To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 746
- compare with another revision
- download diff
- download tarball
- view history from revision 746
- Committer: Teddy Hogeborn
- Date: 2015-04-03 03:01:02 UTC
- Revision ID: teddy@recompile.se-20150403030102-xdxyaqcwc4wmqeyb
mandos: Do minor formatting and whitespace adjustments.
- files added:
- DBUS-API
- debian/source
- debian/upstream
- network-hooks.d
- files removed:
- plugins.d/plymouth
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
36
37
from future_builtins import *
35
38
36
39
import SocketServer as socketserver
37
40
import socket
38
import optparse
41
import argparse
39
42
import datetime
40
43
import errno
41
44
import gnutls.crypto
61
64
import functools
62
65
import cPickle as pickle
63
66
import multiprocessing
67
import types
68
import binascii
69
import tempfile
70
import itertools
71
import collections
64
72
65
73
import dbus
66
74
import dbus.service
80
88
except ImportError:
81
89
SO_BINDTODEVICE = None
82
90
83
84
version = "1.0.14"
85
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
syslogger = (logging.handlers.SysLogHandler
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
91
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
logger.addHandler(syslogger)
95
96
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
100
logger.addHandler(console)
91
if sys.version_info.major == 2:
92
str = unicode
93
94
version = "1.6.9"
95
stored_state_file = "clients.pickle"
96
97
logger = logging.getLogger()
98
syslogger = None
99
100
try:
101
if_nametoindex = ctypes.cdll.LoadLibrary(
102
ctypes.util.find_library("c")).if_nametoindex
103
except (OSError, AttributeError):
104
105
def if_nametoindex(interface):
106
"Get an interface index the hard way, i.e. using fcntl()"
107
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
108
with contextlib.closing(socket.socket()) as s:
109
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
110
struct.pack(b"16s16x", interface))
111
interface_index = struct.unpack("I", ifreq[16:20])[0]
112
return interface_index
113
114
115
def initlogger(debug, level=logging.WARNING):
116
"""init logger and add loglevel"""
117
118
global syslogger
119
syslogger = (logging.handlers.SysLogHandler(
120
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = "/dev/log"))
122
syslogger.setFormatter(logging.Formatter
123
('Mandos [%(process)d]: %(levelname)s:'
124
' %(message)s'))
125
logger.addHandler(syslogger)
126
127
if debug:
128
console = logging.StreamHandler()
129
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
' [%(process)d]:'
131
' %(levelname)s:'
132
' %(message)s'))
133
logger.addHandler(console)
134
logger.setLevel(level)
135
136
137
class PGPError(Exception):
138
"""Exception if encryption/decryption fails"""
139
pass
140
141
142
class PGPEngine(object):
143
"""A simple class for OpenPGP symmetric encryption & decryption"""
144
145
def __init__(self):
146
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
self.gnupgargs = ['--batch',
148
'--home', self.tempdir,
149
'--force-mdc',
150
'--quiet',
151
'--no-use-agent']
152
153
def __enter__(self):
154
return self
155
156
def __exit__(self, exc_type, exc_value, traceback):
157
self._cleanup()
158
return False
159
160
def __del__(self):
161
self._cleanup()
162
163
def _cleanup(self):
164
if self.tempdir is not None:
165
# Delete contents of tempdir
166
for root, dirs, files in os.walk(self.tempdir,
167
topdown = False):
168
for filename in files:
169
os.remove(os.path.join(root, filename))
170
for dirname in dirs:
171
os.rmdir(os.path.join(root, dirname))
172
# Remove tempdir
173
os.rmdir(self.tempdir)
174
self.tempdir = None
175
176
def password_encode(self, password):
177
# Passphrase can not be empty and can not contain newlines or
178
# NUL bytes. So we prefix it and hex encode it.
179
encoded = b"mandos" + binascii.hexlify(password)
180
if len(encoded) > 2048:
181
# GnuPG can't handle long passwords, so encode differently
182
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
183
.replace(b"\n", b"\\n")
184
.replace(b"\0", b"\\x00"))
185
return encoded
186
187
def encrypt(self, data, password):
188
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(
190
dir=self.tempdir) as passfile:
191
passfile.write(passphrase)
192
passfile.flush()
193
proc = subprocess.Popen(['gpg', '--symmetric',
194
'--passphrase-file',
195
passfile.name]
196
+ self.gnupgargs,
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
201
if proc.returncode != 0:
202
raise PGPError(err)
203
return ciphertext
204
205
def decrypt(self, data, password):
206
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(
208
dir = self.tempdir) as passfile:
209
passfile.write(passphrase)
210
passfile.flush()
211
proc = subprocess.Popen(['gpg', '--decrypt',
212
'--passphrase-file',
213
passfile.name]
214
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input = data)
219
if proc.returncode != 0:
220
raise PGPError(err)
221
return decrypted_plaintext
222
101
223
102
224
class AvahiError(Exception):
103
225
def __init__(self, value, *args, **kwargs):
104
226
self.value = value
105
super(AvahiError, self).__init__(value, *args, **kwargs)
106
def __unicode__(self):
107
return unicode(repr(self.value))
227
return super(AvahiError, self).__init__(value, *args,
228
**kwargs)
229
108
230
109
231
class AvahiServiceError(AvahiError):
110
232
pass
111
233
234
112
235
class AvahiGroupError(AvahiError):
113
236
pass
114
237
119
242
Attributes:
120
243
interface: integer; avahi.IF_UNSPEC or an interface index.
121
244
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
124
See <http://www.dns-sd.org/ServiceTypes.html>
245
name: string; Example: 'Mandos'
246
type: string; Example: '_mandos._tcp'.
247
See <https://www.iana.org/assignments/service-names-port-numbers>
125
248
port: integer; what port to announce
126
249
TXT: list of strings; TXT record for the service
127
250
domain: string; Domain to publish on, default to .local if empty.
133
256
server: D-Bus Server
134
257
bus: dbus.SystemBus()
135
258
"""
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
servicetype = None, port = None, TXT = None,
138
domain = u"", host = u"", max_renames = 32768,
139
protocol = avahi.PROTO_UNSPEC, bus = None):
259
260
def __init__(self,
261
interface = avahi.IF_UNSPEC,
262
name = None,
263
servicetype = None,
264
port = None,
265
TXT = None,
266
domain = "",
267
host = "",
268
max_renames = 32768,
269
protocol = avahi.PROTO_UNSPEC,
270
bus = None):
140
271
self.interface = interface
141
272
self.name = name
142
273
self.type = servicetype
150
281
self.group = None # our entry group
151
282
self.server = None
152
283
self.bus = bus
153
def rename(self):
284
self.entry_group_state_changed_match = None
285
286
def rename(self, remove=True):
154
287
"""Derived from the Avahi example code"""
155
288
if self.rename_count >= self.max_renames:
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
289
logger.critical("No suitable Zeroconf service name found"
290
" after %i retries, exiting.",
158
291
self.rename_count)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
292
raise AvahiServiceError("Too many renames")
293
self.name = str(
294
self.server.GetAlternativeServiceName(self.name))
295
self.rename_count += 1
296
logger.info("Changing Zeroconf service name to %r ...",
162
297
self.name)
163
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
166
% self.name))
167
self.remove()
168
self.add()
169
self.rename_count += 1
298
if remove:
299
self.remove()
300
try:
301
self.add()
302
except dbus.exceptions.DBusException as error:
303
if (error.get_dbus_name()
304
== "org.freedesktop.Avahi.CollisionError"):
305
logger.info("Local Zeroconf service name collision.")
306
return self.rename(remove=False)
307
else:
308
logger.critical("D-Bus Exception", exc_info=error)
309
self.cleanup()
310
os._exit(1)
311
170
312
def remove(self):
171
313
"""Derived from the Avahi example code"""
314
if self.entry_group_state_changed_match is not None:
315
self.entry_group_state_changed_match.remove()
316
self.entry_group_state_changed_match = None
172
317
if self.group is not None:
173
318
self.group.Reset()
319
174
320
def add(self):
175
321
"""Derived from the Avahi example code"""
322
self.remove()
176
323
if self.group is None:
177
324
self.group = dbus.Interface(
178
325
self.bus.get_object(avahi.DBUS_NAME,
179
326
self.server.EntryGroupNew()),
180
327
avahi.DBUS_INTERFACE_ENTRY_GROUP)
181
self.group.connect_to_signal('StateChanged',
182
self
183
.entry_group_state_changed)
184
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
328
self.entry_group_state_changed_match = (
329
self.group.connect_to_signal(
330
'StateChanged', self.entry_group_state_changed))
331
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
185
332
self.name, self.type)
186
333
self.group.AddService(
187
334
self.interface,
192
339
dbus.UInt16(self.port),
193
340
avahi.string_array_to_txt_array(self.TXT))
194
341
self.group.Commit()
342
195
343
def entry_group_state_changed(self, state, error):
196
344
"""Derived from the Avahi example code"""
197
logger.debug(u"Avahi state change: %i", state)
345
logger.debug("Avahi entry group state change: %i", state)
198
346
199
347
if state == avahi.ENTRY_GROUP_ESTABLISHED:
200
logger.debug(u"Zeroconf service established.")
348
logger.debug("Zeroconf service established.")
201
349
elif state == avahi.ENTRY_GROUP_COLLISION:
202
logger.warning(u"Zeroconf service name collision.")
350
logger.info("Zeroconf service name collision.")
203
351
self.rename()
204
352
elif state == avahi.ENTRY_GROUP_FAILURE:
205
logger.critical(u"Avahi: Error in group state changed %s",
206
unicode(error))
207
raise AvahiGroupError(u"State changed: %s"
208
% unicode(error))
353
logger.critical("Avahi: Error in group state changed %s",
354
str(error))
355
raise AvahiGroupError("State changed: {!s}".format(error))
356
209
357
def cleanup(self):
210
358
"""Derived from the Avahi example code"""
211
359
if self.group is not None:
212
self.group.Free()
360
try:
361
self.group.Free()
362
except (dbus.exceptions.UnknownMethodException,
363
dbus.exceptions.DBusException):
364
pass
213
365
self.group = None
214
def server_state_changed(self, state):
366
self.remove()
367
368
def server_state_changed(self, state, error=None):
215
369
"""Derived from the Avahi example code"""
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
218
self.remove()
370
logger.debug("Avahi server state change: %i", state)
371
bad_states = {
372
avahi.SERVER_INVALID: "Zeroconf server invalid",
373
avahi.SERVER_REGISTERING: None,
374
avahi.SERVER_COLLISION: "Zeroconf server name collision",
375
avahi.SERVER_FAILURE: "Zeroconf server failure",
376
}
377
if state in bad_states:
378
if bad_states[state] is not None:
379
if error is None:
380
logger.error(bad_states[state])
381
else:
382
logger.error(bad_states[state] + ": %r", error)
383
self.cleanup()
219
384
elif state == avahi.SERVER_RUNNING:
220
385
self.add()
386
else:
387
if error is None:
388
logger.debug("Unknown state: %r", state)
389
else:
390
logger.debug("Unknown state: %r: %r", state, error)
391
221
392
def activate(self):
222
393
"""Derived from the Avahi example code"""
223
394
if self.server is None:
224
395
self.server = dbus.Interface(
225
396
self.bus.get_object(avahi.DBUS_NAME,
226
avahi.DBUS_PATH_SERVER),
397
avahi.DBUS_PATH_SERVER,
398
follow_name_owner_changes=True),
227
399
avahi.DBUS_INTERFACE_SERVER)
228
self.server.connect_to_signal(u"StateChanged",
229
self.server_state_changed)
400
self.server.connect_to_signal("StateChanged",
401
self.server_state_changed)
230
402
self.server_state_changed(self.server.GetState())
231
403
232
404
405
class AvahiServiceToSyslog(AvahiService):
406
def rename(self, *args, **kwargs):
407
"""Add the new name to the syslog messages"""
408
ret = AvahiService.rename(self, *args, **kwargs)
409
syslogger.setFormatter(logging.Formatter(
410
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
411
.format(self.name)))
412
return ret
413
414
233
415
class Client(object):
234
416
"""A representation of a client host served by this server.
235
417
236
418
Attributes:
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
419
approved: bool(); 'None' if not yet approved/disapproved
420
approval_delay: datetime.timedelta(); Time to wait for approval
421
approval_duration: datetime.timedelta(); Duration of one approval
422
checker: subprocess.Popen(); a running checker process used
423
to see if the client lives.
424
'None' if no process is running.
425
checker_callback_tag: a gobject event source tag, or None
426
checker_command: string; External command which is run to check
427
if client lives. %() expansions are done at
428
runtime with vars(self) as dict, so that for
429
instance %(name)s can be used in the command.
430
checker_initiator_tag: a gobject event source tag, or None
431
created: datetime.datetime(); (UTC) object creation
432
client_structure: Object describing what attributes a client has
433
and is used for storing the client at exit
434
current_checker_command: string; current running checker_command
435
disable_initiator_tag: a gobject event source tag, or None
436
enabled: bool()
239
437
fingerprint: string (40 or 32 hexadecimal digits); used to
240
438
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
439
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
440
interval: datetime.timedelta(); How often to start a new checker
441
last_approval_request: datetime.datetime(); (UTC) or None
246
442
last_checked_ok: datetime.datetime(); (UTC) or None
443
last_checker_status: integer between 0 and 255 reflecting exit
444
status of last checker. -1 reflects crashed
445
checker, -2 means no checker completed yet.
446
last_enabled: datetime.datetime(); (UTC) or None
447
name: string; from the config file, used in log messages and
448
D-Bus identifiers
449
secret: bytestring; sent verbatim (over TLS) to client
247
450
timeout: datetime.timedelta(); How long from last_checked_ok
248
451
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
251
checker: subprocess.Popen(); a running checker process used
252
to see if the client lives.
253
'None' if no process is running.
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
259
runtime with vars(self) as dict, so that for
260
instance %(name)s can be used in the command.
261
current_checker_command: string; current running checker_command
262
approved_delay: datetime.timedelta(); Time to wait for approval
263
_approved: bool(); 'None' if not yet approved/disapproved
264
approved_duration: datetime.timedelta(); Duration of one approval
452
extended_timeout: extra long timeout when secret has been sent
453
runtime_expansions: Allowed attributes for runtime expansion.
454
expires: datetime.datetime(); time (UTC) when a client will be
455
disabled, or None
456
server_settings: The server_settings dict from main()
265
457
"""
266
458
459
runtime_expansions = ("approval_delay", "approval_duration",
460
"created", "enabled", "expires",
461
"fingerprint", "host", "interval",
462
"last_approval_request", "last_checked_ok",
463
"last_enabled", "name", "timeout")
464
client_defaults = {
465
"timeout": "PT5M",
466
"extended_timeout": "PT15M",
467
"interval": "PT2M",
468
"checker": "fping -q -- %%(host)s",
469
"host": "",
470
"approval_delay": "PT0S",
471
"approval_duration": "PT1S",
472
"approved_by_default": "True",
473
"enabled": "True",
474
}
475
267
476
@staticmethod
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
273
274
def timeout_milliseconds(self):
275
"Return the 'timeout' attribute in milliseconds"
276
return self._timedelta_to_milliseconds(self.timeout)
277
278
def interval_milliseconds(self):
279
"Return the 'interval' attribute in milliseconds"
280
return self._timedelta_to_milliseconds(self.interval)
281
282
def approved_delay_milliseconds(self):
283
return self._timedelta_to_milliseconds(self.approved_delay)
284
285
def __init__(self, name = None, disable_hook=None, config=None):
286
"""Note: the 'checker' key in 'config' sets the
287
'checker_command' attribute and *not* the 'checker'
288
attribute."""
477
def config_parser(config):
478
"""Construct a new dict of client settings of this form:
479
{ client_name: {setting_name: value, ...}, ...}
480
with exceptions for any special settings as defined above.
481
NOTE: Must be a pure function. Must return the same result
482
value given the same arguments.
483
"""
484
settings = {}
485
for client_name in config.sections():
486
section = dict(config.items(client_name))
487
client = settings[client_name] = {}
488
489
client["host"] = section["host"]
490
# Reformat values from string types to Python types
491
client["approved_by_default"] = config.getboolean(
492
client_name, "approved_by_default")
493
client["enabled"] = config.getboolean(client_name,
494
"enabled")
495
496
# Uppercase and remove spaces from fingerprint for later
497
# comparison purposes with return value from the
498
# fingerprint() function
499
client["fingerprint"] = (section["fingerprint"].upper()
500
.replace(" ", ""))
501
if "secret" in section:
502
client["secret"] = section["secret"].decode("base64")
503
elif "secfile" in section:
504
with open(os.path.expanduser(os.path.expandvars
505
(section["secfile"])),
506
"rb") as secfile:
507
client["secret"] = secfile.read()
508
else:
509
raise TypeError("No secret or secfile for section {}"
510
.format(section))
511
client["timeout"] = string_to_delta(section["timeout"])
512
client["extended_timeout"] = string_to_delta(
513
section["extended_timeout"])
514
client["interval"] = string_to_delta(section["interval"])
515
client["approval_delay"] = string_to_delta(
516
section["approval_delay"])
517
client["approval_duration"] = string_to_delta(
518
section["approval_duration"])
519
client["checker_command"] = section["checker"]
520
client["last_approval_request"] = None
521
client["last_checked_ok"] = None
522
client["last_checker_status"] = -2
523
524
return settings
525
526
def __init__(self, settings, name = None, server_settings=None):
289
527
self.name = name
290
if config is None:
291
config = {}
292
logger.debug(u"Creating client %r", self.name)
293
# Uppercase and remove spaces from fingerprint for later
294
# comparison purposes with return value from the fingerprint()
295
# function
296
self.fingerprint = (config[u"fingerprint"].upper()
297
.replace(u" ", u""))
298
logger.debug(u" Fingerprint: %s", self.fingerprint)
299
if u"secret" in config:
300
self.secret = config[u"secret"].decode(u"base64")
301
elif u"secfile" in config:
302
with open(os.path.expanduser(os.path.expandvars
303
(config[u"secfile"])),
304
"rb") as secfile:
305
self.secret = secfile.read()
528
if server_settings is None:
529
server_settings = {}
530
self.server_settings = server_settings
531
# adding all client settings
532
for setting, value in settings.items():
533
setattr(self, setting, value)
534
535
if self.enabled:
536
if not hasattr(self, "last_enabled"):
537
self.last_enabled = datetime.datetime.utcnow()
538
if not hasattr(self, "expires"):
539
self.expires = (datetime.datetime.utcnow()
540
+ self.timeout)
306
541
else:
307
raise TypeError(u"No secret or secfile for client %s"
308
% self.name)
309
self.host = config.get(u"host", u"")
310
self.created = datetime.datetime.utcnow()
311
self.enabled = False
312
self.last_enabled = None
313
self.last_checked_ok = None
314
self.timeout = string_to_delta(config[u"timeout"])
315
self.interval = string_to_delta(config[u"interval"])
316
self.disable_hook = disable_hook
542
self.last_enabled = None
543
self.expires = None
544
545
logger.debug("Creating client %r", self.name)
546
logger.debug(" Fingerprint: %s", self.fingerprint)
547
self.created = settings.get("created",
548
datetime.datetime.utcnow())
549
550
# attributes specific for this server instance
317
551
self.checker = None
318
552
self.checker_initiator_tag = None
319
553
self.disable_initiator_tag = None
320
554
self.checker_callback_tag = None
321
self.checker_command = config[u"checker"]
322
555
self.current_checker_command = None
323
self.last_connect = None
324
self._approved = None
325
self.approved_by_default = config.get(u"approved_by_default",
326
True)
556
self.approved = None
327
557
self.approvals_pending = 0
328
self.approved_delay = string_to_delta(
329
config[u"approved_delay"])
330
self.approved_duration = string_to_delta(
331
config[u"approved_duration"])
332
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
558
self.changedstate = multiprocessing_manager.Condition(
559
multiprocessing_manager.Lock())
560
self.client_structure = [attr
561
for attr in self.__dict__.iterkeys()
562
if not attr.startswith("_")]
563
self.client_structure.append("client_structure")
564
565
for name, t in inspect.getmembers(
566
type(self), lambda obj: isinstance(obj, property)):
567
if not name.startswith("_"):
568
self.client_structure.append(name)
333
569
570
# Send notice to process children that client state has changed
334
571
def send_changedstate(self):
335
self.changedstate.acquire()
336
self.changedstate.notify_all()
337
self.changedstate.release()
338
572
with self.changedstate:
573
self.changedstate.notify_all()
574
339
575
def enable(self):
340
576
"""Start this client's checker and timeout hooks"""
341
if getattr(self, u"enabled", False):
577
if getattr(self, "enabled", False):
342
578
# Already enabled
343
579
return
344
self.send_changedstate()
580
self.expires = datetime.datetime.utcnow() + self.timeout
581
self.enabled = True
345
582
self.last_enabled = datetime.datetime.utcnow()
346
# Schedule a new checker to be started an 'interval' from now,
347
# and every interval from then on.
348
self.checker_initiator_tag = (gobject.timeout_add
349
(self.interval_milliseconds(),
350
self.start_checker))
351
# Schedule a disable() when 'timeout' has passed
352
self.disable_initiator_tag = (gobject.timeout_add
353
(self.timeout_milliseconds(),
354
self.disable))
355
self.enabled = True
356
# Also start a new checker *right now*.
357
self.start_checker()
583
self.init_checker()
584
self.send_changedstate()
358
585
359
586
def disable(self, quiet=True):
360
587
"""Disable this client."""
361
588
if not getattr(self, "enabled", False):
362
589
return False
363
590
if not quiet:
591
logger.info("Disabling client %s", self.name)
592
if getattr(self, "disable_initiator_tag", None) is not None:
593
gobject.source_remove(self.disable_initiator_tag)
594
self.disable_initiator_tag = None
595
self.expires = None
596
if getattr(self, "checker_initiator_tag", None) is not None:
597
gobject.source_remove(self.checker_initiator_tag)
598
self.checker_initiator_tag = None
599
self.stop_checker()
600
self.enabled = False
601
if not quiet:
364
602
self.send_changedstate()
365
if not quiet:
366
logger.info(u"Disabling client %s", self.name)
367
if getattr(self, u"disable_initiator_tag", False):
368
gobject.source_remove(self.disable_initiator_tag)
369
self.disable_initiator_tag = None
370
if getattr(self, u"checker_initiator_tag", False):
371
gobject.source_remove(self.checker_initiator_tag)
372
self.checker_initiator_tag = None
373
self.stop_checker()
374
if self.disable_hook:
375
self.disable_hook(self)
376
self.enabled = False
377
603
# Do not run this again if called by a gobject.timeout_add
378
604
return False
379
605
380
606
def __del__(self):
381
self.disable_hook = None
382
607
self.disable()
383
608
609
def init_checker(self):
610
# Schedule a new checker to be started an 'interval' from now,
611
# and every interval from then on.
612
if self.checker_initiator_tag is not None:
613
gobject.source_remove(self.checker_initiator_tag)
614
self.checker_initiator_tag = gobject.timeout_add(
615
int(self.interval.total_seconds() * 1000),
616
self.start_checker)
617
# Schedule a disable() when 'timeout' has passed
618
if self.disable_initiator_tag is not None:
619
gobject.source_remove(self.disable_initiator_tag)
620
self.disable_initiator_tag = gobject.timeout_add(
621
int(self.timeout.total_seconds() * 1000), self.disable)
622
# Also start a new checker *right now*.
623
self.start_checker()
624
384
625
def checker_callback(self, pid, condition, command):
385
626
"""The checker has completed, so take appropriate actions."""
386
627
self.checker_callback_tag = None
387
628
self.checker = None
388
629
if os.WIFEXITED(condition):
389
exitstatus = os.WEXITSTATUS(condition)
390
if exitstatus == 0:
391
logger.info(u"Checker for %(name)s succeeded",
630
self.last_checker_status = os.WEXITSTATUS(condition)
631
if self.last_checker_status == 0:
632
logger.info("Checker for %(name)s succeeded",
392
633
vars(self))
393
634
self.checked_ok()
394
635
else:
395
logger.info(u"Checker for %(name)s failed",
396
vars(self))
636
logger.info("Checker for %(name)s failed", vars(self))
397
637
else:
398
logger.warning(u"Checker for %(name)s crashed?",
638
self.last_checker_status = -1
639
logger.warning("Checker for %(name)s crashed?",
399
640
vars(self))
400
641
401
642
def checked_ok(self):
402
"""Bump up the timeout for this client.
403
404
This should only be called when the client has been seen,
405
alive and well.
406
"""
643
"""Assert that the client has been seen, alive and well."""
407
644
self.last_checked_ok = datetime.datetime.utcnow()
408
gobject.source_remove(self.disable_initiator_tag)
409
self.disable_initiator_tag = (gobject.timeout_add
410
(self.timeout_milliseconds(),
411
self.disable))
645
self.last_checker_status = 0
646
self.bump_timeout()
647
648
def bump_timeout(self, timeout=None):
649
"""Bump up the timeout for this client."""
650
if timeout is None:
651
timeout = self.timeout
652
if self.disable_initiator_tag is not None:
653
gobject.source_remove(self.disable_initiator_tag)
654
self.disable_initiator_tag = None
655
if getattr(self, "enabled", False):
656
self.disable_initiator_tag = gobject.timeout_add(
657
int(timeout.total_seconds() * 1000), self.disable)
658
self.expires = datetime.datetime.utcnow() + timeout
659
660
def need_approval(self):
661
self.last_approval_request = datetime.datetime.utcnow()
412
662
413
663
def start_checker(self):
414
664
"""Start a new checker subprocess if one is not running.
416
666
If a checker already exists, leave it running and do
417
667
nothing."""
418
668
# The reason for not killing a running checker is that if we
419
# did that, then if a checker (for some reason) started
420
# running slowly and taking more than 'interval' time, the
421
# client would inevitably timeout, since no checker would get
422
# a chance to run to completion. If we instead leave running
669
# did that, and if a checker (for some reason) started running
670
# slowly and taking more than 'interval' time, then the client
671
# would inevitably timeout, since no checker would get a
672
# chance to run to completion. If we instead leave running
423
673
# checkers alone, the checker would have to take more time
424
674
# than 'timeout' for the client to be disabled, which is as it
425
675
# should be.
427
677
# If a checker exists, make sure it is not a zombie
428
678
try:
429
679
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
430
except (AttributeError, OSError), error:
431
if (isinstance(error, OSError)
432
and error.errno != errno.ECHILD):
433
raise error
680
except AttributeError:
681
pass
682
except OSError as error:
683
if error.errno != errno.ECHILD:
684
raise
434
685
else:
435
686
if pid:
436
logger.warning(u"Checker was a zombie")
687
logger.warning("Checker was a zombie")
437
688
gobject.source_remove(self.checker_callback_tag)
438
689
self.checker_callback(pid, status,
439
690
self.current_checker_command)
440
691
# Start a new checker if needed
441
692
if self.checker is None:
693
# Escape attributes for the shell
694
escaped_attrs = {
695
attr: re.escape(str(getattr(self, attr)))
696
for attr in self.runtime_expansions }
442
697
try:
443
# In case checker_command has exactly one % operator
444
command = self.checker_command % self.host
445
except TypeError:
446
# Escape attributes for the shell
447
escaped_attrs = dict((key,
448
re.escape(unicode(str(val),
449
errors=
450
u'replace')))
451
for key, val in
452
vars(self).iteritems())
453
try:
454
command = self.checker_command % escaped_attrs
455
except TypeError, error:
456
logger.error(u'Could not format string "%s":'
457
u' %s', self.checker_command, error)
458
return True # Try again later
698
command = self.checker_command % escaped_attrs
699
except TypeError as error:
700
logger.error('Could not format string "%s"',
701
self.checker_command,
702
exc_info=error)
703
return True # Try again later
459
704
self.current_checker_command = command
460
705
try:
461
logger.info(u"Starting checker %r for %s",
462
command, self.name)
706
logger.info("Starting checker %r for %s", command,
707
self.name)
463
708
# We don't need to redirect stdout and stderr, since
464
709
# in normal mode, that is already done by daemon(),
465
710
# and in debug mode we don't want to. (Stdin is
466
711
# always replaced by /dev/null.)
712
# The exception is when not debugging but nevertheless
713
# running in the foreground; use the previously
714
# created wnull.
715
popen_args = {}
716
if (not self.server_settings["debug"]
717
and self.server_settings["foreground"]):
718
popen_args.update({"stdout": wnull,
719
"stderr": wnull })
467
720
self.checker = subprocess.Popen(command,
468
721
close_fds=True,
469
shell=True, cwd=u"/")
470
self.checker_callback_tag = (gobject.child_watch_add
471
(self.checker.pid,
472
self.checker_callback,
473
data=command))
474
# The checker may have completed before the gobject
475
# watch was added. Check for this.
722
shell=True,
723
cwd="/",
724
**popen_args)
725
except OSError as error:
726
logger.error("Failed to start subprocess",
727
exc_info=error)
728
return True
729
self.checker_callback_tag = gobject.child_watch_add(
730
self.checker.pid, self.checker_callback, data=command)
731
# The checker may have completed before the gobject
732
# watch was added. Check for this.
733
try:
476
734
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
477
if pid:
478
gobject.source_remove(self.checker_callback_tag)
479
self.checker_callback(pid, status, command)
480
except OSError, error:
481
logger.error(u"Failed to start subprocess: %s",
482
error)
735
except OSError as error:
736
if error.errno == errno.ECHILD:
737
# This should never happen
738
logger.error("Child process vanished",
739
exc_info=error)
740
return True
741
raise
742
if pid:
743
gobject.source_remove(self.checker_callback_tag)
744
self.checker_callback(pid, status, command)
483
745
# Re-run this periodically if run by gobject.timeout_add
484
746
return True
485
747
488
750
if self.checker_callback_tag:
489
751
gobject.source_remove(self.checker_callback_tag)
490
752
self.checker_callback_tag = None
491
if getattr(self, u"checker", None) is None:
753
if getattr(self, "checker", None) is None:
492
754
return
493
logger.debug(u"Stopping checker for %(name)s", vars(self))
755
logger.debug("Stopping checker for %(name)s", vars(self))
494
756
try:
495
os.kill(self.checker.pid, signal.SIGTERM)
757
self.checker.terminate()
496
758
#time.sleep(0.5)
497
759
#if self.checker.poll() is None:
498
# os.kill(self.checker.pid, signal.SIGKILL)
499
except OSError, error:
760
# self.checker.kill()
761
except OSError as error:
500
762
if error.errno != errno.ESRCH: # No such process
501
763
raise
502
764
self.checker = None
503
765
504
def dbus_service_property(dbus_interface, signature=u"v",
505
access=u"readwrite", byte_arrays=False):
766
767
def dbus_service_property(dbus_interface,
768
signature="v",
769
access="readwrite",
770
byte_arrays=False):
506
771
"""Decorators for marking methods of a DBusObjectWithProperties to
507
772
become properties on the D-Bus.
508
773
515
780
"""
516
781
# Encoding deeply encoded byte arrays is not supported yet by the
517
782
# "Set" method, so we fail early here:
518
if byte_arrays and signature != u"ay":
519
raise ValueError(u"Byte arrays not supported for non-'ay'"
520
u" signature %r" % signature)
783
if byte_arrays and signature != "ay":
784
raise ValueError("Byte arrays not supported for non-'ay'"
785
" signature {!r}".format(signature))
786
521
787
def decorator(func):
522
788
func._dbus_is_property = True
523
789
func._dbus_interface = dbus_interface
524
790
func._dbus_signature = signature
525
791
func._dbus_access = access
526
792
func._dbus_name = func.__name__
527
if func._dbus_name.endswith(u"_dbus_property"):
793
if func._dbus_name.endswith("_dbus_property"):
528
794
func._dbus_name = func._dbus_name[:-14]
529
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
530
return func
795
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
796
return func
797
798
return decorator
799
800
801
def dbus_interface_annotations(dbus_interface):
802
"""Decorator for marking functions returning interface annotations
803
804
Usage:
805
806
@dbus_interface_annotations("org.example.Interface")
807
def _foo(self): # Function name does not matter
808
return {"org.freedesktop.DBus.Deprecated": "true",
809
"org.freedesktop.DBus.Property.EmitsChangedSignal":
810
"false"}
811
"""
812
813
def decorator(func):
814
func._dbus_is_interface = True
815
func._dbus_interface = dbus_interface
816
func._dbus_name = dbus_interface
817
return func
818
819
return decorator
820
821
822
def dbus_annotations(annotations):
823
"""Decorator to annotate D-Bus methods, signals or properties
824
Usage:
825
826
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
827
"org.freedesktop.DBus.Property."
828
"EmitsChangedSignal": "false"})
829
@dbus_service_property("org.example.Interface", signature="b",
830
access="r")
831
def Property_dbus_property(self):
832
return dbus.Boolean(False)
833
"""
834
835
def decorator(func):
836
func._dbus_annotations = annotations
837
return func
838
531
839
return decorator
532
840
533
841
534
842
class DBusPropertyException(dbus.exceptions.DBusException):
535
843
"""A base class for D-Bus property-related exceptions
536
844
"""
537
def __unicode__(self):
538
return unicode(str(self))
845
pass
539
846
540
847
541
848
class DBusPropertyAccessException(DBusPropertyException):
552
859
553
860
class DBusObjectWithProperties(dbus.service.Object):
554
861
"""A D-Bus object with properties.
555
862
556
863
Classes inheriting from this can use the dbus_service_property
557
864
decorator to expose methods as D-Bus properties. It exposes the
558
865
standard Get(), Set(), and GetAll() methods on the D-Bus.
559
866
"""
560
867
561
868
@staticmethod
562
def _is_dbus_property(obj):
563
return getattr(obj, u"_dbus_is_property", False)
869
def _is_dbus_thing(thing):
870
"""Returns a function testing if an attribute is a D-Bus thing
871
872
If called like _is_dbus_thing("method") it returns a function
873
suitable for use as predicate to inspect.getmembers().
874
"""
875
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
876
False)
564
877
565
def _get_all_dbus_properties(self):
878
def _get_all_dbus_things(self, thing):
566
879
"""Returns a generator of (name, attribute) pairs
567
880
"""
568
return ((prop._dbus_name, prop)
569
for name, prop in
570
inspect.getmembers(self, self._is_dbus_property))
881
return ((getattr(athing.__get__(self), "_dbus_name", name),
882
athing.__get__(self))
883
for cls in self.__class__.__mro__
884
for name, athing in
885
inspect.getmembers(cls, self._is_dbus_thing(thing)))
571
886
572
887
def _get_dbus_property(self, interface_name, property_name):
573
888
"""Returns a bound method if one exists which is a D-Bus
574
889
property with the specified name and interface.
575
890
"""
576
for name in (property_name,
577
property_name + u"_dbus_property"):
578
prop = getattr(self, name, None)
579
if (prop is None
580
or not self._is_dbus_property(prop)
581
or prop._dbus_name != property_name
582
or (interface_name and prop._dbus_interface
583
and interface_name != prop._dbus_interface)):
584
continue
585
return prop
891
for cls in self.__class__.__mro__:
892
for name, value in inspect.getmembers(
893
cls, self._is_dbus_thing("property")):
894
if (value._dbus_name == property_name
895
and value._dbus_interface == interface_name):
896
return value.__get__(self)
897
586
898
# No such property
587
raise DBusPropertyNotFound(self.dbus_object_path + u":"
588
+ interface_name + u"."
589
+ property_name)
899
raise DBusPropertyNotFound("{}:{}.{}".format(
900
self.dbus_object_path, interface_name, property_name))
590
901
591
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
592
out_signature=u"v")
902
@dbus.service.method(dbus.PROPERTIES_IFACE,
903
in_signature="ss",
904
out_signature="v")
593
905
def Get(self, interface_name, property_name):
594
906
"""Standard D-Bus property Get() method, see D-Bus standard.
595
907
"""
596
908
prop = self._get_dbus_property(interface_name, property_name)
597
if prop._dbus_access == u"write":
909
if prop._dbus_access == "write":
598
910
raise DBusPropertyAccessException(property_name)
599
911
value = prop()
600
if not hasattr(value, u"variant_level"):
912
if not hasattr(value, "variant_level"):
601
913
return value
602
914
return type(value)(value, variant_level=value.variant_level+1)
603
915
604
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
605
917
def Set(self, interface_name, property_name, value):
606
918
"""Standard D-Bus property Set() method, see D-Bus standard.
607
919
"""
608
920
prop = self._get_dbus_property(interface_name, property_name)
609
if prop._dbus_access == u"read":
921
if prop._dbus_access == "read":
610
922
raise DBusPropertyAccessException(property_name)
611
if prop._dbus_get_args_options[u"byte_arrays"]:
923
if prop._dbus_get_args_options["byte_arrays"]:
612
924
# The byte_arrays option is not supported yet on
613
925
# signatures other than "ay".
614
if prop._dbus_signature != u"ay":
615
raise ValueError
616
value = dbus.ByteArray(''.join(unichr(byte)
617
for byte in value))
926
if prop._dbus_signature != "ay":
927
raise ValueError("Byte arrays not supported for non-"
928
"'ay' signature {!r}"
929
.format(prop._dbus_signature))
930
value = dbus.ByteArray(b''.join(chr(byte)
931
for byte in value))
618
932
prop(value)
619
933
620
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
621
out_signature=u"a{sv}")
934
@dbus.service.method(dbus.PROPERTIES_IFACE,
935
in_signature="s",
936
out_signature="a{sv}")
622
937
def GetAll(self, interface_name):
623
938
"""Standard D-Bus property GetAll() method, see D-Bus
624
939
standard.
625
940
626
941
Note: Will not include properties with access="write".
627
942
"""
628
all = {}
629
for name, prop in self._get_all_dbus_properties():
943
properties = {}
944
for name, prop in self._get_all_dbus_things("property"):
630
945
if (interface_name
631
946
and interface_name != prop._dbus_interface):
632
947
# Interface non-empty but did not match
633
948
continue
634
949
# Ignore write-only properties
635
if prop._dbus_access == u"write":
950
if prop._dbus_access == "write":
636
951
continue
637
952
value = prop()
638
if not hasattr(value, u"variant_level"):
639
all[name] = value
953
if not hasattr(value, "variant_level"):
954
properties[name] = value
640
955
continue
641
all[name] = type(value)(value, variant_level=
642
value.variant_level+1)
643
return dbus.Dictionary(all, signature=u"sv")
956
properties[name] = type(value)(
957
value, variant_level = value.variant_level + 1)
958
return dbus.Dictionary(properties, signature="sv")
959
960
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
961
def PropertiesChanged(self, interface_name, changed_properties,
962
invalidated_properties):
963
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
964
standard.
965
"""
966
pass
644
967
645
968
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
646
out_signature=u"s",
969
out_signature="s",
647
970
path_keyword='object_path',
648
971
connection_keyword='connection')
649
972
def Introspect(self, object_path, connection):
650
"""Standard D-Bus method, overloaded to insert property tags.
973
"""Overloading of standard D-Bus method.
974
975
Inserts property tags and interface annotation tags.
651
976
"""
652
977
xmlstring = dbus.service.Object.Introspect(self, object_path,
653
978
connection)
654
979
try:
655
980
document = xml.dom.minidom.parseString(xmlstring)
981
656
982
def make_tag(document, name, prop):
657
e = document.createElement(u"property")
658
e.setAttribute(u"name", name)
659
e.setAttribute(u"type", prop._dbus_signature)
660
e.setAttribute(u"access", prop._dbus_access)
983
e = document.createElement("property")
984
e.setAttribute("name", name)
985
e.setAttribute("type", prop._dbus_signature)
986
e.setAttribute("access", prop._dbus_access)
661
987
return e
662
for if_tag in document.getElementsByTagName(u"interface"):
988
989
for if_tag in document.getElementsByTagName("interface"):
990
# Add property tags
663
991
for tag in (make_tag(document, name, prop)
664
992
for name, prop
665
in self._get_all_dbus_properties()
993
in self._get_all_dbus_things("property")
666
994
if prop._dbus_interface
667
== if_tag.getAttribute(u"name")):
995
== if_tag.getAttribute("name")):
668
996
if_tag.appendChild(tag)
997
# Add annotation tags
998
for typ in ("method", "signal", "property"):
999
for tag in if_tag.getElementsByTagName(typ):
1000
annots = dict()
1001
for name, prop in (self.
1002
_get_all_dbus_things(typ)):
1003
if (name == tag.getAttribute("name")
1004
and prop._dbus_interface
1005
== if_tag.getAttribute("name")):
1006
annots.update(getattr(
1007
prop, "_dbus_annotations", {}))
1008
for name, value in annots.items():
1009
ann_tag = document.createElement(
1010
"annotation")
1011
ann_tag.setAttribute("name", name)
1012
ann_tag.setAttribute("value", value)
1013
tag.appendChild(ann_tag)
1014
# Add interface annotation tags
1015
for annotation, value in dict(
1016
itertools.chain.from_iterable(
1017
annotations().items()
1018
for name, annotations
1019
in self._get_all_dbus_things("interface")
1020
if name == if_tag.getAttribute("name")
1021
)).items():
1022
ann_tag = document.createElement("annotation")
1023
ann_tag.setAttribute("name", annotation)
1024
ann_tag.setAttribute("value", value)
1025
if_tag.appendChild(ann_tag)
669
1026
# Add the names to the return values for the
670
1027
# "org.freedesktop.DBus.Properties" methods
671
if (if_tag.getAttribute(u"name")
672
== u"org.freedesktop.DBus.Properties"):
673
for cn in if_tag.getElementsByTagName(u"method"):
674
if cn.getAttribute(u"name") == u"Get":
675
for arg in cn.getElementsByTagName(u"arg"):
676
if (arg.getAttribute(u"direction")
677
== u"out"):
678
arg.setAttribute(u"name", u"value")
679
elif cn.getAttribute(u"name") == u"GetAll":
680
for arg in cn.getElementsByTagName(u"arg"):
681
if (arg.getAttribute(u"direction")
682
== u"out"):
683
arg.setAttribute(u"name", u"props")
684
xmlstring = document.toxml(u"utf-8")
1028
if (if_tag.getAttribute("name")
1029
== "org.freedesktop.DBus.Properties"):
1030
for cn in if_tag.getElementsByTagName("method"):
1031
if cn.getAttribute("name") == "Get":
1032
for arg in cn.getElementsByTagName("arg"):
1033
if (arg.getAttribute("direction")
1034
== "out"):
1035
arg.setAttribute("name", "value")
1036
elif cn.getAttribute("name") == "GetAll":
1037
for arg in cn.getElementsByTagName("arg"):
1038
if (arg.getAttribute("direction")
1039
== "out"):
1040
arg.setAttribute("name", "props")
1041
xmlstring = document.toxml("utf-8")
685
1042
document.unlink()
686
1043
except (AttributeError, xml.dom.DOMException,
687
xml.parsers.expat.ExpatError), error:
688
logger.error(u"Failed to override Introspection method",
689
error)
1044
xml.parsers.expat.ExpatError) as error:
1045
logger.error("Failed to override Introspection method",
1046
exc_info=error)
690
1047
return xmlstring
691
1048
692
1049
1050
def datetime_to_dbus(dt, variant_level=0):
1051
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1052
if dt is None:
1053
return dbus.String("", variant_level = variant_level)
1054
return dbus.String(dt.isoformat(), variant_level=variant_level)
1055
1056
1057
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1058
"""A class decorator; applied to a subclass of
1059
dbus.service.Object, it will add alternate D-Bus attributes with
1060
interface names according to the "alt_interface_names" mapping.
1061
Usage:
1062
1063
@alternate_dbus_interfaces({"org.example.Interface":
1064
"net.example.AlternateInterface"})
1065
class SampleDBusObject(dbus.service.Object):
1066
@dbus.service.method("org.example.Interface")
1067
def SampleDBusMethod():
1068
pass
1069
1070
The above "SampleDBusMethod" on "SampleDBusObject" will be
1071
reachable via two interfaces: "org.example.Interface" and
1072
"net.example.AlternateInterface", the latter of which will have
1073
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1074
"true", unless "deprecate" is passed with a False value.
1075
1076
This works for methods and signals, and also for D-Bus properties
1077
(from DBusObjectWithProperties) and interfaces (from the
1078
dbus_interface_annotations decorator).
1079
"""
1080
1081
def wrapper(cls):
1082
for orig_interface_name, alt_interface_name in (
1083
alt_interface_names.items()):
1084
attr = {}
1085
interface_names = set()
1086
# Go though all attributes of the class
1087
for attrname, attribute in inspect.getmembers(cls):
1088
# Ignore non-D-Bus attributes, and D-Bus attributes
1089
# with the wrong interface name
1090
if (not hasattr(attribute, "_dbus_interface")
1091
or not attribute._dbus_interface.startswith(
1092
orig_interface_name)):
1093
continue
1094
# Create an alternate D-Bus interface name based on
1095
# the current name
1096
alt_interface = attribute._dbus_interface.replace(
1097
orig_interface_name, alt_interface_name)
1098
interface_names.add(alt_interface)
1099
# Is this a D-Bus signal?
1100
if getattr(attribute, "_dbus_is_signal", False):
1101
# Extract the original non-method undecorated
1102
# function by black magic
1103
nonmethod_func = (dict(
1104
zip(attribute.func_code.co_freevars,
1105
attribute.__closure__))
1106
["func"].cell_contents)
1107
# Create a new, but exactly alike, function
1108
# object, and decorate it to be a new D-Bus signal
1109
# with the alternate D-Bus interface name
1110
new_function = (dbus.service.signal(
1111
alt_interface, attribute._dbus_signature)
1112
(types.FunctionType(
1113
nonmethod_func.func_code,
1114
nonmethod_func.func_globals,
1115
nonmethod_func.func_name,
1116
nonmethod_func.func_defaults,
1117
nonmethod_func.func_closure)))
1118
# Copy annotations, if any
1119
try:
1120
new_function._dbus_annotations = dict(
1121
attribute._dbus_annotations)
1122
except AttributeError:
1123
pass
1124
# Define a creator of a function to call both the
1125
# original and alternate functions, so both the
1126
# original and alternate signals gets sent when
1127
# the function is called
1128
def fixscope(func1, func2):
1129
"""This function is a scope container to pass
1130
func1 and func2 to the "call_both" function
1131
outside of its arguments"""
1132
1133
def call_both(*args, **kwargs):
1134
"""This function will emit two D-Bus
1135
signals by calling func1 and func2"""
1136
func1(*args, **kwargs)
1137
func2(*args, **kwargs)
1138
1139
return call_both
1140
# Create the "call_both" function and add it to
1141
# the class
1142
attr[attrname] = fixscope(attribute, new_function)
1143
# Is this a D-Bus method?
1144
elif getattr(attribute, "_dbus_is_method", False):
1145
# Create a new, but exactly alike, function
1146
# object. Decorate it to be a new D-Bus method
1147
# with the alternate D-Bus interface name. Add it
1148
# to the class.
1149
attr[attrname] = (
1150
dbus.service.method(
1151
alt_interface,
1152
attribute._dbus_in_signature,
1153
attribute._dbus_out_signature)
1154
(types.FunctionType(attribute.func_code,
1155
attribute.func_globals,
1156
attribute.func_name,
1157
attribute.func_defaults,
1158
attribute.func_closure)))
1159
# Copy annotations, if any
1160
try:
1161
attr[attrname]._dbus_annotations = dict(
1162
attribute._dbus_annotations)
1163
except AttributeError:
1164
pass
1165
# Is this a D-Bus property?
1166
elif getattr(attribute, "_dbus_is_property", False):
1167
# Create a new, but exactly alike, function
1168
# object, and decorate it to be a new D-Bus
1169
# property with the alternate D-Bus interface
1170
# name. Add it to the class.
1171
attr[attrname] = (dbus_service_property(
1172
alt_interface, attribute._dbus_signature,
1173
attribute._dbus_access,
1174
attribute._dbus_get_args_options
1175
["byte_arrays"])
1176
(types.FunctionType(
1177
attribute.func_code,
1178
attribute.func_globals,
1179
attribute.func_name,
1180
attribute.func_defaults,
1181
attribute.func_closure)))
1182
# Copy annotations, if any
1183
try:
1184
attr[attrname]._dbus_annotations = dict(
1185
attribute._dbus_annotations)
1186
except AttributeError:
1187
pass
1188
# Is this a D-Bus interface?
1189
elif getattr(attribute, "_dbus_is_interface", False):
1190
# Create a new, but exactly alike, function
1191
# object. Decorate it to be a new D-Bus interface
1192
# with the alternate D-Bus interface name. Add it
1193
# to the class.
1194
attr[attrname] = (
1195
dbus_interface_annotations(alt_interface)
1196
(types.FunctionType(attribute.func_code,
1197
attribute.func_globals,
1198
attribute.func_name,
1199
attribute.func_defaults,
1200
attribute.func_closure)))
1201
if deprecate:
1202
# Deprecate all alternate interfaces
1203
iname="_AlternateDBusNames_interface_annotation{}"
1204
for interface_name in interface_names:
1205
1206
@dbus_interface_annotations(interface_name)
1207
def func(self):
1208
return { "org.freedesktop.DBus.Deprecated":
1209
"true" }
1210
# Find an unused name
1211
for aname in (iname.format(i)
1212
for i in itertools.count()):
1213
if aname not in attr:
1214
attr[aname] = func
1215
break
1216
if interface_names:
1217
# Replace the class with a new subclass of it with
1218
# methods, signals, etc. as created above.
1219
cls = type(b"{}Alternate".format(cls.__name__),
1220
(cls, ), attr)
1221
return cls
1222
1223
return wrapper
1224
1225
1226
@alternate_dbus_interfaces({"se.recompile.Mandos":
1227
"se.bsnet.fukt.Mandos"})
693
1228
class ClientDBus(Client, DBusObjectWithProperties):
694
1229
"""A Client class using D-Bus
695
1230
697
1232
dbus_object_path: dbus.ObjectPath
698
1233
bus: dbus.SystemBus()
699
1234
"""
1235
1236
runtime_expansions = (Client.runtime_expansions
1237
+ ("dbus_object_path", ))
1238
1239
_interface = "se.recompile.Mandos.Client"
1240
700
1241
# dbus.service.Object doesn't use super(), so we can't either.
701
1242
702
1243
def __init__(self, bus = None, *args, **kwargs):
703
self._approvals_pending = 0
704
1244
self.bus = bus
705
1245
Client.__init__(self, *args, **kwargs)
706
1246
# Only now, when this client is initialized, can it show up on
707
1247
# the D-Bus
708
self.dbus_object_path = (dbus.ObjectPath
709
(u"/clients/"
710
+ self.name.replace(u".", u"_")))
1248
client_object_name = str(self.name).translate(
1249
{ord("."): ord("_"),
1250
ord("-"): ord("_")})
1251
self.dbus_object_path = dbus.ObjectPath(
1252
"/clients/" + client_object_name)
711
1253
DBusObjectWithProperties.__init__(self, self.bus,
712
1254
self.dbus_object_path)
713
714
def _get_approvals_pending(self):
715
return self._approvals_pending
716
def _set_approvals_pending(self, value):
717
old_value = self._approvals_pending
718
self._approvals_pending = value
719
bval = bool(value)
720
if (hasattr(self, "dbus_object_path")
721
and bval is not bool(old_value)):
722
dbus_bool = dbus.Boolean(bval, variant_level=1)
723
self.PropertyChanged(dbus.String(u"approved_pending"),
724
dbus_bool)
725
726
approvals_pending = property(_get_approvals_pending,
727
_set_approvals_pending)
728
del _get_approvals_pending, _set_approvals_pending
729
730
@staticmethod
731
def _datetime_to_dbus(dt, variant_level=0):
732
"""Convert a UTC datetime.datetime() to a D-Bus type."""
733
return dbus.String(dt.isoformat(),
734
variant_level=variant_level)
735
736
def enable(self):
737
oldstate = getattr(self, u"enabled", False)
738
r = Client.enable(self)
739
if oldstate != self.enabled:
740
# Emit D-Bus signals
741
self.PropertyChanged(dbus.String(u"enabled"),
742
dbus.Boolean(True, variant_level=1))
743
self.PropertyChanged(
744
dbus.String(u"last_enabled"),
745
self._datetime_to_dbus(self.last_enabled,
746
variant_level=1))
747
return r
748
749
def disable(self, quiet = False):
750
oldstate = getattr(self, u"enabled", False)
751
r = Client.disable(self, quiet=quiet)
752
if not quiet and oldstate != self.enabled:
753
# Emit D-Bus signal
754
self.PropertyChanged(dbus.String(u"enabled"),
755
dbus.Boolean(False, variant_level=1))
756
return r
1255
1256
def notifychangeproperty(transform_func, dbus_name,
1257
type_func=lambda x: x,
1258
variant_level=1,
1259
invalidate_only=False,
1260
_interface=_interface):
1261
""" Modify a variable so that it's a property which announces
1262
its changes to DBus.
1263
1264
transform_fun: Function that takes a value and a variant_level
1265
and transforms it to a D-Bus type.
1266
dbus_name: D-Bus name of the variable
1267
type_func: Function that transform the value before sending it
1268
to the D-Bus. Default: no transform
1269
variant_level: D-Bus variant level. Default: 1
1270
"""
1271
attrname = "_{}".format(dbus_name)
1272
1273
def setter(self, value):
1274
if hasattr(self, "dbus_object_path"):
1275
if (not hasattr(self, attrname) or
1276
type_func(getattr(self, attrname, None))
1277
!= type_func(value)):
1278
if invalidate_only:
1279
self.PropertiesChanged(
1280
_interface, dbus.Dictionary(),
1281
dbus.Array((dbus_name, )))
1282
else:
1283
dbus_value = transform_func(
1284
type_func(value),
1285
variant_level = variant_level)
1286
self.PropertyChanged(dbus.String(dbus_name),
1287
dbus_value)
1288
self.PropertiesChanged(
1289
_interface,
1290
dbus.Dictionary({ dbus.String(dbus_name):
1291
dbus_value }),
1292
dbus.Array())
1293
setattr(self, attrname, value)
1294
1295
return property(lambda self: getattr(self, attrname), setter)
1296
1297
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1298
approvals_pending = notifychangeproperty(dbus.Boolean,
1299
"ApprovalPending",
1300
type_func = bool)
1301
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1302
last_enabled = notifychangeproperty(datetime_to_dbus,
1303
"LastEnabled")
1304
checker = notifychangeproperty(
1305
dbus.Boolean, "CheckerRunning",
1306
type_func = lambda checker: checker is not None)
1307
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1308
"LastCheckedOK")
1309
last_checker_status = notifychangeproperty(dbus.Int16,
1310
"LastCheckerStatus")
1311
last_approval_request = notifychangeproperty(
1312
datetime_to_dbus, "LastApprovalRequest")
1313
approved_by_default = notifychangeproperty(dbus.Boolean,
1314
"ApprovedByDefault")
1315
approval_delay = notifychangeproperty(
1316
dbus.UInt64, "ApprovalDelay",
1317
type_func = lambda td: td.total_seconds() * 1000)
1318
approval_duration = notifychangeproperty(
1319
dbus.UInt64, "ApprovalDuration",
1320
type_func = lambda td: td.total_seconds() * 1000)
1321
host = notifychangeproperty(dbus.String, "Host")
1322
timeout = notifychangeproperty(
1323
dbus.UInt64, "Timeout",
1324
type_func = lambda td: td.total_seconds() * 1000)
1325
extended_timeout = notifychangeproperty(
1326
dbus.UInt64, "ExtendedTimeout",
1327
type_func = lambda td: td.total_seconds() * 1000)
1328
interval = notifychangeproperty(
1329
dbus.UInt64, "Interval",
1330
type_func = lambda td: td.total_seconds() * 1000)
1331
checker_command = notifychangeproperty(dbus.String, "Checker")
1332
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1333
invalidate_only=True)
1334
1335
del notifychangeproperty
757
1336
758
1337
def __del__(self, *args, **kwargs):
759
1338
try:
760
1339
self.remove_from_connection()
761
1340
except LookupError:
762
1341
pass
763
if hasattr(DBusObjectWithProperties, u"__del__"):
1342
if hasattr(DBusObjectWithProperties, "__del__"):
764
1343
DBusObjectWithProperties.__del__(self, *args, **kwargs)
765
1344
Client.__del__(self, *args, **kwargs)
766
1345
768
1347
*args, **kwargs):
769
1348
self.checker_callback_tag = None
770
1349
self.checker = None
771
# Emit D-Bus signal
772
self.PropertyChanged(dbus.String(u"checker_running"),
773
dbus.Boolean(False, variant_level=1))
774
1350
if os.WIFEXITED(condition):
775
1351
exitstatus = os.WEXITSTATUS(condition)
776
1352
# Emit D-Bus signal
786
1362
return Client.checker_callback(self, pid, condition, command,
787
1363
*args, **kwargs)
788
1364
789
def checked_ok(self, *args, **kwargs):
790
r = Client.checked_ok(self, *args, **kwargs)
791
# Emit D-Bus signal
792
self.PropertyChanged(
793
dbus.String(u"last_checked_ok"),
794
(self._datetime_to_dbus(self.last_checked_ok,
795
variant_level=1)))
796
return r
797
798
1365
def start_checker(self, *args, **kwargs):
799
old_checker = self.checker
800
if self.checker is not None:
801
old_checker_pid = self.checker.pid
802
else:
803
old_checker_pid = None
1366
old_checker_pid = getattr(self.checker, "pid", None)
804
1367
r = Client.start_checker(self, *args, **kwargs)
805
1368
# Only if new checker process was started
806
1369
if (self.checker is not None
807
1370
and old_checker_pid != self.checker.pid):
808
1371
# Emit D-Bus signal
809
1372
self.CheckerStarted(self.current_checker_command)
810
self.PropertyChanged(
811
dbus.String(u"checker_running"),
812
dbus.Boolean(True, variant_level=1))
813
1373
return r
814
1374
815
def stop_checker(self, *args, **kwargs):
816
old_checker = getattr(self, u"checker", None)
817
r = Client.stop_checker(self, *args, **kwargs)
818
if (old_checker is not None
819
and getattr(self, u"checker", None) is None):
820
self.PropertyChanged(dbus.String(u"checker_running"),
821
dbus.Boolean(False, variant_level=1))
822
return r
823
824
1375
def _reset_approved(self):
825
self._approved = None
1376
self.approved = None
826
1377
return False
827
1378
828
1379
def approve(self, value=True):
1380
self.approved = value
1381
gobject.timeout_add(int(self.approval_duration.total_seconds()
1382
* 1000), self._reset_approved)
829
1383
self.send_changedstate()
830
self._approved = value
831
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
832
self._reset_approved)
833
834
1384
835
1385
## D-Bus methods, signals & properties
836
_interface = u"se.bsnet.fukt.Mandos.Client"
1386
1387
## Interfaces
837
1388
838
1389
## Signals
839
1390
840
1391
# CheckerCompleted - signal
841
@dbus.service.signal(_interface, signature=u"nxs")
1392
@dbus.service.signal(_interface, signature="nxs")
842
1393
def CheckerCompleted(self, exitcode, waitstatus, command):
843
1394
"D-Bus signal"
844
1395
pass
845
1396
846
1397
# CheckerStarted - signal
847
@dbus.service.signal(_interface, signature=u"s")
1398
@dbus.service.signal(_interface, signature="s")
848
1399
def CheckerStarted(self, command):
849
1400
"D-Bus signal"
850
1401
pass
851
1402
852
1403
# PropertyChanged - signal
853
@dbus.service.signal(_interface, signature=u"sv")
1404
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1405
@dbus.service.signal(_interface, signature="sv")
854
1406
def PropertyChanged(self, property, value):
855
1407
"D-Bus signal"
856
1408
pass
865
1417
pass
866
1418
867
1419
# Rejected - signal
868
@dbus.service.signal(_interface, signature=u"s")
1420
@dbus.service.signal(_interface, signature="s")
869
1421
def Rejected(self, reason):
870
1422
"D-Bus signal"
871
1423
pass
872
1424
873
1425
# NeedApproval - signal
874
@dbus.service.signal(_interface, signature=u"db")
1426
@dbus.service.signal(_interface, signature="tb")
875
1427
def NeedApproval(self, timeout, default):
876
1428
"D-Bus signal"
877
pass
1429
return self.need_approval()
878
1430
879
1431
## Methods
880
1432
881
1433
# Approve - method
882
@dbus.service.method(_interface, in_signature=u"b")
1434
@dbus.service.method(_interface, in_signature="b")
883
1435
def Approve(self, value):
884
1436
self.approve(value)
885
1437
886
1438
# CheckedOK - method
887
1439
@dbus.service.method(_interface)
888
1440
def CheckedOK(self):
889
return self.checked_ok()
1441
self.checked_ok()
890
1442
891
1443
# Enable - method
892
1444
@dbus.service.method(_interface)
913
1465
914
1466
## Properties
915
1467
916
# approved_pending - property
917
@dbus_service_property(_interface, signature=u"b", access=u"read")
918
def approved_pending_dbus_property(self):
1468
# ApprovalPending - property
1469
@dbus_service_property(_interface, signature="b", access="read")
1470
def ApprovalPending_dbus_property(self):
919
1471
return dbus.Boolean(bool(self.approvals_pending))
920
1472
921
# approved_by_default - property
922
@dbus_service_property(_interface, signature=u"b",
923
access=u"readwrite")
924
def approved_by_default_dbus_property(self):
925
return dbus.Boolean(self.approved_by_default)
926
927
# approved_delay - property
928
@dbus_service_property(_interface, signature=u"t",
929
access=u"readwrite")
930
def approved_delay_dbus_property(self):
931
return dbus.UInt64(self.approved_delay_milliseconds())
932
933
# approved_duration - property
934
@dbus_service_property(_interface, signature=u"t",
935
access=u"readwrite")
936
def approved_duration_dbus_property(self):
937
return dbus.UInt64(self._timedelta_to_milliseconds(
938
self.approved_duration))
939
940
# name - property
941
@dbus_service_property(_interface, signature=u"s", access=u"read")
942
def name_dbus_property(self):
1473
# ApprovedByDefault - property
1474
@dbus_service_property(_interface,
1475
signature="b",
1476
access="readwrite")
1477
def ApprovedByDefault_dbus_property(self, value=None):
1478
if value is None: # get
1479
return dbus.Boolean(self.approved_by_default)
1480
self.approved_by_default = bool(value)
1481
1482
# ApprovalDelay - property
1483
@dbus_service_property(_interface,
1484
signature="t",
1485
access="readwrite")
1486
def ApprovalDelay_dbus_property(self, value=None):
1487
if value is None: # get
1488
return dbus.UInt64(self.approval_delay.total_seconds()
1489
* 1000)
1490
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1491
1492
# ApprovalDuration - property
1493
@dbus_service_property(_interface,
1494
signature="t",
1495
access="readwrite")
1496
def ApprovalDuration_dbus_property(self, value=None):
1497
if value is None: # get
1498
return dbus.UInt64(self.approval_duration.total_seconds()
1499
* 1000)
1500
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1501
1502
# Name - property
1503
@dbus_service_property(_interface, signature="s", access="read")
1504
def Name_dbus_property(self):
943
1505
return dbus.String(self.name)
944
1506
945
# fingerprint - property
946
@dbus_service_property(_interface, signature=u"s", access=u"read")
947
def fingerprint_dbus_property(self):
1507
# Fingerprint - property
1508
@dbus_service_property(_interface, signature="s", access="read")
1509
def Fingerprint_dbus_property(self):
948
1510
return dbus.String(self.fingerprint)
949
1511
950
# host - property
951
@dbus_service_property(_interface, signature=u"s",
952
access=u"readwrite")
953
def host_dbus_property(self, value=None):
1512
# Host - property
1513
@dbus_service_property(_interface,
1514
signature="s",
1515
access="readwrite")
1516
def Host_dbus_property(self, value=None):
954
1517
if value is None: # get
955
1518
return dbus.String(self.host)
956
self.host = value
957
# Emit D-Bus signal
958
self.PropertyChanged(dbus.String(u"host"),
959
dbus.String(value, variant_level=1))
960
961
# created - property
962
@dbus_service_property(_interface, signature=u"s", access=u"read")
963
def created_dbus_property(self):
964
return dbus.String(self._datetime_to_dbus(self.created))
965
966
# last_enabled - property
967
@dbus_service_property(_interface, signature=u"s", access=u"read")
968
def last_enabled_dbus_property(self):
969
if self.last_enabled is None:
970
return dbus.String(u"")
971
return dbus.String(self._datetime_to_dbus(self.last_enabled))
972
973
# enabled - property
974
@dbus_service_property(_interface, signature=u"b",
975
access=u"readwrite")
976
def enabled_dbus_property(self, value=None):
1519
self.host = str(value)
1520
1521
# Created - property
1522
@dbus_service_property(_interface, signature="s", access="read")
1523
def Created_dbus_property(self):
1524
return datetime_to_dbus(self.created)
1525
1526
# LastEnabled - property
1527
@dbus_service_property(_interface, signature="s", access="read")
1528
def LastEnabled_dbus_property(self):
1529
return datetime_to_dbus(self.last_enabled)
1530
1531
# Enabled - property
1532
@dbus_service_property(_interface,
1533
signature="b",
1534
access="readwrite")
1535
def Enabled_dbus_property(self, value=None):
977
1536
if value is None: # get
978
1537
return dbus.Boolean(self.enabled)
979
1538
if value:
981
1540
else:
982
1541
self.disable()
983
1542
984
# last_checked_ok - property
985
@dbus_service_property(_interface, signature=u"s",
986
access=u"readwrite")
987
def last_checked_ok_dbus_property(self, value=None):
1543
# LastCheckedOK - property
1544
@dbus_service_property(_interface,
1545
signature="s",
1546
access="readwrite")
1547
def LastCheckedOK_dbus_property(self, value=None):
988
1548
if value is not None:
989
1549
self.checked_ok()
990
1550
return
991
if self.last_checked_ok is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self
994
.last_checked_ok))
995
996
# timeout - property
997
@dbus_service_property(_interface, signature=u"t",
998
access=u"readwrite")
999
def timeout_dbus_property(self, value=None):
1551
return datetime_to_dbus(self.last_checked_ok)
1552
1553
# LastCheckerStatus - property
1554
@dbus_service_property(_interface, signature="n", access="read")
1555
def LastCheckerStatus_dbus_property(self):
1556
return dbus.Int16(self.last_checker_status)
1557
1558
# Expires - property
1559
@dbus_service_property(_interface, signature="s", access="read")
1560
def Expires_dbus_property(self):
1561
return datetime_to_dbus(self.expires)
1562
1563
# LastApprovalRequest - property
1564
@dbus_service_property(_interface, signature="s", access="read")
1565
def LastApprovalRequest_dbus_property(self):
1566
return datetime_to_dbus(self.last_approval_request)
1567
1568
# Timeout - property
1569
@dbus_service_property(_interface,
1570
signature="t",
1571
access="readwrite")
1572
def Timeout_dbus_property(self, value=None):
1000
1573
if value is None: # get
1001
return dbus.UInt64(self.timeout_milliseconds())
1574
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1575
old_timeout = self.timeout
1002
1576
self.timeout = datetime.timedelta(0, 0, 0, value)
1003
# Emit D-Bus signal
1004
self.PropertyChanged(dbus.String(u"timeout"),
1005
dbus.UInt64(value, variant_level=1))
1006
if getattr(self, u"disable_initiator_tag", None) is None:
1007
return
1008
# Reschedule timeout
1009
gobject.source_remove(self.disable_initiator_tag)
1010
self.disable_initiator_tag = None
1011
time_to_die = (self.
1012
_timedelta_to_milliseconds((self
1013
.last_checked_ok
1014
+ self.timeout)
1015
- datetime.datetime
1016
.utcnow()))
1017
if time_to_die <= 0:
1018
# The timeout has passed
1019
self.disable()
1020
else:
1021
self.disable_initiator_tag = (gobject.timeout_add
1022
(time_to_die, self.disable))
1023
1024
# interval - property
1025
@dbus_service_property(_interface, signature=u"t",
1026
access=u"readwrite")
1027
def interval_dbus_property(self, value=None):
1028
if value is None: # get
1029
return dbus.UInt64(self.interval_milliseconds())
1577
# Reschedule disabling
1578
if self.enabled:
1579
now = datetime.datetime.utcnow()
1580
self.expires += self.timeout - old_timeout
1581
if self.expires <= now:
1582
# The timeout has passed
1583
self.disable()
1584
else:
1585
if (getattr(self, "disable_initiator_tag", None)
1586
is None):
1587
return
1588
gobject.source_remove(self.disable_initiator_tag)
1589
self.disable_initiator_tag = gobject.timeout_add(
1590
int((self.expires - now).total_seconds() * 1000),
1591
self.disable)
1592
1593
# ExtendedTimeout - property
1594
@dbus_service_property(_interface,
1595
signature="t",
1596
access="readwrite")
1597
def ExtendedTimeout_dbus_property(self, value=None):
1598
if value is None: # get
1599
return dbus.UInt64(self.extended_timeout.total_seconds()
1600
* 1000)
1601
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1602
1603
# Interval - property
1604
@dbus_service_property(_interface,
1605
signature="t",
1606
access="readwrite")
1607
def Interval_dbus_property(self, value=None):
1608
if value is None: # get
1609
return dbus.UInt64(self.interval.total_seconds() * 1000)
1030
1610
self.interval = datetime.timedelta(0, 0, 0, value)
1031
# Emit D-Bus signal
1032
self.PropertyChanged(dbus.String(u"interval"),
1033
dbus.UInt64(value, variant_level=1))
1034
if getattr(self, u"checker_initiator_tag", None) is None:
1611
if getattr(self, "checker_initiator_tag", None) is None:
1035
1612
return
1036
# Reschedule checker run
1037
gobject.source_remove(self.checker_initiator_tag)
1038
self.checker_initiator_tag = (gobject.timeout_add
1039
(value, self.start_checker))
1040
self.start_checker() # Start one now, too
1041
1042
# checker - property
1043
@dbus_service_property(_interface, signature=u"s",
1044
access=u"readwrite")
1045
def checker_dbus_property(self, value=None):
1613
if self.enabled:
1614
# Reschedule checker run
1615
gobject.source_remove(self.checker_initiator_tag)
1616
self.checker_initiator_tag = gobject.timeout_add(
1617
value, self.start_checker)
1618
self.start_checker() # Start one now, too
1619
1620
# Checker - property
1621
@dbus_service_property(_interface,
1622
signature="s",
1623
access="readwrite")
1624
def Checker_dbus_property(self, value=None):
1046
1625
if value is None: # get
1047
1626
return dbus.String(self.checker_command)
1048
self.checker_command = value
1049
# Emit D-Bus signal
1050
self.PropertyChanged(dbus.String(u"checker"),
1051
dbus.String(self.checker_command,
1052
variant_level=1))
1627
self.checker_command = str(value)
1053
1628
1054
# checker_running - property
1055
@dbus_service_property(_interface, signature=u"b",
1056
access=u"readwrite")
1057
def checker_running_dbus_property(self, value=None):
1629
# CheckerRunning - property
1630
@dbus_service_property(_interface,
1631
signature="b",
1632
access="readwrite")
1633
def CheckerRunning_dbus_property(self, value=None):
1058
1634
if value is None: # get
1059
1635
return dbus.Boolean(self.checker is not None)
1060
1636
if value:
1062
1638
else:
1063
1639
self.stop_checker()
1064
1640
1065
# object_path - property
1066
@dbus_service_property(_interface, signature=u"o", access=u"read")
1067
def object_path_dbus_property(self):
1641
# ObjectPath - property
1642
@dbus_service_property(_interface, signature="o", access="read")
1643
def ObjectPath_dbus_property(self):
1068
1644
return self.dbus_object_path # is already a dbus.ObjectPath
1069
1645
1070
# secret = property
1071
@dbus_service_property(_interface, signature=u"ay",
1072
access=u"write", byte_arrays=True)
1073
def secret_dbus_property(self, value):
1074
self.secret = str(value)
1646
# Secret = property
1647
@dbus_service_property(_interface,
1648
signature="ay",
1649
access="write",
1650
byte_arrays=True)
1651
def Secret_dbus_property(self, value):
1652
self.secret = bytes(value)
1075
1653
1076
1654
del _interface
1077
1655
1082
1660
self._pipe.send(('init', fpr, address))
1083
1661
if not self._pipe.recv():
1084
1662
raise KeyError()
1085
1663
1086
1664
def __getattribute__(self, name):
1087
if(name == '_pipe'):
1665
if name == '_pipe':
1088
1666
return super(ProxyClient, self).__getattribute__(name)
1089
1667
self._pipe.send(('getattr', name))
1090
1668
data = self._pipe.recv()
1091
1669
if data[0] == 'data':
1092
1670
return data[1]
1093
1671
if data[0] == 'function':
1672
1094
1673
def func(*args, **kwargs):
1095
1674
self._pipe.send(('funcall', name, args, kwargs))
1096
1675
return self._pipe.recv()[1]
1676
1097
1677
return func
1098
1678
1099
1679
def __setattr__(self, name, value):
1100
if(name == '_pipe'):
1680
if name == '_pipe':
1101
1681
return super(ProxyClient, self).__setattr__(name, value)
1102
1682
self._pipe.send(('setattr', name, value))
1103
1683
1110
1690
1111
1691
def handle(self):
1112
1692
with contextlib.closing(self.server.child_pipe) as child_pipe:
1113
logger.info(u"TCP connection from: %s",
1114
unicode(self.client_address))
1115
logger.debug(u"Pipe FD: %d",
1693
logger.info("TCP connection from: %s",
1694
str(self.client_address))
1695
logger.debug("Pipe FD: %d",
1116
1696
self.server.child_pipe.fileno())
1117
1118
session = (gnutls.connection
1119
.ClientSession(self.request,
1120
gnutls.connection
1121
.X509Credentials()))
1122
1697
1698
session = gnutls.connection.ClientSession(
1699
self.request, gnutls.connection .X509Credentials())
1700
1123
1701
# Note: gnutls.connection.X509Credentials is really a
1124
1702
# generic GnuTLS certificate credentials object so long as
1125
1703
# no X.509 keys are added to it. Therefore, we can use it
1126
1704
# here despite using OpenPGP certificates.
1127
1128
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1129
# u"+AES-256-CBC", u"+SHA1",
1130
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1131
# u"+DHE-DSS"))
1705
1706
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1707
# "+AES-256-CBC", "+SHA1",
1708
# "+COMP-NULL", "+CTYPE-OPENPGP",
1709
# "+DHE-DSS"))
1132
1710
# Use a fallback default, since this MUST be set.
1133
1711
priority = self.server.gnutls_priority
1134
1712
if priority is None:
1135
priority = u"NORMAL"
1136
(gnutls.library.functions
1137
.gnutls_priority_set_direct(session._c_object,
1138
priority, None))
1139
1713
priority = "NORMAL"
1714
gnutls.library.functions.gnutls_priority_set_direct(
1715
session._c_object, priority, None)
1716
1140
1717
# Start communication using the Mandos protocol
1141
1718
# Get protocol number
1142
1719
line = self.request.makefile().readline()
1143
logger.debug(u"Protocol version: %r", line)
1720
logger.debug("Protocol version: %r", line)
1144
1721
try:
1145
1722
if int(line.strip().split()[0]) > 1:
1146
raise RuntimeError
1147
except (ValueError, IndexError, RuntimeError), error:
1148
logger.error(u"Unknown protocol version: %s", error)
1723
raise RuntimeError(line)
1724
except (ValueError, IndexError, RuntimeError) as error:
1725
logger.error("Unknown protocol version: %s", error)
1149
1726
return
1150
1727
1151
1728
# Start GnuTLS connection
1152
1729
try:
1153
1730
session.handshake()
1154
except gnutls.errors.GNUTLSError, error:
1155
logger.warning(u"Handshake failed: %s", error)
1731
except gnutls.errors.GNUTLSError as error:
1732
logger.warning("Handshake failed: %s", error)
1156
1733
# Do not run session.bye() here: the session is not
1157
1734
# established. Just abandon the request.
1158
1735
return
1159
logger.debug(u"Handshake succeeded")
1160
1736
logger.debug("Handshake succeeded")
1737
1161
1738
approval_required = False
1162
1739
try:
1163
1740
try:
1164
fpr = self.fingerprint(self.peer_certificate
1165
(session))
1166
except (TypeError, gnutls.errors.GNUTLSError), error:
1167
logger.warning(u"Bad certificate: %s", error)
1741
fpr = self.fingerprint(
1742
self.peer_certificate(session))
1743
except (TypeError,
1744
gnutls.errors.GNUTLSError) as error:
1745
logger.warning("Bad certificate: %s", error)
1168
1746
return
1169
logger.debug(u"Fingerprint: %s", fpr)
1170
1747
logger.debug("Fingerprint: %s", fpr)
1748
1171
1749
try:
1172
1750
client = ProxyClient(child_pipe, fpr,
1173
1751
self.client_address)
1174
1752
except KeyError:
1175
1753
return
1176
1754
1177
if client.approved_delay:
1178
delay = client.approved_delay
1755
if client.approval_delay:
1756
delay = client.approval_delay
1179
1757
client.approvals_pending += 1
1180
1758
approval_required = True
1181
1759
1182
1760
while True:
1183
1761
if not client.enabled:
1184
logger.warning(u"Client %s is disabled",
1185
client.name)
1762
logger.info("Client %s is disabled",
1763
client.name)
1186
1764
if self.server.use_dbus:
1187
1765
# Emit D-Bus signal
1188
client.Rejected("Disabled")
1766
client.Rejected("Disabled")
1189
1767
return
1190
1768
1191
if client._approved or not client.approved_delay:
1769
if client.approved or not client.approval_delay:
1192
1770
#We are approved or approval is disabled
1193
1771
break
1194
elif client._approved is None:
1195
logger.info(u"Client %s need approval",
1772
elif client.approved is None:
1773
logger.info("Client %s needs approval",
1196
1774
client.name)
1197
1775
if self.server.use_dbus:
1198
1776
# Emit D-Bus signal
1199
1777
client.NeedApproval(
1200
client.approved_delay_milliseconds(),
1201
client.approved_by_default)
1778
client.approval_delay.total_seconds()
1779
* 1000, client.approved_by_default)
1202
1780
else:
1203
logger.warning(u"Client %s was not approved",
1781
logger.warning("Client %s was not approved",
1204
1782
client.name)
1205
1783
if self.server.use_dbus:
1206
1784
# Emit D-Bus signal
1207
client.Rejected("Disapproved")
1785
client.Rejected("Denied")
1208
1786
return
1209
1787
1210
1788
#wait until timeout or approved
1211
#x = float(client._timedelta_to_milliseconds(delay))
1212
1789
time = datetime.datetime.now()
1213
1790
client.changedstate.acquire()
1214
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1791
client.changedstate.wait(delay.total_seconds())
1215
1792
client.changedstate.release()
1216
1793
time2 = datetime.datetime.now()
1217
1794
if (time2 - time) >= delay:
1221
1798
client.name)
1222
1799
if self.server.use_dbus:
1223
1800
# Emit D-Bus signal
1224
client.Rejected("Time out")
1801
client.Rejected("Approval timed out")
1225
1802
return
1226
1803
else:
1227
1804
break
1232
1809
while sent_size < len(client.secret):
1233
1810
try:
1234
1811
sent = session.send(client.secret[sent_size:])
1235
except (gnutls.errors.GNUTLSError), error:
1236
logger.warning("gnutls send failed")
1812
except gnutls.errors.GNUTLSError as error:
1813
logger.warning("gnutls send failed",
1814
exc_info=error)
1237
1815
return
1238
logger.debug(u"Sent: %d, remaining: %d",
1239
sent, len(client.secret)
1240
- (sent_size + sent))
1816
logger.debug("Sent: %d, remaining: %d", sent,
1817
len(client.secret) - (sent_size
1818
+ sent))
1241
1819
sent_size += sent
1242
1243
logger.info(u"Sending secret to %s", client.name)
1244
# bump the timeout as if seen
1245
client.checked_ok()
1820
1821
logger.info("Sending secret to %s", client.name)
1822
# bump the timeout using extended_timeout
1823
client.bump_timeout(client.extended_timeout)
1246
1824
if self.server.use_dbus:
1247
1825
# Emit D-Bus signal
1248
1826
client.GotSecret()
1252
1830
client.approvals_pending -= 1
1253
1831
try:
1254
1832
session.bye()
1255
except (gnutls.errors.GNUTLSError), error:
1256
logger.warning("gnutls bye failed")
1833
except gnutls.errors.GNUTLSError as error:
1834
logger.warning("GnuTLS bye failed",
1835
exc_info=error)
1257
1836
1258
1837
@staticmethod
1259
1838
def peer_certificate(session):
1260
1839
"Return the peer's OpenPGP certificate as a bytestring"
1261
1840
# If not an OpenPGP certificate...
1262
if (gnutls.library.functions
1263
.gnutls_certificate_type_get(session._c_object)
1841
if (gnutls.library.functions.gnutls_certificate_type_get(
1842
session._c_object)
1264
1843
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1265
1844
# ...do the normal thing
1266
1845
return session.peer_certificate
1269
1848
.gnutls_certificate_get_peers
1270
1849
(session._c_object, ctypes.byref(list_size)))
1271
1850
if not bool(cert_list) and list_size.value != 0:
1272
raise gnutls.errors.GNUTLSError(u"error getting peer"
1273
u" certificate")
1851
raise gnutls.errors.GNUTLSError("error getting peer"
1852
" certificate")
1274
1853
if list_size.value == 0:
1275
1854
return None
1276
1855
cert = cert_list[0]
1280
1859
def fingerprint(openpgp):
1281
1860
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1282
1861
# New GnuTLS "datum" with the OpenPGP public key
1283
datum = (gnutls.library.types
1284
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1285
ctypes.POINTER
1286
(ctypes.c_ubyte)),
1287
ctypes.c_uint(len(openpgp))))
1862
datum = gnutls.library.types.gnutls_datum_t(
1863
ctypes.cast(ctypes.c_char_p(openpgp),
1864
ctypes.POINTER(ctypes.c_ubyte)),
1865
ctypes.c_uint(len(openpgp)))
1288
1866
# New empty GnuTLS certificate
1289
1867
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1290
(gnutls.library.functions
1291
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1868
gnutls.library.functions.gnutls_openpgp_crt_init(
1869
ctypes.byref(crt))
1292
1870
# Import the OpenPGP public key into the certificate
1293
(gnutls.library.functions
1294
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1295
gnutls.library.constants
1296
.GNUTLS_OPENPGP_FMT_RAW))
1871
gnutls.library.functions.gnutls_openpgp_crt_import(
1872
crt, ctypes.byref(datum),
1873
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1297
1874
# Verify the self signature in the key
1298
1875
crtverify = ctypes.c_uint()
1299
(gnutls.library.functions
1300
.gnutls_openpgp_crt_verify_self(crt, 0,
1301
ctypes.byref(crtverify)))
1876
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1877
crt, 0, ctypes.byref(crtverify))
1302
1878
if crtverify.value != 0:
1303
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1304
raise (gnutls.errors.CertificateSecurityError
1305
(u"Verify failed"))
1880
raise gnutls.errors.CertificateSecurityError(
1881
"Verify failed")
1306
1882
# New buffer for the fingerprint
1307
1883
buf = ctypes.create_string_buffer(20)
1308
1884
buf_len = ctypes.c_size_t()
1309
1885
# Get the fingerprint from the certificate into the buffer
1310
(gnutls.library.functions
1311
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1312
ctypes.byref(buf_len)))
1886
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1887
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1313
1888
# Deinit the certificate
1314
1889
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1315
1890
# Convert the buffer to a Python bytestring
1316
1891
fpr = ctypes.string_at(buf, buf_len.value)
1317
1892
# Convert the bytestring to hexadecimal notation
1318
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1893
hex_fpr = binascii.hexlify(fpr).upper()
1319
1894
return hex_fpr
1320
1895
1321
1896
1322
1897
class MultiprocessingMixIn(object):
1323
1898
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1899
1324
1900
def sub_process_main(self, request, address):
1325
1901
try:
1326
1902
self.finish_request(request, address)
1327
except:
1903
except Exception:
1328
1904
self.handle_error(request, address)
1329
1905
self.close_request(request)
1330
1906
1331
1907
def process_request(self, request, address):
1332
1908
"""Start a new process to process the request."""
1333
multiprocessing.Process(target = self.sub_process_main,
1334
args = (request, address)).start()
1909
proc = multiprocessing.Process(target = self.sub_process_main,
1910
args = (request, address))
1911
proc.start()
1912
return proc
1913
1335
1914
1336
1915
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1337
1916
""" adds a pipe to the MixIn """
1917
1338
1918
def process_request(self, request, client_address):
1339
1919
"""Overrides and wraps the original process_request().
1340
1920
1341
1921
This function creates a new pipe in self.pipe
1342
1922
"""
1343
1923
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1344
1345
super(MultiprocessingMixInWithPipe,
1346
self).process_request(request, client_address)
1924
1925
proc = MultiprocessingMixIn.process_request(self, request,
1926
client_address)
1347
1927
self.child_pipe.close()
1348
self.add_pipe(parent_pipe)
1349
1350
def add_pipe(self, parent_pipe):
1928
self.add_pipe(parent_pipe, proc)
1929
1930
def add_pipe(self, parent_pipe, proc):
1351
1931
"""Dummy function; override as necessary"""
1352
pass
1932
raise NotImplementedError()
1933
1353
1934
1354
1935
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1355
1936
socketserver.TCPServer, object):
1360
1941
interface: None or a network interface name (string)
1361
1942
use_ipv6: Boolean; to use IPv6 or not
1362
1943
"""
1944
1363
1945
def __init__(self, server_address, RequestHandlerClass,
1364
interface=None, use_ipv6=True):
1946
interface=None,
1947
use_ipv6=True,
1948
socketfd=None):
1949
"""If socketfd is set, use that file descriptor instead of
1950
creating a new one with socket.socket().
1951
"""
1365
1952
self.interface = interface
1366
1953
if use_ipv6:
1367
1954
self.address_family = socket.AF_INET6
1955
if socketfd is not None:
1956
# Save the file descriptor
1957
self.socketfd = socketfd
1958
# Save the original socket.socket() function
1959
self.socket_socket = socket.socket
1960
# To implement --socket, we monkey patch socket.socket.
1961
#
1962
# (When socketserver.TCPServer is a new-style class, we
1963
# could make self.socket into a property instead of monkey
1964
# patching socket.socket.)
1965
#
1966
# Create a one-time-only replacement for socket.socket()
1967
@functools.wraps(socket.socket)
1968
def socket_wrapper(*args, **kwargs):
1969
# Restore original function so subsequent calls are
1970
# not affected.
1971
socket.socket = self.socket_socket
1972
del self.socket_socket
1973
# This time only, return a new socket object from the
1974
# saved file descriptor.
1975
return socket.fromfd(self.socketfd, *args, **kwargs)
1976
# Replace socket.socket() function with wrapper
1977
socket.socket = socket_wrapper
1978
# The socketserver.TCPServer.__init__ will call
1979
# socket.socket(), which might be our replacement,
1980
# socket_wrapper(), if socketfd was set.
1368
1981
socketserver.TCPServer.__init__(self, server_address,
1369
1982
RequestHandlerClass)
1983
1370
1984
def server_bind(self):
1371
1985
"""This overrides the normal server_bind() function
1372
1986
to bind to an interface if one was specified, and also NOT to
1373
1987
bind to an address or port if they were not specified."""
1374
1988
if self.interface is not None:
1375
1989
if SO_BINDTODEVICE is None:
1376
logger.error(u"SO_BINDTODEVICE does not exist;"
1377
u" cannot bind to interface %s",
1990
logger.error("SO_BINDTODEVICE does not exist;"
1991
" cannot bind to interface %s",
1378
1992
self.interface)
1379
1993
else:
1380
1994
try:
1381
self.socket.setsockopt(socket.SOL_SOCKET,
1382
SO_BINDTODEVICE,
1383
str(self.interface
1384
+ u'\0'))
1385
except socket.error, error:
1386
if error[0] == errno.EPERM:
1387
logger.error(u"No permission to"
1388
u" bind to interface %s",
1389
self.interface)
1390
elif error[0] == errno.ENOPROTOOPT:
1391
logger.error(u"SO_BINDTODEVICE not available;"
1392
u" cannot bind to interface %s",
1393
self.interface)
1995
self.socket.setsockopt(
1996
socket.SOL_SOCKET, SO_BINDTODEVICE,
1997
(self.interface + "\0").encode("utf-8"))
1998
except socket.error as error:
1999
if error.errno == errno.EPERM:
2000
logger.error("No permission to bind to"
2001
" interface %s", self.interface)
2002
elif error.errno == errno.ENOPROTOOPT:
2003
logger.error("SO_BINDTODEVICE not available;"
2004
" cannot bind to interface %s",
2005
self.interface)
2006
elif error.errno == errno.ENODEV:
2007
logger.error("Interface %s does not exist,"
2008
" cannot bind", self.interface)
1394
2009
else:
1395
2010
raise
1396
2011
# Only bind(2) the socket if we really need to.
1397
2012
if self.server_address[0] or self.server_address[1]:
1398
2013
if not self.server_address[0]:
1399
2014
if self.address_family == socket.AF_INET6:
1400
any_address = u"::" # in6addr_any
2015
any_address = "::" # in6addr_any
1401
2016
else:
1402
any_address = socket.INADDR_ANY
2017
any_address = "0.0.0.0" # INADDR_ANY
1403
2018
self.server_address = (any_address,
1404
2019
self.server_address[1])
1405
2020
elif not self.server_address[1]:
1406
self.server_address = (self.server_address[0],
1407
0)
2021
self.server_address = (self.server_address[0], 0)
1408
2022
# if self.interface:
1409
2023
# self.server_address = (self.server_address[0],
1410
2024
# 0, # port
1424
2038
1425
2039
Assumes a gobject.MainLoop event loop.
1426
2040
"""
2041
1427
2042
def __init__(self, server_address, RequestHandlerClass,
1428
interface=None, use_ipv6=True, clients=None,
1429
gnutls_priority=None, use_dbus=True):
2043
interface=None,
2044
use_ipv6=True,
2045
clients=None,
2046
gnutls_priority=None,
2047
use_dbus=True,
2048
socketfd=None):
1430
2049
self.enabled = False
1431
2050
self.clients = clients
1432
2051
if self.clients is None:
1433
self.clients = set()
2052
self.clients = {}
1434
2053
self.use_dbus = use_dbus
1435
2054
self.gnutls_priority = gnutls_priority
1436
2055
IPv6_TCPServer.__init__(self, server_address,
1437
2056
RequestHandlerClass,
1438
2057
interface = interface,
1439
use_ipv6 = use_ipv6)
2058
use_ipv6 = use_ipv6,
2059
socketfd = socketfd)
2060
1440
2061
def server_activate(self):
1441
2062
if self.enabled:
1442
2063
return socketserver.TCPServer.server_activate(self)
2064
1443
2065
def enable(self):
1444
2066
self.enabled = True
1445
def add_pipe(self, parent_pipe):
2067
2068
def add_pipe(self, parent_pipe, proc):
1446
2069
# Call "handle_ipc" for both data and EOF events
1447
gobject.io_add_watch(parent_pipe.fileno(),
1448
gobject.IO_IN | gobject.IO_HUP,
1449
functools.partial(self.handle_ipc,
1450
parent_pipe = parent_pipe))
1451
1452
def handle_ipc(self, source, condition, parent_pipe=None,
2070
gobject.io_add_watch(
2071
parent_pipe.fileno(),
2072
gobject.IO_IN | gobject.IO_HUP,
2073
functools.partial(self.handle_ipc,
2074
parent_pipe = parent_pipe,
2075
proc = proc))
2076
2077
def handle_ipc(self, source, condition,
2078
parent_pipe=None,
2079
proc = None,
1453
2080
client_object=None):
1454
condition_names = {
1455
gobject.IO_IN: u"IN", # There is data to read.
1456
gobject.IO_OUT: u"OUT", # Data can be written (without
1457
# blocking).
1458
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1459
gobject.IO_ERR: u"ERR", # Error condition.
1460
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1461
# broken, usually for pipes and
1462
# sockets).
1463
}
1464
conditions_string = ' | '.join(name
1465
for cond, name in
1466
condition_names.iteritems()
1467
if cond & condition)
1468
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1469
conditions_string)
1470
1471
# error or the other end of multiprocessing.Pipe has closed
1472
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2081
# error, or the other end of multiprocessing.Pipe has closed
2082
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2083
# Wait for other process to exit
2084
proc.join()
1473
2085
return False
1474
2086
1475
2087
# Read a request from the child
1476
2088
request = parent_pipe.recv()
1477
logger.debug(u"IPC request: %s", repr(request))
1478
2089
command = request[0]
1479
2090
1480
2091
if command == 'init':
1481
2092
fpr = request[1]
1482
2093
address = request[2]
1483
2094
1484
for c in self.clients:
2095
for c in self.clients.itervalues():
1485
2096
if c.fingerprint == fpr:
1486
2097
client = c
1487
2098
break
1488
2099
else:
1489
logger.warning(u"Client not found for fingerprint: %s, ad"
1490
u"dress: %s", fpr, address)
2100
logger.info("Client not found for fingerprint: %s, ad"
2101
"dress: %s", fpr, address)
1491
2102
if self.use_dbus:
1492
2103
# Emit D-Bus signal
1493
mandos_dbus_service.ClientNotFound(fpr, address)
2104
mandos_dbus_service.ClientNotFound(fpr,
2105
address[0])
1494
2106
parent_pipe.send(False)
1495
2107
return False
1496
2108
1497
gobject.io_add_watch(parent_pipe.fileno(),
1498
gobject.IO_IN | gobject.IO_HUP,
1499
functools.partial(self.handle_ipc,
1500
parent_pipe = parent_pipe,
1501
client_object = client))
2109
gobject.io_add_watch(
2110
parent_pipe.fileno(),
2111
gobject.IO_IN | gobject.IO_HUP,
2112
functools.partial(self.handle_ipc,
2113
parent_pipe = parent_pipe,
2114
proc = proc,
2115
client_object = client))
1502
2116
parent_pipe.send(True)
1503
# remove the old hook in favor of the new above hook on same fileno
2117
# remove the old hook in favor of the new above hook on
2118
# same fileno
1504
2119
return False
1505
2120
if command == 'funcall':
1506
2121
funcname = request[1]
1507
2122
args = request[2]
1508
2123
kwargs = request[3]
1509
2124
1510
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1511
2125
parent_pipe.send(('data', getattr(client_object,
2126
funcname)(*args,
2127
**kwargs)))
2128
1512
2129
if command == 'getattr':
1513
2130
attrname = request[1]
1514
2131
if callable(client_object.__getattribute__(attrname)):
1515
parent_pipe.send(('function',))
2132
parent_pipe.send(('function', ))
1516
2133
else:
1517
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2134
parent_pipe.send((
2135
'data', client_object.__getattribute__(attrname)))
1518
2136
1519
2137
if command == 'setattr':
1520
2138
attrname = request[1]
1521
2139
value = request[2]
1522
2140
setattr(client_object, attrname, value)
1523
2141
1524
2142
return True
1525
2143
1526
2144
2145
def rfc3339_duration_to_delta(duration):
2146
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2147
2148
>>> rfc3339_duration_to_delta("P7D")
2149
datetime.timedelta(7)
2150
>>> rfc3339_duration_to_delta("PT60S")
2151
datetime.timedelta(0, 60)
2152
>>> rfc3339_duration_to_delta("PT60M")
2153
datetime.timedelta(0, 3600)
2154
>>> rfc3339_duration_to_delta("PT24H")
2155
datetime.timedelta(1)
2156
>>> rfc3339_duration_to_delta("P1W")
2157
datetime.timedelta(7)
2158
>>> rfc3339_duration_to_delta("PT5M30S")
2159
datetime.timedelta(0, 330)
2160
>>> rfc3339_duration_to_delta("P1DT3M20S")
2161
datetime.timedelta(1, 200)
2162
"""
2163
2164
# Parsing an RFC 3339 duration with regular expressions is not
2165
# possible - there would have to be multiple places for the same
2166
# values, like seconds. The current code, while more esoteric, is
2167
# cleaner without depending on a parsing library. If Python had a
2168
# built-in library for parsing we would use it, but we'd like to
2169
# avoid excessive use of external libraries.
2170
2171
# New type for defining tokens, syntax, and semantics all-in-one
2172
Token = collections.namedtuple("Token",
2173
("regexp", # To match token; if
2174
# "value" is not None,
2175
# must have a "group"
2176
# containing digits
2177
"value", # datetime.timedelta or
2178
# None
2179
"followers")) # Tokens valid after
2180
# this token
2181
Token = collections.namedtuple("Token", (
2182
"regexp", # To match token; if "value" is not None, must have
2183
# a "group" containing digits
2184
"value", # datetime.timedelta or None
2185
"followers")) # Tokens valid after this token
2186
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2187
# the "duration" ABNF definition in RFC 3339, Appendix A.
2188
token_end = Token(re.compile(r"$"), None, frozenset())
2189
token_second = Token(re.compile(r"(\d+)S"),
2190
datetime.timedelta(seconds=1),
2191
frozenset((token_end, )))
2192
token_minute = Token(re.compile(r"(\d+)M"),
2193
datetime.timedelta(minutes=1),
2194
frozenset((token_second, token_end)))
2195
token_hour = Token(re.compile(r"(\d+)H"),
2196
datetime.timedelta(hours=1),
2197
frozenset((token_minute, token_end)))
2198
token_time = Token(re.compile(r"T"),
2199
None,
2200
frozenset((token_hour, token_minute,
2201
token_second)))
2202
token_day = Token(re.compile(r"(\d+)D"),
2203
datetime.timedelta(days=1),
2204
frozenset((token_time, token_end)))
2205
token_month = Token(re.compile(r"(\d+)M"),
2206
datetime.timedelta(weeks=4),
2207
frozenset((token_day, token_end)))
2208
token_year = Token(re.compile(r"(\d+)Y"),
2209
datetime.timedelta(weeks=52),
2210
frozenset((token_month, token_end)))
2211
token_week = Token(re.compile(r"(\d+)W"),
2212
datetime.timedelta(weeks=1),
2213
frozenset((token_end, )))
2214
token_duration = Token(re.compile(r"P"), None,
2215
frozenset((token_year, token_month,
2216
token_day, token_time,
2217
token_week)))
2218
# Define starting values
2219
value = datetime.timedelta() # Value so far
2220
found_token = None
2221
followers = frozenset((token_duration,)) # Following valid tokens
2222
s = duration # String left to parse
2223
# Loop until end token is found
2224
while found_token is not token_end:
2225
# Search for any currently valid tokens
2226
for token in followers:
2227
match = token.regexp.match(s)
2228
if match is not None:
2229
# Token found
2230
if token.value is not None:
2231
# Value found, parse digits
2232
factor = int(match.group(1), 10)
2233
# Add to value so far
2234
value += factor * token.value
2235
# Strip token from string
2236
s = token.regexp.sub("", s, 1)
2237
# Go to found token
2238
found_token = token
2239
# Set valid next tokens
2240
followers = found_token.followers
2241
break
2242
else:
2243
# No currently valid tokens were found
2244
raise ValueError("Invalid RFC 3339 duration")
2245
# End token found
2246
return value
2247
2248
1527
2249
def string_to_delta(interval):
1528
2250
"""Parse a string and return a datetime.timedelta
1529
2251
1530
>>> string_to_delta(u'7d')
2252
>>> string_to_delta('7d')
1531
2253
datetime.timedelta(7)
1532
>>> string_to_delta(u'60s')
2254
>>> string_to_delta('60s')
1533
2255
datetime.timedelta(0, 60)
1534
>>> string_to_delta(u'60m')
2256
>>> string_to_delta('60m')
1535
2257
datetime.timedelta(0, 3600)
1536
>>> string_to_delta(u'24h')
2258
>>> string_to_delta('24h')
1537
2259
datetime.timedelta(1)
1538
>>> string_to_delta(u'1w')
2260
>>> string_to_delta('1w')
1539
2261
datetime.timedelta(7)
1540
>>> string_to_delta(u'5m 30s')
2262
>>> string_to_delta('5m 30s')
1541
2263
datetime.timedelta(0, 330)
1542
2264
"""
2265
2266
try:
2267
return rfc3339_duration_to_delta(interval)
2268
except ValueError:
2269
pass
2270
1543
2271
timevalue = datetime.timedelta(0)
1544
2272
for s in interval.split():
1545
2273
try:
1546
suffix = unicode(s[-1])
2274
suffix = s[-1]
1547
2275
value = int(s[:-1])
1548
if suffix == u"d":
2276
if suffix == "d":
1549
2277
delta = datetime.timedelta(value)
1550
elif suffix == u"s":
2278
elif suffix == "s":
1551
2279
delta = datetime.timedelta(0, value)
1552
elif suffix == u"m":
2280
elif suffix == "m":
1553
2281
delta = datetime.timedelta(0, 0, 0, 0, value)
1554
elif suffix == u"h":
2282
elif suffix == "h":
1555
2283
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1556
elif suffix == u"w":
2284
elif suffix == "w":
1557
2285
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1558
2286
else:
1559
raise ValueError(u"Unknown suffix %r" % suffix)
1560
except (ValueError, IndexError), e:
1561
raise ValueError(e.message)
2287
raise ValueError("Unknown suffix {!r}".format(suffix))
2288
except IndexError as e:
2289
raise ValueError(*(e.args))
1562
2290
timevalue += delta
1563
2291
return timevalue
1564
2292
1565
2293
1566
def if_nametoindex(interface):
1567
"""Call the C function if_nametoindex(), or equivalent
1568
1569
Note: This function cannot accept a unicode string."""
1570
global if_nametoindex
1571
try:
1572
if_nametoindex = (ctypes.cdll.LoadLibrary
1573
(ctypes.util.find_library(u"c"))
1574
.if_nametoindex)
1575
except (OSError, AttributeError):
1576
logger.warning(u"Doing if_nametoindex the hard way")
1577
def if_nametoindex(interface):
1578
"Get an interface index the hard way, i.e. using fcntl()"
1579
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1580
with contextlib.closing(socket.socket()) as s:
1581
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1582
struct.pack(str(u"16s16x"),
1583
interface))
1584
interface_index = struct.unpack(str(u"I"),
1585
ifreq[16:20])[0]
1586
return interface_index
1587
return if_nametoindex(interface)
1588
1589
1590
2294
def daemon(nochdir = False, noclose = False):
1591
2295
"""See daemon(3). Standard BSD Unix function.
1592
2296
1595
2299
sys.exit()
1596
2300
os.setsid()
1597
2301
if not nochdir:
1598
os.chdir(u"/")
2302
os.chdir("/")
1599
2303
if os.fork():
1600
2304
sys.exit()
1601
2305
if not noclose:
1602
2306
# Close all standard open file descriptors
1603
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2307
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1604
2308
if not stat.S_ISCHR(os.fstat(null).st_mode):
1605
2309
raise OSError(errno.ENODEV,
1606
u"%s not a character device"
1607
% os.path.devnull)
2310
"{} not a character device"
2311
.format(os.devnull))
1608
2312
os.dup2(null, sys.stdin.fileno())
1609
2313
os.dup2(null, sys.stdout.fileno())
1610
2314
os.dup2(null, sys.stderr.fileno())
1617
2321
##################################################################
1618
2322
# Parsing of options, both command line and config file
1619
2323
1620
parser = optparse.OptionParser(version = "%%prog %s" % version)
1621
parser.add_option("-i", u"--interface", type=u"string",
1622
metavar="IF", help=u"Bind to interface IF")
1623
parser.add_option("-a", u"--address", type=u"string",
1624
help=u"Address to listen for requests on")
1625
parser.add_option("-p", u"--port", type=u"int",
1626
help=u"Port number to receive requests on")
1627
parser.add_option("--check", action=u"store_true",
1628
help=u"Run self-test")
1629
parser.add_option("--debug", action=u"store_true",
1630
help=u"Debug mode; run in foreground and log to"
1631
u" terminal")
1632
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1633
help=u"Debug level for stdout output")
1634
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1635
u" priority string (see GnuTLS documentation)")
1636
parser.add_option("--servicename", type=u"string",
1637
metavar=u"NAME", help=u"Zeroconf service name")
1638
parser.add_option("--configdir", type=u"string",
1639
default=u"/etc/mandos", metavar=u"DIR",
1640
help=u"Directory to search for configuration"
1641
u" files")
1642
parser.add_option("--no-dbus", action=u"store_false",
1643
dest=u"use_dbus", help=u"Do not provide D-Bus"
1644
u" system bus interface")
1645
parser.add_option("--no-ipv6", action=u"store_false",
1646
dest=u"use_ipv6", help=u"Do not use IPv6")
1647
options = parser.parse_args()[0]
2324
parser = argparse.ArgumentParser()
2325
parser.add_argument("-v", "--version", action="version",
2326
version = "%(prog)s {}".format(version),
2327
help="show version number and exit")
2328
parser.add_argument("-i", "--interface", metavar="IF",
2329
help="Bind to interface IF")
2330
parser.add_argument("-a", "--address",
2331
help="Address to listen for requests on")
2332
parser.add_argument("-p", "--port", type=int,
2333
help="Port number to receive requests on")
2334
parser.add_argument("--check", action="store_true",
2335
help="Run self-test")
2336
parser.add_argument("--debug", action="store_true",
2337
help="Debug mode; run in foreground and log"
2338
" to terminal", default=None)
2339
parser.add_argument("--debuglevel", metavar="LEVEL",
2340
help="Debug level for stdout output")
2341
parser.add_argument("--priority", help="GnuTLS"
2342
" priority string (see GnuTLS documentation)")
2343
parser.add_argument("--servicename",
2344
metavar="NAME", help="Zeroconf service name")
2345
parser.add_argument("--configdir",
2346
default="/etc/mandos", metavar="DIR",
2347
help="Directory to search for configuration"
2348
" files")
2349
parser.add_argument("--no-dbus", action="store_false",
2350
dest="use_dbus", help="Do not provide D-Bus"
2351
" system bus interface", default=None)
2352
parser.add_argument("--no-ipv6", action="store_false",
2353
dest="use_ipv6", help="Do not use IPv6",
2354
default=None)
2355
parser.add_argument("--no-restore", action="store_false",
2356
dest="restore", help="Do not restore stored"
2357
" state", default=None)
2358
parser.add_argument("--socket", type=int,
2359
help="Specify a file descriptor to a network"
2360
" socket to use instead of creating one")
2361
parser.add_argument("--statedir", metavar="DIR",
2362
help="Directory to save/restore state in")
2363
parser.add_argument("--foreground", action="store_true",
2364
help="Run in foreground", default=None)
2365
parser.add_argument("--no-zeroconf", action="store_false",
2366
dest="zeroconf", help="Do not use Zeroconf",
2367
default=None)
2368
2369
options = parser.parse_args()
1648
2370
1649
2371
if options.check:
1650
2372
import doctest
1651
doctest.testmod()
1652
sys.exit()
2373
fail_count, test_count = doctest.testmod()
2374
sys.exit(os.EX_OK if fail_count == 0 else 1)
1653
2375
1654
2376
# Default values for config file for server-global settings
1655
server_defaults = { u"interface": u"",
1656
u"address": u"",
1657
u"port": u"",
1658
u"debug": u"False",
1659
u"priority":
1660
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1661
u"servicename": u"Mandos",
1662
u"use_dbus": u"True",
1663
u"use_ipv6": u"True",
1664
u"debuglevel": u"",
1665
}
2377
server_defaults = { "interface": "",
2378
"address": "",
2379
"port": "",
2380
"debug": "False",
2381
"priority":
2382
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2383
":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2384
"servicename": "Mandos",
2385
"use_dbus": "True",
2386
"use_ipv6": "True",
2387
"debuglevel": "",
2388
"restore": "True",
2389
"socket": "",
2390
"statedir": "/var/lib/mandos",
2391
"foreground": "False",
2392
"zeroconf": "True",
2393
}
1666
2394
1667
2395
# Parse config file for server-global settings
1668
2396
server_config = configparser.SafeConfigParser(server_defaults)
1669
2397
del server_defaults
1670
server_config.read(os.path.join(options.configdir,
1671
u"mandos.conf"))
2398
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1672
2399
# Convert the SafeConfigParser object to a dict
1673
2400
server_settings = server_config.defaults()
1674
2401
# Use the appropriate methods on the non-string config options
1675
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1676
server_settings[option] = server_config.getboolean(u"DEFAULT",
2402
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2403
server_settings[option] = server_config.getboolean("DEFAULT",
1677
2404
option)
1678
2405
if server_settings["port"]:
1679
server_settings["port"] = server_config.getint(u"DEFAULT",
1680
u"port")
2406
server_settings["port"] = server_config.getint("DEFAULT",
2407
"port")
2408
if server_settings["socket"]:
2409
server_settings["socket"] = server_config.getint("DEFAULT",
2410
"socket")
2411
# Later, stdin will, and stdout and stderr might, be dup'ed
2412
# over with an opened os.devnull. But we don't want this to
2413
# happen with a supplied network socket.
2414
if 0 <= server_settings["socket"] <= 2:
2415
server_settings["socket"] = os.dup(server_settings
2416
["socket"])
1681
2417
del server_config
1682
2418
1683
2419
# Override the settings from the config file with command line
1684
2420
# options, if set.
1685
for option in (u"interface", u"address", u"port", u"debug",
1686
u"priority", u"servicename", u"configdir",
1687
u"use_dbus", u"use_ipv6", u"debuglevel"):
2421
for option in ("interface", "address", "port", "debug",
2422
"priority", "servicename", "configdir", "use_dbus",
2423
"use_ipv6", "debuglevel", "restore", "statedir",
2424
"socket", "foreground", "zeroconf"):
1688
2425
value = getattr(options, option)
1689
2426
if value is not None:
1690
2427
server_settings[option] = value
1691
2428
del options
1692
2429
# Force all strings to be unicode
1693
2430
for option in server_settings.keys():
1694
if type(server_settings[option]) is str:
1695
server_settings[option] = unicode(server_settings[option])
2431
if isinstance(server_settings[option], bytes):
2432
server_settings[option] = (server_settings[option]
2433
.decode("utf-8"))
2434
# Force all boolean options to be boolean
2435
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2436
"foreground", "zeroconf"):
2437
server_settings[option] = bool(server_settings[option])
2438
# Debug implies foreground
2439
if server_settings["debug"]:
2440
server_settings["foreground"] = True
1696
2441
# Now we have our good server settings in "server_settings"
1697
2442
1698
2443
##################################################################
1699
2444
2445
if (not server_settings["zeroconf"]
2446
and not (server_settings["port"]
2447
or server_settings["socket"] != "")):
2448
parser.error("Needs port or socket to work without Zeroconf")
2449
1700
2450
# For convenience
1701
debug = server_settings[u"debug"]
1702
debuglevel = server_settings[u"debuglevel"]
1703
use_dbus = server_settings[u"use_dbus"]
1704
use_ipv6 = server_settings[u"use_ipv6"]
1705
1706
if server_settings[u"servicename"] != u"Mandos":
1707
syslogger.setFormatter(logging.Formatter
1708
(u'Mandos (%s) [%%(process)d]:'
1709
u' %%(levelname)s: %%(message)s'
1710
% server_settings[u"servicename"]))
2451
debug = server_settings["debug"]
2452
debuglevel = server_settings["debuglevel"]
2453
use_dbus = server_settings["use_dbus"]
2454
use_ipv6 = server_settings["use_ipv6"]
2455
stored_state_path = os.path.join(server_settings["statedir"],
2456
stored_state_file)
2457
foreground = server_settings["foreground"]
2458
zeroconf = server_settings["zeroconf"]
2459
2460
if debug:
2461
initlogger(debug, logging.DEBUG)
2462
else:
2463
if not debuglevel:
2464
initlogger(debug)
2465
else:
2466
level = getattr(logging, debuglevel.upper())
2467
initlogger(debug, level)
2468
2469
if server_settings["servicename"] != "Mandos":
2470
syslogger.setFormatter(
2471
logging.Formatter('Mandos ({}) [%(process)d]:'
2472
' %(levelname)s: %(message)s'.format(
2473
server_settings["servicename"])))
1711
2474
1712
2475
# Parse config file with clients
1713
client_defaults = { u"timeout": u"1h",
1714
u"interval": u"5m",
1715
u"checker": u"fping -q -- %%(host)s",
1716
u"host": u"",
1717
u"approved_delay": u"0s",
1718
u"approved_duration": u"1s",
1719
}
1720
client_config = configparser.SafeConfigParser(client_defaults)
1721
client_config.read(os.path.join(server_settings[u"configdir"],
1722
u"clients.conf"))
2476
client_config = configparser.SafeConfigParser(Client
2477
.client_defaults)
2478
client_config.read(os.path.join(server_settings["configdir"],
2479
"clients.conf"))
1723
2480
1724
2481
global mandos_dbus_service
1725
2482
mandos_dbus_service = None
1726
2483
1727
tcp_server = MandosServer((server_settings[u"address"],
1728
server_settings[u"port"]),
1729
ClientHandler,
1730
interface=server_settings[u"interface"],
1731
use_ipv6=use_ipv6,
1732
gnutls_priority=
1733
server_settings[u"priority"],
1734
use_dbus=use_dbus)
1735
pidfilename = u"/var/run/mandos.pid"
1736
try:
1737
pidfile = open(pidfilename, u"w")
1738
except IOError:
1739
logger.error(u"Could not open file %r", pidfilename)
2484
socketfd = None
2485
if server_settings["socket"] != "":
2486
socketfd = server_settings["socket"]
2487
tcp_server = MandosServer(
2488
(server_settings["address"], server_settings["port"]),
2489
ClientHandler,
2490
interface=(server_settings["interface"] or None),
2491
use_ipv6=use_ipv6,
2492
gnutls_priority=server_settings["priority"],
2493
use_dbus=use_dbus,
2494
socketfd=socketfd)
2495
if not foreground:
2496
pidfilename = "/run/mandos.pid"
2497
if not os.path.isdir("/run/."):
2498
pidfilename = "/var/run/mandos.pid"
2499
pidfile = None
2500
try:
2501
pidfile = open(pidfilename, "w")
2502
except IOError as e:
2503
logger.error("Could not open file %r", pidfilename,
2504
exc_info=e)
1740
2505
1741
try:
1742
uid = pwd.getpwnam(u"_mandos").pw_uid
1743
gid = pwd.getpwnam(u"_mandos").pw_gid
1744
except KeyError:
2506
for name in ("_mandos", "mandos", "nobody"):
1745
2507
try:
1746
uid = pwd.getpwnam(u"mandos").pw_uid
1747
gid = pwd.getpwnam(u"mandos").pw_gid
2508
uid = pwd.getpwnam(name).pw_uid
2509
gid = pwd.getpwnam(name).pw_gid
2510
break
1748
2511
except KeyError:
1749
try:
1750
uid = pwd.getpwnam(u"nobody").pw_uid
1751
gid = pwd.getpwnam(u"nobody").pw_gid
1752
except KeyError:
1753
uid = 65534
1754
gid = 65534
2512
continue
2513
else:
2514
uid = 65534
2515
gid = 65534
1755
2516
try:
1756
2517
os.setgid(gid)
1757
2518
os.setuid(uid)
1758
except OSError, error:
1759
if error[0] != errno.EPERM:
1760
raise error
2519
except OSError as error:
2520
if error.errno != errno.EPERM:
2521
raise
1761
2522
1762
# Enable all possible GnuTLS debugging
1763
1764
1765
if not debug and not debuglevel:
1766
syslogger.setLevel(logging.WARNING)
1767
console.setLevel(logging.WARNING)
1768
if debuglevel:
1769
level = getattr(logging, debuglevel.upper())
1770
syslogger.setLevel(level)
1771
console.setLevel(level)
1772
1773
2523
if debug:
2524
# Enable all possible GnuTLS debugging
2525
1774
2526
# "Use a log level over 10 to enable all debugging options."
1775
2527
# - GnuTLS manual
1776
2528
gnutls.library.functions.gnutls_global_set_log_level(11)
1777
2529
1778
2530
@gnutls.library.types.gnutls_log_func
1779
2531
def debug_gnutls(level, string):
1780
logger.debug(u"GnuTLS: %s", string[:-1])
1781
1782
(gnutls.library.functions
1783
.gnutls_global_set_log_function(debug_gnutls))
1784
2532
logger.debug("GnuTLS: %s", string[:-1])
2533
2534
gnutls.library.functions.gnutls_global_set_log_function(
2535
debug_gnutls)
2536
1785
2537
# Redirect stdin so all checkers get /dev/null
1786
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2538
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1787
2539
os.dup2(null, sys.stdin.fileno())
1788
2540
if null > 2:
1789
2541
os.close(null)
1790
else:
1791
# No console logging
1792
logger.removeHandler(console)
1793
2542
2543
# Need to fork before connecting to D-Bus
2544
if not foreground:
2545
# Close all input and output, do double fork, etc.
2546
daemon()
2547
2548
# multiprocessing will use threads, so before we use gobject we
2549
# need to inform gobject that threads will be used.
2550
gobject.threads_init()
1794
2551
1795
2552
global main_loop
1796
2553
# From the Avahi example code
1797
DBusGMainLoop(set_as_default=True )
2554
DBusGMainLoop(set_as_default=True)
1798
2555
main_loop = gobject.MainLoop()
1799
2556
bus = dbus.SystemBus()
1800
2557
# End of Avahi example code
1801
2558
if use_dbus:
1802
2559
try:
1803
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1804
bus, do_not_queue=True)
1805
except dbus.exceptions.NameExistsException, e:
1806
logger.error(unicode(e) + u", disabling D-Bus")
2560
bus_name = dbus.service.BusName("se.recompile.Mandos",
2561
bus,
2562
do_not_queue=True)
2563
old_bus_name = dbus.service.BusName(
2564
"se.bsnet.fukt.Mandos", bus,
2565
do_not_queue=True)
2566
except dbus.exceptions.NameExistsException as e:
2567
logger.error("Disabling D-Bus:", exc_info=e)
1807
2568
use_dbus = False
1808
server_settings[u"use_dbus"] = False
2569
server_settings["use_dbus"] = False
1809
2570
tcp_server.use_dbus = False
1810
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1811
service = AvahiService(name = server_settings[u"servicename"],
1812
servicetype = u"_mandos._tcp",
1813
protocol = protocol, bus = bus)
1814
if server_settings["interface"]:
1815
service.interface = (if_nametoindex
1816
(str(server_settings[u"interface"])))
1817
1818
if not debug:
1819
# Close all input and output, do double fork, etc.
1820
daemon()
1821
2571
if zeroconf:
2572
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2573
service = AvahiServiceToSyslog(
2574
name = server_settings["servicename"],
2575
servicetype = "_mandos._tcp",
2576
protocol = protocol,
2577
bus = bus)
2578
if server_settings["interface"]:
2579
service.interface = if_nametoindex(
2580
server_settings["interface"].encode("utf-8"))
2581
1822
2582
global multiprocessing_manager
1823
2583
multiprocessing_manager = multiprocessing.Manager()
1824
2584
1825
2585
client_class = Client
1826
2586
if use_dbus:
1827
2587
client_class = functools.partial(ClientDBus, bus = bus)
1828
def client_config_items(config, section):
1829
special_settings = {
1830
"approved_by_default":
1831
lambda: config.getboolean(section,
1832
"approved_by_default"),
1833
}
1834
for name, value in config.items(section):
2588
2589
client_settings = Client.config_parser(client_config)
2590
old_client_settings = {}
2591
clients_data = {}
2592
2593
# This is used to redirect stdout and stderr for checker processes
2594
global wnull
2595
wnull = open(os.devnull, "w") # A writable /dev/null
2596
# Only used if server is running in foreground but not in debug
2597
# mode
2598
if debug or not foreground:
2599
wnull.close()
2600
2601
# Get client data and settings from last running state.
2602
if server_settings["restore"]:
2603
try:
2604
with open(stored_state_path, "rb") as stored_state:
2605
clients_data, old_client_settings = pickle.load(
2606
stored_state)
2607
os.remove(stored_state_path)
2608
except IOError as e:
2609
if e.errno == errno.ENOENT:
2610
logger.warning("Could not load persistent state:"
2611
" {}".format(os.strerror(e.errno)))
2612
else:
2613
logger.critical("Could not load persistent state:",
2614
exc_info=e)
2615
raise
2616
except EOFError as e:
2617
logger.warning("Could not load persistent state: "
2618
"EOFError:",
2619
exc_info=e)
2620
2621
with PGPEngine() as pgp:
2622
for client_name, client in clients_data.items():
2623
# Skip removed clients
2624
if client_name not in client_settings:
2625
continue
2626
2627
# Decide which value to use after restoring saved state.
2628
# We have three different values: Old config file,
2629
# new config file, and saved state.
2630
# New config value takes precedence if it differs from old
2631
# config value, otherwise use saved state.
2632
for name, value in client_settings[client_name].items():
2633
try:
2634
# For each value in new config, check if it
2635
# differs from the old config value (Except for
2636
# the "secret" attribute)
2637
if (name != "secret"
2638
and (value !=
2639
old_client_settings[client_name][name])):
2640
client[name] = value
2641
except KeyError:
2642
pass
2643
2644
# Clients who has passed its expire date can still be
2645
# enabled if its last checker was successful. Clients
2646
# whose checker succeeded before we stored its state is
2647
# assumed to have successfully run all checkers during
2648
# downtime.
2649
if client["enabled"]:
2650
if datetime.datetime.utcnow() >= client["expires"]:
2651
if not client["last_checked_ok"]:
2652
logger.warning(
2653
"disabling client {} - Client never "
2654
"performed a successful checker".format(
2655
client_name))
2656
client["enabled"] = False
2657
elif client["last_checker_status"] != 0:
2658
logger.warning(
2659
"disabling client {} - Client last"
2660
" checker failed with error code"
2661
" {}".format(
2662
client_name,
2663
client["last_checker_status"]))
2664
client["enabled"] = False
2665
else:
2666
client["expires"] = (
2667
datetime.datetime.utcnow()
2668
+ client["timeout"])
2669
logger.debug("Last checker succeeded,"
2670
" keeping {} enabled".format(
2671
client_name))
1835
2672
try:
1836
yield (name, special_settings[name]())
1837
except KeyError:
1838
yield (name, value)
1839
1840
tcp_server.clients.update(set(
1841
client_class(name = section,
1842
config= dict(client_config_items(
1843
client_config, section)))
1844
for section in client_config.sections()))
2673
client["secret"] = pgp.decrypt(
2674
client["encrypted_secret"],
2675
client_settings[client_name]["secret"])
2676
except PGPError:
2677
# If decryption fails, we use secret from new settings
2678
logger.debug("Failed to decrypt {} old secret".format(
2679
client_name))
2680
client["secret"] = (client_settings[client_name]
2681
["secret"])
2682
2683
# Add/remove clients based on new changes made to config
2684
for client_name in (set(old_client_settings)
2685
- set(client_settings)):
2686
del clients_data[client_name]
2687
for client_name in (set(client_settings)
2688
- set(old_client_settings)):
2689
clients_data[client_name] = client_settings[client_name]
2690
2691
# Create all client objects
2692
for client_name, client in clients_data.items():
2693
tcp_server.clients[client_name] = client_class(
2694
name = client_name,
2695
settings = client,
2696
server_settings = server_settings)
2697
1845
2698
if not tcp_server.clients:
1846
logger.warning(u"No clients defined")
1847
1848
try:
1849
with pidfile:
1850
pid = os.getpid()
1851
pidfile.write(str(pid) + "\n")
2699
logger.warning("No clients defined")
2700
2701
if not foreground:
2702
if pidfile is not None:
2703
try:
2704
with pidfile:
2705
pid = os.getpid()
2706
pidfile.write("{}\n".format(pid).encode("utf-8"))
2707
except IOError:
2708
logger.error("Could not write to file %r with PID %d",
2709
pidfilename, pid)
1852
2710
del pidfile
1853
except IOError:
1854
logger.error(u"Could not write to file %r with PID %d",
1855
pidfilename, pid)
1856
except NameError:
1857
# "pidfile" was never created
1858
pass
1859
del pidfilename
2711
del pidfilename
1860
2712
1861
if not debug:
1862
signal.signal(signal.SIGINT, signal.SIG_IGN)
1863
2713
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1864
2714
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1865
2715
1866
2716
if use_dbus:
1867
class MandosDBusService(dbus.service.Object):
2717
2718
@alternate_dbus_interfaces(
2719
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2720
class MandosDBusService(DBusObjectWithProperties):
1868
2721
"""A D-Bus proxy object"""
2722
1869
2723
def __init__(self):
1870
dbus.service.Object.__init__(self, bus, u"/")
1871
_interface = u"se.bsnet.fukt.Mandos"
1872
1873
@dbus.service.signal(_interface, signature=u"o")
2724
dbus.service.Object.__init__(self, bus, "/")
2725
2726
_interface = "se.recompile.Mandos"
2727
2728
@dbus_interface_annotations(_interface)
2729
def _foo(self):
2730
return {
2731
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2732
"false" }
2733
2734
@dbus.service.signal(_interface, signature="o")
1874
2735
def ClientAdded(self, objpath):
1875
2736
"D-Bus signal"
1876
2737
pass
1877
2738
1878
@dbus.service.signal(_interface, signature=u"ss")
2739
@dbus.service.signal(_interface, signature="ss")
1879
2740
def ClientNotFound(self, fingerprint, address):
1880
2741
"D-Bus signal"
1881
2742
pass
1882
2743
1883
@dbus.service.signal(_interface, signature=u"os")
2744
@dbus.service.signal(_interface, signature="os")
1884
2745
def ClientRemoved(self, objpath, name):
1885
2746
"D-Bus signal"
1886
2747
pass
1887
2748
1888
@dbus.service.method(_interface, out_signature=u"ao")
2749
@dbus.service.method(_interface, out_signature="ao")
1889
2750
def GetAllClients(self):
1890
2751
"D-Bus method"
1891
return dbus.Array(c.dbus_object_path
1892
for c in tcp_server.clients)
2752
return dbus.Array(c.dbus_object_path for c in
2753
tcp_server.clients.itervalues())
1893
2754
1894
2755
@dbus.service.method(_interface,
1895
out_signature=u"a{oa{sv}}")
2756
out_signature="a{oa{sv}}")
1896
2757
def GetAllClientsWithProperties(self):
1897
2758
"D-Bus method"
1898
2759
return dbus.Dictionary(
1899
((c.dbus_object_path, c.GetAll(u""))
1900
for c in tcp_server.clients),
1901
signature=u"oa{sv}")
2760
{ c.dbus_object_path: c.GetAll("")
2761
for c in tcp_server.clients.itervalues() },
2762
signature="oa{sv}")
1902
2763
1903
@dbus.service.method(_interface, in_signature=u"o")
2764
@dbus.service.method(_interface, in_signature="o")
1904
2765
def RemoveClient(self, object_path):
1905
2766
"D-Bus method"
1906
for c in tcp_server.clients:
2767
for c in tcp_server.clients.itervalues():
1907
2768
if c.dbus_object_path == object_path:
1908
tcp_server.clients.remove(c)
2769
del tcp_server.clients[c.name]
1909
2770
c.remove_from_connection()
1910
2771
# Don't signal anything except ClientRemoved
1911
2772
c.disable(quiet=True)
1920
2781
1921
2782
def cleanup():
1922
2783
"Cleanup function; run on exit"
1923
service.cleanup()
1924
2784
if zeroconf:
2785
service.cleanup()
2786
2787
multiprocessing.active_children()
2788
wnull.close()
2789
if not (tcp_server.clients or client_settings):
2790
return
2791
2792
# Store client before exiting. Secrets are encrypted with key
2793
# based on what config file has. If config file is
2794
# removed/edited, old secret will thus be unrecovable.
2795
clients = {}
2796
with PGPEngine() as pgp:
2797
for client in tcp_server.clients.itervalues():
2798
key = client_settings[client.name]["secret"]
2799
client.encrypted_secret = pgp.encrypt(client.secret,
2800
key)
2801
client_dict = {}
2802
2803
# A list of attributes that can not be pickled
2804
# + secret.
2805
exclude = { "bus", "changedstate", "secret",
2806
"checker", "server_settings" }
2807
for name, typ in inspect.getmembers(dbus.service
2808
.Object):
2809
exclude.add(name)
2810
2811
client_dict["encrypted_secret"] = (client
2812
.encrypted_secret)
2813
for attr in client.client_structure:
2814
if attr not in exclude:
2815
client_dict[attr] = getattr(client, attr)
2816
2817
clients[client.name] = client_dict
2818
del client_settings[client.name]["secret"]
2819
2820
try:
2821
with tempfile.NamedTemporaryFile(
2822
mode='wb',
2823
suffix=".pickle",
2824
prefix='clients-',
2825
dir=os.path.dirname(stored_state_path),
2826
delete=False) as stored_state:
2827
pickle.dump((clients, client_settings), stored_state)
2828
tempname = stored_state.name
2829
os.rename(tempname, stored_state_path)
2830
except (IOError, OSError) as e:
2831
if not debug:
2832
try:
2833
os.remove(tempname)
2834
except NameError:
2835
pass
2836
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2837
logger.warning("Could not save persistent state: {}"
2838
.format(os.strerror(e.errno)))
2839
else:
2840
logger.warning("Could not save persistent state:",
2841
exc_info=e)
2842
raise
2843
2844
# Delete all clients, and settings from config
1925
2845
while tcp_server.clients:
1926
client = tcp_server.clients.pop()
2846
name, client = tcp_server.clients.popitem()
1927
2847
if use_dbus:
1928
2848
client.remove_from_connection()
1929
client.disable_hook = None
1930
2849
# Don't signal anything except ClientRemoved
1931
2850
client.disable(quiet=True)
1932
2851
if use_dbus:
1933
2852
# Emit D-Bus signal
1934
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1935
client.name)
2853
mandos_dbus_service.ClientRemoved(
2854
client.dbus_object_path, client.name)
2855
client_settings.clear()
1936
2856
1937
2857
atexit.register(cleanup)
1938
2858
1939
for client in tcp_server.clients:
2859
for client in tcp_server.clients.itervalues():
1940
2860
if use_dbus:
1941
2861
# Emit D-Bus signal
1942
2862
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1943
client.enable()
2863
# Need to initiate checking of clients
2864
if client.enabled:
2865
client.init_checker()
1944
2866
1945
2867
tcp_server.enable()
1946
2868
tcp_server.server_activate()
1947
2869
1948
2870
# Find out what port we got
1949
service.port = tcp_server.socket.getsockname()[1]
2871
if zeroconf:
2872
service.port = tcp_server.socket.getsockname()[1]
1950
2873
if use_ipv6:
1951
logger.info(u"Now listening on address %r, port %d,"
1952
" flowinfo %d, scope_id %d"
1953
% tcp_server.socket.getsockname())
2874
logger.info("Now listening on address %r, port %d,"
2875
" flowinfo %d, scope_id %d",
2876
*tcp_server.socket.getsockname())
1954
2877
else: # IPv4
1955
logger.info(u"Now listening on address %r, port %d"
1956
% tcp_server.socket.getsockname())
2878
logger.info("Now listening on address %r, port %d",
2879
*tcp_server.socket.getsockname())
1957
2880
1958
2881
#service.interface = tcp_server.socket.getsockname()[3]
1959
2882
1960
2883
try:
1961
# From the Avahi example code
1962
try:
1963
service.activate()
1964
except dbus.exceptions.DBusException, error:
1965
logger.critical(u"DBusException: %s", error)
1966
cleanup()
1967
sys.exit(1)
1968
# End of Avahi example code
2884
if zeroconf:
2885
# From the Avahi example code
2886
try:
2887
service.activate()
2888
except dbus.exceptions.DBusException as error:
2889
logger.critical("D-Bus Exception", exc_info=error)
2890
cleanup()
2891
sys.exit(1)
2892
# End of Avahi example code
1969
2893
1970
2894
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1971
2895
lambda *args, **kwargs:
1972
2896
(tcp_server.handle_request
1973
2897
(*args[2:], **kwargs) or True))
1974
2898
1975
logger.debug(u"Starting main loop")
2899
logger.debug("Starting main loop")
1976
2900
main_loop.run()
1977
except AvahiError, error:
1978
logger.critical(u"AvahiError: %s", error)
2901
except AvahiError as error:
2902
logger.critical("Avahi Error", exc_info=error)
1979
2903
cleanup()
1980
2904
sys.exit(1)
1981
2905
except KeyboardInterrupt:
1982
2906
if debug:
1983
print >> sys.stderr
1984
logger.debug(u"Server received KeyboardInterrupt")
1985
logger.debug(u"Server exiting")
2907
print("", file=sys.stderr)
2908
logger.debug("Server received KeyboardInterrupt")
2909
logger.debug("Server exiting")
1986
2910
# Must run before the D-Bus bus name gets deregistered
1987
2911
cleanup()
1988
2912
2913
1989
2914
if __name__ == '__main__':
1990
2915
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0