_annotations(_interface)
1360
def _foo(self):
1361
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1362
"false"}
1363
1790
1364
## Signals
1791
1365
1792
1366
# CheckerCompleted - signal
1802
1376
pass
1803
1377
1804
1378
# PropertyChanged - signal
1805
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1806
1379
@dbus.service.signal(_interface, signature="sv")
1807
1380
def PropertyChanged(self, property, value):
1808
1381
"D-Bus signal"
1842
1415
self.checked_ok()
1843
1416
1844
1417
# Enable - method
1845
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1846
1418
@dbus.service.method(_interface)
1847
1419
def Enable(self):
1848
1420
"D-Bus method"
1849
1421
self.enable()
1850
1422
1851
1423
# StartChecker - method
1852
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1853
1424
@dbus.service.method(_interface)
1854
1425
def StartChecker(self):
1855
1426
"D-Bus method"
1856
1427
self.start_checker()
1857
1428
1858
1429
# Disable - method
1859
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1860
1430
@dbus.service.method(_interface)
1861
1431
def Disable(self):
1862
1432
"D-Bus method"
1863
1433
self.disable()
1864
1434
1865
1435
# StopChecker - method
1866
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1867
1436
@dbus.service.method(_interface)
1868
1437
def StopChecker(self):
1869
1438
self.stop_checker()
1876
1445
return dbus.Boolean(bool(self.approvals_pending))
1877
1446
1878
1447
# ApprovedByDefault - property
1879
@dbus_service_property(_interface,
1880
signature="b",
1448
@dbus_service_property(_interface, signature="b",
1881
1449
access="readwrite")
1882
1450
def ApprovedByDefault_dbus_property(self, value=None):
1883
1451
if value is None: # get
1885
1453
self.approved_by_default = bool(value)
1886
1454
1887
1455
# ApprovalDelay - property
1888
@dbus_service_property(_interface,
1889
signature="t",
1456
@dbus_service_property(_interface, signature="t",
1890
1457
access="readwrite")
1891
1458
def ApprovalDelay_dbus_property(self, value=None):
1892
1459
if value is None: # get
1895
1462
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1896
1463
1897
1464
# ApprovalDuration - property
1898
@dbus_service_property(_interface,
1899
signature="t",
1465
@dbus_service_property(_interface, signature="t",
1900
1466
access="readwrite")
1901
1467
def ApprovalDuration_dbus_property(self, value=None):
1902
1468
if value is None: # get
1905
1471
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1906
1472
1907
1473
# Name - property
1908
@dbus_annotations(
1909
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1910
1474
@dbus_service_property(_interface, signature="s", access="read")
1911
1475
def Name_dbus_property(self):
1912
1476
return dbus.String(self.name)
1913
1477
1914
1478
# Fingerprint - property
1915
@dbus_annotations(
1916
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1917
1479
@dbus_service_property(_interface, signature="s", access="read")
1918
1480
def Fingerprint_dbus_property(self):
1919
1481
return dbus.String(self.fingerprint)
1920
1482
1921
1483
# Host - property
1922
@dbus_service_property(_interface,
1923
signature="s",
1484
@dbus_service_property(_interface, signature="s",
1924
1485
access="readwrite")
1925
1486
def Host_dbus_property(self, value=None):
1926
1487
if value is None: # get
1928
1489
self.host = str(value)
1929
1490
1930
1491
# Created - property
1931
@dbus_annotations(
1932
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1933
1492
@dbus_service_property(_interface, signature="s", access="read")
1934
1493
def Created_dbus_property(self):
1935
1494
return datetime_to_dbus(self.created)
1940
1499
return datetime_to_dbus(self.last_enabled)
1941
1500
1942
1501
# Enabled - property
1943
@dbus_service_property(_interface,
1944
signature="b",
1502
@dbus_service_property(_interface, signature="b",
1945
1503
access="readwrite")
1946
1504
def Enabled_dbus_property(self, value=None):
1947
1505
if value is None: # get
1952
1510
self.disable()
1953
1511
1954
1512
# LastCheckedOK - property
1955
@dbus_service_property(_interface,
1956
signature="s",
1513
@dbus_service_property(_interface, signature="s",
1957
1514
access="readwrite")
1958
1515
def LastCheckedOK_dbus_property(self, value=None):
1959
1516
if value is not None:
1962
1519
return datetime_to_dbus(self.last_checked_ok)
1963
1520
1964
1521
# LastCheckerStatus - property
1965
@dbus_service_property(_interface, signature="n", access="read")
1522
@dbus_service_property(_interface, signature="n",
1523
access="read")
1966
1524
def LastCheckerStatus_dbus_property(self):
1967
1525
return dbus.Int16(self.last_checker_status)
1968
1526
1977
1535
return datetime_to_dbus(self.last_approval_request)
1978
1536
1979
1537
# Timeout - property
1980
@dbus_service_property(_interface,
1981
signature="t",
1538
@dbus_service_property(_interface, signature="t",
1982
1539
access="readwrite")
1983
1540
def Timeout_dbus_property(self, value=None):
1984
1541
if value is None: # get
1997
1554
is None):
1998
1555
return
1999
1556
gobject.source_remove(self.disable_initiator_tag)
2000
self.disable_initiator_tag = gobject.timeout_add(
2001
int((self.expires - now).total_seconds() * 1000),
2002
self.disable)
1557
self.disable_initiator_tag = (
1558
gobject.timeout_add(
1559
int((self.expires - now).total_seconds()
1560
* 1000), self.disable))
2003
1561
2004
1562
# ExtendedTimeout - property
2005
@dbus_service_property(_interface,
2006
signature="t",
1563
@dbus_service_property(_interface, signature="t",
2007
1564
access="readwrite")
2008
1565
def ExtendedTimeout_dbus_property(self, value=None):
2009
1566
if value is None: # get
2012
1569
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2013
1570
2014
1571
# Interval - property
2015
@dbus_service_property(_interface,
2016
signature="t",
1572
@dbus_service_property(_interface, signature="t",
2017
1573
access="readwrite")
2018
1574
def Interval_dbus_property(self, value=None):
2019
1575
if value is None: # get
2024
1580
if self.enabled:
2025
1581
# Reschedule checker run
2026
1582
gobject.source_remove(self.checker_initiator_tag)
2027
self.checker_initiator_tag = gobject.timeout_add(
2028
value, self.start_checker)
2029
self.start_checker() # Start one now, too
1583
self.checker_initiator_tag = (gobject.timeout_add
1584
(value, self.start_checker))
1585
self.start_checker() # Start one now, too
2030
1586
2031
1587
# Checker - property
2032
@dbus_service_property(_interface,
2033
signature="s",
1588
@dbus_service_property(_interface, signature="s",
2034
1589
access="readwrite")
2035
1590
def Checker_dbus_property(self, value=None):
2036
1591
if value is None: # get
2038
1593
self.checker_command = str(value)
2039
1594
2040
1595
# CheckerRunning - property
2041
@dbus_service_property(_interface,
2042
signature="b",
1596
@dbus_service_property(_interface, signature="b",
2043
1597
access="readwrite")
2044
1598
def CheckerRunning_dbus_property(self, value=None):
2045
1599
if value is None: # get
2050
1604
self.stop_checker()
2051
1605
2052
1606
# ObjectPath - property
2053
@dbus_annotations(
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2055
"org.freedesktop.DBus.Deprecated": "true"})
2056
1607
@dbus_service_property(_interface, signature="o", access="read")
2057
1608
def ObjectPath_dbus_property(self):
2058
1609
return self.dbus_object_path # is already a dbus.ObjectPath
2059
1610
2060
1611
# Secret = property
2061
@dbus_annotations(
2062
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2063
"invalidates"})
2064
@dbus_service_property(_interface,
2065
signature="ay",
2066
access="write",
2067
byte_arrays=True)
1612
@dbus_service_property(_interface, signature="ay",
1613
access="write", byte_arrays=True)
2068
1614
def Secret_dbus_property(self, value):
2069
1615
self.secret = bytes(value)
2070
1616
2076
1622
self._pipe = child_pipe
2077
1623
self._pipe.send(('init', fpr, address))
2078
1624
if not self._pipe.recv():
2079
raise KeyError(fpr)
1625
raise KeyError()
2080
1626
2081
1627
def __getattribute__(self, name):
2082
1628
if name == '_pipe':
2086
1632
if data[0] == 'data':
2087
1633
return data[1]
2088
1634
if data[0] == 'function':
2089
2090
1635
def func(*args, **kwargs):
2091
1636
self._pipe.send(('funcall', name, args, kwargs))
2092
1637
return self._pipe.recv()[1]
2093
2094
1638
return func
2095
1639
2096
1640
def __setattr__(self, name, value):
2112
1656
logger.debug("Pipe FD: %d",
2113
1657
self.server.child_pipe.fileno())
2114
1658
2115
session = gnutls.ClientSession(self.request)
1659
session = (gnutls.connection
1660
.ClientSession(self.request,
1661
gnutls.connection
1662
.X509Credentials()))
1663
1664
# Note: gnutls.connection.X509Credentials is really a
1665
# generic GnuTLS certificate credentials object so long as
1666
# no X.509 keys are added to it. Therefore, we can use it
1667
# here despite using OpenPGP certificates.
2116
1668
2117
1669
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2118
1670
# "+AES-256-CBC", "+SHA1",
2122
1674
priority = self.server.gnutls_priority
2123
1675
if priority is None:
2124
1676
priority = "NORMAL"
2125
gnutls.priority_set_direct(session._c_object, priority,
2126
None)
1677
(gnutls.library.functions
1678
.gnutls_priority_set_direct(session._c_object,
1679
priority, None))
2127
1680
2128
1681
# Start communication using the Mandos protocol
2129
1682
# Get protocol number
2139
1692
# Start GnuTLS connection
2140
1693
try:
2141
1694
session.handshake()
2142
except gnutls.Error as error:
1695
except gnutls.errors.GNUTLSError as error:
2143
1696
logger.warning("Handshake failed: %s", error)
2144
1697
# Do not run session.bye() here: the session is not
2145
1698
# established. Just abandon the request.
2149
1702
approval_required = False
2150
1703
try:
2151
1704
try:
2152
fpr = self.fingerprint(
2153
self.peer_certificate(session))
2154
except (TypeError, gnutls.Error) as error:
1705
fpr = self.fingerprint(self.peer_certificate
1706
(session))
1707
except (TypeError,
1708
gnutls.errors.GNUTLSError) as error:
2155
1709
logger.warning("Bad certificate: %s", error)
2156
1710
return
2157
1711
logger.debug("Fingerprint: %s", fpr)
2170
1724
while True:
2171
1725
if not client.enabled:
2172
1726
logger.info("Client %s is disabled",
2173
client.name)
1727
client.name)
2174
1728
if self.server.use_dbus:
2175
1729
# Emit D-Bus signal
2176
1730
client.Rejected("Disabled")
2219
1773
while sent_size < len(client.secret):
2220
1774
try:
2221
1775
sent = session.send(client.secret[sent_size:])
2222
except gnutls.Error as error:
1776
except gnutls.errors.GNUTLSError as error:
2223
1777
logger.warning("gnutls send failed",
2224
1778
exc_info=error)
2225
1779
return
2226
logger.debug("Sent: %d, remaining: %d", sent,
2227
len(client.secret) - (sent_size
2228
+ sent))
1780
logger.debug("Sent: %d, remaining: %d",
1781
sent, len(client.secret)
1782
- (sent_size + sent))
2229
1783
sent_size += sent
2230
1784
2231
1785
logger.info("Sending secret to %s", client.name)
2240
1794
client.approvals_pending -= 1
2241
1795
try:
2242
1796
session.bye()
2243
except gnutls.Error as error:
1797
except gnutls.errors.GNUTLSError as error:
2244
1798
logger.warning("GnuTLS bye failed",
2245
1799
exc_info=error)
2246
1800
2248
1802
def peer_certificate(session):
2249
1803
"Return the peer's OpenPGP certificate as a bytestring"
2250
1804
# If not an OpenPGP certificate...
2251
if (gnutls.certificate_type_get(session._c_object)
2252
!= gnutls.CRT_OPENPGP):
2253
# ...return invalid data
2254
return b""
1805
if (gnutls.library.functions
1806
.gnutls_certificate_type_get(session._c_object)
1807
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1808
# ...do the normal thing
1809
return session.peer_certificate
2255
1810
list_size = ctypes.c_uint(1)
2256
cert_list = (gnutls.certificate_get_peers
1811
cert_list = (gnutls.library.functions
1812
.gnutls_certificate_get_peers
2257
1813
(session._c_object, ctypes.byref(list_size)))
2258
1814
if not bool(cert_list) and list_size.value != 0:
2259
raise gnutls.Error("error getting peer certificate")
1815
raise gnutls.errors.GNUTLSError("error getting peer"
1816
" certificate")
2260
1817
if list_size.value == 0:
2261
1818
return None
2262
1819
cert = cert_list[0]
2266
1823
def fingerprint(openpgp):
2267
1824
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2268
1825
# New GnuTLS "datum" with the OpenPGP public key
2269
datum = gnutls.datum_t(
2270
ctypes.cast(ctypes.c_char_p(openpgp),
2271
ctypes.POINTER(ctypes.c_ubyte)),
2272
ctypes.c_uint(len(openpgp)))
1826
datum = (gnutls.library.types
1827
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1828
ctypes.POINTER
1829
(ctypes.c_ubyte)),
1830
ctypes.c_uint(len(openpgp))))
2273
1831
# New empty GnuTLS certificate
2274
crt = gnutls.openpgp_crt_t()
2275
gnutls.openpgp_crt_init(ctypes.byref(crt))
1832
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2276
1835
# Import the OpenPGP public key into the certificate
2277
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2278
gnutls.OPENPGP_FMT_RAW)
1836
(gnutls.library.functions
1837
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1838
gnutls.library.constants
1839
.GNUTLS_OPENPGP_FMT_RAW))
2279
1840
# Verify the self signature in the key
2280
1841
crtverify = ctypes.c_uint()
2281
gnutls.openpgp_crt_verify_self(crt, 0,
2282
ctypes.byref(crtverify))
1842
(gnutls.library.functions
1843
.gnutls_openpgp_crt_verify_self(crt, 0,
1844
ctypes.byref(crtverify)))
2283
1845
if crtverify.value != 0:
2284
gnutls.openpgp_crt_deinit(crt)
2285
raise gnutls.CertificateSecurityError("Verify failed")
1846
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1847
raise (gnutls.errors.CertificateSecurityError
1848
("Verify failed"))
2286
1849
# New buffer for the fingerprint
2287
1850
buf = ctypes.create_string_buffer(20)
2288
1851
buf_len = ctypes.c_size_t()
2289
1852
# Get the fingerprint from the certificate into the buffer
2290
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2291
ctypes.byref(buf_len))
1853
(gnutls.library.functions
1854
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1855
ctypes.byref(buf_len)))
2292
1856
# Deinit the certificate
2293
gnutls.openpgp_crt_deinit(crt)
1857
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2294
1858
# Convert the buffer to a Python bytestring
2295
1859
fpr = ctypes.string_at(buf, buf_len.value)
2296
1860
# Convert the bytestring to hexadecimal notation
2300
1864
2301
1865
class MultiprocessingMixIn(object):
2302
1866
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2303
2304
1867
def sub_process_main(self, request, address):
2305
1868
try:
2306
1869
self.finish_request(request, address)
2318
1881
2319
1882
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2320
1883
""" adds a pipe to the MixIn """
2321
2322
1884
def process_request(self, request, client_address):
2323
1885
"""Overrides and wraps the original process_request().
2324
1886
2345
1907
interface: None or a network interface name (string)
2346
1908
use_ipv6: Boolean; to use IPv6 or not
2347
1909
"""
2348
2349
1910
def __init__(self, server_address, RequestHandlerClass,
2350
interface=None,
2351
use_ipv6=True,
2352
socketfd=None):
1911
interface=None, use_ipv6=True, socketfd=None):
2353
1912
"""If socketfd is set, use that file descriptor instead of
2354
1913
creating a new one with socket.socket().
2355
1914
"""
2396
1955
self.interface)
2397
1956
else:
2398
1957
try:
2399
self.socket.setsockopt(
2400
socket.SOL_SOCKET, SO_BINDTODEVICE,
2401
(self.interface + "\0").encode("utf-8"))
1958
self.socket.setsockopt(socket.SOL_SOCKET,
1959
SO_BINDTODEVICE,
1960
(self.interface + "\0")
1961
.encode("utf-8"))
2402
1962
except socket.error as error:
2403
1963
if error.errno == errno.EPERM:
2404
1964
logger.error("No permission to bind to"
2422
1982
self.server_address = (any_address,
2423
1983
self.server_address[1])
2424
1984
elif not self.server_address[1]:
2425
self.server_address = (self.server_address[0], 0)
1985
self.server_address = (self.server_address[0],
1986
0)
2426
1987
# if self.interface:
2427
1988
# self.server_address = (self.server_address[0],
2428
1989
# 0, # port
2442
2003
2443
2004
Assumes a gobject.MainLoop event loop.
2444
2005
"""
2445
2446
2006
def __init__(self, server_address, RequestHandlerClass,
2447
interface=None,
2448
use_ipv6=True,
2449
clients=None,
2450
gnutls_priority=None,
2451
use_dbus=True,
2452
socketfd=None):
2007
interface=None, use_ipv6=True, clients=None,
2008
gnutls_priority=None, use_dbus=True, socketfd=None):
2453
2009
self.enabled = False
2454
2010
self.clients = clients
2455
2011
if self.clients is None:
2461
2017
interface = interface,
2462
2018
use_ipv6 = use_ipv6,
2463
2019
socketfd = socketfd)
2464
2465
2020
def server_activate(self):
2466
2021
if self.enabled:
2467
2022
return socketserver.TCPServer.server_activate(self)
2471
2026
2472
2027
def add_pipe(self, parent_pipe, proc):
2473
2028
# Call "handle_ipc" for both data and EOF events
2474
gobject.io_add_watch(
2475
parent_pipe.fileno(),
2476
gobject.IO_IN | gobject.IO_HUP,
2477
functools.partial(self.handle_ipc,
2478
parent_pipe = parent_pipe,
2479
proc = proc))
2029
gobject.io_add_watch(parent_pipe.fileno(),
2030
gobject.IO_IN | gobject.IO_HUP,
2031
functools.partial(self.handle_ipc,
2032
parent_pipe =
2033
parent_pipe,
2034
proc = proc))
2480
2035
2481
def handle_ipc(self, source, condition,
2482
parent_pipe=None,
2483
proc = None,
2484
client_object=None):
2036
def handle_ipc(self, source, condition, parent_pipe=None,
2037
proc = None, client_object=None):
2485
2038
# error, or the other end of multiprocessing.Pipe has closed
2486
2039
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2487
2040
# Wait for other process to exit
2510
2063
parent_pipe.send(False)
2511
2064
return False
2512
2065
2513
gobject.io_add_watch(
2514
parent_pipe.fileno(),
2515
gobject.IO_IN | gobject.IO_HUP,
2516
functools.partial(self.handle_ipc,
2517
parent_pipe = parent_pipe,
2518
proc = proc,
2519
client_object = client))
2066
gobject.io_add_watch(parent_pipe.fileno(),
2067
gobject.IO_IN | gobject.IO_HUP,
2068
functools.partial(self.handle_ipc,
2069
parent_pipe =
2070
parent_pipe,
2071
proc = proc,
2072
client_object =
2073
client))
2520
2074
parent_pipe.send(True)
2521
2075
# remove the old hook in favor of the new above hook on
2522
2076
# same fileno
2528
2082
2529
2083
parent_pipe.send(('data', getattr(client_object,
2530
2084
funcname)(*args,
2531
**kwargs)))
2085
**kwargs)))
2532
2086
2533
2087
if command == 'getattr':
2534
2088
attrname = request[1]
2535
if isinstance(client_object.__getattribute__(attrname),
2536
collections.Callable):
2537
parent_pipe.send(('function', ))
2089
if callable(client_object.__getattribute__(attrname)):
2090
parent_pipe.send(('function',))
2538
2091
else:
2539
parent_pipe.send((
2540
'data', client_object.__getattribute__(attrname)))
2092
parent_pipe.send(('data', client_object
2093
.__getattribute__(attrname)))
2541
2094
2542
2095
if command == 'setattr':
2543
2096
attrname = request[1]
2574
2127
# avoid excessive use of external libraries.
2575
2128
2576
2129
# New type for defining tokens, syntax, and semantics all-in-one
2577
Token = collections.namedtuple("Token", (
2578
"regexp", # To match token; if "value" is not None, must have
2579
# a "group" containing digits
2580
"value", # datetime.timedelta or None
2581
"followers")) # Tokens valid after this token
2130
Token = collections.namedtuple("Token",
2131
("regexp", # To match token; if
2132
# "value" is not None,
2133
# must have a "group"
2134
# containing digits
2135
"value", # datetime.timedelta or
2136
# None
2137
"followers")) # Tokens valid after
2138
# this token
2582
2139
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2583
2140
# the "duration" ABNF definition in RFC 3339, Appendix A.
2584
2141
token_end = Token(re.compile(r"$"), None, frozenset())
2585
2142
token_second = Token(re.compile(r"(\d+)S"),
2586
2143
datetime.timedelta(seconds=1),
2587
frozenset((token_end, )))
2144
frozenset((token_end,)))
2588
2145
token_minute = Token(re.compile(r"(\d+)M"),
2589
2146
datetime.timedelta(minutes=1),
2590
2147
frozenset((token_second, token_end)))
2606
2163
frozenset((token_month, token_end)))
2607
2164
token_week = Token(re.compile(r"(\d+)W"),
2608
2165
datetime.timedelta(weeks=1),
2609
frozenset((token_end, )))
2166
frozenset((token_end,)))
2610
2167
token_duration = Token(re.compile(r"P"), None,
2611
2168
frozenset((token_year, token_month,
2612
2169
token_day, token_time,
2614
2171
# Define starting values
2615
2172
value = datetime.timedelta() # Value so far
2616
2173
found_token = None
2617
followers = frozenset((token_duration, )) # Following valid tokens
2174
followers = frozenset((token_duration,)) # Following valid tokens
2618
2175
s = duration # String left to parse
2619
2176
# Loop until end token is found
2620
2177
while found_token is not token_end:
2637
2194
break
2638
2195
else:
2639
2196
# No currently valid tokens were found
2640
raise ValueError("Invalid RFC 3339 duration: {!r}"
2641
.format(duration))
2197
raise ValueError("Invalid RFC 3339 duration")
2642
2198
# End token found
2643
2199
return value
2644
2200
2681
2237
elif suffix == "w":
2682
2238
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2683
2239
else:
2684
raise ValueError("Unknown suffix {!r}".format(suffix))
2240
raise ValueError("Unknown suffix {!r}"
2241
.format(suffix))
2685
2242
except IndexError as e:
2686
2243
raise ValueError(*(e.args))
2687
2244
timevalue += delta
2703
2260
# Close all standard open file descriptors
2704
2261
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2705
2262
if not stat.S_ISCHR(os.fstat(null).st_mode):
2706
raise OSError(errno.ENODEV,
2707
"{} not a character device"
2263
raise OSError(errno.ENODEV, "{} not a character device"
2708
2264
.format(os.devnull))
2709
2265
os.dup2(null, sys.stdin.fileno())
2710
2266
os.dup2(null, sys.stdout.fileno())
2776
2332
"port": "",
2777
2333
"debug": "False",
2778
2334
"priority":
2779
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2780
":+SIGN-DSA-SHA256",
2335
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2781
2336
"servicename": "Mandos",
2782
2337
"use_dbus": "True",
2783
2338
"use_ipv6": "True",
2787
2342
"statedir": "/var/lib/mandos",
2788
2343
"foreground": "False",
2789
2344
"zeroconf": "True",
2790
}
2345
}
2791
2346
2792
2347
# Parse config file for server-global settings
2793
2348
server_config = configparser.SafeConfigParser(server_defaults)
2794
2349
del server_defaults
2795
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2350
server_config.read(os.path.join(options.configdir,
2351
"mandos.conf"))
2796
2352
# Convert the SafeConfigParser object to a dict
2797
2353
server_settings = server_config.defaults()
2798
2354
# Use the appropriate methods on the non-string config options
2816
2372
# Override the settings from the config file with command line
2817
2373
# options, if set.
2818
2374
for option in ("interface", "address", "port", "debug",
2819
"priority", "servicename", "configdir", "use_dbus",
2820
"use_ipv6", "debuglevel", "restore", "statedir",
2821
"socket", "foreground", "zeroconf"):
2375
"priority", "servicename", "configdir",
2376
"use_dbus", "use_ipv6", "debuglevel", "restore",
2377
"statedir", "socket", "foreground", "zeroconf"):
2822
2378
value = getattr(options, option)
2823
2379
if value is not None:
2824
2380
server_settings[option] = value
2839
2395
2840
2396
##################################################################
2841
2397
2842
if (not server_settings["zeroconf"]
2843
and not (server_settings["port"]
2844
or server_settings["socket"] != "")):
2845
parser.error("Needs port or socket to work without Zeroconf")
2398
if (not server_settings["zeroconf"] and
2399
not (server_settings["port"]
2400
or server_settings["socket"] != "")):
2401
parser.error("Needs port or socket to work without"
2402
" Zeroconf")
2846
2403
2847
2404
# For convenience
2848
2405
debug = server_settings["debug"]
2864
2421
initlogger(debug, level)
2865
2422
2866
2423
if server_settings["servicename"] != "Mandos":
2867
syslogger.setFormatter(
2868
logging.Formatter('Mandos ({}) [%(process)d]:'
2869
' %(levelname)s: %(message)s'.format(
2870
server_settings["servicename"])))
2424
syslogger.setFormatter(logging.Formatter
2425
('Mandos ({}) [%(process)d]:'
2426
' %(levelname)s: %(message)s'
2427
.format(server_settings
2428
["servicename"])))
2871
2429
2872
2430
# Parse config file with clients
2873
2431
client_config = configparser.SafeConfigParser(Client
2881
2439
socketfd = None
2882
2440
if server_settings["socket"] != "":
2883
2441
socketfd = server_settings["socket"]
2884
tcp_server = MandosServer(
2885
(server_settings["address"], server_settings["port"]),
2886
ClientHandler,
2887
interface=(server_settings["interface"] or None),
2888
use_ipv6=use_ipv6,
2889
gnutls_priority=server_settings["priority"],
2890
use_dbus=use_dbus,
2891
socketfd=socketfd)
2442
tcp_server = MandosServer((server_settings["address"],
2443
server_settings["port"]),
2444
ClientHandler,
2445
interface=(server_settings["interface"]
2446
or None),
2447
use_ipv6=use_ipv6,
2448
gnutls_priority=
2449
server_settings["priority"],
2450
use_dbus=use_dbus,
2451
socketfd=socketfd)
2892
2452
if not foreground:
2893
2453
pidfilename = "/run/mandos.pid"
2894
2454
if not os.path.isdir("/run/."):
2895
2455
pidfilename = "/var/run/mandos.pid"
2896
2456
pidfile = None
2897
2457
try:
2898
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2458
pidfile = open(pidfilename, "w")
2899
2459
except IOError as e:
2900
2460
logger.error("Could not open file %r", pidfilename,
2901
2461
exc_info=e)
2922
2482
2923
2483
# "Use a log level over 10 to enable all debugging options."
2924
2484
# - GnuTLS manual
2925
gnutls.global_set_log_level(11)
2485
gnutls.library.functions.gnutls_global_set_log_level(11)
2926
2486
2927
@gnutls.log_func
2487
@gnutls.library.types.gnutls_log_func
2928
2488
def debug_gnutls(level, string):
2929
2489
logger.debug("GnuTLS: %s", string[:-1])
2930
2490
2931
gnutls.global_set_log_function(debug_gnutls)
2491
(gnutls.library.functions
2492
.gnutls_global_set_log_function(debug_gnutls))
2932
2493
2933
2494
# Redirect stdin so all checkers get /dev/null
2934
2495
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2954
2515
if use_dbus:
2955
2516
try:
2956
2517
bus_name = dbus.service.BusName("se.recompile.Mandos",
2957
bus,
2958
do_not_queue=True)
2959
old_bus_name = dbus.service.BusName(
2960
"se.bsnet.fukt.Mandos", bus,
2961
do_not_queue=True)
2962
except dbus.exceptions.DBusException as e:
2518
bus, do_not_queue=True)
2519
old_bus_name = (dbus.service.BusName
2520
("se.bsnet.fukt.Mandos", bus,
2521
do_not_queue=True))
2522
except dbus.exceptions.NameExistsException as e:
2963
2523
logger.error("Disabling D-Bus:", exc_info=e)
2964
2524
use_dbus = False
2965
2525
server_settings["use_dbus"] = False
2966
2526
tcp_server.use_dbus = False
2967
2527
if zeroconf:
2968
2528
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2969
service = AvahiServiceToSyslog(
2970
name = server_settings["servicename"],
2971
servicetype = "_mandos._tcp",
2972
protocol = protocol,
2973
bus = bus)
2529
service = AvahiServiceToSyslog(name =
2530
server_settings["servicename"],
2531
servicetype = "_mandos._tcp",
2532
protocol = protocol, bus = bus)
2974
2533
if server_settings["interface"]:
2975
service.interface = if_nametoindex(
2976
server_settings["interface"].encode("utf-8"))
2534
service.interface = (if_nametoindex
2535
(server_settings["interface"]
2536
.encode("utf-8")))
2977
2537
2978
2538
global multiprocessing_manager
2979
2539
multiprocessing_manager = multiprocessing.Manager()
2998
2558
if server_settings["restore"]:
2999
2559
try:
3000
2560
with open(stored_state_path, "rb") as stored_state:
3001
clients_data, old_client_settings = pickle.load(
3002
stored_state)
2561
clients_data, old_client_settings = (pickle.load
2562
(stored_state))
3003
2563
os.remove(stored_state_path)
3004
2564
except IOError as e:
3005
2565
if e.errno == errno.ENOENT:
3006
logger.warning("Could not load persistent state:"
3007
" {}".format(os.strerror(e.errno)))
2566
logger.warning("Could not load persistent state: {}"
2567
.format(os.strerror(e.errno)))
3008
2568
else:
3009
2569
logger.critical("Could not load persistent state:",
3010
2570
exc_info=e)
3011
2571
raise
3012
2572
except EOFError as e:
3013
2573
logger.warning("Could not load persistent state: "
3014
"EOFError:",
3015
exc_info=e)
2574
"EOFError:", exc_info=e)
3016
2575
3017
2576
with PGPEngine() as pgp:
3018
2577
for client_name, client in clients_data.items():
3030
2589
# For each value in new config, check if it
3031
2590
# differs from the old config value (Except for
3032
2591
# the "secret" attribute)
3033
if (name != "secret"
3034
and (value !=
3035
old_client_settings[client_name][name])):
2592
if (name != "secret" and
2593
value != old_client_settings[client_name]
2594
[name]):
3036
2595
client[name] = value
3037
2596
except KeyError:
3038
2597
pass
3039
2598
3040
2599
# Clients who has passed its expire date can still be
3041
# enabled if its last checker was successful. A Client
2600
# enabled if its last checker was successful. Clients
3042
2601
# whose checker succeeded before we stored its state is
3043
2602
# assumed to have successfully run all checkers during
3044
2603
# downtime.
3047
2606
if not client["last_checked_ok"]:
3048
2607
logger.warning(
3049
2608
"disabling client {} - Client never "
3050
"performed a successful checker".format(
3051
client_name))
2609
"performed a successful checker"
2610
.format(client_name))
3052
2611
client["enabled"] = False
3053
2612
elif client["last_checker_status"] != 0:
3054
2613
logger.warning(
3055
2614
"disabling client {} - Client last"
3056
" checker failed with error code"
3057
" {}".format(
3058
client_name,
3059
client["last_checker_status"]))
2615
" checker failed with error code {}"
2616
.format(client_name,
2617
client["last_checker_status"]))
3060
2618
client["enabled"] = False
3061
2619
else:
3062
client["expires"] = (
3063
datetime.datetime.utcnow()
3064
+ client["timeout"])
2620
client["expires"] = (datetime.datetime
2621
.utcnow()
2622
+ client["timeout"])
3065
2623
logger.debug("Last checker succeeded,"
3066
" keeping {} enabled".format(
3067
client_name))
2624
" keeping {} enabled"
2625
.format(client_name))
3068
2626
try:
3069
client["secret"] = pgp.decrypt(
3070
client["encrypted_secret"],
3071
client_settings[client_name]["secret"])
2627
client["secret"] = (
2628
pgp.decrypt(client["encrypted_secret"],
2629
client_settings[client_name]
2630
["secret"]))
3072
2631
except PGPError:
3073
2632
# If decryption fails, we use secret from new settings
3074
logger.debug("Failed to decrypt {} old secret".format(
3075
client_name))
3076
client["secret"] = (client_settings[client_name]
3077
["secret"])
2633
logger.debug("Failed to decrypt {} old secret"
2634
.format(client_name))
2635
client["secret"] = (
2636
client_settings[client_name]["secret"])
3078
2637
3079
2638
# Add/remove clients based on new changes made to config
3080
2639
for client_name in (set(old_client_settings)
3087
2646
# Create all client objects
3088
2647
for client_name, client in clients_data.items():
3089
2648
tcp_server.clients[client_name] = client_class(
3090
name = client_name,
3091
settings = client,
2649
name = client_name, settings = client,
3092
2650
server_settings = server_settings)
3093
2651
3094
2652
if not tcp_server.clients:
3096
2654
3097
2655
if not foreground:
3098
2656
if pidfile is not None:
3099
pid = os.getpid()
3100
2657
try:
3101
2658
with pidfile:
3102
print(pid, file=pidfile)
2659
pid = os.getpid()
2660
pidfile.write("{}\n".format(pid).encode("utf-8"))
3103
2661
except IOError:
3104
2662
logger.error("Could not write to file %r with PID %d",
3105
2663
pidfilename, pid)
3110
2668
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3111
2669
3112
2670
if use_dbus:
3113
3114
@alternate_dbus_interfaces(
3115
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3116
class MandosDBusService(DBusObjectWithObjectManager):
2671
@alternate_dbus_interfaces({"se.recompile.Mandos":
2672
"se.bsnet.fukt.Mandos"})
2673
class MandosDBusService(DBusObjectWithProperties):
3117
2674
"""A D-Bus proxy object"""
3118
3119
2675
def __init__(self):
3120
2676
dbus.service.Object.__init__(self, bus, "/")
3121
3122
2677
_interface = "se.recompile.Mandos"
3123
2678
2679
@dbus_interface_annotations(_interface)
2680
def _foo(self):
2681
return { "org.freedesktop.DBus.Property"
2682
".EmitsChangedSignal":
2683
"false"}
2684
3124
2685
@dbus.service.signal(_interface, signature="o")
3125
2686
def ClientAdded(self, objpath):
3126
2687
"D-Bus signal"
3131
2692
"D-Bus signal"
3132
2693
pass
3133
2694
3134
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3135
"true"})
3136
2695
@dbus.service.signal(_interface, signature="os")
3137
2696
def ClientRemoved(self, objpath, name):
3138
2697
"D-Bus signal"
3139
2698
pass
3140
2699
3141
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3142
"true"})
3143
2700
@dbus.service.method(_interface, out_signature="ao")
3144
2701
def GetAllClients(self):
3145
2702
"D-Bus method"
3146
return dbus.Array(c.dbus_object_path for c in
2703
return dbus.Array(c.dbus_object_path
2704
for c in
3147
2705
tcp_server.clients.itervalues())
3148
2706
3149
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3150
"true"})
3151
2707
@dbus.service.method(_interface,
3152
2708
out_signature="a{oa{sv}}")
3153
2709
def GetAllClientsWithProperties(self):
3154
2710
"D-Bus method"
3155
2711
return dbus.Dictionary(
3156
{ c.dbus_object_path: c.GetAll(
3157
"se.recompile.Mandos.Client")
3158
for c in tcp_server.clients.itervalues() },
2712
((c.dbus_object_path, c.GetAll(""))
2713
for c in tcp_server.clients.itervalues()),
3159
2714
signature="oa{sv}")
3160
2715
3161
2716
@dbus.service.method(_interface, in_signature="o")
3165
2720
if c.dbus_object_path == object_path:
3166
2721
del tcp_server.clients[c.name]
3167
2722
c.remove_from_connection()
3168
# Don't signal the disabling
2723
# Don't signal anything except ClientRemoved
3169
2724
c.disable(quiet=True)
3170
# Emit D-Bus signal for removal
3171
self.client_removed_signal(c)
2725
# Emit D-Bus signal
2726
self.ClientRemoved(object_path, c.name)
3172
2727
return
3173
2728
raise KeyError(object_path)
3174
2729
3175
2730
del _interface
3176
3177
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3178
out_signature = "a{oa{sa{sv}}}")
3179
def GetManagedObjects(self):
3180
"""D-Bus method"""
3181
return dbus.Dictionary(
3182
{ client.dbus_object_path:
3183
dbus.Dictionary(
3184
{ interface: client.GetAll(interface)
3185
for interface in
3186
client._get_all_interface_names()})
3187
for client in tcp_server.clients.values()})
3188
3189
def client_added_signal(self, client):
3190
"""Send the new standard signal and the old signal"""
3191
if use_dbus:
3192
# New standard signal
3193
self.InterfacesAdded(
3194
client.dbus_object_path,
3195
dbus.Dictionary(
3196
{ interface: client.GetAll(interface)
3197
for interface in
3198
client._get_all_interface_names()}))
3199
# Old signal
3200
self.ClientAdded(client.dbus_object_path)
3201
3202
def client_removed_signal(self, client):
3203
"""Send the new standard signal and the old signal"""
3204
if use_dbus:
3205
# New standard signal
3206
self.InterfacesRemoved(
3207
client.dbus_object_path,
3208
client._get_all_interface_names())
3209
# Old signal
3210
self.ClientRemoved(client.dbus_object_path,
3211
client.name)
3212
2731
3213
2732
mandos_dbus_service = MandosDBusService()
3214
2733
3237
2756
# + secret.
3238
2757
exclude = { "bus", "changedstate", "secret",
3239
2758
"checker", "server_settings" }
3240
for name, typ in inspect.getmembers(dbus.service
3241
.Object):
2759
for name, typ in (inspect.getmembers
2760
(dbus.service.Object)):
3242
2761
exclude.add(name)
3243
2762
3244
2763
client_dict["encrypted_secret"] = (client
3251
2770
del client_settings[client.name]["secret"]
3252
2771
3253
2772
try:
3254
with tempfile.NamedTemporaryFile(
3255
mode='wb',
3256
suffix=".pickle",
3257
prefix='clients-',
3258
dir=os.path.dirname(stored_state_path),
3259
delete=False) as stored_state:
2773
with (tempfile.NamedTemporaryFile
2774
(mode='wb', suffix=".pickle", prefix='clients-',
2775
dir=os.path.dirname(stored_state_path),
2776
delete=False)) as stored_state:
3260
2777
pickle.dump((clients, client_settings), stored_state)
3261
tempname = stored_state.name
2778
tempname=stored_state.name
3262
2779
os.rename(tempname, stored_state_path)
3263
2780
except (IOError, OSError) as e:
3264
2781
if not debug:
3279
2796
name, client = tcp_server.clients.popitem()
3280
2797
if use_dbus:
3281
2798
client.remove_from_connection()
3282
# Don't signal the disabling
2799
# Don't signal anything except ClientRemoved
3283
2800
client.disable(quiet=True)
3284
# Emit D-Bus signal for removal
3285
2801
if use_dbus:
3286
mandos_dbus_service.client_removed_signal(client)
2802
# Emit D-Bus signal
2803
mandos_dbus_service.ClientRemoved(client
2804
.dbus_object_path,
2805
client.name)
3287
2806
client_settings.clear()
3288
2807
3289
2808
atexit.register(cleanup)
3290
2809
3291
2810
for client in tcp_server.clients.itervalues():
3292
2811
if use_dbus:
3293
# Emit D-Bus signal for adding
3294
mandos_dbus_service.client_added_signal(client)
2812
# Emit D-Bus signal
2813
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3295
2814
# Need to initiate checking of clients
3296
2815
if client.enabled:
3297
2816
client.init_checker()
3342
2861
# Must run before the D-Bus bus name gets deregistered
3343
2862
cleanup()
3344
2863
3345
3346
2864
if __name__ == '__main__':
3347
2865
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0