To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 742
- compare with another revision
- download diff
- download tarball
- view history from revision 742
- Committer: Teddy Hogeborn
- Date: 2015-03-10 18:03:38 UTC
- Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.
If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default. The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.
There is a "PFS" priority string specifier, but we can't use it because:
1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
enables a lot more algorithms than "SECURE256".
2. It is only available since GnuTLS 3.2.4.
Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.
If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default. The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.
There is a "PFS" priority string specifier, but we can't use it because:
1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
enables a lot more algorithms than "SECURE256".
2. It is only available since GnuTLS 3.2.4.
Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
#
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
#
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
23
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
25
# GNU General Public License for more details.
26
#
26
#
27
27
# You should have received a copy of the GNU General Public License
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
#
30
#
31
31
# Contact the authors at <mandos@recompile.se>.
32
#
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
try:
43
import SocketServer as socketserver
44
except ImportError:
45
import socketserver
39
import SocketServer as socketserver
46
40
import socket
47
41
import argparse
48
42
import datetime
49
43
import errno
50
try:
51
import ConfigParser as configparser
52
except ImportError:
53
import configparser
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
54
51
import sys
55
52
import re
56
53
import os
65
62
import struct
66
63
import fcntl
67
64
import functools
68
try:
69
import cPickle as pickle
70
except ImportError:
71
import pickle
65
import cPickle as pickle
72
66
import multiprocessing
73
67
import types
74
68
import binascii
75
69
import tempfile
76
70
import itertools
77
71
import collections
78
import codecs
79
72
80
73
import dbus
81
74
import dbus.service
82
from gi.repository import GLib
75
import gobject
76
import avahi
83
77
from dbus.mainloop.glib import DBusGMainLoop
84
78
import ctypes
85
79
import ctypes.util
86
80
import xml.dom.minidom
87
81
import inspect
88
82
89
# Try to find the value of SO_BINDTODEVICE:
90
83
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
85
except AttributeError:
95
86
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
98
87
from IN import SO_BINDTODEVICE
99
88
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
89
SO_BINDTODEVICE = None
113
90
114
91
if sys.version_info.major == 2:
115
92
str = unicode
116
93
117
version = "1.7.14"
94
version = "1.6.9"
118
95
stored_state_file = "clients.pickle"
119
96
120
97
logger = logging.getLogger()
121
98
syslogger = None
122
99
123
100
try:
124
if_nametoindex = ctypes.cdll.LoadLibrary(
125
ctypes.util.find_library("c")).if_nametoindex
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
126
104
except (OSError, AttributeError):
127
128
105
def if_nametoindex(interface):
129
106
"Get an interface index the hard way, i.e. using fcntl()"
130
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
135
112
return interface_index
136
113
137
114
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
154
115
def initlogger(debug, level=logging.WARNING):
155
116
"""init logger and add loglevel"""
156
117
157
118
global syslogger
158
syslogger = (logging.handlers.SysLogHandler(
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
160
address="/dev/log"))
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
161
123
syslogger.setFormatter(logging.Formatter
162
124
('Mandos [%(process)d]: %(levelname)s:'
163
125
' %(message)s'))
164
126
logger.addHandler(syslogger)
165
127
166
128
if debug:
167
129
console = logging.StreamHandler()
168
130
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
180
142
181
143
class PGPEngine(object):
182
144
"""A simple class for OpenPGP symmetric encryption & decryption"""
183
184
145
def __init__(self):
185
146
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
self.gpg = "gpg"
187
try:
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
191
if name == "gpg":
192
self.gpg = path
193
break
194
except OSError as e:
195
if e.errno != errno.ENOENT:
196
raise
197
147
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
148
'--home', self.tempdir,
199
149
'--force-mdc',
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
204
150
'--quiet',
151
'--no-use-agent']
152
205
153
def __enter__(self):
206
154
return self
207
155
208
156
def __exit__(self, exc_type, exc_value, traceback):
209
157
self._cleanup()
210
158
return False
211
159
212
160
def __del__(self):
213
161
self._cleanup()
214
162
215
163
def _cleanup(self):
216
164
if self.tempdir is not None:
217
165
# Delete contents of tempdir
218
166
for root, dirs, files in os.walk(self.tempdir,
219
topdown=False):
167
topdown = False):
220
168
for filename in files:
221
169
os.remove(os.path.join(root, filename))
222
170
for dirname in dirs:
224
172
# Remove tempdir
225
173
os.rmdir(self.tempdir)
226
174
self.tempdir = None
227
175
228
176
def password_encode(self, password):
229
177
# Passphrase can not be empty and can not contain newlines or
230
178
# NUL bytes. So we prefix it and hex encode it.
235
183
.replace(b"\n", b"\\n")
236
184
.replace(b"\0", b"\\x00"))
237
185
return encoded
238
186
239
187
def encrypt(self, data, password):
240
188
passphrase = self.password_encode(password)
241
with tempfile.NamedTemporaryFile(
242
dir=self.tempdir) as passfile:
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
243
191
passfile.write(passphrase)
244
192
passfile.flush()
245
proc = subprocess.Popen([self.gpg, '--symmetric',
193
proc = subprocess.Popen(['gpg', '--symmetric',
246
194
'--passphrase-file',
247
195
passfile.name]
248
196
+ self.gnupgargs,
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
253
201
if proc.returncode != 0:
254
202
raise PGPError(err)
255
203
return ciphertext
256
204
257
205
def decrypt(self, data, password):
258
206
passphrase = self.password_encode(password)
259
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
261
209
passfile.write(passphrase)
262
210
passfile.flush()
263
proc = subprocess.Popen([self.gpg, '--decrypt',
211
proc = subprocess.Popen(['gpg', '--decrypt',
264
212
'--passphrase-file',
265
213
passfile.name]
266
214
+ self.gnupgargs,
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
271
220
if proc.returncode != 0:
272
221
raise PGPError(err)
273
222
return decrypted_plaintext
274
223
275
224
276
# Pretend that we have an Avahi module
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
288
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
301
302
303
225
class AvahiError(Exception):
304
226
def __init__(self, value, *args, **kwargs):
305
227
self.value = value
306
228
return super(AvahiError, self).__init__(value, *args,
307
229
**kwargs)
308
230
309
310
231
class AvahiServiceError(AvahiError):
311
232
pass
312
233
313
314
234
class AvahiGroupError(AvahiError):
315
235
pass
316
236
317
237
318
238
class AvahiService(object):
319
239
"""An Avahi (Zeroconf) service.
320
240
321
241
Attributes:
322
242
interface: integer; avahi.IF_UNSPEC or an interface index.
323
243
Used to optionally bind to the specified interface.
335
255
server: D-Bus Server
336
256
bus: dbus.SystemBus()
337
257
"""
338
339
def __init__(self,
340
interface=avahi.IF_UNSPEC,
341
name=None,
342
servicetype=None,
343
port=None,
344
TXT=None,
345
domain="",
346
host="",
347
max_renames=32768,
348
protocol=avahi.PROTO_UNSPEC,
349
bus=None):
258
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
350
263
self.interface = interface
351
264
self.name = name
352
265
self.type = servicetype
361
274
self.server = None
362
275
self.bus = bus
363
276
self.entry_group_state_changed_match = None
364
277
365
278
def rename(self, remove=True):
366
279
"""Derived from the Avahi example code"""
367
280
if self.rename_count >= self.max_renames:
369
282
" after %i retries, exiting.",
370
283
self.rename_count)
371
284
raise AvahiServiceError("Too many renames")
372
self.name = str(
373
self.server.GetAlternativeServiceName(self.name))
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
374
287
self.rename_count += 1
375
288
logger.info("Changing Zeroconf service name to %r ...",
376
289
self.name)
387
300
logger.critical("D-Bus Exception", exc_info=error)
388
301
self.cleanup()
389
302
os._exit(1)
390
303
391
304
def remove(self):
392
305
"""Derived from the Avahi example code"""
393
306
if self.entry_group_state_changed_match is not None:
395
308
self.entry_group_state_changed_match = None
396
309
if self.group is not None:
397
310
self.group.Reset()
398
311
399
312
def add(self):
400
313
"""Derived from the Avahi example code"""
401
314
self.remove()
418
331
dbus.UInt16(self.port),
419
332
avahi.string_array_to_txt_array(self.TXT))
420
333
self.group.Commit()
421
334
422
335
def entry_group_state_changed(self, state, error):
423
336
"""Derived from the Avahi example code"""
424
337
logger.debug("Avahi entry group state change: %i", state)
425
338
426
339
if state == avahi.ENTRY_GROUP_ESTABLISHED:
427
340
logger.debug("Zeroconf service established.")
428
341
elif state == avahi.ENTRY_GROUP_COLLISION:
431
344
elif state == avahi.ENTRY_GROUP_FAILURE:
432
345
logger.critical("Avahi: Error in group state changed %s",
433
346
str(error))
434
raise AvahiGroupError("State changed: {!s}".format(error))
435
347
raise AvahiGroupError("State changed: {!s}"
348
.format(error))
349
436
350
def cleanup(self):
437
351
"""Derived from the Avahi example code"""
438
352
if self.group is not None:
443
357
pass
444
358
self.group = None
445
359
self.remove()
446
360
447
361
def server_state_changed(self, state, error=None):
448
362
"""Derived from the Avahi example code"""
449
363
logger.debug("Avahi server state change: %i", state)
450
bad_states = {
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
452
avahi.SERVER_REGISTERING: None,
453
avahi.SERVER_COLLISION: "Zeroconf server name collision",
454
avahi.SERVER_FAILURE: "Zeroconf server failure",
455
}
364
bad_states = { avahi.SERVER_INVALID:
365
"Zeroconf server invalid",
366
avahi.SERVER_REGISTERING: None,
367
avahi.SERVER_COLLISION:
368
"Zeroconf server name collision",
369
avahi.SERVER_FAILURE:
370
"Zeroconf server failure" }
456
371
if state in bad_states:
457
372
if bad_states[state] is not None:
458
373
if error is None:
461
376
logger.error(bad_states[state] + ": %r", error)
462
377
self.cleanup()
463
378
elif state == avahi.SERVER_RUNNING:
464
try:
465
self.add()
466
except dbus.exceptions.DBusException as error:
467
if (error.get_dbus_name()
468
== "org.freedesktop.Avahi.CollisionError"):
469
logger.info("Local Zeroconf service name"
470
" collision.")
471
return self.rename(remove=False)
472
else:
473
logger.critical("D-Bus Exception", exc_info=error)
474
self.cleanup()
475
os._exit(1)
379
self.add()
476
380
else:
477
381
if error is None:
478
382
logger.debug("Unknown state: %r", state)
479
383
else:
480
384
logger.debug("Unknown state: %r: %r", state, error)
481
385
482
386
def activate(self):
483
387
"""Derived from the Avahi example code"""
484
388
if self.server is None:
488
392
follow_name_owner_changes=True),
489
393
avahi.DBUS_INTERFACE_SERVER)
490
394
self.server.connect_to_signal("StateChanged",
491
self.server_state_changed)
395
self.server_state_changed)
492
396
self.server_state_changed(self.server.GetState())
493
397
494
398
496
400
def rename(self, *args, **kwargs):
497
401
"""Add the new name to the syslog messages"""
498
402
ret = AvahiService.rename(self, *args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
.format(self.name)))
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
406
.format(self.name)))
502
407
return ret
503
408
504
409
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
509
510
library = ctypes.util.find_library("gnutls")
511
if library is None:
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
514
del library
515
_need_version = b"3.3.0"
516
517
def __init__(self):
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
523
524
# Unless otherwise indicated, the constants and types below are
525
# all from the gnutls/gnutls.h C header file.
526
527
# Constants
528
E_SUCCESS = 0
529
E_INTERRUPTED = -52
530
E_AGAIN = -28
531
CRT_OPENPGP = 2
532
CLIENT = 2
533
SHUT_RDWR = 0
534
CRD_CERTIFICATE = 1
535
E_NO_CERTIFICATE_FOUND = -49
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
537
538
# Types
539
class session_int(ctypes.Structure):
540
_fields_ = []
541
session_t = ctypes.POINTER(session_int)
542
543
class certificate_credentials_st(ctypes.Structure):
544
_fields_ = []
545
certificate_credentials_t = ctypes.POINTER(
546
certificate_credentials_st)
547
certificate_type_t = ctypes.c_int
548
549
class datum_t(ctypes.Structure):
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
('size', ctypes.c_uint)]
552
553
class openpgp_crt_int(ctypes.Structure):
554
_fields_ = []
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
credentials_type_t = ctypes.c_int
559
transport_ptr_t = ctypes.c_void_p
560
close_request_t = ctypes.c_int
561
562
# Exceptions
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
571
# gnutls.strerror()
572
self.code = code
573
if message is None and code is not None:
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
576
message, *args)
577
578
class CertificateSecurityError(Error):
579
pass
580
581
# Classes
582
class Credentials(object):
583
def __init__(self):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
588
589
def __del__(self):
590
gnutls.certificate_free_credentials(self._c_object)
591
592
class ClientSession(object):
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
gnutls.set_default_priority(self._c_object)
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
598
gnutls.handshake_set_private_extensions(self._c_object,
599
True)
600
self.socket = socket
601
if credentials is None:
602
credentials = gnutls.Credentials()
603
gnutls.credentials_set(self._c_object, credentials.type,
604
ctypes.cast(credentials._c_object,
605
ctypes.c_void_p))
606
self.credentials = credentials
607
608
def __del__(self):
609
gnutls.deinit(self._c_object)
610
611
def handshake(self):
612
return gnutls.handshake(self._c_object)
613
614
def send(self, data):
615
data = bytes(data)
616
data_len = len(data)
617
while data_len > 0:
618
data_len -= gnutls.record_send(self._c_object,
619
data[-data_len:],
620
data_len)
621
622
def bye(self):
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
625
# Error handling functions
626
def _error_code(result):
627
"""A function to raise exceptions on errors, suitable
628
for the 'restype' attribute on ctypes functions"""
629
if result >= 0:
630
return result
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
634
635
def _retry_on_error(result, func, arguments):
636
"""A function to retry on some errors, suitable
637
for the 'errcheck' attribute on ctypes functions"""
638
while result < 0:
639
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
640
return _error_code(result)
641
result = func(*arguments)
642
return result
643
644
# Unless otherwise indicated, the function declarations below are
645
# all from the gnutls/gnutls.h C header file.
646
647
# Functions
648
priority_set_direct = _library.gnutls_priority_set_direct
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
ctypes.POINTER(ctypes.c_char_p)]
651
priority_set_direct.restype = _error_code
652
653
init = _library.gnutls_init
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
init.restype = _error_code
656
657
set_default_priority = _library.gnutls_set_default_priority
658
set_default_priority.argtypes = [session_t]
659
set_default_priority.restype = _error_code
660
661
record_send = _library.gnutls_record_send
662
record_send.argtypes = [session_t, ctypes.c_void_p,
663
ctypes.c_size_t]
664
record_send.restype = ctypes.c_ssize_t
665
record_send.errcheck = _retry_on_error
666
667
certificate_allocate_credentials = (
668
_library.gnutls_certificate_allocate_credentials)
669
certificate_allocate_credentials.argtypes = [
670
ctypes.POINTER(certificate_credentials_t)]
671
certificate_allocate_credentials.restype = _error_code
672
673
certificate_free_credentials = (
674
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
677
certificate_free_credentials.restype = None
678
679
handshake_set_private_extensions = (
680
_library.gnutls_handshake_set_private_extensions)
681
handshake_set_private_extensions.argtypes = [session_t,
682
ctypes.c_int]
683
handshake_set_private_extensions.restype = None
684
685
credentials_set = _library.gnutls_credentials_set
686
credentials_set.argtypes = [session_t, credentials_type_t,
687
ctypes.c_void_p]
688
credentials_set.restype = _error_code
689
690
strerror = _library.gnutls_strerror
691
strerror.argtypes = [ctypes.c_int]
692
strerror.restype = ctypes.c_char_p
693
694
certificate_type_get = _library.gnutls_certificate_type_get
695
certificate_type_get.argtypes = [session_t]
696
certificate_type_get.restype = _error_code
697
698
certificate_get_peers = _library.gnutls_certificate_get_peers
699
certificate_get_peers.argtypes = [session_t,
700
ctypes.POINTER(ctypes.c_uint)]
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
703
global_set_log_level = _library.gnutls_global_set_log_level
704
global_set_log_level.argtypes = [ctypes.c_int]
705
global_set_log_level.restype = None
706
707
global_set_log_function = _library.gnutls_global_set_log_function
708
global_set_log_function.argtypes = [log_func]
709
global_set_log_function.restype = None
710
711
deinit = _library.gnutls_deinit
712
deinit.argtypes = [session_t]
713
deinit.restype = None
714
715
handshake = _library.gnutls_handshake
716
handshake.argtypes = [session_t]
717
handshake.restype = _error_code
718
handshake.errcheck = _retry_on_error
719
720
transport_set_ptr = _library.gnutls_transport_set_ptr
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
transport_set_ptr.restype = None
723
724
bye = _library.gnutls_bye
725
bye.argtypes = [session_t, close_request_t]
726
bye.restype = _error_code
727
bye.errcheck = _retry_on_error
728
729
check_version = _library.gnutls_check_version
730
check_version.argtypes = [ctypes.c_char_p]
731
check_version.restype = ctypes.c_char_p
732
733
# All the function declarations below are from gnutls/openpgp.h
734
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
738
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
742
openpgp_crt_fmt_t]
743
openpgp_crt_import.restype = _error_code
744
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
749
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
753
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
757
ctypes.c_void_p,
758
ctypes.POINTER(
759
ctypes.c_size_t)]
760
openpgp_crt_get_fingerprint.restype = _error_code
761
762
# Remove non-public functions
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
765
gnutls = GnuTLS()
766
767
768
def call_pipe(connection, # : multiprocessing.Connection
769
func, *args, **kwargs):
770
"""This function is meant to be called by multiprocessing.Process
771
772
This function runs func(*args, **kwargs), and writes the resulting
773
return value on the provided multiprocessing.Connection.
774
"""
775
connection.send(func(*args, **kwargs))
776
connection.close()
777
778
779
410
class Client(object):
780
411
"""A representation of a client host served by this server.
781
412
782
413
Attributes:
783
414
approved: bool(); 'None' if not yet approved/disapproved
784
415
approval_delay: datetime.timedelta(); Time to wait for approval
786
417
checker: subprocess.Popen(); a running checker process used
787
418
to see if the client lives.
788
419
'None' if no process is running.
789
checker_callback_tag: a GLib event source tag, or None
420
checker_callback_tag: a gobject event source tag, or None
790
421
checker_command: string; External command which is run to check
791
422
if client lives. %() expansions are done at
792
423
runtime with vars(self) as dict, so that for
793
424
instance %(name)s can be used in the command.
794
checker_initiator_tag: a GLib event source tag, or None
425
checker_initiator_tag: a gobject event source tag, or None
795
426
created: datetime.datetime(); (UTC) object creation
796
427
client_structure: Object describing what attributes a client has
797
428
and is used for storing the client at exit
798
429
current_checker_command: string; current running checker_command
799
disable_initiator_tag: a GLib event source tag, or None
430
disable_initiator_tag: a gobject event source tag, or None
800
431
enabled: bool()
801
432
fingerprint: string (40 or 32 hexadecimal digits); used to
802
433
uniquely identify the client
807
438
last_checker_status: integer between 0 and 255 reflecting exit
808
439
status of last checker. -1 reflects crashed
809
440
checker, -2 means no checker completed yet.
810
last_checker_signal: The signal which killed the last checker, if
811
last_checker_status is -1
812
441
last_enabled: datetime.datetime(); (UTC) or None
813
442
name: string; from the config file, used in log messages and
814
443
D-Bus identifiers
821
450
disabled, or None
822
451
server_settings: The server_settings dict from main()
823
452
"""
824
453
825
454
runtime_expansions = ("approval_delay", "approval_duration",
826
455
"created", "enabled", "expires",
827
456
"fingerprint", "host", "interval",
828
457
"last_approval_request", "last_checked_ok",
829
458
"last_enabled", "name", "timeout")
830
client_defaults = {
831
"timeout": "PT5M",
832
"extended_timeout": "PT15M",
833
"interval": "PT2M",
834
"checker": "fping -q -- %%(host)s",
835
"host": "",
836
"approval_delay": "PT0S",
837
"approval_duration": "PT1S",
838
"approved_by_default": "True",
839
"enabled": "True",
840
}
841
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
469
842
470
@staticmethod
843
471
def config_parser(config):
844
472
"""Construct a new dict of client settings of this form:
851
479
for client_name in config.sections():
852
480
section = dict(config.items(client_name))
853
481
client = settings[client_name] = {}
854
482
855
483
client["host"] = section["host"]
856
484
# Reformat values from string types to Python types
857
485
client["approved_by_default"] = config.getboolean(
858
486
client_name, "approved_by_default")
859
487
client["enabled"] = config.getboolean(client_name,
860
488
"enabled")
861
489
862
490
# Uppercase and remove spaces from fingerprint for later
863
491
# comparison purposes with return value from the
864
492
# fingerprint() function
865
493
client["fingerprint"] = (section["fingerprint"].upper()
866
494
.replace(" ", ""))
867
495
if "secret" in section:
868
client["secret"] = codecs.decode(section["secret"]
869
.encode("utf-8"),
870
"base64")
496
client["secret"] = section["secret"].decode("base64")
871
497
elif "secfile" in section:
872
498
with open(os.path.expanduser(os.path.expandvars
873
499
(section["secfile"])),
888
514
client["last_approval_request"] = None
889
515
client["last_checked_ok"] = None
890
516
client["last_checker_status"] = -2
891
517
892
518
return settings
893
894
def __init__(self, settings, name=None, server_settings=None):
519
520
def __init__(self, settings, name = None, server_settings=None):
895
521
self.name = name
896
522
if server_settings is None:
897
523
server_settings = {}
899
525
# adding all client settings
900
526
for setting, value in settings.items():
901
527
setattr(self, setting, value)
902
528
903
529
if self.enabled:
904
530
if not hasattr(self, "last_enabled"):
905
531
self.last_enabled = datetime.datetime.utcnow()
909
535
else:
910
536
self.last_enabled = None
911
537
self.expires = None
912
538
913
539
logger.debug("Creating client %r", self.name)
914
540
logger.debug(" Fingerprint: %s", self.fingerprint)
915
541
self.created = settings.get("created",
916
542
datetime.datetime.utcnow())
917
543
918
544
# attributes specific for this server instance
919
545
self.checker = None
920
546
self.checker_initiator_tag = None
923
549
self.current_checker_command = None
924
550
self.approved = None
925
551
self.approvals_pending = 0
926
self.changedstate = multiprocessing_manager.Condition(
927
multiprocessing_manager.Lock())
928
self.client_structure = [attr
929
for attr in self.__dict__.keys()
552
self.changedstate = (multiprocessing_manager
553
.Condition(multiprocessing_manager
554
.Lock()))
555
self.client_structure = [attr for attr in
556
self.__dict__.iterkeys()
930
557
if not attr.startswith("_")]
931
558
self.client_structure.append("client_structure")
932
933
for name, t in inspect.getmembers(
934
type(self), lambda obj: isinstance(obj, property)):
559
560
for name, t in inspect.getmembers(type(self),
561
lambda obj:
562
isinstance(obj,
563
property)):
935
564
if not name.startswith("_"):
936
565
self.client_structure.append(name)
937
566
938
567
# Send notice to process children that client state has changed
939
568
def send_changedstate(self):
940
569
with self.changedstate:
941
570
self.changedstate.notify_all()
942
571
943
572
def enable(self):
944
573
"""Start this client's checker and timeout hooks"""
945
574
if getattr(self, "enabled", False):
950
579
self.last_enabled = datetime.datetime.utcnow()
951
580
self.init_checker()
952
581
self.send_changedstate()
953
582
954
583
def disable(self, quiet=True):
955
584
"""Disable this client."""
956
585
if not getattr(self, "enabled", False):
958
587
if not quiet:
959
588
logger.info("Disabling client %s", self.name)
960
589
if getattr(self, "disable_initiator_tag", None) is not None:
961
GLib.source_remove(self.disable_initiator_tag)
590
gobject.source_remove(self.disable_initiator_tag)
962
591
self.disable_initiator_tag = None
963
592
self.expires = None
964
593
if getattr(self, "checker_initiator_tag", None) is not None:
965
GLib.source_remove(self.checker_initiator_tag)
594
gobject.source_remove(self.checker_initiator_tag)
966
595
self.checker_initiator_tag = None
967
596
self.stop_checker()
968
597
self.enabled = False
969
598
if not quiet:
970
599
self.send_changedstate()
971
# Do not run this again if called by a GLib.timeout_add
600
# Do not run this again if called by a gobject.timeout_add
972
601
return False
973
602
974
603
def __del__(self):
975
604
self.disable()
976
605
977
606
def init_checker(self):
978
607
# Schedule a new checker to be started an 'interval' from now,
979
608
# and every interval from then on.
980
609
if self.checker_initiator_tag is not None:
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
983
int(self.interval.total_seconds() * 1000),
984
self.start_checker)
610
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
612
(int(self.interval
613
.total_seconds() * 1000),
614
self.start_checker))
985
615
# Schedule a disable() when 'timeout' has passed
986
616
if self.disable_initiator_tag is not None:
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
989
int(self.timeout.total_seconds() * 1000), self.disable)
617
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
619
(int(self.timeout
620
.total_seconds() * 1000),
621
self.disable))
990
622
# Also start a new checker *right now*.
991
623
self.start_checker()
992
993
def checker_callback(self, source, condition, connection,
994
command):
624
625
def checker_callback(self, pid, condition, command):
995
626
"""The checker has completed, so take appropriate actions."""
996
627
self.checker_callback_tag = None
997
628
self.checker = None
998
# Read return code from connection (see call_pipe)
999
returncode = connection.recv()
1000
connection.close()
1001
1002
if returncode >= 0:
1003
self.last_checker_status = returncode
1004
self.last_checker_signal = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
1005
631
if self.last_checker_status == 0:
1006
632
logger.info("Checker for %(name)s succeeded",
1007
633
vars(self))
1008
634
self.checked_ok()
1009
635
else:
1010
logger.info("Checker for %(name)s failed", vars(self))
636
logger.info("Checker for %(name)s failed",
637
vars(self))
1011
638
else:
1012
639
self.last_checker_status = -1
1013
self.last_checker_signal = -returncode
1014
640
logger.warning("Checker for %(name)s crashed?",
1015
641
vars(self))
1016
return False
1017
642
1018
643
def checked_ok(self):
1019
644
"""Assert that the client has been seen, alive and well."""
1020
645
self.last_checked_ok = datetime.datetime.utcnow()
1021
646
self.last_checker_status = 0
1022
self.last_checker_signal = None
1023
647
self.bump_timeout()
1024
648
1025
649
def bump_timeout(self, timeout=None):
1026
650
"""Bump up the timeout for this client."""
1027
651
if timeout is None:
1028
652
timeout = self.timeout
1029
653
if self.disable_initiator_tag is not None:
1030
GLib.source_remove(self.disable_initiator_tag)
654
gobject.source_remove(self.disable_initiator_tag)
1031
655
self.disable_initiator_tag = None
1032
656
if getattr(self, "enabled", False):
1033
self.disable_initiator_tag = GLib.timeout_add(
1034
int(timeout.total_seconds() * 1000), self.disable)
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
1035
660
self.expires = datetime.datetime.utcnow() + timeout
1036
661
1037
662
def need_approval(self):
1038
663
self.last_approval_request = datetime.datetime.utcnow()
1039
664
1040
665
def start_checker(self):
1041
666
"""Start a new checker subprocess if one is not running.
1042
667
1043
668
If a checker already exists, leave it running and do
1044
669
nothing."""
1045
670
# The reason for not killing a running checker is that if we
1050
675
# checkers alone, the checker would have to take more time
1051
676
# than 'timeout' for the client to be disabled, which is as it
1052
677
# should be.
1053
1054
if self.checker is not None and not self.checker.is_alive():
1055
logger.warning("Checker was not alive; joining")
1056
self.checker.join()
1057
self.checker = None
678
679
# If a checker exists, make sure it is not a zombie
680
try:
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except AttributeError:
683
pass
684
except OSError as error:
685
if error.errno != errno.ECHILD:
686
raise
687
else:
688
if pid:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
1058
693
# Start a new checker if needed
1059
694
if self.checker is None:
1060
695
# Escape attributes for the shell
1061
escaped_attrs = {
1062
attr: re.escape(str(getattr(self, attr)))
1063
for attr in self.runtime_expansions}
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
1064
699
try:
1065
700
command = self.checker_command % escaped_attrs
1066
701
except TypeError as error:
1067
702
logger.error('Could not format string "%s"',
1068
self.checker_command,
703
self.checker_command, exc_info=error)
704
return True # Try again later
705
self.current_checker_command = command
706
try:
707
logger.info("Starting checker %r for %s",
708
command, self.name)
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
# The exception is when not debugging but nevertheless
714
# running in the foreground; use the previously
715
# created wnull.
716
popen_args = {}
717
if (not self.server_settings["debug"]
718
and self.server_settings["foreground"]):
719
popen_args.update({"stdout": wnull,
720
"stderr": wnull })
721
self.checker = subprocess.Popen(command,
722
close_fds=True,
723
shell=True, cwd="/",
724
**popen_args)
725
except OSError as error:
726
logger.error("Failed to start subprocess",
1069
727
exc_info=error)
1070
return True # Try again later
1071
self.current_checker_command = command
1072
logger.info("Starting checker %r for %s", command,
1073
self.name)
1074
# We don't need to redirect stdout and stderr, since
1075
# in normal mode, that is already done by daemon(),
1076
# and in debug mode we don't want to. (Stdin is
1077
# always replaced by /dev/null.)
1078
# The exception is when not debugging but nevertheless
1079
# running in the foreground; use the previously
1080
# created wnull.
1081
popen_args = {"close_fds": True,
1082
"shell": True,
1083
"cwd": "/"}
1084
if (not self.server_settings["debug"]
1085
and self.server_settings["foreground"]):
1086
popen_args.update({"stdout": wnull,
1087
"stderr": wnull})
1088
pipe = multiprocessing.Pipe(duplex=False)
1089
self.checker = multiprocessing.Process(
1090
target=call_pipe,
1091
args=(pipe[1], subprocess.call, command),
1092
kwargs=popen_args)
1093
self.checker.start()
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1096
self.checker_callback, pipe[0], command)
1097
# Re-run this periodically if run by GLib.timeout_add
728
return True
729
self.checker_callback_tag = (gobject.child_watch_add
730
(self.checker.pid,
731
self.checker_callback,
732
data=command))
733
# The checker may have completed before the gobject
734
# watch was added. Check for this.
735
try:
736
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
737
except OSError as error:
738
if error.errno == errno.ECHILD:
739
# This should never happen
740
logger.error("Child process vanished",
741
exc_info=error)
742
return True
743
raise
744
if pid:
745
gobject.source_remove(self.checker_callback_tag)
746
self.checker_callback(pid, status, command)
747
# Re-run this periodically if run by gobject.timeout_add
1098
748
return True
1099
749
1100
750
def stop_checker(self):
1101
751
"""Force the checker process, if any, to stop."""
1102
752
if self.checker_callback_tag:
1103
GLib.source_remove(self.checker_callback_tag)
753
gobject.source_remove(self.checker_callback_tag)
1104
754
self.checker_callback_tag = None
1105
755
if getattr(self, "checker", None) is None:
1106
756
return
1107
757
logger.debug("Stopping checker for %(name)s", vars(self))
1108
self.checker.terminate()
758
try:
759
self.checker.terminate()
760
#time.sleep(0.5)
761
#if self.checker.poll() is None:
762
# self.checker.kill()
763
except OSError as error:
764
if error.errno != errno.ESRCH: # No such process
765
raise
1109
766
self.checker = None
1110
767
1111
768
1112
def dbus_service_property(dbus_interface,
1113
signature="v",
1114
access="readwrite",
1115
byte_arrays=False):
769
def dbus_service_property(dbus_interface, signature="v",
770
access="readwrite", byte_arrays=False):
1116
771
"""Decorators for marking methods of a DBusObjectWithProperties to
1117
772
become properties on the D-Bus.
1118
773
1119
774
The decorated method will be called with no arguments by "Get"
1120
775
and with one argument by "Set".
1121
776
1122
777
The parameters, where they are supported, are the same as
1123
778
dbus.service.method, except there is only "signature", since the
1124
779
type from Get() and the type sent to Set() is the same.
1128
783
if byte_arrays and signature != "ay":
1129
784
raise ValueError("Byte arrays not supported for non-'ay'"
1130
785
" signature {!r}".format(signature))
1131
1132
786
def decorator(func):
1133
787
func._dbus_is_property = True
1134
788
func._dbus_interface = dbus_interface
1137
791
func._dbus_name = func.__name__
1138
792
if func._dbus_name.endswith("_dbus_property"):
1139
793
func._dbus_name = func._dbus_name[:-14]
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
794
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1141
795
return func
1142
1143
796
return decorator
1144
797
1145
798
1146
799
def dbus_interface_annotations(dbus_interface):
1147
800
"""Decorator for marking functions returning interface annotations
1148
801
1149
802
Usage:
1150
803
1151
804
@dbus_interface_annotations("org.example.Interface")
1152
805
def _foo(self): # Function name does not matter
1153
806
return {"org.freedesktop.DBus.Deprecated": "true",
1154
807
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1155
808
"false"}
1156
809
"""
1157
1158
810
def decorator(func):
1159
811
func._dbus_is_interface = True
1160
812
func._dbus_interface = dbus_interface
1161
813
func._dbus_name = dbus_interface
1162
814
return func
1163
1164
815
return decorator
1165
816
1166
817
1167
818
def dbus_annotations(annotations):
1168
819
"""Decorator to annotate D-Bus methods, signals or properties
1169
820
Usage:
1170
821
1171
822
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1172
823
"org.freedesktop.DBus.Property."
1173
824
"EmitsChangedSignal": "false"})
1175
826
access="r")
1176
827
def Property_dbus_property(self):
1177
828
return dbus.Boolean(False)
1178
1179
See also the DBusObjectWithAnnotations class.
1180
829
"""
1181
1182
830
def decorator(func):
1183
831
func._dbus_annotations = annotations
1184
832
return func
1185
1186
833
return decorator
1187
834
1188
835
1191
838
"""
1192
839
pass
1193
840
1194
1195
841
class DBusPropertyAccessException(DBusPropertyException):
1196
842
"""A property's access permissions disallows an operation.
1197
843
"""
1204
850
pass
1205
851
1206
852
1207
class DBusObjectWithAnnotations(dbus.service.Object):
1208
"""A D-Bus object with annotations.
1209
1210
Classes inheriting from this can use the dbus_annotations
1211
decorator to add annotations to methods or signals.
853
class DBusObjectWithProperties(dbus.service.Object):
854
"""A D-Bus object with properties.
855
856
Classes inheriting from this can use the dbus_service_property
857
decorator to expose methods as D-Bus properties. It exposes the
858
standard Get(), Set(), and GetAll() methods on the D-Bus.
1212
859
"""
1213
860
1214
861
@staticmethod
1215
862
def _is_dbus_thing(thing):
1216
863
"""Returns a function testing if an attribute is a D-Bus thing
1217
864
1218
865
If called like _is_dbus_thing("method") it returns a function
1219
866
suitable for use as predicate to inspect.getmembers().
1220
867
"""
1221
868
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1222
869
False)
1223
870
1224
871
def _get_all_dbus_things(self, thing):
1225
872
"""Returns a generator of (name, attribute) pairs
1226
873
"""
1227
return ((getattr(athing.__get__(self), "_dbus_name", name),
874
return ((getattr(athing.__get__(self), "_dbus_name",
875
name),
1228
876
athing.__get__(self))
1229
877
for cls in self.__class__.__mro__
1230
878
for name, athing in
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1232
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1234
out_signature="s",
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1237
def Introspect(self, object_path, connection):
1238
"""Overloading of standard D-Bus method.
1239
1240
Inserts annotation tags on methods and signals.
1241
"""
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1243
connection)
1244
try:
1245
document = xml.dom.minidom.parseString(xmlstring)
1246
1247
for if_tag in document.getElementsByTagName("interface"):
1248
# Add annotation tags
1249
for typ in ("method", "signal"):
1250
for tag in if_tag.getElementsByTagName(typ):
1251
annots = dict()
1252
for name, prop in (self.
1253
_get_all_dbus_things(typ)):
1254
if (name == tag.getAttribute("name")
1255
and prop._dbus_interface
1256
== if_tag.getAttribute("name")):
1257
annots.update(getattr(
1258
prop, "_dbus_annotations", {}))
1259
for name, value in annots.items():
1260
ann_tag = document.createElement(
1261
"annotation")
1262
ann_tag.setAttribute("name", name)
1263
ann_tag.setAttribute("value", value)
1264
tag.appendChild(ann_tag)
1265
# Add interface annotation tags
1266
for annotation, value in dict(
1267
itertools.chain.from_iterable(
1268
annotations().items()
1269
for name, annotations
1270
in self._get_all_dbus_things("interface")
1271
if name == if_tag.getAttribute("name")
1272
)).items():
1273
ann_tag = document.createElement("annotation")
1274
ann_tag.setAttribute("name", annotation)
1275
ann_tag.setAttribute("value", value)
1276
if_tag.appendChild(ann_tag)
1277
# Fix argument name for the Introspect method itself
1278
if (if_tag.getAttribute("name")
1279
== dbus.INTROSPECTABLE_IFACE):
1280
for cn in if_tag.getElementsByTagName("method"):
1281
if cn.getAttribute("name") == "Introspect":
1282
for arg in cn.getElementsByTagName("arg"):
1283
if (arg.getAttribute("direction")
1284
== "out"):
1285
arg.setAttribute("name",
1286
"xml_data")
1287
xmlstring = document.toxml("utf-8")
1288
document.unlink()
1289
except (AttributeError, xml.dom.DOMException,
1290
xml.parsers.expat.ExpatError) as error:
1291
logger.error("Failed to override Introspection method",
1292
exc_info=error)
1293
return xmlstring
1294
1295
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1297
"""A D-Bus object with properties.
1298
1299
Classes inheriting from this can use the dbus_service_property
1300
decorator to expose methods as D-Bus properties. It exposes the
1301
standard Get(), Set(), and GetAll() methods on the D-Bus.
1302
"""
1303
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
881
1304
882
def _get_dbus_property(self, interface_name, property_name):
1305
883
"""Returns a bound method if one exists which is a D-Bus
1306
884
property with the specified name and interface.
1307
885
"""
1308
for cls in self.__class__.__mro__:
1309
for name, value in inspect.getmembers(
1310
cls, self._is_dbus_thing("property")):
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
888
(cls,
889
self._is_dbus_thing("property"))):
1311
890
if (value._dbus_name == property_name
1312
891
and value._dbus_interface == interface_name):
1313
892
return value.__get__(self)
1314
893
1315
894
# No such property
1316
raise DBusPropertyNotFound("{}:{}.{}".format(
1317
self.dbus_object_path, interface_name, property_name))
1318
1319
@classmethod
1320
def _get_all_interface_names(cls):
1321
"""Get a sequence of all interfaces supported by an object"""
1322
return (name for name in set(getattr(getattr(x, attr),
1323
"_dbus_interface", None)
1324
for x in (inspect.getmro(cls))
1325
for attr in dir(x))
1326
if name is not None)
1327
1328
@dbus.service.method(dbus.PROPERTIES_IFACE,
1329
in_signature="ss",
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
897
+ property_name)
898
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1330
900
out_signature="v")
1331
901
def Get(self, interface_name, property_name):
1332
902
"""Standard D-Bus property Get() method, see D-Bus standard.
1338
908
if not hasattr(value, "variant_level"):
1339
909
return value
1340
910
return type(value)(value, variant_level=value.variant_level+1)
1341
911
1342
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
1343
913
def Set(self, interface_name, property_name, value):
1344
914
"""Standard D-Bus property Set() method, see D-Bus standard.
1356
926
value = dbus.ByteArray(b''.join(chr(byte)
1357
927
for byte in value))
1358
928
prop(value)
1359
1360
@dbus.service.method(dbus.PROPERTIES_IFACE,
1361
in_signature="s",
929
930
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1362
931
out_signature="a{sv}")
1363
932
def GetAll(self, interface_name):
1364
933
"""Standard D-Bus property GetAll() method, see D-Bus
1365
934
standard.
1366
935
1367
936
Note: Will not include properties with access="write".
1368
937
"""
1369
938
properties = {}
1379
948
if not hasattr(value, "variant_level"):
1380
949
properties[name] = value
1381
950
continue
1382
properties[name] = type(value)(
1383
value, variant_level=value.variant_level + 1)
951
properties[name] = type(value)(value, variant_level=
952
value.variant_level+1)
1384
953
return dbus.Dictionary(properties, signature="sv")
1385
954
1386
955
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1387
956
def PropertiesChanged(self, interface_name, changed_properties,
1388
957
invalidated_properties):
1390
959
standard.
1391
960
"""
1392
961
pass
1393
962
1394
963
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1395
964
out_signature="s",
1396
965
path_keyword='object_path',
1397
966
connection_keyword='connection')
1398
967
def Introspect(self, object_path, connection):
1399
968
"""Overloading of standard D-Bus method.
1400
969
1401
970
Inserts property tags and interface annotation tags.
1402
971
"""
1403
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1404
object_path,
1405
connection)
972
xmlstring = dbus.service.Object.Introspect(self, object_path,
973
connection)
1406
974
try:
1407
975
document = xml.dom.minidom.parseString(xmlstring)
1408
1409
976
def make_tag(document, name, prop):
1410
977
e = document.createElement("property")
1411
978
e.setAttribute("name", name)
1412
979
e.setAttribute("type", prop._dbus_signature)
1413
980
e.setAttribute("access", prop._dbus_access)
1414
981
return e
1415
1416
982
for if_tag in document.getElementsByTagName("interface"):
1417
983
# Add property tags
1418
984
for tag in (make_tag(document, name, prop)
1421
987
if prop._dbus_interface
1422
988
== if_tag.getAttribute("name")):
1423
989
if_tag.appendChild(tag)
1424
# Add annotation tags for properties
1425
for tag in if_tag.getElementsByTagName("property"):
1426
annots = dict()
1427
for name, prop in self._get_all_dbus_things(
1428
"property"):
1429
if (name == tag.getAttribute("name")
1430
and prop._dbus_interface
1431
== if_tag.getAttribute("name")):
1432
annots.update(getattr(
1433
prop, "_dbus_annotations", {}))
1434
for name, value in annots.items():
1435
ann_tag = document.createElement(
1436
"annotation")
1437
ann_tag.setAttribute("name", name)
1438
ann_tag.setAttribute("value", value)
1439
tag.appendChild(ann_tag)
990
# Add annotation tags
991
for typ in ("method", "signal", "property"):
992
for tag in if_tag.getElementsByTagName(typ):
993
annots = dict()
994
for name, prop in (self.
995
_get_all_dbus_things(typ)):
996
if (name == tag.getAttribute("name")
997
and prop._dbus_interface
998
== if_tag.getAttribute("name")):
999
annots.update(getattr
1000
(prop,
1001
"_dbus_annotations",
1002
{}))
1003
for name, value in annots.items():
1004
ann_tag = document.createElement(
1005
"annotation")
1006
ann_tag.setAttribute("name", name)
1007
ann_tag.setAttribute("value", value)
1008
tag.appendChild(ann_tag)
1009
# Add interface annotation tags
1010
for annotation, value in dict(
1011
itertools.chain.from_iterable(
1012
annotations().items()
1013
for name, annotations in
1014
self._get_all_dbus_things("interface")
1015
if name == if_tag.getAttribute("name")
1016
)).items():
1017
ann_tag = document.createElement("annotation")
1018
ann_tag.setAttribute("name", annotation)
1019
ann_tag.setAttribute("value", value)
1020
if_tag.appendChild(ann_tag)
1440
1021
# Add the names to the return values for the
1441
1022
# "org.freedesktop.DBus.Properties" methods
1442
1023
if (if_tag.getAttribute("name")
1461
1042
return xmlstring
1462
1043
1463
1044
1464
try:
1465
dbus.OBJECT_MANAGER_IFACE
1466
except AttributeError:
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1468
1469
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
"""A D-Bus object with an ObjectManager.
1472
1473
Classes inheriting from this exposes the standard
1474
GetManagedObjects call and the InterfacesAdded and
1475
InterfacesRemoved signals on the standard
1476
"org.freedesktop.DBus.ObjectManager" interface.
1477
1478
Note: No signals are sent automatically; they must be sent
1479
manually.
1480
"""
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1483
def GetManagedObjects(self):
1484
"""This function must be overridden"""
1485
raise NotImplementedError()
1486
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1490
pass
1491
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1493
def InterfacesRemoved(self, object_path, interfaces):
1494
pass
1495
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1497
out_signature="s",
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1500
def Introspect(self, object_path, connection):
1501
"""Overloading of standard D-Bus method.
1502
1503
Override return argument name of GetManagedObjects to be
1504
"objpath_interfaces_and_properties"
1505
"""
1506
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1507
object_path,
1508
connection)
1509
try:
1510
document = xml.dom.minidom.parseString(xmlstring)
1511
1512
for if_tag in document.getElementsByTagName("interface"):
1513
# Fix argument name for the GetManagedObjects method
1514
if (if_tag.getAttribute("name")
1515
== dbus.OBJECT_MANAGER_IFACE):
1516
for cn in if_tag.getElementsByTagName("method"):
1517
if (cn.getAttribute("name")
1518
== "GetManagedObjects"):
1519
for arg in cn.getElementsByTagName("arg"):
1520
if (arg.getAttribute("direction")
1521
== "out"):
1522
arg.setAttribute(
1523
"name",
1524
"objpath_interfaces"
1525
"_and_properties")
1526
xmlstring = document.toxml("utf-8")
1527
document.unlink()
1528
except (AttributeError, xml.dom.DOMException,
1529
xml.parsers.expat.ExpatError) as error:
1530
logger.error("Failed to override Introspection method",
1531
exc_info=error)
1532
return xmlstring
1533
1534
1535
1045
def datetime_to_dbus(dt, variant_level=0):
1536
1046
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1537
1047
if dt is None:
1538
return dbus.String("", variant_level=variant_level)
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1048
return dbus.String("", variant_level = variant_level)
1049
return dbus.String(dt.isoformat(),
1050
variant_level=variant_level)
1540
1051
1541
1052
1542
1053
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1544
1055
dbus.service.Object, it will add alternate D-Bus attributes with
1545
1056
interface names according to the "alt_interface_names" mapping.
1546
1057
Usage:
1547
1058
1548
1059
@alternate_dbus_interfaces({"org.example.Interface":
1549
1060
"net.example.AlternateInterface"})
1550
1061
class SampleDBusObject(dbus.service.Object):
1551
1062
@dbus.service.method("org.example.Interface")
1552
1063
def SampleDBusMethod():
1553
1064
pass
1554
1065
1555
1066
The above "SampleDBusMethod" on "SampleDBusObject" will be
1556
1067
reachable via two interfaces: "org.example.Interface" and
1557
1068
"net.example.AlternateInterface", the latter of which will have
1558
1069
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1559
1070
"true", unless "deprecate" is passed with a False value.
1560
1071
1561
1072
This works for methods and signals, and also for D-Bus properties
1562
1073
(from DBusObjectWithProperties) and interfaces (from the
1563
1074
dbus_interface_annotations decorator).
1564
1075
"""
1565
1566
1076
def wrapper(cls):
1567
1077
for orig_interface_name, alt_interface_name in (
1568
alt_interface_names.items()):
1078
alt_interface_names.items()):
1569
1079
attr = {}
1570
1080
interface_names = set()
1571
1081
# Go though all attributes of the class
1573
1083
# Ignore non-D-Bus attributes, and D-Bus attributes
1574
1084
# with the wrong interface name
1575
1085
if (not hasattr(attribute, "_dbus_interface")
1576
or not attribute._dbus_interface.startswith(
1577
orig_interface_name)):
1086
or not attribute._dbus_interface
1087
.startswith(orig_interface_name)):
1578
1088
continue
1579
1089
# Create an alternate D-Bus interface name based on
1580
1090
# the current name
1581
alt_interface = attribute._dbus_interface.replace(
1582
orig_interface_name, alt_interface_name)
1091
alt_interface = (attribute._dbus_interface
1092
.replace(orig_interface_name,
1093
alt_interface_name))
1583
1094
interface_names.add(alt_interface)
1584
1095
# Is this a D-Bus signal?
1585
1096
if getattr(attribute, "_dbus_is_signal", False):
1586
1097
# Extract the original non-method undecorated
1587
1098
# function by black magic
1588
if sys.version_info.major == 2:
1589
nonmethod_func = (dict(
1099
nonmethod_func = (dict(
1590
1100
zip(attribute.func_code.co_freevars,
1591
attribute.__closure__))
1592
["func"].cell_contents)
1593
else:
1594
nonmethod_func = (dict(
1595
zip(attribute.__code__.co_freevars,
1596
attribute.__closure__))
1597
["func"].cell_contents)
1101
attribute.__closure__))["func"]
1102
.cell_contents)
1598
1103
# Create a new, but exactly alike, function
1599
1104
# object, and decorate it to be a new D-Bus signal
1600
1105
# with the alternate D-Bus interface name
1601
new_function = copy_function(nonmethod_func)
1602
new_function = (dbus.service.signal(
1603
alt_interface,
1604
attribute._dbus_signature)(new_function))
1106
new_function = (dbus.service.signal
1107
(alt_interface,
1108
attribute._dbus_signature)
1109
(types.FunctionType(
1110
nonmethod_func.func_code,
1111
nonmethod_func.func_globals,
1112
nonmethod_func.func_name,
1113
nonmethod_func.func_defaults,
1114
nonmethod_func.func_closure)))
1605
1115
# Copy annotations, if any
1606
1116
try:
1607
new_function._dbus_annotations = dict(
1608
attribute._dbus_annotations)
1117
new_function._dbus_annotations = (
1118
dict(attribute._dbus_annotations))
1609
1119
except AttributeError:
1610
1120
pass
1611
1612
1121
# Define a creator of a function to call both the
1613
1122
# original and alternate functions, so both the
1614
1123
# original and alternate signals gets sent when
1617
1126
"""This function is a scope container to pass
1618
1127
func1 and func2 to the "call_both" function
1619
1128
outside of its arguments"""
1620
1621
@functools.wraps(func2)
1622
1129
def call_both(*args, **kwargs):
1623
1130
"""This function will emit two D-Bus
1624
1131
signals by calling func1 and func2"""
1625
1132
func1(*args, **kwargs)
1626
1133
func2(*args, **kwargs)
1627
# Make wrapper function look like a D-Bus
1628
# signal
1629
for name, attr in inspect.getmembers(func2):
1630
if name.startswith("_dbus_"):
1631
setattr(call_both, name, attr)
1632
1633
1134
return call_both
1634
1135
# Create the "call_both" function and add it to
1635
1136
# the class
1640
1141
# object. Decorate it to be a new D-Bus method
1641
1142
# with the alternate D-Bus interface name. Add it
1642
1143
# to the class.
1643
attr[attrname] = (
1644
dbus.service.method(
1645
alt_interface,
1646
attribute._dbus_in_signature,
1647
attribute._dbus_out_signature)
1648
(copy_function(attribute)))
1144
attr[attrname] = (dbus.service.method
1145
(alt_interface,
1146
attribute._dbus_in_signature,
1147
attribute._dbus_out_signature)
1148
(types.FunctionType
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1649
1154
# Copy annotations, if any
1650
1155
try:
1651
attr[attrname]._dbus_annotations = dict(
1652
attribute._dbus_annotations)
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1653
1158
except AttributeError:
1654
1159
pass
1655
1160
# Is this a D-Bus property?
1658
1163
# object, and decorate it to be a new D-Bus
1659
1164
# property with the alternate D-Bus interface
1660
1165
# name. Add it to the class.
1661
attr[attrname] = (dbus_service_property(
1662
alt_interface, attribute._dbus_signature,
1663
attribute._dbus_access,
1664
attribute._dbus_get_args_options
1665
["byte_arrays"])
1666
(copy_function(attribute)))
1166
attr[attrname] = (dbus_service_property
1167
(alt_interface,
1168
attribute._dbus_signature,
1169
attribute._dbus_access,
1170
attribute
1171
._dbus_get_args_options
1172
["byte_arrays"])
1173
(types.FunctionType
1174
(attribute.func_code,
1175
attribute.func_globals,
1176
attribute.func_name,
1177
attribute.func_defaults,
1178
attribute.func_closure)))
1667
1179
# Copy annotations, if any
1668
1180
try:
1669
attr[attrname]._dbus_annotations = dict(
1670
attribute._dbus_annotations)
1181
attr[attrname]._dbus_annotations = (
1182
dict(attribute._dbus_annotations))
1671
1183
except AttributeError:
1672
1184
pass
1673
1185
# Is this a D-Bus interface?
1676
1188
# object. Decorate it to be a new D-Bus interface
1677
1189
# with the alternate D-Bus interface name. Add it
1678
1190
# to the class.
1679
attr[attrname] = (
1680
dbus_interface_annotations(alt_interface)
1681
(copy_function(attribute)))
1191
attr[attrname] = (dbus_interface_annotations
1192
(alt_interface)
1193
(types.FunctionType
1194
(attribute.func_code,
1195
attribute.func_globals,
1196
attribute.func_name,
1197
attribute.func_defaults,
1198
attribute.func_closure)))
1682
1199
if deprecate:
1683
1200
# Deprecate all alternate interfaces
1684
iname = "_AlternateDBusNames_interface_annotation{}"
1201
iname="_AlternateDBusNames_interface_annotation{}"
1685
1202
for interface_name in interface_names:
1686
1687
1203
@dbus_interface_annotations(interface_name)
1688
1204
def func(self):
1689
return {"org.freedesktop.DBus.Deprecated":
1690
"true"}
1205
return { "org.freedesktop.DBus.Deprecated":
1206
"true" }
1691
1207
# Find an unused name
1692
1208
for aname in (iname.format(i)
1693
1209
for i in itertools.count()):
1697
1213
if interface_names:
1698
1214
# Replace the class with a new subclass of it with
1699
1215
# methods, signals, etc. as created above.
1700
if sys.version_info.major == 2:
1701
cls = type(b"{}Alternate".format(cls.__name__),
1702
(cls, ), attr)
1703
else:
1704
cls = type("{}Alternate".format(cls.__name__),
1705
(cls, ), attr)
1216
cls = type(b"{}Alternate".format(cls.__name__),
1217
(cls,), attr)
1706
1218
return cls
1707
1708
1219
return wrapper
1709
1220
1710
1221
1711
1222
@alternate_dbus_interfaces({"se.recompile.Mandos":
1712
"se.bsnet.fukt.Mandos"})
1223
"se.bsnet.fukt.Mandos"})
1713
1224
class ClientDBus(Client, DBusObjectWithProperties):
1714
1225
"""A Client class using D-Bus
1715
1226
1716
1227
Attributes:
1717
1228
dbus_object_path: dbus.ObjectPath
1718
1229
bus: dbus.SystemBus()
1719
1230
"""
1720
1231
1721
1232
runtime_expansions = (Client.runtime_expansions
1722
+ ("dbus_object_path", ))
1723
1233
+ ("dbus_object_path",))
1234
1724
1235
_interface = "se.recompile.Mandos.Client"
1725
1236
1726
1237
# dbus.service.Object doesn't use super(), so we can't either.
1727
1728
def __init__(self, bus=None, *args, **kwargs):
1238
1239
def __init__(self, bus = None, *args, **kwargs):
1729
1240
self.bus = bus
1730
1241
Client.__init__(self, *args, **kwargs)
1731
1242
# Only now, when this client is initialized, can it show up on
1733
1244
client_object_name = str(self.name).translate(
1734
1245
{ord("."): ord("_"),
1735
1246
ord("-"): ord("_")})
1736
self.dbus_object_path = dbus.ObjectPath(
1737
"/clients/" + client_object_name)
1247
self.dbus_object_path = (dbus.ObjectPath
1248
("/clients/" + client_object_name))
1738
1249
DBusObjectWithProperties.__init__(self, self.bus,
1739
1250
self.dbus_object_path)
1740
1741
def notifychangeproperty(transform_func, dbus_name,
1742
type_func=lambda x: x,
1743
variant_level=1,
1744
invalidate_only=False,
1251
1252
def notifychangeproperty(transform_func,
1253
dbus_name, type_func=lambda x: x,
1254
variant_level=1, invalidate_only=False,
1745
1255
_interface=_interface):
1746
1256
""" Modify a variable so that it's a property which announces
1747
1257
its changes to DBus.
1748
1258
1749
1259
transform_fun: Function that takes a value and a variant_level
1750
1260
and transforms it to a D-Bus type.
1751
1261
dbus_name: D-Bus name of the variable
1754
1264
variant_level: D-Bus variant level. Default: 1
1755
1265
"""
1756
1266
attrname = "_{}".format(dbus_name)
1757
1758
1267
def setter(self, value):
1759
1268
if hasattr(self, "dbus_object_path"):
1760
1269
if (not hasattr(self, attrname) or
1761
1270
type_func(getattr(self, attrname, None))
1762
1271
!= type_func(value)):
1763
1272
if invalidate_only:
1764
self.PropertiesChanged(
1765
_interface, dbus.Dictionary(),
1766
dbus.Array((dbus_name, )))
1273
self.PropertiesChanged(_interface,
1274
dbus.Dictionary(),
1275
dbus.Array
1276
((dbus_name,)))
1767
1277
else:
1768
dbus_value = transform_func(
1769
type_func(value),
1770
variant_level=variant_level)
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1771
1281
self.PropertyChanged(dbus.String(dbus_name),
1772
1282
dbus_value)
1773
self.PropertiesChanged(
1774
_interface,
1775
dbus.Dictionary({dbus.String(dbus_name):
1776
dbus_value}),
1777
dbus.Array())
1283
self.PropertiesChanged(_interface,
1284
dbus.Dictionary({
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1778
1287
setattr(self, attrname, value)
1779
1288
1780
1289
return property(lambda self: getattr(self, attrname), setter)
1781
1290
1782
1291
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1783
1292
approvals_pending = notifychangeproperty(dbus.Boolean,
1784
1293
"ApprovalPending",
1785
type_func=bool)
1294
type_func = bool)
1786
1295
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1787
1296
last_enabled = notifychangeproperty(datetime_to_dbus,
1788
1297
"LastEnabled")
1789
checker = notifychangeproperty(
1790
dbus.Boolean, "CheckerRunning",
1791
type_func=lambda checker: checker is not None)
1298
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
type_func = lambda checker:
1300
checker is not None)
1792
1301
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1793
1302
"LastCheckedOK")
1794
1303
last_checker_status = notifychangeproperty(dbus.Int16,
1797
1306
datetime_to_dbus, "LastApprovalRequest")
1798
1307
approved_by_default = notifychangeproperty(dbus.Boolean,
1799
1308
"ApprovedByDefault")
1800
approval_delay = notifychangeproperty(
1801
dbus.UInt64, "ApprovalDelay",
1802
type_func=lambda td: td.total_seconds() * 1000)
1309
approval_delay = notifychangeproperty(dbus.UInt64,
1310
"ApprovalDelay",
1311
type_func =
1312
lambda td: td.total_seconds()
1313
* 1000)
1803
1314
approval_duration = notifychangeproperty(
1804
1315
dbus.UInt64, "ApprovalDuration",
1805
type_func=lambda td: td.total_seconds() * 1000)
1316
type_func = lambda td: td.total_seconds() * 1000)
1806
1317
host = notifychangeproperty(dbus.String, "Host")
1807
timeout = notifychangeproperty(
1808
dbus.UInt64, "Timeout",
1809
type_func=lambda td: td.total_seconds() * 1000)
1318
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1319
type_func = lambda td:
1320
td.total_seconds() * 1000)
1810
1321
extended_timeout = notifychangeproperty(
1811
1322
dbus.UInt64, "ExtendedTimeout",
1812
type_func=lambda td: td.total_seconds() * 1000)
1813
interval = notifychangeproperty(
1814
dbus.UInt64, "Interval",
1815
type_func=lambda td: td.total_seconds() * 1000)
1323
type_func = lambda td: td.total_seconds() * 1000)
1324
interval = notifychangeproperty(dbus.UInt64,
1325
"Interval",
1326
type_func =
1327
lambda td: td.total_seconds()
1328
* 1000)
1816
1329
checker_command = notifychangeproperty(dbus.String, "Checker")
1817
1330
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1818
1331
invalidate_only=True)
1819
1332
1820
1333
del notifychangeproperty
1821
1334
1822
1335
def __del__(self, *args, **kwargs):
1823
1336
try:
1824
1337
self.remove_from_connection()
1827
1340
if hasattr(DBusObjectWithProperties, "__del__"):
1828
1341
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1829
1342
Client.__del__(self, *args, **kwargs)
1830
1831
def checker_callback(self, source, condition,
1832
connection, command, *args, **kwargs):
1833
ret = Client.checker_callback(self, source, condition,
1834
connection, command, *args,
1835
**kwargs)
1836
exitstatus = self.last_checker_status
1837
if exitstatus >= 0:
1343
1344
def checker_callback(self, pid, condition, command,
1345
*args, **kwargs):
1346
self.checker_callback_tag = None
1347
self.checker = None
1348
if os.WIFEXITED(condition):
1349
exitstatus = os.WEXITSTATUS(condition)
1838
1350
# Emit D-Bus signal
1839
1351
self.CheckerCompleted(dbus.Int16(exitstatus),
1840
# This is specific to GNU libC
1841
dbus.Int64(exitstatus << 8),
1352
dbus.Int64(condition),
1842
1353
dbus.String(command))
1843
1354
else:
1844
1355
# Emit D-Bus signal
1845
1356
self.CheckerCompleted(dbus.Int16(-1),
1846
dbus.Int64(
1847
# This is specific to GNU libC
1848
(exitstatus << 8)
1849
| self.last_checker_signal),
1357
dbus.Int64(condition),
1850
1358
dbus.String(command))
1851
return ret
1852
1359
1360
return Client.checker_callback(self, pid, condition, command,
1361
*args, **kwargs)
1362
1853
1363
def start_checker(self, *args, **kwargs):
1854
1364
old_checker_pid = getattr(self.checker, "pid", None)
1855
1365
r = Client.start_checker(self, *args, **kwargs)
1859
1369
# Emit D-Bus signal
1860
1370
self.CheckerStarted(self.current_checker_command)
1861
1371
return r
1862
1372
1863
1373
def _reset_approved(self):
1864
1374
self.approved = None
1865
1375
return False
1866
1376
1867
1377
def approve(self, value=True):
1868
1378
self.approved = value
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
1379
gobject.timeout_add(int(self.approval_duration.total_seconds()
1380
* 1000), self._reset_approved)
1871
1381
self.send_changedstate()
1872
1873
# D-Bus methods, signals & properties
1874
1875
# Interfaces
1876
1877
# Signals
1878
1382
1383
## D-Bus methods, signals & properties
1384
1385
## Interfaces
1386
1387
## Signals
1388
1879
1389
# CheckerCompleted - signal
1880
1390
@dbus.service.signal(_interface, signature="nxs")
1881
1391
def CheckerCompleted(self, exitcode, waitstatus, command):
1882
1392
"D-Bus signal"
1883
1393
pass
1884
1394
1885
1395
# CheckerStarted - signal
1886
1396
@dbus.service.signal(_interface, signature="s")
1887
1397
def CheckerStarted(self, command):
1888
1398
"D-Bus signal"
1889
1399
pass
1890
1400
1891
1401
# PropertyChanged - signal
1892
1402
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1893
1403
@dbus.service.signal(_interface, signature="sv")
1894
1404
def PropertyChanged(self, property, value):
1895
1405
"D-Bus signal"
1896
1406
pass
1897
1407
1898
1408
# GotSecret - signal
1899
1409
@dbus.service.signal(_interface)
1900
1410
def GotSecret(self):
1903
1413
server to mandos-client
1904
1414
"""
1905
1415
pass
1906
1416
1907
1417
# Rejected - signal
1908
1418
@dbus.service.signal(_interface, signature="s")
1909
1419
def Rejected(self, reason):
1910
1420
"D-Bus signal"
1911
1421
pass
1912
1422
1913
1423
# NeedApproval - signal
1914
1424
@dbus.service.signal(_interface, signature="tb")
1915
1425
def NeedApproval(self, timeout, default):
1916
1426
"D-Bus signal"
1917
1427
return self.need_approval()
1918
1919
# Methods
1920
1428
1429
## Methods
1430
1921
1431
# Approve - method
1922
1432
@dbus.service.method(_interface, in_signature="b")
1923
1433
def Approve(self, value):
1924
1434
self.approve(value)
1925
1435
1926
1436
# CheckedOK - method
1927
1437
@dbus.service.method(_interface)
1928
1438
def CheckedOK(self):
1929
1439
self.checked_ok()
1930
1440
1931
1441
# Enable - method
1932
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1933
1442
@dbus.service.method(_interface)
1934
1443
def Enable(self):
1935
1444
"D-Bus method"
1936
1445
self.enable()
1937
1446
1938
1447
# StartChecker - method
1939
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1940
1448
@dbus.service.method(_interface)
1941
1449
def StartChecker(self):
1942
1450
"D-Bus method"
1943
1451
self.start_checker()
1944
1452
1945
1453
# Disable - method
1946
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1947
1454
@dbus.service.method(_interface)
1948
1455
def Disable(self):
1949
1456
"D-Bus method"
1950
1457
self.disable()
1951
1458
1952
1459
# StopChecker - method
1953
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1954
1460
@dbus.service.method(_interface)
1955
1461
def StopChecker(self):
1956
1462
self.stop_checker()
1957
1958
# Properties
1959
1463
1464
## Properties
1465
1960
1466
# ApprovalPending - property
1961
1467
@dbus_service_property(_interface, signature="b", access="read")
1962
1468
def ApprovalPending_dbus_property(self):
1963
1469
return dbus.Boolean(bool(self.approvals_pending))
1964
1470
1965
1471
# ApprovedByDefault - property
1966
@dbus_service_property(_interface,
1967
signature="b",
1472
@dbus_service_property(_interface, signature="b",
1968
1473
access="readwrite")
1969
1474
def ApprovedByDefault_dbus_property(self, value=None):
1970
1475
if value is None: # get
1971
1476
return dbus.Boolean(self.approved_by_default)
1972
1477
self.approved_by_default = bool(value)
1973
1478
1974
1479
# ApprovalDelay - property
1975
@dbus_service_property(_interface,
1976
signature="t",
1480
@dbus_service_property(_interface, signature="t",
1977
1481
access="readwrite")
1978
1482
def ApprovalDelay_dbus_property(self, value=None):
1979
1483
if value is None: # get
1980
1484
return dbus.UInt64(self.approval_delay.total_seconds()
1981
1485
* 1000)
1982
1486
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1983
1487
1984
1488
# ApprovalDuration - property
1985
@dbus_service_property(_interface,
1986
signature="t",
1489
@dbus_service_property(_interface, signature="t",
1987
1490
access="readwrite")
1988
1491
def ApprovalDuration_dbus_property(self, value=None):
1989
1492
if value is None: # get
1990
1493
return dbus.UInt64(self.approval_duration.total_seconds()
1991
1494
* 1000)
1992
1495
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1993
1496
1994
1497
# Name - property
1995
@dbus_annotations(
1996
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1997
1498
@dbus_service_property(_interface, signature="s", access="read")
1998
1499
def Name_dbus_property(self):
1999
1500
return dbus.String(self.name)
2000
1501
2001
1502
# Fingerprint - property
2002
@dbus_annotations(
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2004
1503
@dbus_service_property(_interface, signature="s", access="read")
2005
1504
def Fingerprint_dbus_property(self):
2006
1505
return dbus.String(self.fingerprint)
2007
1506
2008
1507
# Host - property
2009
@dbus_service_property(_interface,
2010
signature="s",
1508
@dbus_service_property(_interface, signature="s",
2011
1509
access="readwrite")
2012
1510
def Host_dbus_property(self, value=None):
2013
1511
if value is None: # get
2014
1512
return dbus.String(self.host)
2015
1513
self.host = str(value)
2016
1514
2017
1515
# Created - property
2018
@dbus_annotations(
2019
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2020
1516
@dbus_service_property(_interface, signature="s", access="read")
2021
1517
def Created_dbus_property(self):
2022
1518
return datetime_to_dbus(self.created)
2023
1519
2024
1520
# LastEnabled - property
2025
1521
@dbus_service_property(_interface, signature="s", access="read")
2026
1522
def LastEnabled_dbus_property(self):
2027
1523
return datetime_to_dbus(self.last_enabled)
2028
1524
2029
1525
# Enabled - property
2030
@dbus_service_property(_interface,
2031
signature="b",
1526
@dbus_service_property(_interface, signature="b",
2032
1527
access="readwrite")
2033
1528
def Enabled_dbus_property(self, value=None):
2034
1529
if value is None: # get
2037
1532
self.enable()
2038
1533
else:
2039
1534
self.disable()
2040
1535
2041
1536
# LastCheckedOK - property
2042
@dbus_service_property(_interface,
2043
signature="s",
1537
@dbus_service_property(_interface, signature="s",
2044
1538
access="readwrite")
2045
1539
def LastCheckedOK_dbus_property(self, value=None):
2046
1540
if value is not None:
2047
1541
self.checked_ok()
2048
1542
return
2049
1543
return datetime_to_dbus(self.last_checked_ok)
2050
1544
2051
1545
# LastCheckerStatus - property
2052
@dbus_service_property(_interface, signature="n", access="read")
1546
@dbus_service_property(_interface, signature="n",
1547
access="read")
2053
1548
def LastCheckerStatus_dbus_property(self):
2054
1549
return dbus.Int16(self.last_checker_status)
2055
1550
2056
1551
# Expires - property
2057
1552
@dbus_service_property(_interface, signature="s", access="read")
2058
1553
def Expires_dbus_property(self):
2059
1554
return datetime_to_dbus(self.expires)
2060
1555
2061
1556
# LastApprovalRequest - property
2062
1557
@dbus_service_property(_interface, signature="s", access="read")
2063
1558
def LastApprovalRequest_dbus_property(self):
2064
1559
return datetime_to_dbus(self.last_approval_request)
2065
1560
2066
1561
# Timeout - property
2067
@dbus_service_property(_interface,
2068
signature="t",
1562
@dbus_service_property(_interface, signature="t",
2069
1563
access="readwrite")
2070
1564
def Timeout_dbus_property(self, value=None):
2071
1565
if value is None: # get
2083
1577
if (getattr(self, "disable_initiator_tag", None)
2084
1578
is None):
2085
1579
return
2086
GLib.source_remove(self.disable_initiator_tag)
2087
self.disable_initiator_tag = GLib.timeout_add(
2088
int((self.expires - now).total_seconds() * 1000),
2089
self.disable)
2090
1580
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
int((self.expires - now).total_seconds()
1584
* 1000), self.disable))
1585
2091
1586
# ExtendedTimeout - property
2092
@dbus_service_property(_interface,
2093
signature="t",
1587
@dbus_service_property(_interface, signature="t",
2094
1588
access="readwrite")
2095
1589
def ExtendedTimeout_dbus_property(self, value=None):
2096
1590
if value is None: # get
2097
1591
return dbus.UInt64(self.extended_timeout.total_seconds()
2098
1592
* 1000)
2099
1593
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2100
1594
2101
1595
# Interval - property
2102
@dbus_service_property(_interface,
2103
signature="t",
1596
@dbus_service_property(_interface, signature="t",
2104
1597
access="readwrite")
2105
1598
def Interval_dbus_property(self, value=None):
2106
1599
if value is None: # get
2110
1603
return
2111
1604
if self.enabled:
2112
1605
# Reschedule checker run
2113
GLib.source_remove(self.checker_initiator_tag)
2114
self.checker_initiator_tag = GLib.timeout_add(
2115
value, self.start_checker)
2116
self.start_checker() # Start one now, too
2117
1606
gobject.source_remove(self.checker_initiator_tag)
1607
self.checker_initiator_tag = (gobject.timeout_add
1608
(value, self.start_checker))
1609
self.start_checker() # Start one now, too
1610
2118
1611
# Checker - property
2119
@dbus_service_property(_interface,
2120
signature="s",
1612
@dbus_service_property(_interface, signature="s",
2121
1613
access="readwrite")
2122
1614
def Checker_dbus_property(self, value=None):
2123
1615
if value is None: # get
2124
1616
return dbus.String(self.checker_command)
2125
1617
self.checker_command = str(value)
2126
1618
2127
1619
# CheckerRunning - property
2128
@dbus_service_property(_interface,
2129
signature="b",
1620
@dbus_service_property(_interface, signature="b",
2130
1621
access="readwrite")
2131
1622
def CheckerRunning_dbus_property(self, value=None):
2132
1623
if value is None: # get
2135
1626
self.start_checker()
2136
1627
else:
2137
1628
self.stop_checker()
2138
1629
2139
1630
# ObjectPath - property
2140
@dbus_annotations(
2141
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2142
"org.freedesktop.DBus.Deprecated": "true"})
2143
1631
@dbus_service_property(_interface, signature="o", access="read")
2144
1632
def ObjectPath_dbus_property(self):
2145
return self.dbus_object_path # is already a dbus.ObjectPath
2146
1633
return self.dbus_object_path # is already a dbus.ObjectPath
1634
2147
1635
# Secret = property
2148
@dbus_annotations(
2149
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2150
"invalidates"})
2151
@dbus_service_property(_interface,
2152
signature="ay",
2153
access="write",
2154
byte_arrays=True)
1636
@dbus_service_property(_interface, signature="ay",
1637
access="write", byte_arrays=True)
2155
1638
def Secret_dbus_property(self, value):
2156
1639
self.secret = bytes(value)
2157
1640
2158
1641
del _interface
2159
1642
2160
1643
2163
1646
self._pipe = child_pipe
2164
1647
self._pipe.send(('init', fpr, address))
2165
1648
if not self._pipe.recv():
2166
raise KeyError(fpr)
2167
1649
raise KeyError()
1650
2168
1651
def __getattribute__(self, name):
2169
1652
if name == '_pipe':
2170
1653
return super(ProxyClient, self).__getattribute__(name)
2173
1656
if data[0] == 'data':
2174
1657
return data[1]
2175
1658
if data[0] == 'function':
2176
2177
1659
def func(*args, **kwargs):
2178
1660
self._pipe.send(('funcall', name, args, kwargs))
2179
1661
return self._pipe.recv()[1]
2180
2181
1662
return func
2182
1663
2183
1664
def __setattr__(self, name, value):
2184
1665
if name == '_pipe':
2185
1666
return super(ProxyClient, self).__setattr__(name, value)
2188
1669
2189
1670
class ClientHandler(socketserver.BaseRequestHandler, object):
2190
1671
"""A class to handle client connections.
2191
1672
2192
1673
Instantiated once for each connection to handle it.
2193
1674
Note: This will run in its own forked process."""
2194
1675
2195
1676
def handle(self):
2196
1677
with contextlib.closing(self.server.child_pipe) as child_pipe:
2197
1678
logger.info("TCP connection from: %s",
2198
1679
str(self.client_address))
2199
1680
logger.debug("Pipe FD: %d",
2200
1681
self.server.child_pipe.fileno())
2201
2202
session = gnutls.ClientSession(self.request)
2203
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2207
# "+DHE-DSS"))
1682
1683
session = (gnutls.connection
1684
.ClientSession(self.request,
1685
gnutls.connection
1686
.X509Credentials()))
1687
1688
# Note: gnutls.connection.X509Credentials is really a
1689
# generic GnuTLS certificate credentials object so long as
1690
# no X.509 keys are added to it. Therefore, we can use it
1691
# here despite using OpenPGP certificates.
1692
1693
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1694
# "+AES-256-CBC", "+SHA1",
1695
# "+COMP-NULL", "+CTYPE-OPENPGP",
1696
# "+DHE-DSS"))
2208
1697
# Use a fallback default, since this MUST be set.
2209
1698
priority = self.server.gnutls_priority
2210
1699
if priority is None:
2211
1700
priority = "NORMAL"
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
2214
None)
2215
1701
(gnutls.library.functions
1702
.gnutls_priority_set_direct(session._c_object,
1703
priority, None))
1704
2216
1705
# Start communication using the Mandos protocol
2217
1706
# Get protocol number
2218
1707
line = self.request.makefile().readline()
2223
1712
except (ValueError, IndexError, RuntimeError) as error:
2224
1713
logger.error("Unknown protocol version: %s", error)
2225
1714
return
2226
1715
2227
1716
# Start GnuTLS connection
2228
1717
try:
2229
1718
session.handshake()
2230
except gnutls.Error as error:
1719
except gnutls.errors.GNUTLSError as error:
2231
1720
logger.warning("Handshake failed: %s", error)
2232
1721
# Do not run session.bye() here: the session is not
2233
1722
# established. Just abandon the request.
2234
1723
return
2235
1724
logger.debug("Handshake succeeded")
2236
1725
2237
1726
approval_required = False
2238
1727
try:
2239
1728
try:
2240
fpr = self.fingerprint(
2241
self.peer_certificate(session))
2242
except (TypeError, gnutls.Error) as error:
1729
fpr = self.fingerprint(self.peer_certificate
1730
(session))
1731
except (TypeError,
1732
gnutls.errors.GNUTLSError) as error:
2243
1733
logger.warning("Bad certificate: %s", error)
2244
1734
return
2245
1735
logger.debug("Fingerprint: %s", fpr)
2246
1736
2247
1737
try:
2248
1738
client = ProxyClient(child_pipe, fpr,
2249
1739
self.client_address)
2250
1740
except KeyError:
2251
1741
return
2252
1742
2253
1743
if client.approval_delay:
2254
1744
delay = client.approval_delay
2255
1745
client.approvals_pending += 1
2256
1746
approval_required = True
2257
1747
2258
1748
while True:
2259
1749
if not client.enabled:
2260
1750
logger.info("Client %s is disabled",
2261
client.name)
1751
client.name)
2262
1752
if self.server.use_dbus:
2263
1753
# Emit D-Bus signal
2264
1754
client.Rejected("Disabled")
2265
1755
return
2266
1756
2267
1757
if client.approved or not client.approval_delay:
2268
# We are approved or approval is disabled
1758
#We are approved or approval is disabled
2269
1759
break
2270
1760
elif client.approved is None:
2271
1761
logger.info("Client %s needs approval",
2282
1772
# Emit D-Bus signal
2283
1773
client.Rejected("Denied")
2284
1774
return
2285
2286
# wait until timeout or approved
1775
1776
#wait until timeout or approved
2287
1777
time = datetime.datetime.now()
2288
1778
client.changedstate.acquire()
2289
1779
client.changedstate.wait(delay.total_seconds())
2302
1792
break
2303
1793
else:
2304
1794
delay -= time2 - time
2305
2306
try:
2307
session.send(client.secret)
2308
except gnutls.Error as error:
2309
logger.warning("gnutls send failed",
2310
exc_info=error)
2311
return
2312
1795
1796
sent_size = 0
1797
while sent_size < len(client.secret):
1798
try:
1799
sent = session.send(client.secret[sent_size:])
1800
except gnutls.errors.GNUTLSError as error:
1801
logger.warning("gnutls send failed",
1802
exc_info=error)
1803
return
1804
logger.debug("Sent: %d, remaining: %d",
1805
sent, len(client.secret)
1806
- (sent_size + sent))
1807
sent_size += sent
1808
2313
1809
logger.info("Sending secret to %s", client.name)
2314
1810
# bump the timeout using extended_timeout
2315
1811
client.bump_timeout(client.extended_timeout)
2316
1812
if self.server.use_dbus:
2317
1813
# Emit D-Bus signal
2318
1814
client.GotSecret()
2319
1815
2320
1816
finally:
2321
1817
if approval_required:
2322
1818
client.approvals_pending -= 1
2323
1819
try:
2324
1820
session.bye()
2325
except gnutls.Error as error:
1821
except gnutls.errors.GNUTLSError as error:
2326
1822
logger.warning("GnuTLS bye failed",
2327
1823
exc_info=error)
2328
1824
2329
1825
@staticmethod
2330
1826
def peer_certificate(session):
2331
1827
"Return the peer's OpenPGP certificate as a bytestring"
2332
1828
# If not an OpenPGP certificate...
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2335
# ...return invalid data
2336
return b""
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
1831
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
# ...do the normal thing
1833
return session.peer_certificate
2337
1834
list_size = ctypes.c_uint(1)
2338
cert_list = (gnutls.certificate_get_peers
1835
cert_list = (gnutls.library.functions
1836
.gnutls_certificate_get_peers
2339
1837
(session._c_object, ctypes.byref(list_size)))
2340
1838
if not bool(cert_list) and list_size.value != 0:
2341
raise gnutls.Error("error getting peer certificate")
1839
raise gnutls.errors.GNUTLSError("error getting peer"
1840
" certificate")
2342
1841
if list_size.value == 0:
2343
1842
return None
2344
1843
cert = cert_list[0]
2345
1844
return ctypes.string_at(cert.data, cert.size)
2346
1845
2347
1846
@staticmethod
2348
1847
def fingerprint(openpgp):
2349
1848
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2350
1849
# New GnuTLS "datum" with the OpenPGP public key
2351
datum = gnutls.datum_t(
2352
ctypes.cast(ctypes.c_char_p(openpgp),
2353
ctypes.POINTER(ctypes.c_ubyte)),
2354
ctypes.c_uint(len(openpgp)))
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.POINTER
1853
(ctypes.c_ubyte)),
1854
ctypes.c_uint(len(openpgp))))
2355
1855
# New empty GnuTLS certificate
2356
crt = gnutls.openpgp_crt_t()
2357
gnutls.openpgp_crt_init(ctypes.byref(crt))
1856
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2358
1859
# Import the OpenPGP public key into the certificate
2359
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2360
gnutls.OPENPGP_FMT_RAW)
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
2361
1864
# Verify the self signature in the key
2362
1865
crtverify = ctypes.c_uint()
2363
gnutls.openpgp_crt_verify_self(crt, 0,
2364
ctypes.byref(crtverify))
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
2365
1869
if crtverify.value != 0:
2366
gnutls.openpgp_crt_deinit(crt)
2367
raise gnutls.CertificateSecurityError("Verify failed")
1870
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
1872
("Verify failed"))
2368
1873
# New buffer for the fingerprint
2369
1874
buf = ctypes.create_string_buffer(20)
2370
1875
buf_len = ctypes.c_size_t()
2371
1876
# Get the fingerprint from the certificate into the buffer
2372
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2373
ctypes.byref(buf_len))
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
2374
1880
# Deinit the certificate
2375
gnutls.openpgp_crt_deinit(crt)
1881
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2376
1882
# Convert the buffer to a Python bytestring
2377
1883
fpr = ctypes.string_at(buf, buf_len.value)
2378
1884
# Convert the bytestring to hexadecimal notation
2382
1888
2383
1889
class MultiprocessingMixIn(object):
2384
1890
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2385
2386
1891
def sub_process_main(self, request, address):
2387
1892
try:
2388
1893
self.finish_request(request, address)
2389
1894
except Exception:
2390
1895
self.handle_error(request, address)
2391
1896
self.close_request(request)
2392
1897
2393
1898
def process_request(self, request, address):
2394
1899
"""Start a new process to process the request."""
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
1900
proc = multiprocessing.Process(target = self.sub_process_main,
1901
args = (request, address))
2397
1902
proc.start()
2398
1903
return proc
2399
1904
2400
1905
2401
1906
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2402
1907
""" adds a pipe to the MixIn """
2403
2404
1908
def process_request(self, request, client_address):
2405
1909
"""Overrides and wraps the original process_request().
2406
1910
2407
1911
This function creates a new pipe in self.pipe
2408
1912
"""
2409
1913
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2410
1914
2411
1915
proc = MultiprocessingMixIn.process_request(self, request,
2412
1916
client_address)
2413
1917
self.child_pipe.close()
2414
1918
self.add_pipe(parent_pipe, proc)
2415
1919
2416
1920
def add_pipe(self, parent_pipe, proc):
2417
1921
"""Dummy function; override as necessary"""
2418
1922
raise NotImplementedError()
2421
1925
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2422
1926
socketserver.TCPServer, object):
2423
1927
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2424
1928
2425
1929
Attributes:
2426
1930
enabled: Boolean; whether this server is activated yet
2427
1931
interface: None or a network interface name (string)
2428
1932
use_ipv6: Boolean; to use IPv6 or not
2429
1933
"""
2430
2431
1934
def __init__(self, server_address, RequestHandlerClass,
2432
interface=None,
2433
use_ipv6=True,
2434
socketfd=None):
1935
interface=None, use_ipv6=True, socketfd=None):
2435
1936
"""If socketfd is set, use that file descriptor instead of
2436
1937
creating a new one with socket.socket().
2437
1938
"""
2443
1944
self.socketfd = socketfd
2444
1945
# Save the original socket.socket() function
2445
1946
self.socket_socket = socket.socket
2446
2447
1947
# To implement --socket, we monkey patch socket.socket.
2448
#
1948
#
2449
1949
# (When socketserver.TCPServer is a new-style class, we
2450
1950
# could make self.socket into a property instead of monkey
2451
1951
# patching socket.socket.)
2452
#
1952
#
2453
1953
# Create a one-time-only replacement for socket.socket()
2454
1954
@functools.wraps(socket.socket)
2455
1955
def socket_wrapper(*args, **kwargs):
2467
1967
# socket_wrapper(), if socketfd was set.
2468
1968
socketserver.TCPServer.__init__(self, server_address,
2469
1969
RequestHandlerClass)
2470
1970
2471
1971
def server_bind(self):
2472
1972
"""This overrides the normal server_bind() function
2473
1973
to bind to an interface if one was specified, and also NOT to
2474
1974
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2476
1975
if self.interface is not None:
2477
1976
if SO_BINDTODEVICE is None:
2478
# Fall back to a hard-coded value which seems to be
2479
# common enough.
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2482
try:
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2493
self.interface)
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2497
else:
2498
raise
1977
logger.error("SO_BINDTODEVICE does not exist;"
1978
" cannot bind to interface %s",
1979
self.interface)
1980
else:
1981
try:
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1983
SO_BINDTODEVICE,
1984
(self.interface + "\0")
1985
.encode("utf-8"))
1986
except socket.error as error:
1987
if error.errno == errno.EPERM:
1988
logger.error("No permission to bind to"
1989
" interface %s", self.interface)
1990
elif error.errno == errno.ENOPROTOOPT:
1991
logger.error("SO_BINDTODEVICE not available;"
1992
" cannot bind to interface %s",
1993
self.interface)
1994
elif error.errno == errno.ENODEV:
1995
logger.error("Interface %s does not exist,"
1996
" cannot bind", self.interface)
1997
else:
1998
raise
2499
1999
# Only bind(2) the socket if we really need to.
2500
2000
if self.server_address[0] or self.server_address[1]:
2501
2001
if not self.server_address[0]:
2502
2002
if self.address_family == socket.AF_INET6:
2503
any_address = "::" # in6addr_any
2003
any_address = "::" # in6addr_any
2504
2004
else:
2505
any_address = "0.0.0.0" # INADDR_ANY
2005
any_address = "0.0.0.0" # INADDR_ANY
2506
2006
self.server_address = (any_address,
2507
2007
self.server_address[1])
2508
2008
elif not self.server_address[1]:
2509
self.server_address = (self.server_address[0], 0)
2009
self.server_address = (self.server_address[0],
2010
0)
2510
2011
# if self.interface:
2511
2012
# self.server_address = (self.server_address[0],
2512
2013
# 0, # port
2518
2019
2519
2020
class MandosServer(IPv6_TCPServer):
2520
2021
"""Mandos server.
2521
2022
2522
2023
Attributes:
2523
2024
clients: set of Client objects
2524
2025
gnutls_priority GnuTLS priority string
2525
2026
use_dbus: Boolean; to emit D-Bus signals or not
2526
2527
Assumes a GLib.MainLoop event loop.
2027
2028
Assumes a gobject.MainLoop event loop.
2528
2029
"""
2529
2530
2030
def __init__(self, server_address, RequestHandlerClass,
2531
interface=None,
2532
use_ipv6=True,
2533
clients=None,
2534
gnutls_priority=None,
2535
use_dbus=True,
2536
socketfd=None):
2031
interface=None, use_ipv6=True, clients=None,
2032
gnutls_priority=None, use_dbus=True, socketfd=None):
2537
2033
self.enabled = False
2538
2034
self.clients = clients
2539
2035
if self.clients is None:
2542
2038
self.gnutls_priority = gnutls_priority
2543
2039
IPv6_TCPServer.__init__(self, server_address,
2544
2040
RequestHandlerClass,
2545
interface=interface,
2546
use_ipv6=use_ipv6,
2547
socketfd=socketfd)
2548
2041
interface = interface,
2042
use_ipv6 = use_ipv6,
2043
socketfd = socketfd)
2549
2044
def server_activate(self):
2550
2045
if self.enabled:
2551
2046
return socketserver.TCPServer.server_activate(self)
2552
2047
2553
2048
def enable(self):
2554
2049
self.enabled = True
2555
2050
2556
2051
def add_pipe(self, parent_pipe, proc):
2557
2052
# Call "handle_ipc" for both data and EOF events
2558
GLib.io_add_watch(
2559
parent_pipe.fileno(),
2560
GLib.IO_IN | GLib.IO_HUP,
2561
functools.partial(self.handle_ipc,
2562
parent_pipe=parent_pipe,
2563
proc=proc))
2564
2565
def handle_ipc(self, source, condition,
2566
parent_pipe=None,
2567
proc=None,
2568
client_object=None):
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2056
parent_pipe =
2057
parent_pipe,
2058
proc = proc))
2059
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2569
2062
# error, or the other end of multiprocessing.Pipe has closed
2570
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2063
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2571
2064
# Wait for other process to exit
2572
2065
proc.join()
2573
2066
return False
2574
2067
2575
2068
# Read a request from the child
2576
2069
request = parent_pipe.recv()
2577
2070
command = request[0]
2578
2071
2579
2072
if command == 'init':
2580
2073
fpr = request[1]
2581
2074
address = request[2]
2582
2583
for c in self.clients.values():
2075
2076
for c in self.clients.itervalues():
2584
2077
if c.fingerprint == fpr:
2585
2078
client = c
2586
2079
break
2593
2086
address[0])
2594
2087
parent_pipe.send(False)
2595
2088
return False
2596
2597
GLib.io_add_watch(
2598
parent_pipe.fileno(),
2599
GLib.IO_IN | GLib.IO_HUP,
2600
functools.partial(self.handle_ipc,
2601
parent_pipe=parent_pipe,
2602
proc=proc,
2603
client_object=client))
2089
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2093
parent_pipe =
2094
parent_pipe,
2095
proc = proc,
2096
client_object =
2097
client))
2604
2098
parent_pipe.send(True)
2605
2099
# remove the old hook in favor of the new above hook on
2606
2100
# same fileno
2609
2103
funcname = request[1]
2610
2104
args = request[2]
2611
2105
kwargs = request[3]
2612
2106
2613
2107
parent_pipe.send(('data', getattr(client_object,
2614
2108
funcname)(*args,
2615
**kwargs)))
2616
2109
**kwargs)))
2110
2617
2111
if command == 'getattr':
2618
2112
attrname = request[1]
2619
if isinstance(client_object.__getattribute__(attrname),
2620
collections.Callable):
2621
parent_pipe.send(('function', ))
2113
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2622
2115
else:
2623
parent_pipe.send((
2624
'data', client_object.__getattribute__(attrname)))
2625
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2118
2626
2119
if command == 'setattr':
2627
2120
attrname = request[1]
2628
2121
value = request[2]
2629
2122
setattr(client_object, attrname, value)
2630
2123
2631
2124
return True
2632
2125
2633
2126
2634
2127
def rfc3339_duration_to_delta(duration):
2635
2128
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2636
2129
2637
2130
>>> rfc3339_duration_to_delta("P7D")
2638
2131
datetime.timedelta(7)
2639
2132
>>> rfc3339_duration_to_delta("PT60S")
2649
2142
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
2143
datetime.timedelta(1, 200)
2651
2144
"""
2652
2145
2653
2146
# Parsing an RFC 3339 duration with regular expressions is not
2654
2147
# possible - there would have to be multiple places for the same
2655
2148
# values, like seconds. The current code, while more esoteric, is
2656
2149
# cleaner without depending on a parsing library. If Python had a
2657
2150
# built-in library for parsing we would use it, but we'd like to
2658
2151
# avoid excessive use of external libraries.
2659
2152
2660
2153
# New type for defining tokens, syntax, and semantics all-in-one
2661
Token = collections.namedtuple("Token", (
2662
"regexp", # To match token; if "value" is not None, must have
2663
# a "group" containing digits
2664
"value", # datetime.timedelta or None
2665
"followers")) # Tokens valid after this token
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2158
# containing digits
2159
"value", # datetime.timedelta or
2160
# None
2161
"followers")) # Tokens valid after
2162
# this token
2666
2163
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2667
2164
# the "duration" ABNF definition in RFC 3339, Appendix A.
2668
2165
token_end = Token(re.compile(r"$"), None, frozenset())
2669
2166
token_second = Token(re.compile(r"(\d+)S"),
2670
2167
datetime.timedelta(seconds=1),
2671
frozenset((token_end, )))
2168
frozenset((token_end,)))
2672
2169
token_minute = Token(re.compile(r"(\d+)M"),
2673
2170
datetime.timedelta(minutes=1),
2674
2171
frozenset((token_second, token_end)))
2690
2187
frozenset((token_month, token_end)))
2691
2188
token_week = Token(re.compile(r"(\d+)W"),
2692
2189
datetime.timedelta(weeks=1),
2693
frozenset((token_end, )))
2190
frozenset((token_end,)))
2694
2191
token_duration = Token(re.compile(r"P"), None,
2695
2192
frozenset((token_year, token_month,
2696
2193
token_day, token_time,
2697
2194
token_week)))
2698
# Define starting values:
2699
# Value so far
2700
value = datetime.timedelta()
2195
# Define starting values
2196
value = datetime.timedelta() # Value so far
2701
2197
found_token = None
2702
# Following valid tokens
2703
followers = frozenset((token_duration, ))
2704
# String left to parse
2705
s = duration
2198
followers = frozenset((token_duration,)) # Following valid tokens
2199
s = duration # String left to parse
2706
2200
# Loop until end token is found
2707
2201
while found_token is not token_end:
2708
2202
# Search for any currently valid tokens
2724
2218
break
2725
2219
else:
2726
2220
# No currently valid tokens were found
2727
raise ValueError("Invalid RFC 3339 duration: {!r}"
2728
.format(duration))
2221
raise ValueError("Invalid RFC 3339 duration")
2729
2222
# End token found
2730
2223
return value
2731
2224
2732
2225
2733
2226
def string_to_delta(interval):
2734
2227
"""Parse a string and return a datetime.timedelta
2735
2228
2736
2229
>>> string_to_delta('7d')
2737
2230
datetime.timedelta(7)
2738
2231
>>> string_to_delta('60s')
2746
2239
>>> string_to_delta('5m 30s')
2747
2240
datetime.timedelta(0, 330)
2748
2241
"""
2749
2242
2750
2243
try:
2751
2244
return rfc3339_duration_to_delta(interval)
2752
2245
except ValueError:
2753
2246
pass
2754
2247
2755
2248
timevalue = datetime.timedelta(0)
2756
2249
for s in interval.split():
2757
2250
try:
2768
2261
elif suffix == "w":
2769
2262
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2770
2263
else:
2771
raise ValueError("Unknown suffix {!r}".format(suffix))
2264
raise ValueError("Unknown suffix {!r}"
2265
.format(suffix))
2772
2266
except IndexError as e:
2773
2267
raise ValueError(*(e.args))
2774
2268
timevalue += delta
2775
2269
return timevalue
2776
2270
2777
2271
2778
def daemon(nochdir=False, noclose=False):
2272
def daemon(nochdir = False, noclose = False):
2779
2273
"""See daemon(3). Standard BSD Unix function.
2780
2274
2781
2275
This should really exist as os.daemon, but it doesn't (yet)."""
2782
2276
if os.fork():
2783
2277
sys.exit()
2790
2284
# Close all standard open file descriptors
2791
2285
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2792
2286
if not stat.S_ISCHR(os.fstat(null).st_mode):
2793
raise OSError(errno.ENODEV,
2794
"{} not a character device"
2287
raise OSError(errno.ENODEV, "{} not a character device"
2795
2288
.format(os.devnull))
2796
2289
os.dup2(null, sys.stdin.fileno())
2797
2290
os.dup2(null, sys.stdout.fileno())
2801
2294
2802
2295
2803
2296
def main():
2804
2297
2805
2298
##################################################################
2806
2299
# Parsing of options, both command line and config file
2807
2300
2808
2301
parser = argparse.ArgumentParser()
2809
2302
parser.add_argument("-v", "--version", action="version",
2810
version="%(prog)s {}".format(version),
2303
version = "%(prog)s {}".format(version),
2811
2304
help="show version number and exit")
2812
2305
parser.add_argument("-i", "--interface", metavar="IF",
2813
2306
help="Bind to interface IF")
2849
2342
parser.add_argument("--no-zeroconf", action="store_false",
2850
2343
dest="zeroconf", help="Do not use Zeroconf",
2851
2344
default=None)
2852
2345
2853
2346
options = parser.parse_args()
2854
2347
2855
2348
if options.check:
2856
2349
import doctest
2857
2350
fail_count, test_count = doctest.testmod()
2858
2351
sys.exit(os.EX_OK if fail_count == 0 else 1)
2859
2352
2860
2353
# Default values for config file for server-global settings
2861
server_defaults = {"interface": "",
2862
"address": "",
2863
"port": "",
2864
"debug": "False",
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2869
"use_dbus": "True",
2870
"use_ipv6": "True",
2871
"debuglevel": "",
2872
"restore": "True",
2873
"socket": "",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
2876
"zeroconf": "True",
2877
}
2878
2354
server_defaults = { "interface": "",
2355
"address": "",
2356
"port": "",
2357
"debug": "False",
2358
"priority":
2359
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2360
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2361
"servicename": "Mandos",
2362
"use_dbus": "True",
2363
"use_ipv6": "True",
2364
"debuglevel": "",
2365
"restore": "True",
2366
"socket": "",
2367
"statedir": "/var/lib/mandos",
2368
"foreground": "False",
2369
"zeroconf": "True",
2370
}
2371
2879
2372
# Parse config file for server-global settings
2880
2373
server_config = configparser.SafeConfigParser(server_defaults)
2881
2374
del server_defaults
2882
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2375
server_config.read(os.path.join(options.configdir,
2376
"mandos.conf"))
2883
2377
# Convert the SafeConfigParser object to a dict
2884
2378
server_settings = server_config.defaults()
2885
2379
# Use the appropriate methods on the non-string config options
2899
2393
server_settings["socket"] = os.dup(server_settings
2900
2394
["socket"])
2901
2395
del server_config
2902
2396
2903
2397
# Override the settings from the config file with command line
2904
2398
# options, if set.
2905
2399
for option in ("interface", "address", "port", "debug",
2906
"priority", "servicename", "configdir", "use_dbus",
2907
"use_ipv6", "debuglevel", "restore", "statedir",
2908
"socket", "foreground", "zeroconf"):
2400
"priority", "servicename", "configdir",
2401
"use_dbus", "use_ipv6", "debuglevel", "restore",
2402
"statedir", "socket", "foreground", "zeroconf"):
2909
2403
value = getattr(options, option)
2910
2404
if value is not None:
2911
2405
server_settings[option] = value
2923
2417
if server_settings["debug"]:
2924
2418
server_settings["foreground"] = True
2925
2419
# Now we have our good server settings in "server_settings"
2926
2420
2927
2421
##################################################################
2928
2929
if (not server_settings["zeroconf"]
2930
and not (server_settings["port"]
2931
or server_settings["socket"] != "")):
2932
parser.error("Needs port or socket to work without Zeroconf")
2933
2422
2423
if (not server_settings["zeroconf"] and
2424
not (server_settings["port"]
2425
or server_settings["socket"] != "")):
2426
parser.error("Needs port or socket to work without"
2427
" Zeroconf")
2428
2934
2429
# For convenience
2935
2430
debug = server_settings["debug"]
2936
2431
debuglevel = server_settings["debuglevel"]
2940
2435
stored_state_file)
2941
2436
foreground = server_settings["foreground"]
2942
2437
zeroconf = server_settings["zeroconf"]
2943
2438
2944
2439
if debug:
2945
2440
initlogger(debug, logging.DEBUG)
2946
2441
else:
2949
2444
else:
2950
2445
level = getattr(logging, debuglevel.upper())
2951
2446
initlogger(debug, level)
2952
2447
2953
2448
if server_settings["servicename"] != "Mandos":
2954
syslogger.setFormatter(
2955
logging.Formatter('Mandos ({}) [%(process)d]:'
2956
' %(levelname)s: %(message)s'.format(
2957
server_settings["servicename"])))
2958
2449
syslogger.setFormatter(logging.Formatter
2450
('Mandos ({}) [%(process)d]:'
2451
' %(levelname)s: %(message)s'
2452
.format(server_settings
2453
["servicename"])))
2454
2959
2455
# Parse config file with clients
2960
2456
client_config = configparser.SafeConfigParser(Client
2961
2457
.client_defaults)
2962
2458
client_config.read(os.path.join(server_settings["configdir"],
2963
2459
"clients.conf"))
2964
2460
2965
2461
global mandos_dbus_service
2966
2462
mandos_dbus_service = None
2967
2463
2968
2464
socketfd = None
2969
2465
if server_settings["socket"] != "":
2970
2466
socketfd = server_settings["socket"]
2971
tcp_server = MandosServer(
2972
(server_settings["address"], server_settings["port"]),
2973
ClientHandler,
2974
interface=(server_settings["interface"] or None),
2975
use_ipv6=use_ipv6,
2976
gnutls_priority=server_settings["priority"],
2977
use_dbus=use_dbus,
2978
socketfd=socketfd)
2467
tcp_server = MandosServer((server_settings["address"],
2468
server_settings["port"]),
2469
ClientHandler,
2470
interface=(server_settings["interface"]
2471
or None),
2472
use_ipv6=use_ipv6,
2473
gnutls_priority=
2474
server_settings["priority"],
2475
use_dbus=use_dbus,
2476
socketfd=socketfd)
2979
2477
if not foreground:
2980
2478
pidfilename = "/run/mandos.pid"
2981
2479
if not os.path.isdir("/run/."):
2982
2480
pidfilename = "/var/run/mandos.pid"
2983
2481
pidfile = None
2984
2482
try:
2985
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2483
pidfile = open(pidfilename, "w")
2986
2484
except IOError as e:
2987
2485
logger.error("Could not open file %r", pidfilename,
2988
2486
exc_info=e)
2989
2990
for name, group in (("_mandos", "_mandos"),
2991
("mandos", "mandos"),
2992
("nobody", "nogroup")):
2487
2488
for name in ("_mandos", "mandos", "nobody"):
2993
2489
try:
2994
2490
uid = pwd.getpwnam(name).pw_uid
2995
gid = pwd.getpwnam(group).pw_gid
2491
gid = pwd.getpwnam(name).pw_gid
2996
2492
break
2997
2493
except KeyError:
2998
2494
continue
3002
2498
try:
3003
2499
os.setgid(gid)
3004
2500
os.setuid(uid)
3005
if debug:
3006
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3007
gid))
3008
2501
except OSError as error:
3009
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
.format(uid, gid, os.strerror(error.errno)))
3011
2502
if error.errno != errno.EPERM:
3012
2503
raise
3013
2504
3014
2505
if debug:
3015
2506
# Enable all possible GnuTLS debugging
3016
2507
3017
2508
# "Use a log level over 10 to enable all debugging options."
3018
2509
# - GnuTLS manual
3019
gnutls.global_set_log_level(11)
3020
3021
@gnutls.log_func
2510
gnutls.library.functions.gnutls_global_set_log_level(11)
2511
2512
@gnutls.library.types.gnutls_log_func
3022
2513
def debug_gnutls(level, string):
3023
2514
logger.debug("GnuTLS: %s", string[:-1])
3024
3025
gnutls.global_set_log_function(debug_gnutls)
3026
2515
2516
(gnutls.library.functions
2517
.gnutls_global_set_log_function(debug_gnutls))
2518
3027
2519
# Redirect stdin so all checkers get /dev/null
3028
2520
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3029
2521
os.dup2(null, sys.stdin.fileno())
3030
2522
if null > 2:
3031
2523
os.close(null)
3032
2524
3033
2525
# Need to fork before connecting to D-Bus
3034
2526
if not foreground:
3035
2527
# Close all input and output, do double fork, etc.
3036
2528
daemon()
3037
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
3040
GLib.threads_init()
3041
2529
2530
# multiprocessing will use threads, so before we use gobject we
2531
# need to inform gobject that threads will be used.
2532
gobject.threads_init()
2533
3042
2534
global main_loop
3043
2535
# From the Avahi example code
3044
2536
DBusGMainLoop(set_as_default=True)
3045
main_loop = GLib.MainLoop()
2537
main_loop = gobject.MainLoop()
3046
2538
bus = dbus.SystemBus()
3047
2539
# End of Avahi example code
3048
2540
if use_dbus:
3049
2541
try:
3050
2542
bus_name = dbus.service.BusName("se.recompile.Mandos",
3051
bus,
3052
do_not_queue=True)
3053
old_bus_name = dbus.service.BusName(
3054
"se.bsnet.fukt.Mandos", bus,
3055
do_not_queue=True)
3056
except dbus.exceptions.DBusException as e:
2543
bus, do_not_queue=True)
2544
old_bus_name = (dbus.service.BusName
2545
("se.bsnet.fukt.Mandos", bus,
2546
do_not_queue=True))
2547
except dbus.exceptions.NameExistsException as e:
3057
2548
logger.error("Disabling D-Bus:", exc_info=e)
3058
2549
use_dbus = False
3059
2550
server_settings["use_dbus"] = False
3060
2551
tcp_server.use_dbus = False
3061
2552
if zeroconf:
3062
2553
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3063
service = AvahiServiceToSyslog(
3064
name=server_settings["servicename"],
3065
servicetype="_mandos._tcp",
3066
protocol=protocol,
3067
bus=bus)
2554
service = AvahiServiceToSyslog(name =
2555
server_settings["servicename"],
2556
servicetype = "_mandos._tcp",
2557
protocol = protocol, bus = bus)
3068
2558
if server_settings["interface"]:
3069
service.interface = if_nametoindex(
3070
server_settings["interface"].encode("utf-8"))
3071
2559
service.interface = (if_nametoindex
2560
(server_settings["interface"]
2561
.encode("utf-8")))
2562
3072
2563
global multiprocessing_manager
3073
2564
multiprocessing_manager = multiprocessing.Manager()
3074
2565
3075
2566
client_class = Client
3076
2567
if use_dbus:
3077
client_class = functools.partial(ClientDBus, bus=bus)
3078
2568
client_class = functools.partial(ClientDBus, bus = bus)
2569
3079
2570
client_settings = Client.config_parser(client_config)
3080
2571
old_client_settings = {}
3081
2572
clients_data = {}
3082
2573
3083
2574
# This is used to redirect stdout and stderr for checker processes
3084
2575
global wnull
3085
wnull = open(os.devnull, "w") # A writable /dev/null
2576
wnull = open(os.devnull, "w") # A writable /dev/null
3086
2577
# Only used if server is running in foreground but not in debug
3087
2578
# mode
3088
2579
if debug or not foreground:
3089
2580
wnull.close()
3090
2581
3091
2582
# Get client data and settings from last running state.
3092
2583
if server_settings["restore"]:
3093
2584
try:
3094
2585
with open(stored_state_path, "rb") as stored_state:
3095
if sys.version_info.major == 2:
3096
clients_data, old_client_settings = pickle.load(
3097
stored_state)
3098
else:
3099
bytes_clients_data, bytes_old_client_settings = (
3100
pickle.load(stored_state, encoding="bytes"))
3101
# Fix bytes to strings
3102
# clients_data
3103
# .keys()
3104
clients_data = {(key.decode("utf-8")
3105
if isinstance(key, bytes)
3106
else key): value
3107
for key, value in
3108
bytes_clients_data.items()}
3109
del bytes_clients_data
3110
for key in clients_data:
3111
value = {(k.decode("utf-8")
3112
if isinstance(k, bytes) else k): v
3113
for k, v in
3114
clients_data[key].items()}
3115
clients_data[key] = value
3116
# .client_structure
3117
value["client_structure"] = [
3118
(s.decode("utf-8")
3119
if isinstance(s, bytes)
3120
else s) for s in
3121
value["client_structure"]]
3122
# .name & .host
3123
for k in ("name", "host"):
3124
if isinstance(value[k], bytes):
3125
value[k] = value[k].decode("utf-8")
3126
# old_client_settings
3127
# .keys()
3128
old_client_settings = {
3129
(key.decode("utf-8")
3130
if isinstance(key, bytes)
3131
else key): value
3132
for key, value in
3133
bytes_old_client_settings.items()}
3134
del bytes_old_client_settings
3135
# .host
3136
for value in old_client_settings.values():
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3139
.decode("utf-8"))
2586
clients_data, old_client_settings = (pickle.load
2587
(stored_state))
3140
2588
os.remove(stored_state_path)
3141
2589
except IOError as e:
3142
2590
if e.errno == errno.ENOENT:
3143
logger.warning("Could not load persistent state:"
3144
" {}".format(os.strerror(e.errno)))
2591
logger.warning("Could not load persistent state: {}"
2592
.format(os.strerror(e.errno)))
3145
2593
else:
3146
2594
logger.critical("Could not load persistent state:",
3147
2595
exc_info=e)
3148
2596
raise
3149
2597
except EOFError as e:
3150
2598
logger.warning("Could not load persistent state: "
3151
"EOFError:",
3152
exc_info=e)
3153
2599
"EOFError:", exc_info=e)
2600
3154
2601
with PGPEngine() as pgp:
3155
2602
for client_name, client in clients_data.items():
3156
2603
# Skip removed clients
3157
2604
if client_name not in client_settings:
3158
2605
continue
3159
2606
3160
2607
# Decide which value to use after restoring saved state.
3161
2608
# We have three different values: Old config file,
3162
2609
# new config file, and saved state.
3167
2614
# For each value in new config, check if it
3168
2615
# differs from the old config value (Except for
3169
2616
# the "secret" attribute)
3170
if (name != "secret"
3171
and (value !=
3172
old_client_settings[client_name][name])):
2617
if (name != "secret" and
2618
value != old_client_settings[client_name]
2619
[name]):
3173
2620
client[name] = value
3174
2621
except KeyError:
3175
2622
pass
3176
2623
3177
2624
# Clients who has passed its expire date can still be
3178
# enabled if its last checker was successful. A Client
2625
# enabled if its last checker was successful. Clients
3179
2626
# whose checker succeeded before we stored its state is
3180
2627
# assumed to have successfully run all checkers during
3181
2628
# downtime.
3184
2631
if not client["last_checked_ok"]:
3185
2632
logger.warning(
3186
2633
"disabling client {} - Client never "
3187
"performed a successful checker".format(
3188
client_name))
2634
"performed a successful checker"
2635
.format(client_name))
3189
2636
client["enabled"] = False
3190
2637
elif client["last_checker_status"] != 0:
3191
2638
logger.warning(
3192
2639
"disabling client {} - Client last"
3193
" checker failed with error code"
3194
" {}".format(
3195
client_name,
3196
client["last_checker_status"]))
2640
" checker failed with error code {}"
2641
.format(client_name,
2642
client["last_checker_status"]))
3197
2643
client["enabled"] = False
3198
2644
else:
3199
client["expires"] = (
3200
datetime.datetime.utcnow()
3201
+ client["timeout"])
2645
client["expires"] = (datetime.datetime
2646
.utcnow()
2647
+ client["timeout"])
3202
2648
logger.debug("Last checker succeeded,"
3203
" keeping {} enabled".format(
3204
client_name))
2649
" keeping {} enabled"
2650
.format(client_name))
3205
2651
try:
3206
client["secret"] = pgp.decrypt(
3207
client["encrypted_secret"],
3208
client_settings[client_name]["secret"])
2652
client["secret"] = (
2653
pgp.decrypt(client["encrypted_secret"],
2654
client_settings[client_name]
2655
["secret"]))
3209
2656
except PGPError:
3210
2657
# If decryption fails, we use secret from new settings
3211
logger.debug("Failed to decrypt {} old secret".format(
3212
client_name))
3213
client["secret"] = (client_settings[client_name]
3214
["secret"])
3215
2658
logger.debug("Failed to decrypt {} old secret"
2659
.format(client_name))
2660
client["secret"] = (
2661
client_settings[client_name]["secret"])
2662
3216
2663
# Add/remove clients based on new changes made to config
3217
2664
for client_name in (set(old_client_settings)
3218
2665
- set(client_settings)):
3220
2667
for client_name in (set(client_settings)
3221
2668
- set(old_client_settings)):
3222
2669
clients_data[client_name] = client_settings[client_name]
3223
2670
3224
2671
# Create all client objects
3225
2672
for client_name, client in clients_data.items():
3226
2673
tcp_server.clients[client_name] = client_class(
3227
name=client_name,
3228
settings=client,
3229
server_settings=server_settings)
3230
2674
name = client_name, settings = client,
2675
server_settings = server_settings)
2676
3231
2677
if not tcp_server.clients:
3232
2678
logger.warning("No clients defined")
3233
2679
3234
2680
if not foreground:
3235
2681
if pidfile is not None:
3236
pid = os.getpid()
3237
2682
try:
3238
2683
with pidfile:
3239
print(pid, file=pidfile)
2684
pid = os.getpid()
2685
pidfile.write("{}\n".format(pid).encode("utf-8"))
3240
2686
except IOError:
3241
2687
logger.error("Could not write to file %r with PID %d",
3242
2688
pidfilename, pid)
3243
2689
del pidfile
3244
2690
del pidfilename
3245
3246
for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
lambda: main_loop.quit() and False)
3249
2691
2692
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2693
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2694
3250
2695
if use_dbus:
3251
3252
@alternate_dbus_interfaces(
3253
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3254
class MandosDBusService(DBusObjectWithObjectManager):
2696
@alternate_dbus_interfaces({"se.recompile.Mandos":
2697
"se.bsnet.fukt.Mandos"})
2698
class MandosDBusService(DBusObjectWithProperties):
3255
2699
"""A D-Bus proxy object"""
3256
3257
2700
def __init__(self):
3258
2701
dbus.service.Object.__init__(self, bus, "/")
3259
3260
2702
_interface = "se.recompile.Mandos"
3261
2703
2704
@dbus_interface_annotations(_interface)
2705
def _foo(self):
2706
return { "org.freedesktop.DBus.Property"
2707
".EmitsChangedSignal":
2708
"false"}
2709
3262
2710
@dbus.service.signal(_interface, signature="o")
3263
2711
def ClientAdded(self, objpath):
3264
2712
"D-Bus signal"
3265
2713
pass
3266
2714
3267
2715
@dbus.service.signal(_interface, signature="ss")
3268
2716
def ClientNotFound(self, fingerprint, address):
3269
2717
"D-Bus signal"
3270
2718
pass
3271
3272
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3273
"true"})
2719
3274
2720
@dbus.service.signal(_interface, signature="os")
3275
2721
def ClientRemoved(self, objpath, name):
3276
2722
"D-Bus signal"
3277
2723
pass
3278
3279
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3280
"true"})
2724
3281
2725
@dbus.service.method(_interface, out_signature="ao")
3282
2726
def GetAllClients(self):
3283
2727
"D-Bus method"
3284
return dbus.Array(c.dbus_object_path for c in
3285
tcp_server.clients.values())
3286
3287
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3288
"true"})
2728
return dbus.Array(c.dbus_object_path
2729
for c in
2730
tcp_server.clients.itervalues())
2731
3289
2732
@dbus.service.method(_interface,
3290
2733
out_signature="a{oa{sv}}")
3291
2734
def GetAllClientsWithProperties(self):
3292
2735
"D-Bus method"
3293
2736
return dbus.Dictionary(
3294
{c.dbus_object_path: c.GetAll(
3295
"se.recompile.Mandos.Client")
3296
for c in tcp_server.clients.values()},
2737
{ c.dbus_object_path: c.GetAll("")
2738
for c in tcp_server.clients.itervalues() },
3297
2739
signature="oa{sv}")
3298
2740
3299
2741
@dbus.service.method(_interface, in_signature="o")
3300
2742
def RemoveClient(self, object_path):
3301
2743
"D-Bus method"
3302
for c in tcp_server.clients.values():
2744
for c in tcp_server.clients.itervalues():
3303
2745
if c.dbus_object_path == object_path:
3304
2746
del tcp_server.clients[c.name]
3305
2747
c.remove_from_connection()
3306
# Don't signal the disabling
2748
# Don't signal anything except ClientRemoved
3307
2749
c.disable(quiet=True)
3308
# Emit D-Bus signal for removal
3309
self.client_removed_signal(c)
2750
# Emit D-Bus signal
2751
self.ClientRemoved(object_path, c.name)
3310
2752
return
3311
2753
raise KeyError(object_path)
3312
2754
3313
2755
del _interface
3314
3315
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3316
out_signature="a{oa{sa{sv}}}")
3317
def GetManagedObjects(self):
3318
"""D-Bus method"""
3319
return dbus.Dictionary(
3320
{client.dbus_object_path:
3321
dbus.Dictionary(
3322
{interface: client.GetAll(interface)
3323
for interface in
3324
client._get_all_interface_names()})
3325
for client in tcp_server.clients.values()})
3326
3327
def client_added_signal(self, client):
3328
"""Send the new standard signal and the old signal"""
3329
if use_dbus:
3330
# New standard signal
3331
self.InterfacesAdded(
3332
client.dbus_object_path,
3333
dbus.Dictionary(
3334
{interface: client.GetAll(interface)
3335
for interface in
3336
client._get_all_interface_names()}))
3337
# Old signal
3338
self.ClientAdded(client.dbus_object_path)
3339
3340
def client_removed_signal(self, client):
3341
"""Send the new standard signal and the old signal"""
3342
if use_dbus:
3343
# New standard signal
3344
self.InterfacesRemoved(
3345
client.dbus_object_path,
3346
client._get_all_interface_names())
3347
# Old signal
3348
self.ClientRemoved(client.dbus_object_path,
3349
client.name)
3350
2756
3351
2757
mandos_dbus_service = MandosDBusService()
3352
3353
# Save modules to variables to exempt the modules from being
3354
# unloaded before the function registered with atexit() is run.
3355
mp = multiprocessing
3356
wn = wnull
3357
2758
3358
2759
def cleanup():
3359
2760
"Cleanup function; run on exit"
3360
2761
if zeroconf:
3361
2762
service.cleanup()
3362
3363
mp.active_children()
3364
wn.close()
2763
2764
multiprocessing.active_children()
2765
wnull.close()
3365
2766
if not (tcp_server.clients or client_settings):
3366
2767
return
3367
2768
3368
2769
# Store client before exiting. Secrets are encrypted with key
3369
2770
# based on what config file has. If config file is
3370
2771
# removed/edited, old secret will thus be unrecovable.
3371
2772
clients = {}
3372
2773
with PGPEngine() as pgp:
3373
for client in tcp_server.clients.values():
2774
for client in tcp_server.clients.itervalues():
3374
2775
key = client_settings[client.name]["secret"]
3375
2776
client.encrypted_secret = pgp.encrypt(client.secret,
3376
2777
key)
3377
2778
client_dict = {}
3378
2779
3379
2780
# A list of attributes that can not be pickled
3380
2781
# + secret.
3381
exclude = {"bus", "changedstate", "secret",
3382
"checker", "server_settings"}
3383
for name, typ in inspect.getmembers(dbus.service
3384
.Object):
2782
exclude = { "bus", "changedstate", "secret",
2783
"checker", "server_settings" }
2784
for name, typ in (inspect.getmembers
2785
(dbus.service.Object)):
3385
2786
exclude.add(name)
3386
2787
3387
2788
client_dict["encrypted_secret"] = (client
3388
2789
.encrypted_secret)
3389
2790
for attr in client.client_structure:
3390
2791
if attr not in exclude:
3391
2792
client_dict[attr] = getattr(client, attr)
3392
2793
3393
2794
clients[client.name] = client_dict
3394
2795
del client_settings[client.name]["secret"]
3395
2796
3396
2797
try:
3397
with tempfile.NamedTemporaryFile(
3398
mode='wb',
3399
suffix=".pickle",
3400
prefix='clients-',
3401
dir=os.path.dirname(stored_state_path),
3402
delete=False) as stored_state:
3403
pickle.dump((clients, client_settings), stored_state,
3404
protocol=2)
3405
tempname = stored_state.name
2798
with (tempfile.NamedTemporaryFile
2799
(mode='wb', suffix=".pickle", prefix='clients-',
2800
dir=os.path.dirname(stored_state_path),
2801
delete=False)) as stored_state:
2802
pickle.dump((clients, client_settings), stored_state)
2803
tempname=stored_state.name
3406
2804
os.rename(tempname, stored_state_path)
3407
2805
except (IOError, OSError) as e:
3408
2806
if not debug:
3417
2815
logger.warning("Could not save persistent state:",
3418
2816
exc_info=e)
3419
2817
raise
3420
2818
3421
2819
# Delete all clients, and settings from config
3422
2820
while tcp_server.clients:
3423
2821
name, client = tcp_server.clients.popitem()
3424
2822
if use_dbus:
3425
2823
client.remove_from_connection()
3426
# Don't signal the disabling
2824
# Don't signal anything except ClientRemoved
3427
2825
client.disable(quiet=True)
3428
# Emit D-Bus signal for removal
3429
2826
if use_dbus:
3430
mandos_dbus_service.client_removed_signal(client)
2827
# Emit D-Bus signal
2828
mandos_dbus_service.ClientRemoved(client
2829
.dbus_object_path,
2830
client.name)
3431
2831
client_settings.clear()
3432
2832
3433
2833
atexit.register(cleanup)
3434
3435
for client in tcp_server.clients.values():
2834
2835
for client in tcp_server.clients.itervalues():
3436
2836
if use_dbus:
3437
# Emit D-Bus signal for adding
3438
mandos_dbus_service.client_added_signal(client)
2837
# Emit D-Bus signal
2838
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3439
2839
# Need to initiate checking of clients
3440
2840
if client.enabled:
3441
2841
client.init_checker()
3442
2842
3443
2843
tcp_server.enable()
3444
2844
tcp_server.server_activate()
3445
2845
3446
2846
# Find out what port we got
3447
2847
if zeroconf:
3448
2848
service.port = tcp_server.socket.getsockname()[1]
3453
2853
else: # IPv4
3454
2854
logger.info("Now listening on address %r, port %d",
3455
2855
*tcp_server.socket.getsockname())
3456
3457
# service.interface = tcp_server.socket.getsockname()[3]
3458
2856
2857
#service.interface = tcp_server.socket.getsockname()[3]
2858
3459
2859
try:
3460
2860
if zeroconf:
3461
2861
# From the Avahi example code
3466
2866
cleanup()
3467
2867
sys.exit(1)
3468
2868
# End of Avahi example code
3469
3470
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
lambda *args, **kwargs:
3472
(tcp_server.handle_request
3473
(*args[2:], **kwargs) or True))
3474
2869
2870
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2871
lambda *args, **kwargs:
2872
(tcp_server.handle_request
2873
(*args[2:], **kwargs) or True))
2874
3475
2875
logger.debug("Starting main loop")
3476
2876
main_loop.run()
3477
2877
except AvahiError as error:
3486
2886
# Must run before the D-Bus bus name gets deregistered
3487
2887
cleanup()
3488
2888
3489
3490
2889
if __name__ == '__main__':
3491
2890
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0