/mandos/trunk : revision 752

395

logger.error(bad_states[state] + ": %r", error)

396

self.cleanup()

397

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

398

self.add()

410

399

else:

411

400

if error is None:

412

401

logger.debug("Unknown state: %r", state)

435

424

.format(self.name)))

436

425

return ret

437

426

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

427

448

428

class Client(object):

449

429

"""A representation of a client host served by this server.

476

456

last_checker_status: integer between 0 and 255 reflecting exit

477

457

status of last checker. -1 reflects crashed

478

458

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

459

last_enabled: datetime.datetime(); (UTC) or None

482

460

name: string; from the config file, used in log messages and

483

461

D-Bus identifiers

657

635

# Also start a new checker *right now*.

658

636

self.start_checker()

659

637

660

def checker_callback(self, source, condition, connection,

661

command):

638

def checker_callback(self, pid, condition, command):

662

639

"""The checker has completed, so take appropriate actions."""

663

640

self.checker_callback_tag = None

664

641

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

642

if os.WIFEXITED(condition):

643

self.last_checker_status = os.WEXITSTATUS(condition)

672

644

if self.last_checker_status == 0:

673

645

logger.info("Checker for %(name)s succeeded",

674

646

vars(self))

677

649

logger.info("Checker for %(name)s failed", vars(self))

678

650

else:

679

651

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

652

logger.warning("Checker for %(name)s crashed?",

682

653

vars(self))

683

return False

684

654

685

655

def checked_ok(self):

686

656

"""Assert that the client has been seen, alive and well."""

687

657

self.last_checked_ok = datetime.datetime.utcnow()

688

658

self.last_checker_status = 0

689

self.last_checker_signal = None

690

659

self.bump_timeout()

691

660

692

661

def bump_timeout(self, timeout=None):

718

687

# than 'timeout' for the client to be disabled, which is as it

719

688

# should be.

720

689

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

725

704

# Start a new checker if needed

726

705

if self.checker is None:

727

706

# Escape attributes for the shell

736

715

exc_info=error)

737

716

return True # Try again later

738

717

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

718

try:

719

logger.info("Starting checker %r for %s", command,

720

self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True,

736

cwd="/",

737

**popen_args)

738

except OSError as error:

739

logger.error("Failed to start subprocess",

740

exc_info=error)

741

return True

742

self.checker_callback_tag = gobject.child_watch_add(

743

self.checker.pid, self.checker_callback, data=command)

744

# The checker may have completed before the gobject

745

# watch was added. Check for this.

746

try:

747

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

748

except OSError as error:

749

if error.errno == errno.ECHILD:

750

# This should never happen

751

logger.error("Child process vanished",

752

exc_info=error)

753

return True

754

raise

755

if pid:

756

gobject.source_remove(self.checker_callback_tag)

757

self.checker_callback(pid, status, command)

764

758

# Re-run this periodically if run by gobject.timeout_add

765

759

return True

766

760

772

766

if getattr(self, "checker", None) is None:

773

767

return

774

768

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

769

try:

770

self.checker.terminate()

771

#time.sleep(0.5)

772

#if self.checker.poll() is None:

773

# self.checker.kill()

774

except OSError as error:

775

if error.errno != errno.ESRCH: # No such process

776

raise

776

777

self.checker = None

777

778

779

1110

1111

interface_names.add(alt_interface)

1111

1112

# Is this a D-Bus signal?

1112

1113

if getattr(attribute, "_dbus_is_signal", False):

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1120

else:

1121

nonmethod_func = attribute

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1122

1120

# Create a new, but exactly alike, function

1123

1121

# object, and decorate it to be a new D-Bus signal

1124

1122

# with the alternate D-Bus interface name

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1139

1123

new_function = (dbus.service.signal(

1140

alt_interface,

1141

attribute._dbus_signature)(new_function))

1124

alt_interface, attribute._dbus_signature)

1125

(types.FunctionType(

1126

nonmethod_func.func_code,

1127

nonmethod_func.func_globals,

1128

nonmethod_func.func_name,

1129

nonmethod_func.func_defaults,

1130

nonmethod_func.func_closure)))

1142

1131

# Copy annotations, if any

1143

1132

try:

1144

1133

new_function._dbus_annotations = dict(

1367

1356

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1368

1357

Client.__del__(self, *args, **kwargs)

1369

1358

1370

def checker_callback(self, source, condition,

1371

connection, command, *args, **kwargs):

1372

ret = Client.checker_callback(self, source, condition,

1373

connection, command, *args,

1374

**kwargs)

1375

exitstatus = self.last_checker_status

1376

if exitstatus >= 0:

1359

def checker_callback(self, pid, condition, command,

1360

*args, **kwargs):

1361

self.checker_callback_tag = None

1362

self.checker = None

1363

if os.WIFEXITED(condition):

1364

exitstatus = os.WEXITSTATUS(condition)

1377

1365

# Emit D-Bus signal

1378

1366

self.CheckerCompleted(dbus.Int16(exitstatus),

1379

dbus.Int64(0),

1367

dbus.Int64(condition),

1380

1368

dbus.String(command))

1381

1369

else:

1382

1370

# Emit D-Bus signal

1383

1371

self.CheckerCompleted(dbus.Int16(-1),

1384

dbus.Int64(

1385

self.last_checker_signal),

1372

dbus.Int64(condition),

1386

1373

dbus.String(command))

1387

return ret

1374

1375

return Client.checker_callback(self, pid, condition, command,

1376

*args, **kwargs)

1388

1377

1389

1378

def start_checker(self, *args, **kwargs):

1390

1379

old_checker_pid = getattr(self.checker, "pid", None)

2152

2141

2153

2142

if command == 'getattr':

2154

2143

attrname = request[1]

2155

if isinstance(client_object.__getattribute__(attrname),

2156

collections.Callable):

2144

if callable(client_object.__getattribute__(attrname)):

2157

2145

parent_pipe.send(('function', ))

2158

2146

else:

2159

2147

parent_pipe.send((

2194

2182

# avoid excessive use of external libraries.

2195

2183

2196

2184

# New type for defining tokens, syntax, and semantics all-in-one

2185

Token = collections.namedtuple("Token",

2186

("regexp", # To match token; if

2187

# "value" is not None,

2188

# must have a "group"

2189

# containing digits

2190

"value", # datetime.timedelta or

2191

# None

2192

"followers")) # Tokens valid after

2193

# this token

2197

2194

Token = collections.namedtuple("Token", (

2198

2195

"regexp", # To match token; if "value" is not None, must have

2199

2196

# a "group" containing digits

2234

2231

# Define starting values

2235

2232

value = datetime.timedelta() # Value so far

2236

2233

found_token = None

2237

followers = frozenset((token_duration, )) # Following valid tokens

2234

followers = frozenset((token_duration,)) # Following valid tokens

2238

2235

s = duration # String left to parse

2239

2236

# Loop until end token is found

2240

2237

while found_token is not token_end:

2397

2394

"debug": "False",

2398

2395

"priority":

2399

2396

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2400

":+SIGN-DSA-SHA256",

2397

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2401

2398

"servicename": "Mandos",

2402

2399

"use_dbus": "True",

2403

2400

"use_ipv6": "True",

2659

2656

pass

2660

2657

2661

2658

# Clients who has passed its expire date can still be

2662

# enabled if its last checker was successful. A Client

2659

# enabled if its last checker was successful. Clients

2663

2660

# whose checker succeeded before we stored its state is

2664

2661

# assumed to have successfully run all checkers during

2665

2662

# downtime.