To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 777
- compare with another revision
- download diff
- download tarball
- view history from revision 777
- Committer: Teddy Hogeborn
- Date: 2015-07-20 03:03:33 UTC
- Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
- files added:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
import SocketServer as socketserver
37
from future_builtins import *
38
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
38
43
import socket
39
44
import argparse
40
45
import datetime
45
50
import gnutls.library.functions
46
51
import gnutls.library.constants
47
52
import gnutls.library.types
48
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
49
57
import sys
50
58
import re
51
59
import os
60
68
import struct
61
69
import fcntl
62
70
import functools
63
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
64
75
import multiprocessing
76
import types
77
import binascii
78
import tempfile
79
import itertools
80
import collections
81
import codecs
65
82
66
83
import dbus
67
84
import dbus.service
68
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
69
89
import avahi
70
90
from dbus.mainloop.glib import DBusGMainLoop
71
91
import ctypes
81
101
except ImportError:
82
102
SO_BINDTODEVICE = None
83
103
84
85
version = "1.3.1"
86
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
89
syslogger = (logging.handlers.SysLogHandler
90
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
92
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
95
logger.addHandler(syslogger)
96
97
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
101
logger.addHandler(console)
104
if sys.version_info.major == 2:
105
str = unicode
106
107
version = "1.6.9"
108
stored_state_file = "clients.pickle"
109
110
logger = logging.getLogger()
111
syslogger = None
112
113
try:
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
116
except (OSError, AttributeError):
117
118
def if_nametoindex(interface):
119
"Get an interface index the hard way, i.e. using fcntl()"
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
121
with contextlib.closing(socket.socket()) as s:
122
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
struct.pack(b"16s16x", interface))
124
interface_index = struct.unpack("I", ifreq[16:20])[0]
125
return interface_index
126
127
128
def initlogger(debug, level=logging.WARNING):
129
"""init logger and add loglevel"""
130
131
global syslogger
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
135
syslogger.setFormatter(logging.Formatter
136
('Mandos [%(process)d]: %(levelname)s:'
137
' %(message)s'))
138
logger.addHandler(syslogger)
139
140
if debug:
141
console = logging.StreamHandler()
142
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
143
' [%(process)d]:'
144
' %(levelname)s:'
145
' %(message)s'))
146
logger.addHandler(console)
147
logger.setLevel(level)
148
149
150
class PGPError(Exception):
151
"""Exception if encryption/decryption fails"""
152
pass
153
154
155
class PGPEngine(object):
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
158
def __init__(self):
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
self.gnupgargs = ['--batch',
161
'--home', self.tempdir,
162
'--force-mdc',
163
'--quiet',
164
'--no-use-agent']
165
166
def __enter__(self):
167
return self
168
169
def __exit__(self, exc_type, exc_value, traceback):
170
self._cleanup()
171
return False
172
173
def __del__(self):
174
self._cleanup()
175
176
def _cleanup(self):
177
if self.tempdir is not None:
178
# Delete contents of tempdir
179
for root, dirs, files in os.walk(self.tempdir,
180
topdown = False):
181
for filename in files:
182
os.remove(os.path.join(root, filename))
183
for dirname in dirs:
184
os.rmdir(os.path.join(root, dirname))
185
# Remove tempdir
186
os.rmdir(self.tempdir)
187
self.tempdir = None
188
189
def password_encode(self, password):
190
# Passphrase can not be empty and can not contain newlines or
191
# NUL bytes. So we prefix it and hex encode it.
192
encoded = b"mandos" + binascii.hexlify(password)
193
if len(encoded) > 2048:
194
# GnuPG can't handle long passwords, so encode differently
195
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
.replace(b"\n", b"\\n")
197
.replace(b"\0", b"\\x00"))
198
return encoded
199
200
def encrypt(self, data, password):
201
passphrase = self.password_encode(password)
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
204
passfile.write(passphrase)
205
passfile.flush()
206
proc = subprocess.Popen(['gpg', '--symmetric',
207
'--passphrase-file',
208
passfile.name]
209
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
214
if proc.returncode != 0:
215
raise PGPError(err)
216
return ciphertext
217
218
def decrypt(self, data, password):
219
passphrase = self.password_encode(password)
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
222
passfile.write(passphrase)
223
passfile.flush()
224
proc = subprocess.Popen(['gpg', '--decrypt',
225
'--passphrase-file',
226
passfile.name]
227
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
232
if proc.returncode != 0:
233
raise PGPError(err)
234
return decrypted_plaintext
235
102
236
103
237
class AvahiError(Exception):
104
238
def __init__(self, value, *args, **kwargs):
105
239
self.value = value
106
super(AvahiError, self).__init__(value, *args, **kwargs)
107
def __unicode__(self):
108
return unicode(repr(self.value))
240
return super(AvahiError, self).__init__(value, *args,
241
**kwargs)
242
109
243
110
244
class AvahiServiceError(AvahiError):
111
245
pass
112
246
247
113
248
class AvahiGroupError(AvahiError):
114
249
pass
115
250
122
257
Used to optionally bind to the specified interface.
123
258
name: string; Example: 'Mandos'
124
259
type: string; Example: '_mandos._tcp'.
125
See <http://www.dns-sd.org/ServiceTypes.html>
260
See <https://www.iana.org/assignments/service-names-port-numbers>
126
261
port: integer; what port to announce
127
262
TXT: list of strings; TXT record for the service
128
263
domain: string; Domain to publish on, default to .local if empty.
134
269
server: D-Bus Server
135
270
bus: dbus.SystemBus()
136
271
"""
137
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
140
protocol = avahi.PROTO_UNSPEC, bus = None):
272
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
141
284
self.interface = interface
142
285
self.name = name
143
286
self.type = servicetype
152
295
self.server = None
153
296
self.bus = bus
154
297
self.entry_group_state_changed_match = None
155
def rename(self):
298
299
def rename(self, remove=True):
156
300
"""Derived from the Avahi example code"""
157
301
if self.rename_count >= self.max_renames:
158
302
logger.critical("No suitable Zeroconf service name found"
159
303
" after %i retries, exiting.",
160
304
self.rename_count)
161
305
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
308
self.rename_count += 1
163
309
logger.info("Changing Zeroconf service name to %r ...",
164
310
self.name)
165
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
168
% self.name))
169
self.remove()
311
if remove:
312
self.remove()
170
313
try:
171
314
self.add()
172
315
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
176
self.rename_count += 1
316
if (error.get_dbus_name()
317
== "org.freedesktop.Avahi.CollisionError"):
318
logger.info("Local Zeroconf service name collision.")
319
return self.rename(remove=False)
320
else:
321
logger.critical("D-Bus Exception", exc_info=error)
322
self.cleanup()
323
os._exit(1)
324
177
325
def remove(self):
178
326
"""Derived from the Avahi example code"""
179
327
if self.entry_group_state_changed_match is not None:
181
329
self.entry_group_state_changed_match = None
182
330
if self.group is not None:
183
331
self.group.Reset()
332
184
333
def add(self):
185
334
"""Derived from the Avahi example code"""
186
335
self.remove()
191
340
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
341
self.entry_group_state_changed_match = (
193
342
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
343
'StateChanged', self.entry_group_state_changed))
195
344
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
196
345
self.name, self.type)
197
346
self.group.AddService(
203
352
dbus.UInt16(self.port),
204
353
avahi.string_array_to_txt_array(self.TXT))
205
354
self.group.Commit()
355
206
356
def entry_group_state_changed(self, state, error):
207
357
"""Derived from the Avahi example code"""
208
358
logger.debug("Avahi entry group state change: %i", state)
214
364
self.rename()
215
365
elif state == avahi.ENTRY_GROUP_FAILURE:
216
366
logger.critical("Avahi: Error in group state changed %s",
217
unicode(error))
218
raise AvahiGroupError("State changed: %s"
219
% unicode(error))
367
str(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
369
220
370
def cleanup(self):
221
371
"""Derived from the Avahi example code"""
222
372
if self.group is not None:
223
373
try:
224
374
self.group.Free()
225
375
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
376
dbus.exceptions.DBusException):
227
377
pass
228
378
self.group = None
229
379
self.remove()
380
230
381
def server_state_changed(self, state, error=None):
231
382
"""Derived from the Avahi example code"""
232
383
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
240
390
if state in bad_states:
241
391
if bad_states[state] is not None:
242
392
if error is None:
245
395
logger.error(bad_states[state] + ": %r", error)
246
396
self.cleanup()
247
397
elif state == avahi.SERVER_RUNNING:
248
self.add()
398
try:
399
self.add()
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
404
" collision.")
405
return self.rename(remove=False)
406
else:
407
logger.critical("D-Bus Exception", exc_info=error)
408
self.cleanup()
409
os._exit(1)
249
410
else:
250
411
if error is None:
251
412
logger.debug("Unknown state: %r", state)
252
413
else:
253
414
logger.debug("Unknown state: %r: %r", state, error)
415
254
416
def activate(self):
255
417
"""Derived from the Avahi example code"""
256
418
if self.server is None:
260
422
follow_name_owner_changes=True),
261
423
avahi.DBUS_INTERFACE_SERVER)
262
424
self.server.connect_to_signal("StateChanged",
263
self.server_state_changed)
425
self.server_state_changed)
264
426
self.server_state_changed(self.server.GetState())
265
427
266
428
429
class AvahiServiceToSyslog(AvahiService):
430
def rename(self, *args, **kwargs):
431
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
.format(self.name)))
436
return ret
437
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
441
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
444
"""
445
connection.send(func(*args, **kwargs))
446
connection.close()
447
267
448
class Client(object):
268
449
"""A representation of a client host served by this server.
269
450
270
451
Attributes:
271
_approved: bool(); 'None' if not yet approved/disapproved
452
approved: bool(); 'None' if not yet approved/disapproved
272
453
approval_delay: datetime.timedelta(); Time to wait for approval
273
454
approval_duration: datetime.timedelta(); Duration of one approval
274
455
checker: subprocess.Popen(); a running checker process used
281
462
instance %(name)s can be used in the command.
282
463
checker_initiator_tag: a gobject event source tag, or None
283
464
created: datetime.datetime(); (UTC) object creation
465
client_structure: Object describing what attributes a client has
466
and is used for storing the client at exit
284
467
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
286
468
disable_initiator_tag: a gobject event source tag, or None
287
469
enabled: bool()
288
470
fingerprint: string (40 or 32 hexadecimal digits); used to
291
473
interval: datetime.timedelta(); How often to start a new checker
292
474
last_approval_request: datetime.datetime(); (UTC) or None
293
475
last_checked_ok: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
476
last_checker_status: integer between 0 and 255 reflecting exit
477
status of last checker. -1 reflects crashed
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
481
last_enabled: datetime.datetime(); (UTC) or None
295
482
name: string; from the config file, used in log messages and
296
483
D-Bus identifiers
297
484
secret: bytestring; sent verbatim (over TLS) to client
298
485
timeout: datetime.timedelta(); How long from last_checked_ok
299
486
until this client is disabled
487
extended_timeout: extra long timeout when secret has been sent
300
488
runtime_expansions: Allowed attributes for runtime expansion.
489
expires: datetime.datetime(); time (UTC) when a client will be
490
disabled, or None
491
server_settings: The server_settings dict from main()
301
492
"""
302
493
303
494
runtime_expansions = ("approval_delay", "approval_duration",
304
"created", "enabled", "fingerprint",
305
"host", "interval", "last_checked_ok",
495
"created", "enabled", "expires",
496
"fingerprint", "host", "interval",
497
"last_approval_request", "last_checked_ok",
306
498
"last_enabled", "name", "timeout")
499
client_defaults = {
500
"timeout": "PT5M",
501
"extended_timeout": "PT15M",
502
"interval": "PT2M",
503
"checker": "fping -q -- %%(host)s",
504
"host": "",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
508
"enabled": "True",
509
}
307
510
308
511
@staticmethod
309
def _timedelta_to_milliseconds(td):
310
"Convert a datetime.timedelta() to milliseconds"
311
return ((td.days * 24 * 60 * 60 * 1000)
312
+ (td.seconds * 1000)
313
+ (td.microseconds // 1000))
314
315
def timeout_milliseconds(self):
316
"Return the 'timeout' attribute in milliseconds"
317
return self._timedelta_to_milliseconds(self.timeout)
318
319
def interval_milliseconds(self):
320
"Return the 'interval' attribute in milliseconds"
321
return self._timedelta_to_milliseconds(self.interval)
322
323
def approval_delay_milliseconds(self):
324
return self._timedelta_to_milliseconds(self.approval_delay)
325
326
def __init__(self, name = None, disable_hook=None, config=None):
327
"""Note: the 'checker' key in 'config' sets the
328
'checker_command' attribute and *not* the 'checker'
329
attribute."""
512
def config_parser(config):
513
"""Construct a new dict of client settings of this form:
514
{ client_name: {setting_name: value, ...}, ...}
515
with exceptions for any special settings as defined above.
516
NOTE: Must be a pure function. Must return the same result
517
value given the same arguments.
518
"""
519
settings = {}
520
for client_name in config.sections():
521
section = dict(config.items(client_name))
522
client = settings[client_name] = {}
523
524
client["host"] = section["host"]
525
# Reformat values from string types to Python types
526
client["approved_by_default"] = config.getboolean(
527
client_name, "approved_by_default")
528
client["enabled"] = config.getboolean(client_name,
529
"enabled")
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
534
client["fingerprint"] = (section["fingerprint"].upper()
535
.replace(" ", ""))
536
if "secret" in section:
537
client["secret"] = section["secret"].decode("base64")
538
elif "secfile" in section:
539
with open(os.path.expanduser(os.path.expandvars
540
(section["secfile"])),
541
"rb") as secfile:
542
client["secret"] = secfile.read()
543
else:
544
raise TypeError("No secret or secfile for section {}"
545
.format(section))
546
client["timeout"] = string_to_delta(section["timeout"])
547
client["extended_timeout"] = string_to_delta(
548
section["extended_timeout"])
549
client["interval"] = string_to_delta(section["interval"])
550
client["approval_delay"] = string_to_delta(
551
section["approval_delay"])
552
client["approval_duration"] = string_to_delta(
553
section["approval_duration"])
554
client["checker_command"] = section["checker"]
555
client["last_approval_request"] = None
556
client["last_checked_ok"] = None
557
client["last_checker_status"] = -2
558
559
return settings
560
561
def __init__(self, settings, name = None, server_settings=None):
330
562
self.name = name
331
if config is None:
332
config = {}
563
if server_settings is None:
564
server_settings = {}
565
self.server_settings = server_settings
566
# adding all client settings
567
for setting, value in settings.items():
568
setattr(self, setting, value)
569
570
if self.enabled:
571
if not hasattr(self, "last_enabled"):
572
self.last_enabled = datetime.datetime.utcnow()
573
if not hasattr(self, "expires"):
574
self.expires = (datetime.datetime.utcnow()
575
+ self.timeout)
576
else:
577
self.last_enabled = None
578
self.expires = None
579
333
580
logger.debug("Creating client %r", self.name)
334
# Uppercase and remove spaces from fingerprint for later
335
# comparison purposes with return value from the fingerprint()
336
# function
337
self.fingerprint = (config["fingerprint"].upper()
338
.replace(" ", ""))
339
581
logger.debug(" Fingerprint: %s", self.fingerprint)
340
if "secret" in config:
341
self.secret = config["secret"].decode("base64")
342
elif "secfile" in config:
343
with open(os.path.expanduser(os.path.expandvars
344
(config["secfile"])),
345
"rb") as secfile:
346
self.secret = secfile.read()
347
else:
348
raise TypeError("No secret or secfile for client %s"
349
% self.name)
350
self.host = config.get("host", "")
351
self.created = datetime.datetime.utcnow()
352
self.enabled = False
353
self.last_approval_request = None
354
self.last_enabled = None
355
self.last_checked_ok = None
356
self.timeout = string_to_delta(config["timeout"])
357
self.interval = string_to_delta(config["interval"])
358
self.disable_hook = disable_hook
582
self.created = settings.get("created",
583
datetime.datetime.utcnow())
584
585
# attributes specific for this server instance
359
586
self.checker = None
360
587
self.checker_initiator_tag = None
361
588
self.disable_initiator_tag = None
362
589
self.checker_callback_tag = None
363
self.checker_command = config["checker"]
364
590
self.current_checker_command = None
365
self.last_connect = None
366
self._approved = None
367
self.approved_by_default = config.get("approved_by_default",
368
True)
591
self.approved = None
369
592
self.approvals_pending = 0
370
self.approval_delay = string_to_delta(
371
config["approval_delay"])
372
self.approval_duration = string_to_delta(
373
config["approval_duration"])
374
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
597
if not attr.startswith("_")]
598
self.client_structure.append("client_structure")
599
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
602
if not name.startswith("_"):
603
self.client_structure.append(name)
375
604
605
# Send notice to process children that client state has changed
376
606
def send_changedstate(self):
377
self.changedstate.acquire()
378
self.changedstate.notify_all()
379
self.changedstate.release()
380
607
with self.changedstate:
608
self.changedstate.notify_all()
609
381
610
def enable(self):
382
611
"""Start this client's checker and timeout hooks"""
383
612
if getattr(self, "enabled", False):
384
613
# Already enabled
385
614
return
386
self.send_changedstate()
615
self.expires = datetime.datetime.utcnow() + self.timeout
616
self.enabled = True
387
617
self.last_enabled = datetime.datetime.utcnow()
388
# Schedule a new checker to be started an 'interval' from now,
389
# and every interval from then on.
390
self.checker_initiator_tag = (gobject.timeout_add
391
(self.interval_milliseconds(),
392
self.start_checker))
393
# Schedule a disable() when 'timeout' has passed
394
self.disable_initiator_tag = (gobject.timeout_add
395
(self.timeout_milliseconds(),
396
self.disable))
397
self.enabled = True
398
# Also start a new checker *right now*.
399
self.start_checker()
618
self.init_checker()
619
self.send_changedstate()
400
620
401
621
def disable(self, quiet=True):
402
622
"""Disable this client."""
403
623
if not getattr(self, "enabled", False):
404
624
return False
405
625
if not quiet:
406
self.send_changedstate()
407
if not quiet:
408
626
logger.info("Disabling client %s", self.name)
409
if getattr(self, "disable_initiator_tag", False):
627
if getattr(self, "disable_initiator_tag", None) is not None:
410
628
gobject.source_remove(self.disable_initiator_tag)
411
629
self.disable_initiator_tag = None
412
if getattr(self, "checker_initiator_tag", False):
630
self.expires = None
631
if getattr(self, "checker_initiator_tag", None) is not None:
413
632
gobject.source_remove(self.checker_initiator_tag)
414
633
self.checker_initiator_tag = None
415
634
self.stop_checker()
416
if self.disable_hook:
417
self.disable_hook(self)
418
635
self.enabled = False
636
if not quiet:
637
self.send_changedstate()
419
638
# Do not run this again if called by a gobject.timeout_add
420
639
return False
421
640
422
641
def __del__(self):
423
self.disable_hook = None
424
642
self.disable()
425
643
426
def checker_callback(self, pid, condition, command):
644
def init_checker(self):
645
# Schedule a new checker to be started an 'interval' from now,
646
# and every interval from then on.
647
if self.checker_initiator_tag is not None:
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
652
# Schedule a disable() when 'timeout' has passed
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
657
# Also start a new checker *right now*.
658
self.start_checker()
659
660
def checker_callback(self, source, condition, connection,
661
command):
427
662
"""The checker has completed, so take appropriate actions."""
428
663
self.checker_callback_tag = None
429
664
self.checker = None
430
if os.WIFEXITED(condition):
431
exitstatus = os.WEXITSTATUS(condition)
432
if exitstatus == 0:
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
667
connection.close()
668
669
if returncode >= 0:
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
672
if self.last_checker_status == 0:
433
673
logger.info("Checker for %(name)s succeeded",
434
674
vars(self))
435
675
self.checked_ok()
436
676
else:
437
logger.info("Checker for %(name)s failed",
438
vars(self))
677
logger.info("Checker for %(name)s failed", vars(self))
439
678
else:
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
440
681
logger.warning("Checker for %(name)s crashed?",
441
682
vars(self))
683
return False
442
684
443
685
def checked_ok(self):
444
"""Bump up the timeout for this client.
445
446
This should only be called when the client has been seen,
447
alive and well.
448
"""
686
"""Assert that the client has been seen, alive and well."""
449
687
self.last_checked_ok = datetime.datetime.utcnow()
450
gobject.source_remove(self.disable_initiator_tag)
451
self.disable_initiator_tag = (gobject.timeout_add
452
(self.timeout_milliseconds(),
453
self.disable))
688
self.last_checker_status = 0
689
self.last_checker_signal = None
690
self.bump_timeout()
691
692
def bump_timeout(self, timeout=None):
693
"""Bump up the timeout for this client."""
694
if timeout is None:
695
timeout = self.timeout
696
if self.disable_initiator_tag is not None:
697
gobject.source_remove(self.disable_initiator_tag)
698
self.disable_initiator_tag = None
699
if getattr(self, "enabled", False):
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
702
self.expires = datetime.datetime.utcnow() + timeout
454
703
455
704
def need_approval(self):
456
705
self.last_approval_request = datetime.datetime.utcnow()
461
710
If a checker already exists, leave it running and do
462
711
nothing."""
463
712
# The reason for not killing a running checker is that if we
464
# did that, then if a checker (for some reason) started
465
# running slowly and taking more than 'interval' time, the
466
# client would inevitably timeout, since no checker would get
467
# a chance to run to completion. If we instead leave running
713
# did that, and if a checker (for some reason) started running
714
# slowly and taking more than 'interval' time, then the client
715
# would inevitably timeout, since no checker would get a
716
# chance to run to completion. If we instead leave running
468
717
# checkers alone, the checker would have to take more time
469
718
# than 'timeout' for the client to be disabled, which is as it
470
719
# should be.
471
720
472
# If a checker exists, make sure it is not a zombie
473
try:
474
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
475
except (AttributeError, OSError) as error:
476
if (isinstance(error, OSError)
477
and error.errno != errno.ECHILD):
478
raise error
479
else:
480
if pid:
481
logger.warning("Checker was a zombie")
482
gobject.source_remove(self.checker_callback_tag)
483
self.checker_callback(pid, status,
484
self.current_checker_command)
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
723
self.checker.join()
724
self.checker = None
485
725
# Start a new checker if needed
486
726
if self.checker is None:
727
# Escape attributes for the shell
728
escaped_attrs = {
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
487
731
try:
488
# In case checker_command has exactly one % operator
489
command = self.checker_command % self.host
490
except TypeError:
491
# Escape attributes for the shell
492
escaped_attrs = dict(
493
(attr,
494
re.escape(unicode(str(getattr(self, attr, "")),
495
errors=
496
'replace')))
497
for attr in
498
self.runtime_expansions)
499
500
try:
501
command = self.checker_command % escaped_attrs
502
except TypeError as error:
503
logger.error('Could not format string "%s":'
504
' %s', self.checker_command, error)
505
return True # Try again later
732
command = self.checker_command % escaped_attrs
733
except TypeError as error:
734
logger.error('Could not format string "%s"',
735
self.checker_command,
736
exc_info=error)
737
return True # Try again later
506
738
self.current_checker_command = command
507
try:
508
logger.info("Starting checker %r for %s",
509
command, self.name)
510
# We don't need to redirect stdout and stderr, since
511
# in normal mode, that is already done by daemon(),
512
# and in debug mode we don't want to. (Stdin is
513
# always replaced by /dev/null.)
514
self.checker = subprocess.Popen(command,
515
close_fds=True,
516
shell=True, cwd="/")
517
self.checker_callback_tag = (gobject.child_watch_add
518
(self.checker.pid,
519
self.checker_callback,
520
data=command))
521
# The checker may have completed before the gobject
522
# watch was added. Check for this.
523
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
524
if pid:
525
gobject.source_remove(self.checker_callback_tag)
526
self.checker_callback(pid, status, command)
527
except OSError as error:
528
logger.error("Failed to start subprocess: %s",
529
error)
739
logger.info("Starting checker %r for %s", command,
740
self.name)
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
747
# created wnull.
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
760
self.checker.start()
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
530
764
# Re-run this periodically if run by gobject.timeout_add
531
765
return True
532
766
538
772
if getattr(self, "checker", None) is None:
539
773
return
540
774
logger.debug("Stopping checker for %(name)s", vars(self))
541
try:
542
os.kill(self.checker.pid, signal.SIGTERM)
543
#time.sleep(0.5)
544
#if self.checker.poll() is None:
545
# os.kill(self.checker.pid, signal.SIGKILL)
546
except OSError as error:
547
if error.errno != errno.ESRCH: # No such process
548
raise
775
self.checker.terminate()
549
776
self.checker = None
550
777
551
def dbus_service_property(dbus_interface, signature="v",
552
access="readwrite", byte_arrays=False):
778
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
553
783
"""Decorators for marking methods of a DBusObjectWithProperties to
554
784
become properties on the D-Bus.
555
785
564
794
# "Set" method, so we fail early here:
565
795
if byte_arrays and signature != "ay":
566
796
raise ValueError("Byte arrays not supported for non-'ay'"
567
" signature %r" % signature)
797
" signature {!r}".format(signature))
798
568
799
def decorator(func):
569
800
func._dbus_is_property = True
570
801
func._dbus_interface = dbus_interface
575
806
func._dbus_name = func._dbus_name[:-14]
576
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
577
808
return func
809
810
return decorator
811
812
813
def dbus_interface_annotations(dbus_interface):
814
"""Decorator for marking functions returning interface annotations
815
816
Usage:
817
818
@dbus_interface_annotations("org.example.Interface")
819
def _foo(self): # Function name does not matter
820
return {"org.freedesktop.DBus.Deprecated": "true",
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
822
"false"}
823
"""
824
825
def decorator(func):
826
func._dbus_is_interface = True
827
func._dbus_interface = dbus_interface
828
func._dbus_name = dbus_interface
829
return func
830
831
return decorator
832
833
834
def dbus_annotations(annotations):
835
"""Decorator to annotate D-Bus methods, signals or properties
836
Usage:
837
838
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
"org.freedesktop.DBus.Property."
840
"EmitsChangedSignal": "false"})
841
@dbus_service_property("org.example.Interface", signature="b",
842
access="r")
843
def Property_dbus_property(self):
844
return dbus.Boolean(False)
845
"""
846
847
def decorator(func):
848
func._dbus_annotations = annotations
849
return func
850
578
851
return decorator
579
852
580
853
581
854
class DBusPropertyException(dbus.exceptions.DBusException):
582
855
"""A base class for D-Bus property-related exceptions
583
856
"""
584
def __unicode__(self):
585
return unicode(str(self))
857
pass
586
858
587
859
588
860
class DBusPropertyAccessException(DBusPropertyException):
599
871
600
872
class DBusObjectWithProperties(dbus.service.Object):
601
873
"""A D-Bus object with properties.
602
874
603
875
Classes inheriting from this can use the dbus_service_property
604
876
decorator to expose methods as D-Bus properties. It exposes the
605
877
standard Get(), Set(), and GetAll() methods on the D-Bus.
606
878
"""
607
879
608
880
@staticmethod
609
def _is_dbus_property(obj):
610
return getattr(obj, "_dbus_is_property", False)
881
def _is_dbus_thing(thing):
882
"""Returns a function testing if an attribute is a D-Bus thing
883
884
If called like _is_dbus_thing("method") it returns a function
885
suitable for use as predicate to inspect.getmembers().
886
"""
887
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
False)
611
889
612
def _get_all_dbus_properties(self):
890
def _get_all_dbus_things(self, thing):
613
891
"""Returns a generator of (name, attribute) pairs
614
892
"""
615
return ((prop._dbus_name, prop)
616
for name, prop in
617
inspect.getmembers(self, self._is_dbus_property))
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
894
athing.__get__(self))
895
for cls in self.__class__.__mro__
896
for name, athing in
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
618
898
619
899
def _get_dbus_property(self, interface_name, property_name):
620
900
"""Returns a bound method if one exists which is a D-Bus
621
901
property with the specified name and interface.
622
902
"""
623
for name in (property_name,
624
property_name + "_dbus_property"):
625
prop = getattr(self, name, None)
626
if (prop is None
627
or not self._is_dbus_property(prop)
628
or prop._dbus_name != property_name
629
or (interface_name and prop._dbus_interface
630
and interface_name != prop._dbus_interface)):
631
continue
632
return prop
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
906
if (value._dbus_name == property_name
907
and value._dbus_interface == interface_name):
908
return value.__get__(self)
909
633
910
# No such property
634
raise DBusPropertyNotFound(self.dbus_object_path + ":"
635
+ interface_name + "."
636
+ property_name)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
637
913
638
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
915
in_signature="ss",
639
916
out_signature="v")
640
917
def Get(self, interface_name, property_name):
641
918
"""Standard D-Bus property Get() method, see D-Bus standard.
659
936
# The byte_arrays option is not supported yet on
660
937
# signatures other than "ay".
661
938
if prop._dbus_signature != "ay":
662
raise ValueError
663
value = dbus.ByteArray(''.join(unichr(byte)
664
for byte in value))
939
raise ValueError("Byte arrays not supported for non-"
940
"'ay' signature {!r}"
941
.format(prop._dbus_signature))
942
value = dbus.ByteArray(b''.join(chr(byte)
943
for byte in value))
665
944
prop(value)
666
945
667
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
in_signature="s",
668
948
out_signature="a{sv}")
669
949
def GetAll(self, interface_name):
670
950
"""Standard D-Bus property GetAll() method, see D-Bus
671
951
standard.
672
952
673
953
Note: Will not include properties with access="write".
674
954
"""
675
all = {}
676
for name, prop in self._get_all_dbus_properties():
955
properties = {}
956
for name, prop in self._get_all_dbus_things("property"):
677
957
if (interface_name
678
958
and interface_name != prop._dbus_interface):
679
959
# Interface non-empty but did not match
683
963
continue
684
964
value = prop()
685
965
if not hasattr(value, "variant_level"):
686
all[name] = value
966
properties[name] = value
687
967
continue
688
all[name] = type(value)(value, variant_level=
689
value.variant_level+1)
690
return dbus.Dictionary(all, signature="sv")
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
970
return dbus.Dictionary(properties, signature="sv")
971
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
def PropertiesChanged(self, interface_name, changed_properties,
974
invalidated_properties):
975
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
976
standard.
977
"""
978
pass
691
979
692
980
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
693
981
out_signature="s",
694
982
path_keyword='object_path',
695
983
connection_keyword='connection')
696
984
def Introspect(self, object_path, connection):
697
"""Standard D-Bus method, overloaded to insert property tags.
985
"""Overloading of standard D-Bus method.
986
987
Inserts property tags and interface annotation tags.
698
988
"""
699
989
xmlstring = dbus.service.Object.Introspect(self, object_path,
700
990
connection)
701
991
try:
702
992
document = xml.dom.minidom.parseString(xmlstring)
993
703
994
def make_tag(document, name, prop):
704
995
e = document.createElement("property")
705
996
e.setAttribute("name", name)
706
997
e.setAttribute("type", prop._dbus_signature)
707
998
e.setAttribute("access", prop._dbus_access)
708
999
return e
1000
709
1001
for if_tag in document.getElementsByTagName("interface"):
1002
# Add property tags
710
1003
for tag in (make_tag(document, name, prop)
711
1004
for name, prop
712
in self._get_all_dbus_properties()
1005
in self._get_all_dbus_things("property")
713
1006
if prop._dbus_interface
714
1007
== if_tag.getAttribute("name")):
715
1008
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1012
annots = dict()
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1022
"annotation")
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1033
)).items():
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
716
1038
# Add the names to the return values for the
717
1039
# "org.freedesktop.DBus.Properties" methods
718
1040
if (if_tag.getAttribute("name")
733
1055
except (AttributeError, xml.dom.DOMException,
734
1056
xml.parsers.expat.ExpatError) as error:
735
1057
logger.error("Failed to override Introspection method",
736
error)
1058
exc_info=error)
737
1059
return xmlstring
738
1060
739
1061
1062
def datetime_to_dbus(dt, variant_level=0):
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1064
if dt is None:
1065
return dbus.String("", variant_level = variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1067
1068
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
"""A class decorator; applied to a subclass of
1071
dbus.service.Object, it will add alternate D-Bus attributes with
1072
interface names according to the "alt_interface_names" mapping.
1073
Usage:
1074
1075
@alternate_dbus_interfaces({"org.example.Interface":
1076
"net.example.AlternateInterface"})
1077
class SampleDBusObject(dbus.service.Object):
1078
@dbus.service.method("org.example.Interface")
1079
def SampleDBusMethod():
1080
pass
1081
1082
The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
reachable via two interfaces: "org.example.Interface" and
1084
"net.example.AlternateInterface", the latter of which will have
1085
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
"true", unless "deprecate" is passed with a False value.
1087
1088
This works for methods and signals, and also for D-Bus properties
1089
(from DBusObjectWithProperties) and interfaces (from the
1090
dbus_interface_annotations decorator).
1091
"""
1092
1093
def wrapper(cls):
1094
for orig_interface_name, alt_interface_name in (
1095
alt_interface_names.items()):
1096
attr = {}
1097
interface_names = set()
1098
# Go though all attributes of the class
1099
for attrname, attribute in inspect.getmembers(cls):
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1101
# with the wrong interface name
1102
if (not hasattr(attribute, "_dbus_interface")
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1105
continue
1106
# Create an alternate D-Bus interface name based on
1107
# the current name
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1110
interface_names.add(alt_interface)
1111
# Is this a D-Bus signal?
1112
if getattr(attribute, "_dbus_is_signal", False):
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1116
nonmethod_func = (dict(
1117
zip(attribute.func_code.co_freevars,
1118
attribute.__closure__))
1119
["func"].cell_contents)
1120
else:
1121
nonmethod_func = attribute
1122
# Create a new, but exactly alike, function
1123
# object, and decorate it to be a new D-Bus signal
1124
# with the alternate D-Bus interface name
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1132
else:
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1139
new_function = (dbus.service.signal(
1140
alt_interface,
1141
attribute._dbus_signature)(new_function))
1142
# Copy annotations, if any
1143
try:
1144
new_function._dbus_annotations = dict(
1145
attribute._dbus_annotations)
1146
except AttributeError:
1147
pass
1148
# Define a creator of a function to call both the
1149
# original and alternate functions, so both the
1150
# original and alternate signals gets sent when
1151
# the function is called
1152
def fixscope(func1, func2):
1153
"""This function is a scope container to pass
1154
func1 and func2 to the "call_both" function
1155
outside of its arguments"""
1156
1157
def call_both(*args, **kwargs):
1158
"""This function will emit two D-Bus
1159
signals by calling func1 and func2"""
1160
func1(*args, **kwargs)
1161
func2(*args, **kwargs)
1162
1163
return call_both
1164
# Create the "call_both" function and add it to
1165
# the class
1166
attr[attrname] = fixscope(attribute, new_function)
1167
# Is this a D-Bus method?
1168
elif getattr(attribute, "_dbus_is_method", False):
1169
# Create a new, but exactly alike, function
1170
# object. Decorate it to be a new D-Bus method
1171
# with the alternate D-Bus interface name. Add it
1172
# to the class.
1173
attr[attrname] = (
1174
dbus.service.method(
1175
alt_interface,
1176
attribute._dbus_in_signature,
1177
attribute._dbus_out_signature)
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1183
# Copy annotations, if any
1184
try:
1185
attr[attrname]._dbus_annotations = dict(
1186
attribute._dbus_annotations)
1187
except AttributeError:
1188
pass
1189
# Is this a D-Bus property?
1190
elif getattr(attribute, "_dbus_is_property", False):
1191
# Create a new, but exactly alike, function
1192
# object, and decorate it to be a new D-Bus
1193
# property with the alternate D-Bus interface
1194
# name. Add it to the class.
1195
attr[attrname] = (dbus_service_property(
1196
alt_interface, attribute._dbus_signature,
1197
attribute._dbus_access,
1198
attribute._dbus_get_args_options
1199
["byte_arrays"])
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1206
# Copy annotations, if any
1207
try:
1208
attr[attrname]._dbus_annotations = dict(
1209
attribute._dbus_annotations)
1210
except AttributeError:
1211
pass
1212
# Is this a D-Bus interface?
1213
elif getattr(attribute, "_dbus_is_interface", False):
1214
# Create a new, but exactly alike, function
1215
# object. Decorate it to be a new D-Bus interface
1216
# with the alternate D-Bus interface name. Add it
1217
# to the class.
1218
attr[attrname] = (
1219
dbus_interface_annotations(alt_interface)
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1225
if deprecate:
1226
# Deprecate all alternate interfaces
1227
iname="_AlternateDBusNames_interface_annotation{}"
1228
for interface_name in interface_names:
1229
1230
@dbus_interface_annotations(interface_name)
1231
def func(self):
1232
return { "org.freedesktop.DBus.Deprecated":
1233
"true" }
1234
# Find an unused name
1235
for aname in (iname.format(i)
1236
for i in itertools.count()):
1237
if aname not in attr:
1238
attr[aname] = func
1239
break
1240
if interface_names:
1241
# Replace the class with a new subclass of it with
1242
# methods, signals, etc. as created above.
1243
cls = type(b"{}Alternate".format(cls.__name__),
1244
(cls, ), attr)
1245
return cls
1246
1247
return wrapper
1248
1249
1250
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
"se.bsnet.fukt.Mandos"})
740
1252
class ClientDBus(Client, DBusObjectWithProperties):
741
1253
"""A Client class using D-Bus
742
1254
746
1258
"""
747
1259
748
1260
runtime_expansions = (Client.runtime_expansions
749
+ ("dbus_object_path",))
1261
+ ("dbus_object_path", ))
1262
1263
_interface = "se.recompile.Mandos.Client"
750
1264
751
1265
# dbus.service.Object doesn't use super(), so we can't either.
752
1266
753
1267
def __init__(self, bus = None, *args, **kwargs):
754
self._approvals_pending = 0
755
1268
self.bus = bus
756
1269
Client.__init__(self, *args, **kwargs)
757
1270
# Only now, when this client is initialized, can it show up on
758
1271
# the D-Bus
759
client_object_name = unicode(self.name).translate(
1272
client_object_name = str(self.name).translate(
760
1273
{ord("."): ord("_"),
761
1274
ord("-"): ord("_")})
762
self.dbus_object_path = (dbus.ObjectPath
763
("/clients/" + client_object_name))
1275
self.dbus_object_path = dbus.ObjectPath(
1276
"/clients/" + client_object_name)
764
1277
DBusObjectWithProperties.__init__(self, self.bus,
765
1278
self.dbus_object_path)
766
767
def _get_approvals_pending(self):
768
return self._approvals_pending
769
def _set_approvals_pending(self, value):
770
old_value = self._approvals_pending
771
self._approvals_pending = value
772
bval = bool(value)
773
if (hasattr(self, "dbus_object_path")
774
and bval is not bool(old_value)):
775
dbus_bool = dbus.Boolean(bval, variant_level=1)
776
self.PropertyChanged(dbus.String("ApprovalPending"),
777
dbus_bool)
778
779
approvals_pending = property(_get_approvals_pending,
780
_set_approvals_pending)
781
del _get_approvals_pending, _set_approvals_pending
782
783
@staticmethod
784
def _datetime_to_dbus(dt, variant_level=0):
785
"""Convert a UTC datetime.datetime() to a D-Bus type."""
786
return dbus.String(dt.isoformat(),
787
variant_level=variant_level)
788
789
def enable(self):
790
oldstate = getattr(self, "enabled", False)
791
r = Client.enable(self)
792
if oldstate != self.enabled:
793
# Emit D-Bus signals
794
self.PropertyChanged(dbus.String("Enabled"),
795
dbus.Boolean(True, variant_level=1))
796
self.PropertyChanged(
797
dbus.String("LastEnabled"),
798
self._datetime_to_dbus(self.last_enabled,
799
variant_level=1))
800
return r
801
802
def disable(self, quiet = False):
803
oldstate = getattr(self, "enabled", False)
804
r = Client.disable(self, quiet=quiet)
805
if not quiet and oldstate != self.enabled:
806
# Emit D-Bus signal
807
self.PropertyChanged(dbus.String("Enabled"),
808
dbus.Boolean(False, variant_level=1))
809
return r
1279
1280
def notifychangeproperty(transform_func, dbus_name,
1281
type_func=lambda x: x,
1282
variant_level=1,
1283
invalidate_only=False,
1284
_interface=_interface):
1285
""" Modify a variable so that it's a property which announces
1286
its changes to DBus.
1287
1288
transform_fun: Function that takes a value and a variant_level
1289
and transforms it to a D-Bus type.
1290
dbus_name: D-Bus name of the variable
1291
type_func: Function that transform the value before sending it
1292
to the D-Bus. Default: no transform
1293
variant_level: D-Bus variant level. Default: 1
1294
"""
1295
attrname = "_{}".format(dbus_name)
1296
1297
def setter(self, value):
1298
if hasattr(self, "dbus_object_path"):
1299
if (not hasattr(self, attrname) or
1300
type_func(getattr(self, attrname, None))
1301
!= type_func(value)):
1302
if invalidate_only:
1303
self.PropertiesChanged(
1304
_interface, dbus.Dictionary(),
1305
dbus.Array((dbus_name, )))
1306
else:
1307
dbus_value = transform_func(
1308
type_func(value),
1309
variant_level = variant_level)
1310
self.PropertyChanged(dbus.String(dbus_name),
1311
dbus_value)
1312
self.PropertiesChanged(
1313
_interface,
1314
dbus.Dictionary({ dbus.String(dbus_name):
1315
dbus_value }),
1316
dbus.Array())
1317
setattr(self, attrname, value)
1318
1319
return property(lambda self: getattr(self, attrname), setter)
1320
1321
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1322
approvals_pending = notifychangeproperty(dbus.Boolean,
1323
"ApprovalPending",
1324
type_func = bool)
1325
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
last_enabled = notifychangeproperty(datetime_to_dbus,
1327
"LastEnabled")
1328
checker = notifychangeproperty(
1329
dbus.Boolean, "CheckerRunning",
1330
type_func = lambda checker: checker is not None)
1331
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1332
"LastCheckedOK")
1333
last_checker_status = notifychangeproperty(dbus.Int16,
1334
"LastCheckerStatus")
1335
last_approval_request = notifychangeproperty(
1336
datetime_to_dbus, "LastApprovalRequest")
1337
approved_by_default = notifychangeproperty(dbus.Boolean,
1338
"ApprovedByDefault")
1339
approval_delay = notifychangeproperty(
1340
dbus.UInt64, "ApprovalDelay",
1341
type_func = lambda td: td.total_seconds() * 1000)
1342
approval_duration = notifychangeproperty(
1343
dbus.UInt64, "ApprovalDuration",
1344
type_func = lambda td: td.total_seconds() * 1000)
1345
host = notifychangeproperty(dbus.String, "Host")
1346
timeout = notifychangeproperty(
1347
dbus.UInt64, "Timeout",
1348
type_func = lambda td: td.total_seconds() * 1000)
1349
extended_timeout = notifychangeproperty(
1350
dbus.UInt64, "ExtendedTimeout",
1351
type_func = lambda td: td.total_seconds() * 1000)
1352
interval = notifychangeproperty(
1353
dbus.UInt64, "Interval",
1354
type_func = lambda td: td.total_seconds() * 1000)
1355
checker_command = notifychangeproperty(dbus.String, "Checker")
1356
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
invalidate_only=True)
1358
1359
del notifychangeproperty
810
1360
811
1361
def __del__(self, *args, **kwargs):
812
1362
try:
817
1367
DBusObjectWithProperties.__del__(self, *args, **kwargs)
818
1368
Client.__del__(self, *args, **kwargs)
819
1369
820
def checker_callback(self, pid, condition, command,
821
*args, **kwargs):
822
self.checker_callback_tag = None
823
self.checker = None
824
# Emit D-Bus signal
825
self.PropertyChanged(dbus.String("CheckerRunning"),
826
dbus.Boolean(False, variant_level=1))
827
if os.WIFEXITED(condition):
828
exitstatus = os.WEXITSTATUS(condition)
1370
def checker_callback(self, source, condition,
1371
connection, command, *args, **kwargs):
1372
ret = Client.checker_callback(self, source, condition,
1373
connection, command, *args,
1374
**kwargs)
1375
exitstatus = self.last_checker_status
1376
if exitstatus >= 0:
829
1377
# Emit D-Bus signal
830
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
831
dbus.Int64(condition),
1379
dbus.Int64(0),
832
1380
dbus.String(command))
833
1381
else:
834
1382
# Emit D-Bus signal
835
1383
self.CheckerCompleted(dbus.Int16(-1),
836
dbus.Int64(condition),
1384
dbus.Int64(
1385
self.last_checker_signal),
837
1386
dbus.String(command))
838
839
return Client.checker_callback(self, pid, condition, command,
840
*args, **kwargs)
841
842
def checked_ok(self, *args, **kwargs):
843
Client.checked_ok(self, *args, **kwargs)
844
# Emit D-Bus signal
845
self.PropertyChanged(
846
dbus.String("LastCheckedOK"),
847
(self._datetime_to_dbus(self.last_checked_ok,
848
variant_level=1)))
849
850
def need_approval(self, *args, **kwargs):
851
r = Client.need_approval(self, *args, **kwargs)
852
# Emit D-Bus signal
853
self.PropertyChanged(
854
dbus.String("LastApprovalRequest"),
855
(self._datetime_to_dbus(self.last_approval_request,
856
variant_level=1)))
857
return r
1387
return ret
858
1388
859
1389
def start_checker(self, *args, **kwargs):
860
old_checker = self.checker
861
if self.checker is not None:
862
old_checker_pid = self.checker.pid
863
else:
864
old_checker_pid = None
1390
old_checker_pid = getattr(self.checker, "pid", None)
865
1391
r = Client.start_checker(self, *args, **kwargs)
866
1392
# Only if new checker process was started
867
1393
if (self.checker is not None
868
1394
and old_checker_pid != self.checker.pid):
869
1395
# Emit D-Bus signal
870
1396
self.CheckerStarted(self.current_checker_command)
871
self.PropertyChanged(
872
dbus.String("CheckerRunning"),
873
dbus.Boolean(True, variant_level=1))
874
1397
return r
875
1398
876
def stop_checker(self, *args, **kwargs):
877
old_checker = getattr(self, "checker", None)
878
r = Client.stop_checker(self, *args, **kwargs)
879
if (old_checker is not None
880
and getattr(self, "checker", None) is None):
881
self.PropertyChanged(dbus.String("CheckerRunning"),
882
dbus.Boolean(False, variant_level=1))
883
return r
884
885
1399
def _reset_approved(self):
886
self._approved = None
1400
self.approved = None
887
1401
return False
888
1402
889
1403
def approve(self, value=True):
1404
self.approved = value
1405
gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
* 1000), self._reset_approved)
890
1407
self.send_changedstate()
891
self._approved = value
892
gobject.timeout_add(self._timedelta_to_milliseconds
893
(self.approval_duration),
894
self._reset_approved)
895
896
1408
897
1409
## D-Bus methods, signals & properties
898
_interface = "se.bsnet.fukt.Mandos.Client"
1410
1411
## Interfaces
899
1412
900
1413
## Signals
901
1414
912
1425
pass
913
1426
914
1427
# PropertyChanged - signal
1428
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
915
1429
@dbus.service.signal(_interface, signature="sv")
916
1430
def PropertyChanged(self, property, value):
917
1431
"D-Bus signal"
981
1495
return dbus.Boolean(bool(self.approvals_pending))
982
1496
983
1497
# ApprovedByDefault - property
984
@dbus_service_property(_interface, signature="b",
1498
@dbus_service_property(_interface,
1499
signature="b",
985
1500
access="readwrite")
986
1501
def ApprovedByDefault_dbus_property(self, value=None):
987
1502
if value is None: # get
988
1503
return dbus.Boolean(self.approved_by_default)
989
1504
self.approved_by_default = bool(value)
990
# Emit D-Bus signal
991
self.PropertyChanged(dbus.String("ApprovedByDefault"),
992
dbus.Boolean(value, variant_level=1))
993
1505
994
1506
# ApprovalDelay - property
995
@dbus_service_property(_interface, signature="t",
1507
@dbus_service_property(_interface,
1508
signature="t",
996
1509
access="readwrite")
997
1510
def ApprovalDelay_dbus_property(self, value=None):
998
1511
if value is None: # get
999
return dbus.UInt64(self.approval_delay_milliseconds())
1512
return dbus.UInt64(self.approval_delay.total_seconds()
1513
* 1000)
1000
1514
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1001
# Emit D-Bus signal
1002
self.PropertyChanged(dbus.String("ApprovalDelay"),
1003
dbus.UInt64(value, variant_level=1))
1004
1515
1005
1516
# ApprovalDuration - property
1006
@dbus_service_property(_interface, signature="t",
1517
@dbus_service_property(_interface,
1518
signature="t",
1007
1519
access="readwrite")
1008
1520
def ApprovalDuration_dbus_property(self, value=None):
1009
1521
if value is None: # get
1010
return dbus.UInt64(self._timedelta_to_milliseconds(
1011
self.approval_duration))
1522
return dbus.UInt64(self.approval_duration.total_seconds()
1523
* 1000)
1012
1524
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1013
# Emit D-Bus signal
1014
self.PropertyChanged(dbus.String("ApprovalDuration"),
1015
dbus.UInt64(value, variant_level=1))
1016
1525
1017
1526
# Name - property
1018
1527
@dbus_service_property(_interface, signature="s", access="read")
1025
1534
return dbus.String(self.fingerprint)
1026
1535
1027
1536
# Host - property
1028
@dbus_service_property(_interface, signature="s",
1537
@dbus_service_property(_interface,
1538
signature="s",
1029
1539
access="readwrite")
1030
1540
def Host_dbus_property(self, value=None):
1031
1541
if value is None: # get
1032
1542
return dbus.String(self.host)
1033
self.host = value
1034
# Emit D-Bus signal
1035
self.PropertyChanged(dbus.String("Host"),
1036
dbus.String(value, variant_level=1))
1543
self.host = str(value)
1037
1544
1038
1545
# Created - property
1039
1546
@dbus_service_property(_interface, signature="s", access="read")
1040
1547
def Created_dbus_property(self):
1041
return dbus.String(self._datetime_to_dbus(self.created))
1548
return datetime_to_dbus(self.created)
1042
1549
1043
1550
# LastEnabled - property
1044
1551
@dbus_service_property(_interface, signature="s", access="read")
1045
1552
def LastEnabled_dbus_property(self):
1046
if self.last_enabled is None:
1047
return dbus.String("")
1048
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1553
return datetime_to_dbus(self.last_enabled)
1049
1554
1050
1555
# Enabled - property
1051
@dbus_service_property(_interface, signature="b",
1556
@dbus_service_property(_interface,
1557
signature="b",
1052
1558
access="readwrite")
1053
1559
def Enabled_dbus_property(self, value=None):
1054
1560
if value is None: # get
1059
1565
self.disable()
1060
1566
1061
1567
# LastCheckedOK - property
1062
@dbus_service_property(_interface, signature="s",
1568
@dbus_service_property(_interface,
1569
signature="s",
1063
1570
access="readwrite")
1064
1571
def LastCheckedOK_dbus_property(self, value=None):
1065
1572
if value is not None:
1066
1573
self.checked_ok()
1067
1574
return
1068
if self.last_checked_ok is None:
1069
return dbus.String("")
1070
return dbus.String(self._datetime_to_dbus(self
1071
.last_checked_ok))
1575
return datetime_to_dbus(self.last_checked_ok)
1576
1577
# LastCheckerStatus - property
1578
@dbus_service_property(_interface, signature="n", access="read")
1579
def LastCheckerStatus_dbus_property(self):
1580
return dbus.Int16(self.last_checker_status)
1581
1582
# Expires - property
1583
@dbus_service_property(_interface, signature="s", access="read")
1584
def Expires_dbus_property(self):
1585
return datetime_to_dbus(self.expires)
1072
1586
1073
1587
# LastApprovalRequest - property
1074
1588
@dbus_service_property(_interface, signature="s", access="read")
1075
1589
def LastApprovalRequest_dbus_property(self):
1076
if self.last_approval_request is None:
1077
return dbus.String("")
1078
return dbus.String(self.
1079
_datetime_to_dbus(self
1080
.last_approval_request))
1590
return datetime_to_dbus(self.last_approval_request)
1081
1591
1082
1592
# Timeout - property
1083
@dbus_service_property(_interface, signature="t",
1593
@dbus_service_property(_interface,
1594
signature="t",
1084
1595
access="readwrite")
1085
1596
def Timeout_dbus_property(self, value=None):
1086
1597
if value is None: # get
1087
return dbus.UInt64(self.timeout_milliseconds())
1598
return dbus.UInt64(self.timeout.total_seconds() * 1000)
1599
old_timeout = self.timeout
1088
1600
self.timeout = datetime.timedelta(0, 0, 0, value)
1089
# Emit D-Bus signal
1090
self.PropertyChanged(dbus.String("Timeout"),
1091
dbus.UInt64(value, variant_level=1))
1092
if getattr(self, "disable_initiator_tag", None) is None:
1093
return
1094
# Reschedule timeout
1095
gobject.source_remove(self.disable_initiator_tag)
1096
self.disable_initiator_tag = None
1097
time_to_die = (self.
1098
_timedelta_to_milliseconds((self
1099
.last_checked_ok
1100
+ self.timeout)
1101
- datetime.datetime
1102
.utcnow()))
1103
if time_to_die <= 0:
1104
# The timeout has passed
1105
self.disable()
1106
else:
1107
self.disable_initiator_tag = (gobject.timeout_add
1108
(time_to_die, self.disable))
1601
# Reschedule disabling
1602
if self.enabled:
1603
now = datetime.datetime.utcnow()
1604
self.expires += self.timeout - old_timeout
1605
if self.expires <= now:
1606
# The timeout has passed
1607
self.disable()
1608
else:
1609
if (getattr(self, "disable_initiator_tag", None)
1610
is None):
1611
return
1612
gobject.source_remove(self.disable_initiator_tag)
1613
self.disable_initiator_tag = gobject.timeout_add(
1614
int((self.expires - now).total_seconds() * 1000),
1615
self.disable)
1616
1617
# ExtendedTimeout - property
1618
@dbus_service_property(_interface,
1619
signature="t",
1620
access="readwrite")
1621
def ExtendedTimeout_dbus_property(self, value=None):
1622
if value is None: # get
1623
return dbus.UInt64(self.extended_timeout.total_seconds()
1624
* 1000)
1625
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1109
1626
1110
1627
# Interval - property
1111
@dbus_service_property(_interface, signature="t",
1628
@dbus_service_property(_interface,
1629
signature="t",
1112
1630
access="readwrite")
1113
1631
def Interval_dbus_property(self, value=None):
1114
1632
if value is None: # get
1115
return dbus.UInt64(self.interval_milliseconds())
1633
return dbus.UInt64(self.interval.total_seconds() * 1000)
1116
1634
self.interval = datetime.timedelta(0, 0, 0, value)
1117
# Emit D-Bus signal
1118
self.PropertyChanged(dbus.String("Interval"),
1119
dbus.UInt64(value, variant_level=1))
1120
1635
if getattr(self, "checker_initiator_tag", None) is None:
1121
1636
return
1122
# Reschedule checker run
1123
gobject.source_remove(self.checker_initiator_tag)
1124
self.checker_initiator_tag = (gobject.timeout_add
1125
(value, self.start_checker))
1126
self.start_checker() # Start one now, too
1127
1637
if self.enabled:
1638
# Reschedule checker run
1639
gobject.source_remove(self.checker_initiator_tag)
1640
self.checker_initiator_tag = gobject.timeout_add(
1641
value, self.start_checker)
1642
self.start_checker() # Start one now, too
1643
1128
1644
# Checker - property
1129
@dbus_service_property(_interface, signature="s",
1645
@dbus_service_property(_interface,
1646
signature="s",
1130
1647
access="readwrite")
1131
1648
def Checker_dbus_property(self, value=None):
1132
1649
if value is None: # get
1133
1650
return dbus.String(self.checker_command)
1134
self.checker_command = value
1135
# Emit D-Bus signal
1136
self.PropertyChanged(dbus.String("Checker"),
1137
dbus.String(self.checker_command,
1138
variant_level=1))
1651
self.checker_command = str(value)
1139
1652
1140
1653
# CheckerRunning - property
1141
@dbus_service_property(_interface, signature="b",
1654
@dbus_service_property(_interface,
1655
signature="b",
1142
1656
access="readwrite")
1143
1657
def CheckerRunning_dbus_property(self, value=None):
1144
1658
if value is None: # get
1154
1668
return self.dbus_object_path # is already a dbus.ObjectPath
1155
1669
1156
1670
# Secret = property
1157
@dbus_service_property(_interface, signature="ay",
1158
access="write", byte_arrays=True)
1671
@dbus_service_property(_interface,
1672
signature="ay",
1673
access="write",
1674
byte_arrays=True)
1159
1675
def Secret_dbus_property(self, value):
1160
self.secret = str(value)
1676
self.secret = bytes(value)
1161
1677
1162
1678
del _interface
1163
1679
1167
1683
self._pipe = child_pipe
1168
1684
self._pipe.send(('init', fpr, address))
1169
1685
if not self._pipe.recv():
1170
raise KeyError()
1171
1686
raise KeyError(fpr)
1687
1172
1688
def __getattribute__(self, name):
1173
if(name == '_pipe'):
1689
if name == '_pipe':
1174
1690
return super(ProxyClient, self).__getattribute__(name)
1175
1691
self._pipe.send(('getattr', name))
1176
1692
data = self._pipe.recv()
1177
1693
if data[0] == 'data':
1178
1694
return data[1]
1179
1695
if data[0] == 'function':
1696
1180
1697
def func(*args, **kwargs):
1181
1698
self._pipe.send(('funcall', name, args, kwargs))
1182
1699
return self._pipe.recv()[1]
1700
1183
1701
return func
1184
1702
1185
1703
def __setattr__(self, name, value):
1186
if(name == '_pipe'):
1704
if name == '_pipe':
1187
1705
return super(ProxyClient, self).__setattr__(name, value)
1188
1706
self._pipe.send(('setattr', name, value))
1189
1707
1197
1715
def handle(self):
1198
1716
with contextlib.closing(self.server.child_pipe) as child_pipe:
1199
1717
logger.info("TCP connection from: %s",
1200
unicode(self.client_address))
1718
str(self.client_address))
1201
1719
logger.debug("Pipe FD: %d",
1202
1720
self.server.child_pipe.fileno())
1203
1204
session = (gnutls.connection
1205
.ClientSession(self.request,
1206
gnutls.connection
1207
.X509Credentials()))
1208
1721
1722
session = gnutls.connection.ClientSession(
1723
self.request, gnutls.connection .X509Credentials())
1724
1209
1725
# Note: gnutls.connection.X509Credentials is really a
1210
1726
# generic GnuTLS certificate credentials object so long as
1211
1727
# no X.509 keys are added to it. Therefore, we can use it
1212
1728
# here despite using OpenPGP certificates.
1213
1729
1214
1730
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1215
1731
# "+AES-256-CBC", "+SHA1",
1216
1732
# "+COMP-NULL", "+CTYPE-OPENPGP",
1219
1735
priority = self.server.gnutls_priority
1220
1736
if priority is None:
1221
1737
priority = "NORMAL"
1222
(gnutls.library.functions
1223
.gnutls_priority_set_direct(session._c_object,
1224
priority, None))
1225
1738
gnutls.library.functions.gnutls_priority_set_direct(
1739
session._c_object, priority, None)
1740
1226
1741
# Start communication using the Mandos protocol
1227
1742
# Get protocol number
1228
1743
line = self.request.makefile().readline()
1229
1744
logger.debug("Protocol version: %r", line)
1230
1745
try:
1231
1746
if int(line.strip().split()[0]) > 1:
1232
raise RuntimeError
1747
raise RuntimeError(line)
1233
1748
except (ValueError, IndexError, RuntimeError) as error:
1234
1749
logger.error("Unknown protocol version: %s", error)
1235
1750
return
1236
1751
1237
1752
# Start GnuTLS connection
1238
1753
try:
1239
1754
session.handshake()
1243
1758
# established. Just abandon the request.
1244
1759
return
1245
1760
logger.debug("Handshake succeeded")
1246
1761
1247
1762
approval_required = False
1248
1763
try:
1249
1764
try:
1250
fpr = self.fingerprint(self.peer_certificate
1251
(session))
1765
fpr = self.fingerprint(
1766
self.peer_certificate(session))
1252
1767
except (TypeError,
1253
1768
gnutls.errors.GNUTLSError) as error:
1254
1769
logger.warning("Bad certificate: %s", error)
1255
1770
return
1256
1771
logger.debug("Fingerprint: %s", fpr)
1257
1772
1258
1773
try:
1259
1774
client = ProxyClient(child_pipe, fpr,
1260
1775
self.client_address)
1269
1784
while True:
1270
1785
if not client.enabled:
1271
1786
logger.info("Client %s is disabled",
1272
client.name)
1787
client.name)
1273
1788
if self.server.use_dbus:
1274
1789
# Emit D-Bus signal
1275
client.Rejected("Disabled")
1790
client.Rejected("Disabled")
1276
1791
return
1277
1792
1278
if client._approved or not client.approval_delay:
1793
if client.approved or not client.approval_delay:
1279
1794
#We are approved or approval is disabled
1280
1795
break
1281
elif client._approved is None:
1796
elif client.approved is None:
1282
1797
logger.info("Client %s needs approval",
1283
1798
client.name)
1284
1799
if self.server.use_dbus:
1285
1800
# Emit D-Bus signal
1286
1801
client.NeedApproval(
1287
client.approval_delay_milliseconds(),
1288
client.approved_by_default)
1802
client.approval_delay.total_seconds()
1803
* 1000, client.approved_by_default)
1289
1804
else:
1290
1805
logger.warning("Client %s was not approved",
1291
1806
client.name)
1295
1810
return
1296
1811
1297
1812
#wait until timeout or approved
1298
#x = float(client._timedelta_to_milliseconds(delay))
1299
1813
time = datetime.datetime.now()
1300
1814
client.changedstate.acquire()
1301
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1815
client.changedstate.wait(delay.total_seconds())
1302
1816
client.changedstate.release()
1303
1817
time2 = datetime.datetime.now()
1304
1818
if (time2 - time) >= delay:
1320
1834
try:
1321
1835
sent = session.send(client.secret[sent_size:])
1322
1836
except gnutls.errors.GNUTLSError as error:
1323
logger.warning("gnutls send failed")
1837
logger.warning("gnutls send failed",
1838
exc_info=error)
1324
1839
return
1325
logger.debug("Sent: %d, remaining: %d",
1326
sent, len(client.secret)
1327
- (sent_size + sent))
1840
logger.debug("Sent: %d, remaining: %d", sent,
1841
len(client.secret) - (sent_size
1842
+ sent))
1328
1843
sent_size += sent
1329
1844
1330
1845
logger.info("Sending secret to %s", client.name)
1331
# bump the timeout as if seen
1332
client.checked_ok()
1846
# bump the timeout using extended_timeout
1847
client.bump_timeout(client.extended_timeout)
1333
1848
if self.server.use_dbus:
1334
1849
# Emit D-Bus signal
1335
1850
client.GotSecret()
1340
1855
try:
1341
1856
session.bye()
1342
1857
except gnutls.errors.GNUTLSError as error:
1343
logger.warning("GnuTLS bye failed")
1858
logger.warning("GnuTLS bye failed",
1859
exc_info=error)
1344
1860
1345
1861
@staticmethod
1346
1862
def peer_certificate(session):
1347
1863
"Return the peer's OpenPGP certificate as a bytestring"
1348
1864
# If not an OpenPGP certificate...
1349
if (gnutls.library.functions
1350
.gnutls_certificate_type_get(session._c_object)
1865
if (gnutls.library.functions.gnutls_certificate_type_get(
1866
session._c_object)
1351
1867
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1352
1868
# ...do the normal thing
1353
1869
return session.peer_certificate
1367
1883
def fingerprint(openpgp):
1368
1884
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1369
1885
# New GnuTLS "datum" with the OpenPGP public key
1370
datum = (gnutls.library.types
1371
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1372
ctypes.POINTER
1373
(ctypes.c_ubyte)),
1374
ctypes.c_uint(len(openpgp))))
1886
datum = gnutls.library.types.gnutls_datum_t(
1887
ctypes.cast(ctypes.c_char_p(openpgp),
1888
ctypes.POINTER(ctypes.c_ubyte)),
1889
ctypes.c_uint(len(openpgp)))
1375
1890
# New empty GnuTLS certificate
1376
1891
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1377
(gnutls.library.functions
1378
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1892
gnutls.library.functions.gnutls_openpgp_crt_init(
1893
ctypes.byref(crt))
1379
1894
# Import the OpenPGP public key into the certificate
1380
(gnutls.library.functions
1381
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1382
gnutls.library.constants
1383
.GNUTLS_OPENPGP_FMT_RAW))
1895
gnutls.library.functions.gnutls_openpgp_crt_import(
1896
crt, ctypes.byref(datum),
1897
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1384
1898
# Verify the self signature in the key
1385
1899
crtverify = ctypes.c_uint()
1386
(gnutls.library.functions
1387
.gnutls_openpgp_crt_verify_self(crt, 0,
1388
ctypes.byref(crtverify)))
1900
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
crt, 0, ctypes.byref(crtverify))
1389
1902
if crtverify.value != 0:
1390
1903
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1391
raise (gnutls.errors.CertificateSecurityError
1392
("Verify failed"))
1904
raise gnutls.errors.CertificateSecurityError(
1905
"Verify failed")
1393
1906
# New buffer for the fingerprint
1394
1907
buf = ctypes.create_string_buffer(20)
1395
1908
buf_len = ctypes.c_size_t()
1396
1909
# Get the fingerprint from the certificate into the buffer
1397
(gnutls.library.functions
1398
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1399
ctypes.byref(buf_len)))
1910
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1400
1912
# Deinit the certificate
1401
1913
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1402
1914
# Convert the buffer to a Python bytestring
1403
1915
fpr = ctypes.string_at(buf, buf_len.value)
1404
1916
# Convert the bytestring to hexadecimal notation
1405
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1917
hex_fpr = binascii.hexlify(fpr).upper()
1406
1918
return hex_fpr
1407
1919
1408
1920
1409
1921
class MultiprocessingMixIn(object):
1410
1922
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1923
1411
1924
def sub_process_main(self, request, address):
1412
1925
try:
1413
1926
self.finish_request(request, address)
1414
except:
1927
except Exception:
1415
1928
self.handle_error(request, address)
1416
1929
self.close_request(request)
1417
1930
1418
1931
def process_request(self, request, address):
1419
1932
"""Start a new process to process the request."""
1420
multiprocessing.Process(target = self.sub_process_main,
1421
args = (request, address)).start()
1933
proc = multiprocessing.Process(target = self.sub_process_main,
1934
args = (request, address))
1935
proc.start()
1936
return proc
1937
1422
1938
1423
1939
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1424
1940
""" adds a pipe to the MixIn """
1941
1425
1942
def process_request(self, request, client_address):
1426
1943
"""Overrides and wraps the original process_request().
1427
1944
1428
1945
This function creates a new pipe in self.pipe
1429
1946
"""
1430
1947
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1431
1432
super(MultiprocessingMixInWithPipe,
1433
self).process_request(request, client_address)
1948
1949
proc = MultiprocessingMixIn.process_request(self, request,
1950
client_address)
1434
1951
self.child_pipe.close()
1435
self.add_pipe(parent_pipe)
1436
1437
def add_pipe(self, parent_pipe):
1952
self.add_pipe(parent_pipe, proc)
1953
1954
def add_pipe(self, parent_pipe, proc):
1438
1955
"""Dummy function; override as necessary"""
1439
raise NotImplementedError
1956
raise NotImplementedError()
1957
1440
1958
1441
1959
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1442
1960
socketserver.TCPServer, object):
1447
1965
interface: None or a network interface name (string)
1448
1966
use_ipv6: Boolean; to use IPv6 or not
1449
1967
"""
1968
1450
1969
def __init__(self, server_address, RequestHandlerClass,
1451
interface=None, use_ipv6=True):
1970
interface=None,
1971
use_ipv6=True,
1972
socketfd=None):
1973
"""If socketfd is set, use that file descriptor instead of
1974
creating a new one with socket.socket().
1975
"""
1452
1976
self.interface = interface
1453
1977
if use_ipv6:
1454
1978
self.address_family = socket.AF_INET6
1979
if socketfd is not None:
1980
# Save the file descriptor
1981
self.socketfd = socketfd
1982
# Save the original socket.socket() function
1983
self.socket_socket = socket.socket
1984
# To implement --socket, we monkey patch socket.socket.
1985
#
1986
# (When socketserver.TCPServer is a new-style class, we
1987
# could make self.socket into a property instead of monkey
1988
# patching socket.socket.)
1989
#
1990
# Create a one-time-only replacement for socket.socket()
1991
@functools.wraps(socket.socket)
1992
def socket_wrapper(*args, **kwargs):
1993
# Restore original function so subsequent calls are
1994
# not affected.
1995
socket.socket = self.socket_socket
1996
del self.socket_socket
1997
# This time only, return a new socket object from the
1998
# saved file descriptor.
1999
return socket.fromfd(self.socketfd, *args, **kwargs)
2000
# Replace socket.socket() function with wrapper
2001
socket.socket = socket_wrapper
2002
# The socketserver.TCPServer.__init__ will call
2003
# socket.socket(), which might be our replacement,
2004
# socket_wrapper(), if socketfd was set.
1455
2005
socketserver.TCPServer.__init__(self, server_address,
1456
2006
RequestHandlerClass)
2007
1457
2008
def server_bind(self):
1458
2009
"""This overrides the normal server_bind() function
1459
2010
to bind to an interface if one was specified, and also NOT to
1465
2016
self.interface)
1466
2017
else:
1467
2018
try:
1468
self.socket.setsockopt(socket.SOL_SOCKET,
1469
SO_BINDTODEVICE,
1470
str(self.interface
1471
+ '\0'))
2019
self.socket.setsockopt(
2020
socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
(self.interface + "\0").encode("utf-8"))
1472
2022
except socket.error as error:
1473
if error[0] == errno.EPERM:
1474
logger.error("No permission to"
1475
" bind to interface %s",
1476
self.interface)
1477
elif error[0] == errno.ENOPROTOOPT:
2023
if error.errno == errno.EPERM:
2024
logger.error("No permission to bind to"
2025
" interface %s", self.interface)
2026
elif error.errno == errno.ENOPROTOOPT:
1478
2027
logger.error("SO_BINDTODEVICE not available;"
1479
2028
" cannot bind to interface %s",
1480
2029
self.interface)
2030
elif error.errno == errno.ENODEV:
2031
logger.error("Interface %s does not exist,"
2032
" cannot bind", self.interface)
1481
2033
else:
1482
2034
raise
1483
2035
# Only bind(2) the socket if we really need to.
1486
2038
if self.address_family == socket.AF_INET6:
1487
2039
any_address = "::" # in6addr_any
1488
2040
else:
1489
any_address = socket.INADDR_ANY
2041
any_address = "0.0.0.0" # INADDR_ANY
1490
2042
self.server_address = (any_address,
1491
2043
self.server_address[1])
1492
2044
elif not self.server_address[1]:
1493
self.server_address = (self.server_address[0],
1494
0)
2045
self.server_address = (self.server_address[0], 0)
1495
2046
# if self.interface:
1496
2047
# self.server_address = (self.server_address[0],
1497
2048
# 0, # port
1511
2062
1512
2063
Assumes a gobject.MainLoop event loop.
1513
2064
"""
2065
1514
2066
def __init__(self, server_address, RequestHandlerClass,
1515
interface=None, use_ipv6=True, clients=None,
1516
gnutls_priority=None, use_dbus=True):
2067
interface=None,
2068
use_ipv6=True,
2069
clients=None,
2070
gnutls_priority=None,
2071
use_dbus=True,
2072
socketfd=None):
1517
2073
self.enabled = False
1518
2074
self.clients = clients
1519
2075
if self.clients is None:
1520
self.clients = set()
2076
self.clients = {}
1521
2077
self.use_dbus = use_dbus
1522
2078
self.gnutls_priority = gnutls_priority
1523
2079
IPv6_TCPServer.__init__(self, server_address,
1524
2080
RequestHandlerClass,
1525
2081
interface = interface,
1526
use_ipv6 = use_ipv6)
2082
use_ipv6 = use_ipv6,
2083
socketfd = socketfd)
2084
1527
2085
def server_activate(self):
1528
2086
if self.enabled:
1529
2087
return socketserver.TCPServer.server_activate(self)
2088
1530
2089
def enable(self):
1531
2090
self.enabled = True
1532
def add_pipe(self, parent_pipe):
2091
2092
def add_pipe(self, parent_pipe, proc):
1533
2093
# Call "handle_ipc" for both data and EOF events
1534
gobject.io_add_watch(parent_pipe.fileno(),
1535
gobject.IO_IN | gobject.IO_HUP,
1536
functools.partial(self.handle_ipc,
1537
parent_pipe = parent_pipe))
1538
1539
def handle_ipc(self, source, condition, parent_pipe=None,
2094
gobject.io_add_watch(
2095
parent_pipe.fileno(),
2096
gobject.IO_IN | gobject.IO_HUP,
2097
functools.partial(self.handle_ipc,
2098
parent_pipe = parent_pipe,
2099
proc = proc))
2100
2101
def handle_ipc(self, source, condition,
2102
parent_pipe=None,
2103
proc = None,
1540
2104
client_object=None):
1541
condition_names = {
1542
gobject.IO_IN: "IN", # There is data to read.
1543
gobject.IO_OUT: "OUT", # Data can be written (without
1544
# blocking).
1545
gobject.IO_PRI: "PRI", # There is urgent data to read.
1546
gobject.IO_ERR: "ERR", # Error condition.
1547
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1548
# broken, usually for pipes and
1549
# sockets).
1550
}
1551
conditions_string = ' | '.join(name
1552
for cond, name in
1553
condition_names.iteritems()
1554
if cond & condition)
1555
# error or the other end of multiprocessing.Pipe has closed
1556
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2105
# error, or the other end of multiprocessing.Pipe has closed
2106
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2107
# Wait for other process to exit
2108
proc.join()
1557
2109
return False
1558
2110
1559
2111
# Read a request from the child
1564
2116
fpr = request[1]
1565
2117
address = request[2]
1566
2118
1567
for c in self.clients:
2119
for c in self.clients.itervalues():
1568
2120
if c.fingerprint == fpr:
1569
2121
client = c
1570
2122
break
1573
2125
"dress: %s", fpr, address)
1574
2126
if self.use_dbus:
1575
2127
# Emit D-Bus signal
1576
mandos_dbus_service.ClientNotFound(fpr, address[0])
2128
mandos_dbus_service.ClientNotFound(fpr,
2129
address[0])
1577
2130
parent_pipe.send(False)
1578
2131
return False
1579
2132
1580
gobject.io_add_watch(parent_pipe.fileno(),
1581
gobject.IO_IN | gobject.IO_HUP,
1582
functools.partial(self.handle_ipc,
1583
parent_pipe = parent_pipe,
1584
client_object = client))
2133
gobject.io_add_watch(
2134
parent_pipe.fileno(),
2135
gobject.IO_IN | gobject.IO_HUP,
2136
functools.partial(self.handle_ipc,
2137
parent_pipe = parent_pipe,
2138
proc = proc,
2139
client_object = client))
1585
2140
parent_pipe.send(True)
1586
# remove the old hook in favor of the new above hook on same fileno
2141
# remove the old hook in favor of the new above hook on
2142
# same fileno
1587
2143
return False
1588
2144
if command == 'funcall':
1589
2145
funcname = request[1]
1590
2146
args = request[2]
1591
2147
kwargs = request[3]
1592
2148
1593
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1594
2149
parent_pipe.send(('data', getattr(client_object,
2150
funcname)(*args,
2151
**kwargs)))
2152
1595
2153
if command == 'getattr':
1596
2154
attrname = request[1]
1597
if callable(client_object.__getattribute__(attrname)):
1598
parent_pipe.send(('function',))
2155
if isinstance(client_object.__getattribute__(attrname),
2156
collections.Callable):
2157
parent_pipe.send(('function', ))
1599
2158
else:
1600
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2159
parent_pipe.send((
2160
'data', client_object.__getattribute__(attrname)))
1601
2161
1602
2162
if command == 'setattr':
1603
2163
attrname = request[1]
1604
2164
value = request[2]
1605
2165
setattr(client_object, attrname, value)
1606
2166
1607
2167
return True
1608
2168
1609
2169
2170
def rfc3339_duration_to_delta(duration):
2171
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2172
2173
>>> rfc3339_duration_to_delta("P7D")
2174
datetime.timedelta(7)
2175
>>> rfc3339_duration_to_delta("PT60S")
2176
datetime.timedelta(0, 60)
2177
>>> rfc3339_duration_to_delta("PT60M")
2178
datetime.timedelta(0, 3600)
2179
>>> rfc3339_duration_to_delta("PT24H")
2180
datetime.timedelta(1)
2181
>>> rfc3339_duration_to_delta("P1W")
2182
datetime.timedelta(7)
2183
>>> rfc3339_duration_to_delta("PT5M30S")
2184
datetime.timedelta(0, 330)
2185
>>> rfc3339_duration_to_delta("P1DT3M20S")
2186
datetime.timedelta(1, 200)
2187
"""
2188
2189
# Parsing an RFC 3339 duration with regular expressions is not
2190
# possible - there would have to be multiple places for the same
2191
# values, like seconds. The current code, while more esoteric, is
2192
# cleaner without depending on a parsing library. If Python had a
2193
# built-in library for parsing we would use it, but we'd like to
2194
# avoid excessive use of external libraries.
2195
2196
# New type for defining tokens, syntax, and semantics all-in-one
2197
Token = collections.namedtuple("Token", (
2198
"regexp", # To match token; if "value" is not None, must have
2199
# a "group" containing digits
2200
"value", # datetime.timedelta or None
2201
"followers")) # Tokens valid after this token
2202
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2203
# the "duration" ABNF definition in RFC 3339, Appendix A.
2204
token_end = Token(re.compile(r"$"), None, frozenset())
2205
token_second = Token(re.compile(r"(\d+)S"),
2206
datetime.timedelta(seconds=1),
2207
frozenset((token_end, )))
2208
token_minute = Token(re.compile(r"(\d+)M"),
2209
datetime.timedelta(minutes=1),
2210
frozenset((token_second, token_end)))
2211
token_hour = Token(re.compile(r"(\d+)H"),
2212
datetime.timedelta(hours=1),
2213
frozenset((token_minute, token_end)))
2214
token_time = Token(re.compile(r"T"),
2215
None,
2216
frozenset((token_hour, token_minute,
2217
token_second)))
2218
token_day = Token(re.compile(r"(\d+)D"),
2219
datetime.timedelta(days=1),
2220
frozenset((token_time, token_end)))
2221
token_month = Token(re.compile(r"(\d+)M"),
2222
datetime.timedelta(weeks=4),
2223
frozenset((token_day, token_end)))
2224
token_year = Token(re.compile(r"(\d+)Y"),
2225
datetime.timedelta(weeks=52),
2226
frozenset((token_month, token_end)))
2227
token_week = Token(re.compile(r"(\d+)W"),
2228
datetime.timedelta(weeks=1),
2229
frozenset((token_end, )))
2230
token_duration = Token(re.compile(r"P"), None,
2231
frozenset((token_year, token_month,
2232
token_day, token_time,
2233
token_week)))
2234
# Define starting values
2235
value = datetime.timedelta() # Value so far
2236
found_token = None
2237
followers = frozenset((token_duration, )) # Following valid tokens
2238
s = duration # String left to parse
2239
# Loop until end token is found
2240
while found_token is not token_end:
2241
# Search for any currently valid tokens
2242
for token in followers:
2243
match = token.regexp.match(s)
2244
if match is not None:
2245
# Token found
2246
if token.value is not None:
2247
# Value found, parse digits
2248
factor = int(match.group(1), 10)
2249
# Add to value so far
2250
value += factor * token.value
2251
# Strip token from string
2252
s = token.regexp.sub("", s, 1)
2253
# Go to found token
2254
found_token = token
2255
# Set valid next tokens
2256
followers = found_token.followers
2257
break
2258
else:
2259
# No currently valid tokens were found
2260
raise ValueError("Invalid RFC 3339 duration: {!r}"
2261
.format(duration))
2262
# End token found
2263
return value
2264
2265
1610
2266
def string_to_delta(interval):
1611
2267
"""Parse a string and return a datetime.timedelta
1612
2268
1623
2279
>>> string_to_delta('5m 30s')
1624
2280
datetime.timedelta(0, 330)
1625
2281
"""
2282
2283
try:
2284
return rfc3339_duration_to_delta(interval)
2285
except ValueError:
2286
pass
2287
1626
2288
timevalue = datetime.timedelta(0)
1627
2289
for s in interval.split():
1628
2290
try:
1629
suffix = unicode(s[-1])
2291
suffix = s[-1]
1630
2292
value = int(s[:-1])
1631
2293
if suffix == "d":
1632
2294
delta = datetime.timedelta(value)
1639
2301
elif suffix == "w":
1640
2302
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1641
2303
else:
1642
raise ValueError("Unknown suffix %r" % suffix)
1643
except (ValueError, IndexError) as e:
2304
raise ValueError("Unknown suffix {!r}".format(suffix))
2305
except IndexError as e:
1644
2306
raise ValueError(*(e.args))
1645
2307
timevalue += delta
1646
2308
return timevalue
1647
2309
1648
2310
1649
def if_nametoindex(interface):
1650
"""Call the C function if_nametoindex(), or equivalent
1651
1652
Note: This function cannot accept a unicode string."""
1653
global if_nametoindex
1654
try:
1655
if_nametoindex = (ctypes.cdll.LoadLibrary
1656
(ctypes.util.find_library("c"))
1657
.if_nametoindex)
1658
except (OSError, AttributeError):
1659
logger.warning("Doing if_nametoindex the hard way")
1660
def if_nametoindex(interface):
1661
"Get an interface index the hard way, i.e. using fcntl()"
1662
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1663
with contextlib.closing(socket.socket()) as s:
1664
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1665
struct.pack(str("16s16x"),
1666
interface))
1667
interface_index = struct.unpack(str("I"),
1668
ifreq[16:20])[0]
1669
return interface_index
1670
return if_nametoindex(interface)
1671
1672
1673
2311
def daemon(nochdir = False, noclose = False):
1674
2312
"""See daemon(3). Standard BSD Unix function.
1675
2313
1683
2321
sys.exit()
1684
2322
if not noclose:
1685
2323
# Close all standard open file descriptors
1686
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2324
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1687
2325
if not stat.S_ISCHR(os.fstat(null).st_mode):
1688
2326
raise OSError(errno.ENODEV,
1689
"%s not a character device"
1690
% os.path.devnull)
2327
"{} not a character device"
2328
.format(os.devnull))
1691
2329
os.dup2(null, sys.stdin.fileno())
1692
2330
os.dup2(null, sys.stdout.fileno())
1693
2331
os.dup2(null, sys.stderr.fileno())
1702
2340
1703
2341
parser = argparse.ArgumentParser()
1704
2342
parser.add_argument("-v", "--version", action="version",
1705
version = "%%(prog)s %s" % version,
2343
version = "%(prog)s {}".format(version),
1706
2344
help="show version number and exit")
1707
2345
parser.add_argument("-i", "--interface", metavar="IF",
1708
2346
help="Bind to interface IF")
1714
2352
help="Run self-test")
1715
2353
parser.add_argument("--debug", action="store_true",
1716
2354
help="Debug mode; run in foreground and log"
1717
" to terminal")
2355
" to terminal", default=None)
1718
2356
parser.add_argument("--debuglevel", metavar="LEVEL",
1719
2357
help="Debug level for stdout output")
1720
2358
parser.add_argument("--priority", help="GnuTLS"
1727
2365
" files")
1728
2366
parser.add_argument("--no-dbus", action="store_false",
1729
2367
dest="use_dbus", help="Do not provide D-Bus"
1730
" system bus interface")
2368
" system bus interface", default=None)
1731
2369
parser.add_argument("--no-ipv6", action="store_false",
1732
dest="use_ipv6", help="Do not use IPv6")
2370
dest="use_ipv6", help="Do not use IPv6",
2371
default=None)
2372
parser.add_argument("--no-restore", action="store_false",
2373
dest="restore", help="Do not restore stored"
2374
" state", default=None)
2375
parser.add_argument("--socket", type=int,
2376
help="Specify a file descriptor to a network"
2377
" socket to use instead of creating one")
2378
parser.add_argument("--statedir", metavar="DIR",
2379
help="Directory to save/restore state in")
2380
parser.add_argument("--foreground", action="store_true",
2381
help="Run in foreground", default=None)
2382
parser.add_argument("--no-zeroconf", action="store_false",
2383
dest="zeroconf", help="Do not use Zeroconf",
2384
default=None)
2385
1733
2386
options = parser.parse_args()
1734
2387
1735
2388
if options.check:
1736
2389
import doctest
1737
doctest.testmod()
1738
sys.exit()
2390
fail_count, test_count = doctest.testmod()
2391
sys.exit(os.EX_OK if fail_count == 0 else 1)
1739
2392
1740
2393
# Default values for config file for server-global settings
1741
2394
server_defaults = { "interface": "",
1743
2396
"port": "",
1744
2397
"debug": "False",
1745
2398
"priority":
1746
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2399
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2400
":+SIGN-DSA-SHA256",
1747
2401
"servicename": "Mandos",
1748
2402
"use_dbus": "True",
1749
2403
"use_ipv6": "True",
1750
2404
"debuglevel": "",
1751
}
2405
"restore": "True",
2406
"socket": "",
2407
"statedir": "/var/lib/mandos",
2408
"foreground": "False",
2409
"zeroconf": "True",
2410
}
1752
2411
1753
2412
# Parse config file for server-global settings
1754
2413
server_config = configparser.SafeConfigParser(server_defaults)
1755
2414
del server_defaults
1756
server_config.read(os.path.join(options.configdir,
1757
"mandos.conf"))
2415
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1758
2416
# Convert the SafeConfigParser object to a dict
1759
2417
server_settings = server_config.defaults()
1760
2418
# Use the appropriate methods on the non-string config options
1761
for option in ("debug", "use_dbus", "use_ipv6"):
2419
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1762
2420
server_settings[option] = server_config.getboolean("DEFAULT",
1763
2421
option)
1764
2422
if server_settings["port"]:
1765
2423
server_settings["port"] = server_config.getint("DEFAULT",
1766
2424
"port")
2425
if server_settings["socket"]:
2426
server_settings["socket"] = server_config.getint("DEFAULT",
2427
"socket")
2428
# Later, stdin will, and stdout and stderr might, be dup'ed
2429
# over with an opened os.devnull. But we don't want this to
2430
# happen with a supplied network socket.
2431
if 0 <= server_settings["socket"] <= 2:
2432
server_settings["socket"] = os.dup(server_settings
2433
["socket"])
1767
2434
del server_config
1768
2435
1769
2436
# Override the settings from the config file with command line
1770
2437
# options, if set.
1771
2438
for option in ("interface", "address", "port", "debug",
1772
"priority", "servicename", "configdir",
1773
"use_dbus", "use_ipv6", "debuglevel"):
2439
"priority", "servicename", "configdir", "use_dbus",
2440
"use_ipv6", "debuglevel", "restore", "statedir",
2441
"socket", "foreground", "zeroconf"):
1774
2442
value = getattr(options, option)
1775
2443
if value is not None:
1776
2444
server_settings[option] = value
1777
2445
del options
1778
2446
# Force all strings to be unicode
1779
2447
for option in server_settings.keys():
1780
if type(server_settings[option]) is str:
1781
server_settings[option] = unicode(server_settings[option])
2448
if isinstance(server_settings[option], bytes):
2449
server_settings[option] = (server_settings[option]
2450
.decode("utf-8"))
2451
# Force all boolean options to be boolean
2452
for option in ("debug", "use_dbus", "use_ipv6", "restore",
2453
"foreground", "zeroconf"):
2454
server_settings[option] = bool(server_settings[option])
2455
# Debug implies foreground
2456
if server_settings["debug"]:
2457
server_settings["foreground"] = True
1782
2458
# Now we have our good server settings in "server_settings"
1783
2459
1784
2460
##################################################################
1785
2461
2462
if (not server_settings["zeroconf"]
2463
and not (server_settings["port"]
2464
or server_settings["socket"] != "")):
2465
parser.error("Needs port or socket to work without Zeroconf")
2466
1786
2467
# For convenience
1787
2468
debug = server_settings["debug"]
1788
2469
debuglevel = server_settings["debuglevel"]
1789
2470
use_dbus = server_settings["use_dbus"]
1790
2471
use_ipv6 = server_settings["use_ipv6"]
1791
2472
stored_state_path = os.path.join(server_settings["statedir"],
2473
stored_state_file)
2474
foreground = server_settings["foreground"]
2475
zeroconf = server_settings["zeroconf"]
2476
2477
if debug:
2478
initlogger(debug, logging.DEBUG)
2479
else:
2480
if not debuglevel:
2481
initlogger(debug)
2482
else:
2483
level = getattr(logging, debuglevel.upper())
2484
initlogger(debug, level)
2485
1792
2486
if server_settings["servicename"] != "Mandos":
1793
syslogger.setFormatter(logging.Formatter
1794
('Mandos (%s) [%%(process)d]:'
1795
' %%(levelname)s: %%(message)s'
1796
% server_settings["servicename"]))
2487
syslogger.setFormatter(
2488
logging.Formatter('Mandos ({}) [%(process)d]:'
2489
' %(levelname)s: %(message)s'.format(
2490
server_settings["servicename"])))
1797
2491
1798
2492
# Parse config file with clients
1799
client_defaults = { "timeout": "1h",
1800
"interval": "5m",
1801
"checker": "fping -q -- %%(host)s",
1802
"host": "",
1803
"approval_delay": "0s",
1804
"approval_duration": "1s",
1805
}
1806
client_config = configparser.SafeConfigParser(client_defaults)
2493
client_config = configparser.SafeConfigParser(Client
2494
.client_defaults)
1807
2495
client_config.read(os.path.join(server_settings["configdir"],
1808
2496
"clients.conf"))
1809
2497
1810
2498
global mandos_dbus_service
1811
2499
mandos_dbus_service = None
1812
2500
1813
tcp_server = MandosServer((server_settings["address"],
1814
server_settings["port"]),
1815
ClientHandler,
1816
interface=(server_settings["interface"]
1817
or None),
1818
use_ipv6=use_ipv6,
1819
gnutls_priority=
1820
server_settings["priority"],
1821
use_dbus=use_dbus)
1822
if not debug:
1823
pidfilename = "/var/run/mandos.pid"
2501
socketfd = None
2502
if server_settings["socket"] != "":
2503
socketfd = server_settings["socket"]
2504
tcp_server = MandosServer(
2505
(server_settings["address"], server_settings["port"]),
2506
ClientHandler,
2507
interface=(server_settings["interface"] or None),
2508
use_ipv6=use_ipv6,
2509
gnutls_priority=server_settings["priority"],
2510
use_dbus=use_dbus,
2511
socketfd=socketfd)
2512
if not foreground:
2513
pidfilename = "/run/mandos.pid"
2514
if not os.path.isdir("/run/."):
2515
pidfilename = "/var/run/mandos.pid"
2516
pidfile = None
1824
2517
try:
1825
pidfile = open(pidfilename, "w")
1826
except IOError:
1827
logger.error("Could not open file %r", pidfilename)
2518
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2519
except IOError as e:
2520
logger.error("Could not open file %r", pidfilename,
2521
exc_info=e)
1828
2522
1829
try:
1830
uid = pwd.getpwnam("_mandos").pw_uid
1831
gid = pwd.getpwnam("_mandos").pw_gid
1832
except KeyError:
2523
for name in ("_mandos", "mandos", "nobody"):
1833
2524
try:
1834
uid = pwd.getpwnam("mandos").pw_uid
1835
gid = pwd.getpwnam("mandos").pw_gid
2525
uid = pwd.getpwnam(name).pw_uid
2526
gid = pwd.getpwnam(name).pw_gid
2527
break
1836
2528
except KeyError:
1837
try:
1838
uid = pwd.getpwnam("nobody").pw_uid
1839
gid = pwd.getpwnam("nobody").pw_gid
1840
except KeyError:
1841
uid = 65534
1842
gid = 65534
2529
continue
2530
else:
2531
uid = 65534
2532
gid = 65534
1843
2533
try:
1844
2534
os.setgid(gid)
1845
2535
os.setuid(uid)
1846
2536
except OSError as error:
1847
if error[0] != errno.EPERM:
1848
raise error
2537
if error.errno != errno.EPERM:
2538
raise
1849
2539
1850
if not debug and not debuglevel:
1851
syslogger.setLevel(logging.WARNING)
1852
console.setLevel(logging.WARNING)
1853
if debuglevel:
1854
level = getattr(logging, debuglevel.upper())
1855
syslogger.setLevel(level)
1856
console.setLevel(level)
1857
1858
2540
if debug:
1859
2541
# Enable all possible GnuTLS debugging
1860
2542
1866
2548
def debug_gnutls(level, string):
1867
2549
logger.debug("GnuTLS: %s", string[:-1])
1868
2550
1869
(gnutls.library.functions
1870
.gnutls_global_set_log_function(debug_gnutls))
2551
gnutls.library.functions.gnutls_global_set_log_function(
2552
debug_gnutls)
1871
2553
1872
2554
# Redirect stdin so all checkers get /dev/null
1873
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2555
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1874
2556
os.dup2(null, sys.stdin.fileno())
1875
2557
if null > 2:
1876
2558
os.close(null)
1877
else:
1878
# No console logging
1879
logger.removeHandler(console)
1880
2559
1881
2560
# Need to fork before connecting to D-Bus
1882
if not debug:
2561
if not foreground:
1883
2562
# Close all input and output, do double fork, etc.
1884
2563
daemon()
1885
2564
2565
# multiprocessing will use threads, so before we use gobject we
2566
# need to inform gobject that threads will be used.
2567
gobject.threads_init()
2568
1886
2569
global main_loop
1887
2570
# From the Avahi example code
1888
DBusGMainLoop(set_as_default=True )
2571
DBusGMainLoop(set_as_default=True)
1889
2572
main_loop = gobject.MainLoop()
1890
2573
bus = dbus.SystemBus()
1891
2574
# End of Avahi example code
1892
2575
if use_dbus:
1893
2576
try:
1894
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1895
bus, do_not_queue=True)
1896
except dbus.exceptions.NameExistsException as e:
1897
logger.error(unicode(e) + ", disabling D-Bus")
2577
bus_name = dbus.service.BusName("se.recompile.Mandos",
2578
bus,
2579
do_not_queue=True)
2580
old_bus_name = dbus.service.BusName(
2581
"se.bsnet.fukt.Mandos", bus,
2582
do_not_queue=True)
2583
except dbus.exceptions.DBusException as e:
2584
logger.error("Disabling D-Bus:", exc_info=e)
1898
2585
use_dbus = False
1899
2586
server_settings["use_dbus"] = False
1900
2587
tcp_server.use_dbus = False
1901
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1902
service = AvahiService(name = server_settings["servicename"],
1903
servicetype = "_mandos._tcp",
1904
protocol = protocol, bus = bus)
1905
if server_settings["interface"]:
1906
service.interface = (if_nametoindex
1907
(str(server_settings["interface"])))
2588
if zeroconf:
2589
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
service = AvahiServiceToSyslog(
2591
name = server_settings["servicename"],
2592
servicetype = "_mandos._tcp",
2593
protocol = protocol,
2594
bus = bus)
2595
if server_settings["interface"]:
2596
service.interface = if_nametoindex(
2597
server_settings["interface"].encode("utf-8"))
1908
2598
1909
2599
global multiprocessing_manager
1910
2600
multiprocessing_manager = multiprocessing.Manager()
1912
2602
client_class = Client
1913
2603
if use_dbus:
1914
2604
client_class = functools.partial(ClientDBus, bus = bus)
1915
def client_config_items(config, section):
1916
special_settings = {
1917
"approved_by_default":
1918
lambda: config.getboolean(section,
1919
"approved_by_default"),
1920
}
1921
for name, value in config.items(section):
2605
2606
client_settings = Client.config_parser(client_config)
2607
old_client_settings = {}
2608
clients_data = {}
2609
2610
# This is used to redirect stdout and stderr for checker processes
2611
global wnull
2612
wnull = open(os.devnull, "w") # A writable /dev/null
2613
# Only used if server is running in foreground but not in debug
2614
# mode
2615
if debug or not foreground:
2616
wnull.close()
2617
2618
# Get client data and settings from last running state.
2619
if server_settings["restore"]:
2620
try:
2621
with open(stored_state_path, "rb") as stored_state:
2622
clients_data, old_client_settings = pickle.load(
2623
stored_state)
2624
os.remove(stored_state_path)
2625
except IOError as e:
2626
if e.errno == errno.ENOENT:
2627
logger.warning("Could not load persistent state:"
2628
" {}".format(os.strerror(e.errno)))
2629
else:
2630
logger.critical("Could not load persistent state:",
2631
exc_info=e)
2632
raise
2633
except EOFError as e:
2634
logger.warning("Could not load persistent state: "
2635
"EOFError:",
2636
exc_info=e)
2637
2638
with PGPEngine() as pgp:
2639
for client_name, client in clients_data.items():
2640
# Skip removed clients
2641
if client_name not in client_settings:
2642
continue
2643
2644
# Decide which value to use after restoring saved state.
2645
# We have three different values: Old config file,
2646
# new config file, and saved state.
2647
# New config value takes precedence if it differs from old
2648
# config value, otherwise use saved state.
2649
for name, value in client_settings[client_name].items():
2650
try:
2651
# For each value in new config, check if it
2652
# differs from the old config value (Except for
2653
# the "secret" attribute)
2654
if (name != "secret"
2655
and (value !=
2656
old_client_settings[client_name][name])):
2657
client[name] = value
2658
except KeyError:
2659
pass
2660
2661
# Clients who has passed its expire date can still be
2662
# enabled if its last checker was successful. A Client
2663
# whose checker succeeded before we stored its state is
2664
# assumed to have successfully run all checkers during
2665
# downtime.
2666
if client["enabled"]:
2667
if datetime.datetime.utcnow() >= client["expires"]:
2668
if not client["last_checked_ok"]:
2669
logger.warning(
2670
"disabling client {} - Client never "
2671
"performed a successful checker".format(
2672
client_name))
2673
client["enabled"] = False
2674
elif client["last_checker_status"] != 0:
2675
logger.warning(
2676
"disabling client {} - Client last"
2677
" checker failed with error code"
2678
" {}".format(
2679
client_name,
2680
client["last_checker_status"]))
2681
client["enabled"] = False
2682
else:
2683
client["expires"] = (
2684
datetime.datetime.utcnow()
2685
+ client["timeout"])
2686
logger.debug("Last checker succeeded,"
2687
" keeping {} enabled".format(
2688
client_name))
1922
2689
try:
1923
yield (name, special_settings[name]())
1924
except KeyError:
1925
yield (name, value)
1926
1927
tcp_server.clients.update(set(
1928
client_class(name = section,
1929
config= dict(client_config_items(
1930
client_config, section)))
1931
for section in client_config.sections()))
2690
client["secret"] = pgp.decrypt(
2691
client["encrypted_secret"],
2692
client_settings[client_name]["secret"])
2693
except PGPError:
2694
# If decryption fails, we use secret from new settings
2695
logger.debug("Failed to decrypt {} old secret".format(
2696
client_name))
2697
client["secret"] = (client_settings[client_name]
2698
["secret"])
2699
2700
# Add/remove clients based on new changes made to config
2701
for client_name in (set(old_client_settings)
2702
- set(client_settings)):
2703
del clients_data[client_name]
2704
for client_name in (set(client_settings)
2705
- set(old_client_settings)):
2706
clients_data[client_name] = client_settings[client_name]
2707
2708
# Create all client objects
2709
for client_name, client in clients_data.items():
2710
tcp_server.clients[client_name] = client_class(
2711
name = client_name,
2712
settings = client,
2713
server_settings = server_settings)
2714
1932
2715
if not tcp_server.clients:
1933
2716
logger.warning("No clients defined")
1934
1935
if not debug:
1936
try:
1937
with pidfile:
1938
pid = os.getpid()
1939
pidfile.write(str(pid) + "\n".encode("utf-8"))
1940
del pidfile
1941
except IOError:
1942
logger.error("Could not write to file %r with PID %d",
1943
pidfilename, pid)
1944
except NameError:
1945
# "pidfile" was never created
1946
pass
2717
2718
if not foreground:
2719
if pidfile is not None:
2720
pid = os.getpid()
2721
try:
2722
with pidfile:
2723
print(pid, file=pidfile)
2724
except IOError:
2725
logger.error("Could not write to file %r with PID %d",
2726
pidfilename, pid)
2727
del pidfile
1947
2728
del pidfilename
1948
1949
signal.signal(signal.SIGINT, signal.SIG_IGN)
1950
2729
1951
2730
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1952
2731
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1953
2732
1954
2733
if use_dbus:
1955
class MandosDBusService(dbus.service.Object):
2734
2735
@alternate_dbus_interfaces(
2736
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2737
class MandosDBusService(DBusObjectWithProperties):
1956
2738
"""A D-Bus proxy object"""
2739
1957
2740
def __init__(self):
1958
2741
dbus.service.Object.__init__(self, bus, "/")
1959
_interface = "se.bsnet.fukt.Mandos"
2742
2743
_interface = "se.recompile.Mandos"
2744
2745
@dbus_interface_annotations(_interface)
2746
def _foo(self):
2747
return {
2748
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
"false" }
1960
2750
1961
2751
@dbus.service.signal(_interface, signature="o")
1962
2752
def ClientAdded(self, objpath):
1976
2766
@dbus.service.method(_interface, out_signature="ao")
1977
2767
def GetAllClients(self):
1978
2768
"D-Bus method"
1979
return dbus.Array(c.dbus_object_path
1980
for c in tcp_server.clients)
2769
return dbus.Array(c.dbus_object_path for c in
2770
tcp_server.clients.itervalues())
1981
2771
1982
2772
@dbus.service.method(_interface,
1983
2773
out_signature="a{oa{sv}}")
1984
2774
def GetAllClientsWithProperties(self):
1985
2775
"D-Bus method"
1986
2776
return dbus.Dictionary(
1987
((c.dbus_object_path, c.GetAll(""))
1988
for c in tcp_server.clients),
2777
{ c.dbus_object_path: c.GetAll("")
2778
for c in tcp_server.clients.itervalues() },
1989
2779
signature="oa{sv}")
1990
2780
1991
2781
@dbus.service.method(_interface, in_signature="o")
1992
2782
def RemoveClient(self, object_path):
1993
2783
"D-Bus method"
1994
for c in tcp_server.clients:
2784
for c in tcp_server.clients.itervalues():
1995
2785
if c.dbus_object_path == object_path:
1996
tcp_server.clients.remove(c)
2786
del tcp_server.clients[c.name]
1997
2787
c.remove_from_connection()
1998
2788
# Don't signal anything except ClientRemoved
1999
2789
c.disable(quiet=True)
2008
2798
2009
2799
def cleanup():
2010
2800
"Cleanup function; run on exit"
2011
service.cleanup()
2012
2801
if zeroconf:
2802
service.cleanup()
2803
2804
multiprocessing.active_children()
2805
wnull.close()
2806
if not (tcp_server.clients or client_settings):
2807
return
2808
2809
# Store client before exiting. Secrets are encrypted with key
2810
# based on what config file has. If config file is
2811
# removed/edited, old secret will thus be unrecovable.
2812
clients = {}
2813
with PGPEngine() as pgp:
2814
for client in tcp_server.clients.itervalues():
2815
key = client_settings[client.name]["secret"]
2816
client.encrypted_secret = pgp.encrypt(client.secret,
2817
key)
2818
client_dict = {}
2819
2820
# A list of attributes that can not be pickled
2821
# + secret.
2822
exclude = { "bus", "changedstate", "secret",
2823
"checker", "server_settings" }
2824
for name, typ in inspect.getmembers(dbus.service
2825
.Object):
2826
exclude.add(name)
2827
2828
client_dict["encrypted_secret"] = (client
2829
.encrypted_secret)
2830
for attr in client.client_structure:
2831
if attr not in exclude:
2832
client_dict[attr] = getattr(client, attr)
2833
2834
clients[client.name] = client_dict
2835
del client_settings[client.name]["secret"]
2836
2837
try:
2838
with tempfile.NamedTemporaryFile(
2839
mode='wb',
2840
suffix=".pickle",
2841
prefix='clients-',
2842
dir=os.path.dirname(stored_state_path),
2843
delete=False) as stored_state:
2844
pickle.dump((clients, client_settings), stored_state)
2845
tempname = stored_state.name
2846
os.rename(tempname, stored_state_path)
2847
except (IOError, OSError) as e:
2848
if not debug:
2849
try:
2850
os.remove(tempname)
2851
except NameError:
2852
pass
2853
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2854
logger.warning("Could not save persistent state: {}"
2855
.format(os.strerror(e.errno)))
2856
else:
2857
logger.warning("Could not save persistent state:",
2858
exc_info=e)
2859
raise
2860
2861
# Delete all clients, and settings from config
2013
2862
while tcp_server.clients:
2014
client = tcp_server.clients.pop()
2863
name, client = tcp_server.clients.popitem()
2015
2864
if use_dbus:
2016
2865
client.remove_from_connection()
2017
client.disable_hook = None
2018
2866
# Don't signal anything except ClientRemoved
2019
2867
client.disable(quiet=True)
2020
2868
if use_dbus:
2021
2869
# Emit D-Bus signal
2022
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2023
client.name)
2870
mandos_dbus_service.ClientRemoved(
2871
client.dbus_object_path, client.name)
2872
client_settings.clear()
2024
2873
2025
2874
atexit.register(cleanup)
2026
2875
2027
for client in tcp_server.clients:
2876
for client in tcp_server.clients.itervalues():
2028
2877
if use_dbus:
2029
2878
# Emit D-Bus signal
2030
2879
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2031
client.enable()
2880
# Need to initiate checking of clients
2881
if client.enabled:
2882
client.init_checker()
2032
2883
2033
2884
tcp_server.enable()
2034
2885
tcp_server.server_activate()
2035
2886
2036
2887
# Find out what port we got
2037
service.port = tcp_server.socket.getsockname()[1]
2888
if zeroconf:
2889
service.port = tcp_server.socket.getsockname()[1]
2038
2890
if use_ipv6:
2039
2891
logger.info("Now listening on address %r, port %d,"
2040
" flowinfo %d, scope_id %d"
2041
% tcp_server.socket.getsockname())
2892
" flowinfo %d, scope_id %d",
2893
*tcp_server.socket.getsockname())
2042
2894
else: # IPv4
2043
logger.info("Now listening on address %r, port %d"
2044
% tcp_server.socket.getsockname())
2895
logger.info("Now listening on address %r, port %d",
2896
*tcp_server.socket.getsockname())
2045
2897
2046
2898
#service.interface = tcp_server.socket.getsockname()[3]
2047
2899
2048
2900
try:
2049
# From the Avahi example code
2050
try:
2051
service.activate()
2052
except dbus.exceptions.DBusException as error:
2053
logger.critical("DBusException: %s", error)
2054
cleanup()
2055
sys.exit(1)
2056
# End of Avahi example code
2901
if zeroconf:
2902
# From the Avahi example code
2903
try:
2904
service.activate()
2905
except dbus.exceptions.DBusException as error:
2906
logger.critical("D-Bus Exception", exc_info=error)
2907
cleanup()
2908
sys.exit(1)
2909
# End of Avahi example code
2057
2910
2058
2911
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2059
2912
lambda *args, **kwargs:
2063
2916
logger.debug("Starting main loop")
2064
2917
main_loop.run()
2065
2918
except AvahiError as error:
2066
logger.critical("AvahiError: %s", error)
2919
logger.critical("Avahi Error", exc_info=error)
2067
2920
cleanup()
2068
2921
sys.exit(1)
2069
2922
except KeyboardInterrupt:
2074
2927
# Must run before the D-Bus bus name gets deregistered
2075
2928
cleanup()
2076
2929
2930
2077
2931
if __name__ == '__main__':
2078
2932
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0