To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 742
- compare with another revision
- download diff
- download tarball
- view history from revision 742
- Committer: Teddy Hogeborn
- Date: 2015-03-10 18:03:38 UTC
- Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.
If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default. The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.
There is a "PFS" priority string specifier, but we can't use it because:
1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
enables a lot more algorithms than "SECURE256".
2. It is only available since GnuTLS 3.2.4.
Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.
If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default. The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.
There is a "PFS" priority string specifier, but we can't use it because:
1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
enables a lot more algorithms than "SECURE256".
2. It is only available since GnuTLS 3.2.4.
Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.
- files added:
- debian/upstream
- files modified:
- DBUS-API
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
68
68
import binascii
69
69
import tempfile
70
70
import itertools
71
import collections
71
72
72
73
import dbus
73
74
import dbus.service
78
79
import ctypes.util
79
80
import xml.dom.minidom
80
81
import inspect
81
import GnuPGInterface
82
82
83
83
try:
84
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
88
except ImportError:
89
89
SO_BINDTODEVICE = None
90
90
91
version = "1.6.0"
91
if sys.version_info.major == 2:
92
str = unicode
93
94
version = "1.6.9"
92
95
stored_state_file = "clients.pickle"
93
96
94
97
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
98
syslogger = None
98
99
99
100
try:
100
101
if_nametoindex = (ctypes.cdll.LoadLibrary
106
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
108
with contextlib.closing(socket.socket()) as s:
108
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
110
interface))
111
interface_index = struct.unpack(str("I"),
112
ifreq[16:20])[0]
110
struct.pack(b"16s16x", interface))
111
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
112
return interface_index
114
113
115
114
116
115
def initlogger(debug, level=logging.WARNING):
117
116
"""init logger and add loglevel"""
118
117
118
global syslogger
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
119
123
syslogger.setFormatter(logging.Formatter
120
124
('Mandos [%(process)d]: %(levelname)s:'
121
125
' %(message)s'))
139
143
class PGPEngine(object):
140
144
"""A simple class for OpenPGP symmetric encryption & decryption"""
141
145
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
143
146
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
147
self.gnupgargs = ['--batch',
148
'--home', self.tempdir,
149
'--force-mdc',
150
'--quiet',
151
'--no-use-agent']
150
152
151
153
def __enter__(self):
152
154
return self
174
176
def password_encode(self, password):
175
177
# Passphrase can not be empty and can not contain newlines or
176
178
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
179
encoded = b"mandos" + binascii.hexlify(password)
180
if len(encoded) > 2048:
181
# GnuPG can't handle long passwords, so encode differently
182
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
183
.replace(b"\n", b"\\n")
184
.replace(b"\0", b"\\x00"))
185
return encoded
178
186
179
187
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
188
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
191
passfile.write(passphrase)
192
passfile.flush()
193
proc = subprocess.Popen(['gpg', '--symmetric',
194
'--passphrase-file',
195
passfile.name]
196
+ self.gnupgargs,
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
201
if proc.returncode != 0:
202
raise PGPError(err)
194
203
return ciphertext
195
204
196
205
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
206
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
209
passfile.write(passphrase)
210
passfile.flush()
211
proc = subprocess.Popen(['gpg', '--decrypt',
212
'--passphrase-file',
213
passfile.name]
214
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
220
if proc.returncode != 0:
221
raise PGPError(err)
211
222
return decrypted_plaintext
212
223
213
224
214
225
class AvahiError(Exception):
215
226
def __init__(self, value, *args, **kwargs):
216
227
self.value = value
217
super(AvahiError, self).__init__(value, *args, **kwargs)
218
def __unicode__(self):
219
return unicode(repr(self.value))
228
return super(AvahiError, self).__init__(value, *args,
229
**kwargs)
220
230
221
231
class AvahiServiceError(AvahiError):
222
232
pass
233
243
Used to optionally bind to the specified interface.
234
244
name: string; Example: 'Mandos'
235
245
type: string; Example: '_mandos._tcp'.
236
See <http://www.dns-sd.org/ServiceTypes.html>
246
See <https://www.iana.org/assignments/service-names-port-numbers>
237
247
port: integer; what port to announce
238
248
TXT: list of strings; TXT record for the service
239
249
domain: string; Domain to publish on, default to .local if empty.
265
275
self.bus = bus
266
276
self.entry_group_state_changed_match = None
267
277
268
def rename(self):
278
def rename(self, remove=True):
269
279
"""Derived from the Avahi example code"""
270
280
if self.rename_count >= self.max_renames:
271
281
logger.critical("No suitable Zeroconf service name found"
272
282
" after %i retries, exiting.",
273
283
self.rename_count)
274
284
raise AvahiServiceError("Too many renames")
275
self.name = unicode(self.server
276
.GetAlternativeServiceName(self.name))
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
287
self.rename_count += 1
277
288
logger.info("Changing Zeroconf service name to %r ...",
278
289
self.name)
279
self.remove()
290
if remove:
291
self.remove()
280
292
try:
281
293
self.add()
282
294
except dbus.exceptions.DBusException as error:
283
logger.critical("D-Bus Exception", exc_info=error)
284
self.cleanup()
285
os._exit(1)
286
self.rename_count += 1
295
if (error.get_dbus_name()
296
== "org.freedesktop.Avahi.CollisionError"):
297
logger.info("Local Zeroconf service name collision.")
298
return self.rename(remove=False)
299
else:
300
logger.critical("D-Bus Exception", exc_info=error)
301
self.cleanup()
302
os._exit(1)
287
303
288
304
def remove(self):
289
305
"""Derived from the Avahi example code"""
327
343
self.rename()
328
344
elif state == avahi.ENTRY_GROUP_FAILURE:
329
345
logger.critical("Avahi: Error in group state changed %s",
330
unicode(error))
331
raise AvahiGroupError("State changed: {0!s}"
346
str(error))
347
raise AvahiGroupError("State changed: {!s}"
332
348
.format(error))
333
349
334
350
def cleanup(self):
381
397
382
398
383
399
class AvahiServiceToSyslog(AvahiService):
384
def rename(self):
400
def rename(self, *args, **kwargs):
385
401
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
402
ret = AvahiService.rename(self, *args, **kwargs)
387
403
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
404
('Mandos ({}) [%(process)d]:'
389
405
' %(levelname)s: %(message)s'
390
406
.format(self.name)))
391
407
return ret
392
408
393
409
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
399
400
401
410
class Client(object):
402
411
"""A representation of a client host served by this server.
403
412
439
448
runtime_expansions: Allowed attributes for runtime expansion.
440
449
expires: datetime.datetime(); time (UTC) when a client will be
441
450
disabled, or None
451
server_settings: The server_settings dict from main()
442
452
"""
443
453
444
454
runtime_expansions = ("approval_delay", "approval_duration",
446
456
"fingerprint", "host", "interval",
447
457
"last_approval_request", "last_checked_ok",
448
458
"last_enabled", "name", "timeout")
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
451
"interval": "2m",
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
452
462
"checker": "fping -q -- %%(host)s",
453
463
"host": "",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
456
466
"approved_by_default": "True",
457
467
"enabled": "True",
458
468
}
459
469
460
def timeout_milliseconds(self):
461
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
463
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
467
468
def interval_milliseconds(self):
469
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
471
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
474
475
470
@staticmethod
476
471
def config_parser(config):
477
472
"""Construct a new dict of client settings of this form:
492
487
client["enabled"] = config.getboolean(client_name,
493
488
"enabled")
494
489
490
# Uppercase and remove spaces from fingerprint for later
491
# comparison purposes with return value from the
492
# fingerprint() function
495
493
client["fingerprint"] = (section["fingerprint"].upper()
496
494
.replace(" ", ""))
497
495
if "secret" in section:
502
500
"rb") as secfile:
503
501
client["secret"] = secfile.read()
504
502
else:
505
raise TypeError("No secret or secfile for section {0}"
503
raise TypeError("No secret or secfile for section {}"
506
504
.format(section))
507
505
client["timeout"] = string_to_delta(section["timeout"])
508
506
client["extended_timeout"] = string_to_delta(
519
517
520
518
return settings
521
519
522
def __init__(self, settings, name = None):
520
def __init__(self, settings, name = None, server_settings=None):
523
521
self.name = name
522
if server_settings is None:
523
server_settings = {}
524
self.server_settings = server_settings
524
525
# adding all client settings
525
for setting, value in settings.iteritems():
526
for setting, value in settings.items():
526
527
setattr(self, setting, value)
527
528
528
529
if self.enabled:
536
537
self.expires = None
537
538
538
539
logger.debug("Creating client %r", self.name)
539
# Uppercase and remove spaces from fingerprint for later
540
# comparison purposes with return value from the fingerprint()
541
# function
542
540
logger.debug(" Fingerprint: %s", self.fingerprint)
543
541
self.created = settings.get("created",
544
542
datetime.datetime.utcnow())
611
609
if self.checker_initiator_tag is not None:
612
610
gobject.source_remove(self.checker_initiator_tag)
613
611
self.checker_initiator_tag = (gobject.timeout_add
614
(self.interval_milliseconds(),
612
(int(self.interval
613
.total_seconds() * 1000),
615
614
self.start_checker))
616
615
# Schedule a disable() when 'timeout' has passed
617
616
if self.disable_initiator_tag is not None:
618
617
gobject.source_remove(self.disable_initiator_tag)
619
618
self.disable_initiator_tag = (gobject.timeout_add
620
(self.timeout_milliseconds(),
621
self.disable))
619
(int(self.timeout
620
.total_seconds() * 1000),
621
self.disable))
622
622
# Also start a new checker *right now*.
623
623
self.start_checker()
624
624
655
655
self.disable_initiator_tag = None
656
656
if getattr(self, "enabled", False):
657
657
self.disable_initiator_tag = (gobject.timeout_add
658
(timedelta_to_milliseconds
659
(timeout), self.disable))
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
660
660
self.expires = datetime.datetime.utcnow() + timeout
661
661
662
662
def need_approval(self):
679
679
# If a checker exists, make sure it is not a zombie
680
680
try:
681
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except (AttributeError, OSError) as error:
683
if (isinstance(error, OSError)
684
and error.errno != errno.ECHILD):
685
raise error
682
except AttributeError:
683
pass
684
except OSError as error:
685
if error.errno != errno.ECHILD:
686
raise
686
687
else:
687
688
if pid:
688
689
logger.warning("Checker was a zombie")
692
693
# Start a new checker if needed
693
694
if self.checker is None:
694
695
# Escape attributes for the shell
695
escaped_attrs = dict(
696
(attr, re.escape(unicode(getattr(self, attr))))
697
for attr in
698
self.runtime_expansions)
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
699
699
try:
700
700
command = self.checker_command % escaped_attrs
701
701
except TypeError as error:
710
710
# in normal mode, that is already done by daemon(),
711
711
# and in debug mode we don't want to. (Stdin is
712
712
# always replaced by /dev/null.)
713
# The exception is when not debugging but nevertheless
714
# running in the foreground; use the previously
715
# created wnull.
716
popen_args = {}
717
if (not self.server_settings["debug"]
718
and self.server_settings["foreground"]):
719
popen_args.update({"stdout": wnull,
720
"stderr": wnull })
713
721
self.checker = subprocess.Popen(command,
714
722
close_fds=True,
715
shell=True, cwd="/")
723
shell=True, cwd="/",
724
**popen_args)
716
725
except OSError as error:
717
726
logger.error("Failed to start subprocess",
718
727
exc_info=error)
728
return True
719
729
self.checker_callback_tag = (gobject.child_watch_add
720
730
(self.checker.pid,
721
731
self.checker_callback,
722
732
data=command))
723
733
# The checker may have completed before the gobject
724
734
# watch was added. Check for this.
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
735
try:
736
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
737
except OSError as error:
738
if error.errno == errno.ECHILD:
739
# This should never happen
740
logger.error("Child process vanished",
741
exc_info=error)
742
return True
743
raise
726
744
if pid:
727
745
gobject.source_remove(self.checker_callback_tag)
728
746
self.checker_callback(pid, status, command)
764
782
# "Set" method, so we fail early here:
765
783
if byte_arrays and signature != "ay":
766
784
raise ValueError("Byte arrays not supported for non-'ay'"
767
" signature {0!r}".format(signature))
785
" signature {!r}".format(signature))
768
786
def decorator(func):
769
787
func._dbus_is_property = True
770
788
func._dbus_interface = dbus_interface
801
819
"""Decorator to annotate D-Bus methods, signals or properties
802
820
Usage:
803
821
822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
823
"org.freedesktop.DBus.Property."
824
"EmitsChangedSignal": "false"})
804
825
@dbus_service_property("org.example.Interface", signature="b",
805
826
access="r")
806
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
"org.freedesktop.DBus.Property."
808
"EmitsChangedSignal": "false"})
809
827
def Property_dbus_property(self):
810
828
return dbus.Boolean(False)
811
829
"""
818
836
class DBusPropertyException(dbus.exceptions.DBusException):
819
837
"""A base class for D-Bus property-related exceptions
820
838
"""
821
def __unicode__(self):
822
return unicode(str(self))
823
839
pass
824
840
825
841
class DBusPropertyAccessException(DBusPropertyException):
826
842
"""A property's access permissions disallows an operation.
849
865
If called like _is_dbus_thing("method") it returns a function
850
866
suitable for use as predicate to inspect.getmembers().
851
867
"""
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
868
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
853
869
False)
854
870
855
871
def _get_all_dbus_things(self, thing):
904
920
# The byte_arrays option is not supported yet on
905
921
# signatures other than "ay".
906
922
if prop._dbus_signature != "ay":
907
raise ValueError
923
raise ValueError("Byte arrays not supported for non-"
924
"'ay' signature {!r}"
925
.format(prop._dbus_signature))
908
926
value = dbus.ByteArray(b''.join(chr(byte)
909
927
for byte in value))
910
928
prop(value)
934
952
value.variant_level+1)
935
953
return dbus.Dictionary(properties, signature="sv")
936
954
955
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
956
def PropertiesChanged(self, interface_name, changed_properties,
957
invalidated_properties):
958
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
959
standard.
960
"""
961
pass
962
937
963
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
938
964
out_signature="s",
939
965
path_keyword='object_path',
974
1000
(prop,
975
1001
"_dbus_annotations",
976
1002
{}))
977
for name, value in annots.iteritems():
1003
for name, value in annots.items():
978
1004
ann_tag = document.createElement(
979
1005
"annotation")
980
1006
ann_tag.setAttribute("name", name)
983
1009
# Add interface annotation tags
984
1010
for annotation, value in dict(
985
1011
itertools.chain.from_iterable(
986
annotations().iteritems()
1012
annotations().items()
987
1013
for name, annotations in
988
1014
self._get_all_dbus_things("interface")
989
1015
if name == if_tag.getAttribute("name")
990
)).iteritems():
1016
)).items():
991
1017
ann_tag = document.createElement("annotation")
992
1018
ann_tag.setAttribute("name", annotation)
993
1019
ann_tag.setAttribute("value", value)
1049
1075
"""
1050
1076
def wrapper(cls):
1051
1077
for orig_interface_name, alt_interface_name in (
1052
alt_interface_names.iteritems()):
1078
alt_interface_names.items()):
1053
1079
attr = {}
1054
1080
interface_names = set()
1055
1081
# Go though all attributes of the class
1068
1094
interface_names.add(alt_interface)
1069
1095
# Is this a D-Bus signal?
1070
1096
if getattr(attribute, "_dbus_is_signal", False):
1071
# Extract the original non-method function by
1072
# black magic
1097
# Extract the original non-method undecorated
1098
# function by black magic
1073
1099
nonmethod_func = (dict(
1074
1100
zip(attribute.func_code.co_freevars,
1075
1101
attribute.__closure__))["func"]
1172
1198
attribute.func_closure)))
1173
1199
if deprecate:
1174
1200
# Deprecate all alternate interfaces
1175
iname="_AlternateDBusNames_interface_annotation{0}"
1201
iname="_AlternateDBusNames_interface_annotation{}"
1176
1202
for interface_name in interface_names:
1177
1203
@dbus_interface_annotations(interface_name)
1178
1204
def func(self):
1187
1213
if interface_names:
1188
1214
# Replace the class with a new subclass of it with
1189
1215
# methods, signals, etc. as created above.
1190
cls = type(b"{0}Alternate".format(cls.__name__),
1216
cls = type(b"{}Alternate".format(cls.__name__),
1191
1217
(cls,), attr)
1192
1218
return cls
1193
1219
return wrapper
1206
1232
runtime_expansions = (Client.runtime_expansions
1207
1233
+ ("dbus_object_path",))
1208
1234
1235
_interface = "se.recompile.Mandos.Client"
1236
1209
1237
# dbus.service.Object doesn't use super(), so we can't either.
1210
1238
1211
1239
def __init__(self, bus = None, *args, **kwargs):
1213
1241
Client.__init__(self, *args, **kwargs)
1214
1242
# Only now, when this client is initialized, can it show up on
1215
1243
# the D-Bus
1216
client_object_name = unicode(self.name).translate(
1244
client_object_name = str(self.name).translate(
1217
1245
{ord("."): ord("_"),
1218
1246
ord("-"): ord("_")})
1219
1247
self.dbus_object_path = (dbus.ObjectPath
1223
1251
1224
1252
def notifychangeproperty(transform_func,
1225
1253
dbus_name, type_func=lambda x: x,
1226
variant_level=1):
1254
variant_level=1, invalidate_only=False,
1255
_interface=_interface):
1227
1256
""" Modify a variable so that it's a property which announces
1228
1257
its changes to DBus.
1229
1258
1234
1263
to the D-Bus. Default: no transform
1235
1264
variant_level: D-Bus variant level. Default: 1
1236
1265
"""
1237
attrname = "_{0}".format(dbus_name)
1266
attrname = "_{}".format(dbus_name)
1238
1267
def setter(self, value):
1239
1268
if hasattr(self, "dbus_object_path"):
1240
1269
if (not hasattr(self, attrname) or
1241
1270
type_func(getattr(self, attrname, None))
1242
1271
!= type_func(value)):
1243
dbus_value = transform_func(type_func(value),
1244
variant_level
1245
=variant_level)
1246
self.PropertyChanged(dbus.String(dbus_name),
1247
dbus_value)
1272
if invalidate_only:
1273
self.PropertiesChanged(_interface,
1274
dbus.Dictionary(),
1275
dbus.Array
1276
((dbus_name,)))
1277
else:
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1281
self.PropertyChanged(dbus.String(dbus_name),
1282
dbus_value)
1283
self.PropertiesChanged(_interface,
1284
dbus.Dictionary({
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1248
1287
setattr(self, attrname, value)
1249
1288
1250
1289
return property(lambda self: getattr(self, attrname), setter)
1270
1309
approval_delay = notifychangeproperty(dbus.UInt64,
1271
1310
"ApprovalDelay",
1272
1311
type_func =
1273
timedelta_to_milliseconds)
1312
lambda td: td.total_seconds()
1313
* 1000)
1274
1314
approval_duration = notifychangeproperty(
1275
1315
dbus.UInt64, "ApprovalDuration",
1276
type_func = timedelta_to_milliseconds)
1316
type_func = lambda td: td.total_seconds() * 1000)
1277
1317
host = notifychangeproperty(dbus.String, "Host")
1278
1318
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1279
type_func =
1280
timedelta_to_milliseconds)
1319
type_func = lambda td:
1320
td.total_seconds() * 1000)
1281
1321
extended_timeout = notifychangeproperty(
1282
1322
dbus.UInt64, "ExtendedTimeout",
1283
type_func = timedelta_to_milliseconds)
1323
type_func = lambda td: td.total_seconds() * 1000)
1284
1324
interval = notifychangeproperty(dbus.UInt64,
1285
1325
"Interval",
1286
1326
type_func =
1287
timedelta_to_milliseconds)
1327
lambda td: td.total_seconds()
1328
* 1000)
1288
1329
checker_command = notifychangeproperty(dbus.String, "Checker")
1330
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1331
invalidate_only=True)
1289
1332
1290
1333
del notifychangeproperty
1291
1334
1318
1361
*args, **kwargs)
1319
1362
1320
1363
def start_checker(self, *args, **kwargs):
1321
old_checker = self.checker
1322
if self.checker is not None:
1323
old_checker_pid = self.checker.pid
1324
else:
1325
old_checker_pid = None
1364
old_checker_pid = getattr(self.checker, "pid", None)
1326
1365
r = Client.start_checker(self, *args, **kwargs)
1327
1366
# Only if new checker process was started
1328
1367
if (self.checker is not None
1337
1376
1338
1377
def approve(self, value=True):
1339
1378
self.approved = value
1340
gobject.timeout_add(timedelta_to_milliseconds
1341
(self.approval_duration),
1342
self._reset_approved)
1379
gobject.timeout_add(int(self.approval_duration.total_seconds()
1380
* 1000), self._reset_approved)
1343
1381
self.send_changedstate()
1344
1382
1345
1383
## D-Bus methods, signals & properties
1346
_interface = "se.recompile.Mandos.Client"
1347
1384
1348
1385
## Interfaces
1349
1386
1350
@dbus_interface_annotations(_interface)
1351
def _foo(self):
1352
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
"false"}
1354
1355
1387
## Signals
1356
1388
1357
1389
# CheckerCompleted - signal
1367
1399
pass
1368
1400
1369
1401
# PropertyChanged - signal
1402
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1370
1403
@dbus.service.signal(_interface, signature="sv")
1371
1404
def PropertyChanged(self, property, value):
1372
1405
"D-Bus signal"
1448
1481
access="readwrite")
1449
1482
def ApprovalDelay_dbus_property(self, value=None):
1450
1483
if value is None: # get
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1484
return dbus.UInt64(self.approval_delay.total_seconds()
1485
* 1000)
1452
1486
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1453
1487
1454
1488
# ApprovalDuration - property
1456
1490
access="readwrite")
1457
1491
def ApprovalDuration_dbus_property(self, value=None):
1458
1492
if value is None: # get
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1493
return dbus.UInt64(self.approval_duration.total_seconds()
1494
* 1000)
1461
1495
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1462
1496
1463
1497
# Name - property
1476
1510
def Host_dbus_property(self, value=None):
1477
1511
if value is None: # get
1478
1512
return dbus.String(self.host)
1479
self.host = unicode(value)
1513
self.host = str(value)
1480
1514
1481
1515
# Created - property
1482
1516
@dbus_service_property(_interface, signature="s", access="read")
1529
1563
access="readwrite")
1530
1564
def Timeout_dbus_property(self, value=None):
1531
1565
if value is None: # get
1532
return dbus.UInt64(self.timeout_milliseconds())
1566
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1533
1567
old_timeout = self.timeout
1534
1568
self.timeout = datetime.timedelta(0, 0, 0, value)
1535
1569
# Reschedule disabling
1546
1580
gobject.source_remove(self.disable_initiator_tag)
1547
1581
self.disable_initiator_tag = (
1548
1582
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1550
self.disable))
1583
int((self.expires - now).total_seconds()
1584
* 1000), self.disable))
1551
1585
1552
1586
# ExtendedTimeout - property
1553
1587
@dbus_service_property(_interface, signature="t",
1554
1588
access="readwrite")
1555
1589
def ExtendedTimeout_dbus_property(self, value=None):
1556
1590
if value is None: # get
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1591
return dbus.UInt64(self.extended_timeout.total_seconds()
1592
* 1000)
1558
1593
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1559
1594
1560
1595
# Interval - property
1562
1597
access="readwrite")
1563
1598
def Interval_dbus_property(self, value=None):
1564
1599
if value is None: # get
1565
return dbus.UInt64(self.interval_milliseconds())
1600
return dbus.UInt64(self.interval.total_seconds() * 1000)
1566
1601
self.interval = datetime.timedelta(0, 0, 0, value)
1567
1602
if getattr(self, "checker_initiator_tag", None) is None:
1568
1603
return
1579
1614
def Checker_dbus_property(self, value=None):
1580
1615
if value is None: # get
1581
1616
return dbus.String(self.checker_command)
1582
self.checker_command = unicode(value)
1617
self.checker_command = str(value)
1583
1618
1584
1619
# CheckerRunning - property
1585
1620
@dbus_service_property(_interface, signature="b",
1601
1636
@dbus_service_property(_interface, signature="ay",
1602
1637
access="write", byte_arrays=True)
1603
1638
def Secret_dbus_property(self, value):
1604
self.secret = str(value)
1639
self.secret = bytes(value)
1605
1640
1606
1641
del _interface
1607
1642
1641
1676
def handle(self):
1642
1677
with contextlib.closing(self.server.child_pipe) as child_pipe:
1643
1678
logger.info("TCP connection from: %s",
1644
unicode(self.client_address))
1679
str(self.client_address))
1645
1680
logger.debug("Pipe FD: %d",
1646
1681
self.server.child_pipe.fileno())
1647
1682
1673
1708
logger.debug("Protocol version: %r", line)
1674
1709
try:
1675
1710
if int(line.strip().split()[0]) > 1:
1676
raise RuntimeError
1711
raise RuntimeError(line)
1677
1712
except (ValueError, IndexError, RuntimeError) as error:
1678
1713
logger.error("Unknown protocol version: %s", error)
1679
1714
return
1728
1763
if self.server.use_dbus:
1729
1764
# Emit D-Bus signal
1730
1765
client.NeedApproval(
1731
client.approval_delay_milliseconds(),
1732
client.approved_by_default)
1766
client.approval_delay.total_seconds()
1767
* 1000, client.approved_by_default)
1733
1768
else:
1734
1769
logger.warning("Client %s was not approved",
1735
1770
client.name)
1741
1776
#wait until timeout or approved
1742
1777
time = datetime.datetime.now()
1743
1778
client.changedstate.acquire()
1744
client.changedstate.wait(
1745
float(timedelta_to_milliseconds(delay)
1746
/ 1000))
1779
client.changedstate.wait(delay.total_seconds())
1747
1780
client.changedstate.release()
1748
1781
time2 = datetime.datetime.now()
1749
1782
if (time2 - time) >= delay:
1886
1919
1887
1920
def add_pipe(self, parent_pipe, proc):
1888
1921
"""Dummy function; override as necessary"""
1889
raise NotImplementedError
1922
raise NotImplementedError()
1890
1923
1891
1924
1892
1925
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1948
1981
try:
1949
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1950
1983
SO_BINDTODEVICE,
1951
str(self.interface + '\0'))
1984
(self.interface + "\0")
1985
.encode("utf-8"))
1952
1986
except socket.error as error:
1953
1987
if error.errno == errno.EPERM:
1954
1988
logger.error("No permission to bind to"
1968
2002
if self.address_family == socket.AF_INET6:
1969
2003
any_address = "::" # in6addr_any
1970
2004
else:
1971
any_address = socket.INADDR_ANY
2005
any_address = "0.0.0.0" # INADDR_ANY
1972
2006
self.server_address = (any_address,
1973
2007
self.server_address[1])
1974
2008
elif not self.server_address[1]:
2090
2124
return True
2091
2125
2092
2126
2127
def rfc3339_duration_to_delta(duration):
2128
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2129
2130
>>> rfc3339_duration_to_delta("P7D")
2131
datetime.timedelta(7)
2132
>>> rfc3339_duration_to_delta("PT60S")
2133
datetime.timedelta(0, 60)
2134
>>> rfc3339_duration_to_delta("PT60M")
2135
datetime.timedelta(0, 3600)
2136
>>> rfc3339_duration_to_delta("PT24H")
2137
datetime.timedelta(1)
2138
>>> rfc3339_duration_to_delta("P1W")
2139
datetime.timedelta(7)
2140
>>> rfc3339_duration_to_delta("PT5M30S")
2141
datetime.timedelta(0, 330)
2142
>>> rfc3339_duration_to_delta("P1DT3M20S")
2143
datetime.timedelta(1, 200)
2144
"""
2145
2146
# Parsing an RFC 3339 duration with regular expressions is not
2147
# possible - there would have to be multiple places for the same
2148
# values, like seconds. The current code, while more esoteric, is
2149
# cleaner without depending on a parsing library. If Python had a
2150
# built-in library for parsing we would use it, but we'd like to
2151
# avoid excessive use of external libraries.
2152
2153
# New type for defining tokens, syntax, and semantics all-in-one
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2158
# containing digits
2159
"value", # datetime.timedelta or
2160
# None
2161
"followers")) # Tokens valid after
2162
# this token
2163
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
token_end = Token(re.compile(r"$"), None, frozenset())
2166
token_second = Token(re.compile(r"(\d+)S"),
2167
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2169
token_minute = Token(re.compile(r"(\d+)M"),
2170
datetime.timedelta(minutes=1),
2171
frozenset((token_second, token_end)))
2172
token_hour = Token(re.compile(r"(\d+)H"),
2173
datetime.timedelta(hours=1),
2174
frozenset((token_minute, token_end)))
2175
token_time = Token(re.compile(r"T"),
2176
None,
2177
frozenset((token_hour, token_minute,
2178
token_second)))
2179
token_day = Token(re.compile(r"(\d+)D"),
2180
datetime.timedelta(days=1),
2181
frozenset((token_time, token_end)))
2182
token_month = Token(re.compile(r"(\d+)M"),
2183
datetime.timedelta(weeks=4),
2184
frozenset((token_day, token_end)))
2185
token_year = Token(re.compile(r"(\d+)Y"),
2186
datetime.timedelta(weeks=52),
2187
frozenset((token_month, token_end)))
2188
token_week = Token(re.compile(r"(\d+)W"),
2189
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2191
token_duration = Token(re.compile(r"P"), None,
2192
frozenset((token_year, token_month,
2193
token_day, token_time,
2194
token_week)))
2195
# Define starting values
2196
value = datetime.timedelta() # Value so far
2197
found_token = None
2198
followers = frozenset((token_duration,)) # Following valid tokens
2199
s = duration # String left to parse
2200
# Loop until end token is found
2201
while found_token is not token_end:
2202
# Search for any currently valid tokens
2203
for token in followers:
2204
match = token.regexp.match(s)
2205
if match is not None:
2206
# Token found
2207
if token.value is not None:
2208
# Value found, parse digits
2209
factor = int(match.group(1), 10)
2210
# Add to value so far
2211
value += factor * token.value
2212
# Strip token from string
2213
s = token.regexp.sub("", s, 1)
2214
# Go to found token
2215
found_token = token
2216
# Set valid next tokens
2217
followers = found_token.followers
2218
break
2219
else:
2220
# No currently valid tokens were found
2221
raise ValueError("Invalid RFC 3339 duration")
2222
# End token found
2223
return value
2224
2225
2093
2226
def string_to_delta(interval):
2094
2227
"""Parse a string and return a datetime.timedelta
2095
2228
2106
2239
>>> string_to_delta('5m 30s')
2107
2240
datetime.timedelta(0, 330)
2108
2241
"""
2242
2243
try:
2244
return rfc3339_duration_to_delta(interval)
2245
except ValueError:
2246
pass
2247
2109
2248
timevalue = datetime.timedelta(0)
2110
2249
for s in interval.split():
2111
2250
try:
2112
suffix = unicode(s[-1])
2251
suffix = s[-1]
2113
2252
value = int(s[:-1])
2114
2253
if suffix == "d":
2115
2254
delta = datetime.timedelta(value)
2122
2261
elif suffix == "w":
2123
2262
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2124
2263
else:
2125
raise ValueError("Unknown suffix {0!r}"
2264
raise ValueError("Unknown suffix {!r}"
2126
2265
.format(suffix))
2127
except (ValueError, IndexError) as e:
2266
except IndexError as e:
2128
2267
raise ValueError(*(e.args))
2129
2268
timevalue += delta
2130
2269
return timevalue
2145
2284
# Close all standard open file descriptors
2146
2285
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2147
2286
if not stat.S_ISCHR(os.fstat(null).st_mode):
2148
raise OSError(errno.ENODEV,
2149
"{0} not a character device"
2287
raise OSError(errno.ENODEV, "{} not a character device"
2150
2288
.format(os.devnull))
2151
2289
os.dup2(null, sys.stdin.fileno())
2152
2290
os.dup2(null, sys.stdout.fileno())
2162
2300
2163
2301
parser = argparse.ArgumentParser()
2164
2302
parser.add_argument("-v", "--version", action="version",
2165
version = "%(prog)s {0}".format(version),
2303
version = "%(prog)s {}".format(version),
2166
2304
help="show version number and exit")
2167
2305
parser.add_argument("-i", "--interface", metavar="IF",
2168
2306
help="Bind to interface IF")
2174
2312
help="Run self-test")
2175
2313
parser.add_argument("--debug", action="store_true",
2176
2314
help="Debug mode; run in foreground and log"
2177
" to terminal")
2315
" to terminal", default=None)
2178
2316
parser.add_argument("--debuglevel", metavar="LEVEL",
2179
2317
help="Debug level for stdout output")
2180
2318
parser.add_argument("--priority", help="GnuTLS"
2187
2325
" files")
2188
2326
parser.add_argument("--no-dbus", action="store_false",
2189
2327
dest="use_dbus", help="Do not provide D-Bus"
2190
" system bus interface")
2328
" system bus interface", default=None)
2191
2329
parser.add_argument("--no-ipv6", action="store_false",
2192
dest="use_ipv6", help="Do not use IPv6")
2330
dest="use_ipv6", help="Do not use IPv6",
2331
default=None)
2193
2332
parser.add_argument("--no-restore", action="store_false",
2194
2333
dest="restore", help="Do not restore stored"
2195
" state")
2334
" state", default=None)
2196
2335
parser.add_argument("--socket", type=int,
2197
2336
help="Specify a file descriptor to a network"
2198
2337
" socket to use instead of creating one")
2199
2338
parser.add_argument("--statedir", metavar="DIR",
2200
2339
help="Directory to save/restore state in")
2201
2340
parser.add_argument("--foreground", action="store_true",
2202
help="Run in foreground")
2341
help="Run in foreground", default=None)
2342
parser.add_argument("--no-zeroconf", action="store_false",
2343
dest="zeroconf", help="Do not use Zeroconf",
2344
default=None)
2203
2345
2204
2346
options = parser.parse_args()
2205
2347
2206
2348
if options.check:
2207
2349
import doctest
2208
doctest.testmod()
2209
sys.exit()
2350
fail_count, test_count = doctest.testmod()
2351
sys.exit(os.EX_OK if fail_count == 0 else 1)
2210
2352
2211
2353
# Default values for config file for server-global settings
2212
2354
server_defaults = { "interface": "",
2214
2356
"port": "",
2215
2357
"debug": "False",
2216
2358
"priority":
2217
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2359
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2360
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2218
2361
"servicename": "Mandos",
2219
2362
"use_dbus": "True",
2220
2363
"use_ipv6": "True",
2223
2366
"socket": "",
2224
2367
"statedir": "/var/lib/mandos",
2225
2368
"foreground": "False",
2369
"zeroconf": "True",
2226
2370
}
2227
2371
2228
2372
# Parse config file for server-global settings
2255
2399
for option in ("interface", "address", "port", "debug",
2256
2400
"priority", "servicename", "configdir",
2257
2401
"use_dbus", "use_ipv6", "debuglevel", "restore",
2258
"statedir", "socket", "foreground"):
2402
"statedir", "socket", "foreground", "zeroconf"):
2259
2403
value = getattr(options, option)
2260
2404
if value is not None:
2261
2405
server_settings[option] = value
2262
2406
del options
2263
2407
# Force all strings to be unicode
2264
2408
for option in server_settings.keys():
2265
if type(server_settings[option]) is str:
2266
server_settings[option] = unicode(server_settings[option])
2409
if isinstance(server_settings[option], bytes):
2410
server_settings[option] = (server_settings[option]
2411
.decode("utf-8"))
2412
# Force all boolean options to be boolean
2413
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2414
"foreground", "zeroconf"):
2415
server_settings[option] = bool(server_settings[option])
2267
2416
# Debug implies foreground
2268
2417
if server_settings["debug"]:
2269
2418
server_settings["foreground"] = True
2271
2420
2272
2421
##################################################################
2273
2422
2423
if (not server_settings["zeroconf"] and
2424
not (server_settings["port"]
2425
or server_settings["socket"] != "")):
2426
parser.error("Needs port or socket to work without"
2427
" Zeroconf")
2428
2274
2429
# For convenience
2275
2430
debug = server_settings["debug"]
2276
2431
debuglevel = server_settings["debuglevel"]
2279
2434
stored_state_path = os.path.join(server_settings["statedir"],
2280
2435
stored_state_file)
2281
2436
foreground = server_settings["foreground"]
2437
zeroconf = server_settings["zeroconf"]
2282
2438
2283
2439
if debug:
2284
2440
initlogger(debug, logging.DEBUG)
2291
2447
2292
2448
if server_settings["servicename"] != "Mandos":
2293
2449
syslogger.setFormatter(logging.Formatter
2294
('Mandos ({0}) [%(process)d]:'
2450
('Mandos ({}) [%(process)d]:'
2295
2451
' %(levelname)s: %(message)s'
2296
2452
.format(server_settings
2297
2453
["servicename"])))
2305
2461
global mandos_dbus_service
2306
2462
mandos_dbus_service = None
2307
2463
2464
socketfd = None
2465
if server_settings["socket"] != "":
2466
socketfd = server_settings["socket"]
2308
2467
tcp_server = MandosServer((server_settings["address"],
2309
2468
server_settings["port"]),
2310
2469
ClientHandler,
2314
2473
gnutls_priority=
2315
2474
server_settings["priority"],
2316
2475
use_dbus=use_dbus,
2317
socketfd=(server_settings["socket"]
2318
or None))
2476
socketfd=socketfd)
2319
2477
if not foreground:
2320
pidfilename = "/var/run/mandos.pid"
2478
pidfilename = "/run/mandos.pid"
2479
if not os.path.isdir("/run/."):
2480
pidfilename = "/var/run/mandos.pid"
2321
2481
pidfile = None
2322
2482
try:
2323
2483
pidfile = open(pidfilename, "w")
2340
2500
os.setuid(uid)
2341
2501
except OSError as error:
2342
2502
if error.errno != errno.EPERM:
2343
raise error
2503
raise
2344
2504
2345
2505
if debug:
2346
2506
# Enable all possible GnuTLS debugging
2389
2549
use_dbus = False
2390
2550
server_settings["use_dbus"] = False
2391
2551
tcp_server.use_dbus = False
2392
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2393
service = AvahiServiceToSyslog(name =
2394
server_settings["servicename"],
2395
servicetype = "_mandos._tcp",
2396
protocol = protocol, bus = bus)
2397
if server_settings["interface"]:
2398
service.interface = (if_nametoindex
2399
(str(server_settings["interface"])))
2552
if zeroconf:
2553
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2554
service = AvahiServiceToSyslog(name =
2555
server_settings["servicename"],
2556
servicetype = "_mandos._tcp",
2557
protocol = protocol, bus = bus)
2558
if server_settings["interface"]:
2559
service.interface = (if_nametoindex
2560
(server_settings["interface"]
2561
.encode("utf-8")))
2400
2562
2401
2563
global multiprocessing_manager
2402
2564
multiprocessing_manager = multiprocessing.Manager()
2409
2571
old_client_settings = {}
2410
2572
clients_data = {}
2411
2573
2574
# This is used to redirect stdout and stderr for checker processes
2575
global wnull
2576
wnull = open(os.devnull, "w") # A writable /dev/null
2577
# Only used if server is running in foreground but not in debug
2578
# mode
2579
if debug or not foreground:
2580
wnull.close()
2581
2412
2582
# Get client data and settings from last running state.
2413
2583
if server_settings["restore"]:
2414
2584
try:
2418
2588
os.remove(stored_state_path)
2419
2589
except IOError as e:
2420
2590
if e.errno == errno.ENOENT:
2421
logger.warning("Could not load persistent state: {0}"
2591
logger.warning("Could not load persistent state: {}"
2422
2592
.format(os.strerror(e.errno)))
2423
2593
else:
2424
2594
logger.critical("Could not load persistent state:",
2429
2599
"EOFError:", exc_info=e)
2430
2600
2431
2601
with PGPEngine() as pgp:
2432
for client_name, client in clients_data.iteritems():
2602
for client_name, client in clients_data.items():
2603
# Skip removed clients
2604
if client_name not in client_settings:
2605
continue
2606
2433
2607
# Decide which value to use after restoring saved state.
2434
2608
# We have three different values: Old config file,
2435
2609
# new config file, and saved state.
2456
2630
if datetime.datetime.utcnow() >= client["expires"]:
2457
2631
if not client["last_checked_ok"]:
2458
2632
logger.warning(
2459
"disabling client {0} - Client never "
2633
"disabling client {} - Client never "
2460
2634
"performed a successful checker"
2461
2635
.format(client_name))
2462
2636
client["enabled"] = False
2463
2637
elif client["last_checker_status"] != 0:
2464
2638
logger.warning(
2465
"disabling client {0} - Client "
2466
"last checker failed with error code {1}"
2639
"disabling client {} - Client last"
2640
" checker failed with error code {}"
2467
2641
.format(client_name,
2468
2642
client["last_checker_status"]))
2469
2643
client["enabled"] = False
2472
2646
.utcnow()
2473
2647
+ client["timeout"])
2474
2648
logger.debug("Last checker succeeded,"
2475
" keeping {0} enabled"
2649
" keeping {} enabled"
2476
2650
.format(client_name))
2477
2651
try:
2478
2652
client["secret"] = (
2481
2655
["secret"]))
2482
2656
except PGPError:
2483
2657
# If decryption fails, we use secret from new settings
2484
logger.debug("Failed to decrypt {0} old secret"
2658
logger.debug("Failed to decrypt {} old secret"
2485
2659
.format(client_name))
2486
2660
client["secret"] = (
2487
2661
client_settings[client_name]["secret"])
2495
2669
clients_data[client_name] = client_settings[client_name]
2496
2670
2497
2671
# Create all client objects
2498
for client_name, client in clients_data.iteritems():
2672
for client_name, client in clients_data.items():
2499
2673
tcp_server.clients[client_name] = client_class(
2500
name = client_name, settings = client)
2674
name = client_name, settings = client,
2675
server_settings = server_settings)
2501
2676
2502
2677
if not tcp_server.clients:
2503
2678
logger.warning("No clients defined")
2507
2682
try:
2508
2683
with pidfile:
2509
2684
pid = os.getpid()
2510
pidfile.write(str(pid) + "\n".encode("utf-8"))
2685
pidfile.write("{}\n".format(pid).encode("utf-8"))
2511
2686
except IOError:
2512
2687
logger.error("Could not write to file %r with PID %d",
2513
2688
pidfilename, pid)
2559
2734
def GetAllClientsWithProperties(self):
2560
2735
"D-Bus method"
2561
2736
return dbus.Dictionary(
2562
((c.dbus_object_path, c.GetAll(""))
2563
for c in tcp_server.clients.itervalues()),
2737
{ c.dbus_object_path: c.GetAll("")
2738
for c in tcp_server.clients.itervalues() },
2564
2739
signature="oa{sv}")
2565
2740
2566
2741
@dbus.service.method(_interface, in_signature="o")
2583
2758
2584
2759
def cleanup():
2585
2760
"Cleanup function; run on exit"
2586
service.cleanup()
2761
if zeroconf:
2762
service.cleanup()
2587
2763
2588
2764
multiprocessing.active_children()
2765
wnull.close()
2589
2766
if not (tcp_server.clients or client_settings):
2590
2767
return
2591
2768
2602
2779
2603
2780
# A list of attributes that can not be pickled
2604
2781
# + secret.
2605
exclude = set(("bus", "changedstate", "secret",
2606
"checker"))
2782
exclude = { "bus", "changedstate", "secret",
2783
"checker", "server_settings" }
2607
2784
for name, typ in (inspect.getmembers
2608
2785
(dbus.service.Object)):
2609
2786
exclude.add(name)
2632
2809
except NameError:
2633
2810
pass
2634
2811
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2635
logger.warning("Could not save persistent state: {0}"
2812
logger.warning("Could not save persistent state: {}"
2636
2813
.format(os.strerror(e.errno)))
2637
2814
else:
2638
2815
logger.warning("Could not save persistent state:",
2639
2816
exc_info=e)
2640
raise e
2817
raise
2641
2818
2642
2819
# Delete all clients, and settings from config
2643
2820
while tcp_server.clients:
2667
2844
tcp_server.server_activate()
2668
2845
2669
2846
# Find out what port we got
2670
service.port = tcp_server.socket.getsockname()[1]
2847
if zeroconf:
2848
service.port = tcp_server.socket.getsockname()[1]
2671
2849
if use_ipv6:
2672
2850
logger.info("Now listening on address %r, port %d,"
2673
2851
" flowinfo %d, scope_id %d",
2679
2857
#service.interface = tcp_server.socket.getsockname()[3]
2680
2858
2681
2859
try:
2682
# From the Avahi example code
2683
try:
2684
service.activate()
2685
except dbus.exceptions.DBusException as error:
2686
logger.critical("D-Bus Exception", exc_info=error)
2687
cleanup()
2688
sys.exit(1)
2689
# End of Avahi example code
2860
if zeroconf:
2861
# From the Avahi example code
2862
try:
2863
service.activate()
2864
except dbus.exceptions.DBusException as error:
2865
logger.critical("D-Bus Exception", exc_info=error)
2866
cleanup()
2867
sys.exit(1)
2868
# End of Avahi example code
2690
2869
2691
2870
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2692
2871
lambda *args, **kwargs:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0