To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 777
- compare with another revision
- download diff
- download tarball
- view history from revision 777
- Committer: Teddy Hogeborn
- Date: 2015-07-20 03:03:33 UTC
- Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
- files added:
- plugin-helpers/mandos-client-iprouteadddel.c
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
37
37
from future_builtins import *
38
38
39
import SocketServer as socketserver
39
try:
40
import SocketServer as socketserver
41
except ImportError:
42
import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
import ConfigParser as configparser
53
try:
54
import ConfigParser as configparser
55
except ImportError:
56
import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
import cPickle as pickle
71
try:
72
import cPickle as pickle
73
except ImportError:
74
import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
69
78
import tempfile
70
79
import itertools
71
80
import collections
81
import codecs
72
82
73
83
import dbus
74
84
import dbus.service
75
import gobject
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
76
89
import avahi
77
90
from dbus.mainloop.glib import DBusGMainLoop
78
91
import ctypes
98
111
syslogger = None
99
112
100
113
try:
101
if_nametoindex = (ctypes.cdll.LoadLibrary
102
(ctypes.util.find_library("c"))
103
.if_nametoindex)
114
if_nametoindex = ctypes.cdll.LoadLibrary(
115
ctypes.util.find_library("c")).if_nametoindex
104
116
except (OSError, AttributeError):
117
105
118
def if_nametoindex(interface):
106
119
"Get an interface index the hard way, i.e. using fcntl()"
107
120
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
116
129
"""init logger and add loglevel"""
117
130
118
131
global syslogger
119
syslogger = (logging.handlers.SysLogHandler
120
(facility =
121
logging.handlers.SysLogHandler.LOG_DAEMON,
122
address = "/dev/log"))
132
syslogger = (logging.handlers.SysLogHandler(
133
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
address = "/dev/log"))
123
135
syslogger.setFormatter(logging.Formatter
124
136
('Mandos [%(process)d]: %(levelname)s:'
125
137
' %(message)s'))
142
154
143
155
class PGPEngine(object):
144
156
"""A simple class for OpenPGP symmetric encryption & decryption"""
157
145
158
def __init__(self):
146
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
147
160
self.gnupgargs = ['--batch',
186
199
187
200
def encrypt(self, data, password):
188
201
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
190
) as passfile:
202
with tempfile.NamedTemporaryFile(
203
dir=self.tempdir) as passfile:
191
204
passfile.write(passphrase)
192
205
passfile.flush()
193
206
proc = subprocess.Popen(['gpg', '--symmetric',
204
217
205
218
def decrypt(self, data, password):
206
219
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
208
) as passfile:
220
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
209
222
passfile.write(passphrase)
210
223
passfile.flush()
211
224
proc = subprocess.Popen(['gpg', '--decrypt',
215
228
stdin = subprocess.PIPE,
216
229
stdout = subprocess.PIPE,
217
230
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
219
= data)
231
decrypted_plaintext, err = proc.communicate(input = data)
220
232
if proc.returncode != 0:
221
233
raise PGPError(err)
222
234
return decrypted_plaintext
228
240
return super(AvahiError, self).__init__(value, *args,
229
241
**kwargs)
230
242
243
231
244
class AvahiServiceError(AvahiError):
232
245
pass
233
246
247
234
248
class AvahiGroupError(AvahiError):
235
249
pass
236
250
256
270
bus: dbus.SystemBus()
257
271
"""
258
272
259
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
servicetype = None, port = None, TXT = None,
261
domain = "", host = "", max_renames = 32768,
262
protocol = avahi.PROTO_UNSPEC, bus = None):
273
def __init__(self,
274
interface = avahi.IF_UNSPEC,
275
name = None,
276
servicetype = None,
277
port = None,
278
TXT = None,
279
domain = "",
280
host = "",
281
max_renames = 32768,
282
protocol = avahi.PROTO_UNSPEC,
283
bus = None):
263
284
self.interface = interface
264
285
self.name = name
265
286
self.type = servicetype
282
303
" after %i retries, exiting.",
283
304
self.rename_count)
284
305
raise AvahiServiceError("Too many renames")
285
self.name = str(self.server
286
.GetAlternativeServiceName(self.name))
306
self.name = str(
307
self.server.GetAlternativeServiceName(self.name))
287
308
self.rename_count += 1
288
309
logger.info("Changing Zeroconf service name to %r ...",
289
310
self.name)
344
365
elif state == avahi.ENTRY_GROUP_FAILURE:
345
366
logger.critical("Avahi: Error in group state changed %s",
346
367
str(error))
347
raise AvahiGroupError("State changed: {!s}"
348
.format(error))
368
raise AvahiGroupError("State changed: {!s}".format(error))
349
369
350
370
def cleanup(self):
351
371
"""Derived from the Avahi example code"""
361
381
def server_state_changed(self, state, error=None):
362
382
"""Derived from the Avahi example code"""
363
383
logger.debug("Avahi server state change: %i", state)
364
bad_states = { avahi.SERVER_INVALID:
365
"Zeroconf server invalid",
366
avahi.SERVER_REGISTERING: None,
367
avahi.SERVER_COLLISION:
368
"Zeroconf server name collision",
369
avahi.SERVER_FAILURE:
370
"Zeroconf server failure" }
384
bad_states = {
385
avahi.SERVER_INVALID: "Zeroconf server invalid",
386
avahi.SERVER_REGISTERING: None,
387
avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
avahi.SERVER_FAILURE: "Zeroconf server failure",
389
}
371
390
if state in bad_states:
372
391
if bad_states[state] is not None:
373
392
if error is None:
376
395
logger.error(bad_states[state] + ": %r", error)
377
396
self.cleanup()
378
397
elif state == avahi.SERVER_RUNNING:
379
self.add()
398
try:
399
self.add()
400
except dbus.exceptions.DBusException as error:
401
if (error.get_dbus_name()
402
== "org.freedesktop.Avahi.CollisionError"):
403
logger.info("Local Zeroconf service name"
404
" collision.")
405
return self.rename(remove=False)
406
else:
407
logger.critical("D-Bus Exception", exc_info=error)
408
self.cleanup()
409
os._exit(1)
380
410
else:
381
411
if error is None:
382
412
logger.debug("Unknown state: %r", state)
392
422
follow_name_owner_changes=True),
393
423
avahi.DBUS_INTERFACE_SERVER)
394
424
self.server.connect_to_signal("StateChanged",
395
self.server_state_changed)
425
self.server_state_changed)
396
426
self.server_state_changed(self.server.GetState())
397
427
398
428
400
430
def rename(self, *args, **kwargs):
401
431
"""Add the new name to the syslog messages"""
402
432
ret = AvahiService.rename(self, *args, **kwargs)
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
406
.format(self.name)))
433
syslogger.setFormatter(logging.Formatter(
434
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
.format(self.name)))
407
436
return ret
408
437
438
def call_pipe(connection, # : multiprocessing.Connection
439
func, *args, **kwargs):
440
"""This function is meant to be called by multiprocessing.Process
441
442
This function runs func(*args, **kwargs), and writes the resulting
443
return value on the provided multiprocessing.Connection.
444
"""
445
connection.send(func(*args, **kwargs))
446
connection.close()
409
447
410
448
class Client(object):
411
449
"""A representation of a client host served by this server.
438
476
last_checker_status: integer between 0 and 255 reflecting exit
439
477
status of last checker. -1 reflects crashed
440
478
checker, -2 means no checker completed yet.
479
last_checker_signal: The signal which killed the last checker, if
480
last_checker_status is -1
441
481
last_enabled: datetime.datetime(); (UTC) or None
442
482
name: string; from the config file, used in log messages and
443
483
D-Bus identifiers
456
496
"fingerprint", "host", "interval",
457
497
"last_approval_request", "last_checked_ok",
458
498
"last_enabled", "name", "timeout")
459
client_defaults = { "timeout": "PT5M",
460
"extended_timeout": "PT15M",
461
"interval": "PT2M",
462
"checker": "fping -q -- %%(host)s",
463
"host": "",
464
"approval_delay": "PT0S",
465
"approval_duration": "PT1S",
466
"approved_by_default": "True",
467
"enabled": "True",
468
}
499
client_defaults = {
500
"timeout": "PT5M",
501
"extended_timeout": "PT15M",
502
"interval": "PT2M",
503
"checker": "fping -q -- %%(host)s",
504
"host": "",
505
"approval_delay": "PT0S",
506
"approval_duration": "PT1S",
507
"approved_by_default": "True",
508
"enabled": "True",
509
}
469
510
470
511
@staticmethod
471
512
def config_parser(config):
487
528
client["enabled"] = config.getboolean(client_name,
488
529
"enabled")
489
530
531
# Uppercase and remove spaces from fingerprint for later
532
# comparison purposes with return value from the
533
# fingerprint() function
490
534
client["fingerprint"] = (section["fingerprint"].upper()
491
535
.replace(" ", ""))
492
536
if "secret" in section:
534
578
self.expires = None
535
579
536
580
logger.debug("Creating client %r", self.name)
537
# Uppercase and remove spaces from fingerprint for later
538
# comparison purposes with return value from the fingerprint()
539
# function
540
581
logger.debug(" Fingerprint: %s", self.fingerprint)
541
582
self.created = settings.get("created",
542
583
datetime.datetime.utcnow())
549
590
self.current_checker_command = None
550
591
self.approved = None
551
592
self.approvals_pending = 0
552
self.changedstate = (multiprocessing_manager
553
.Condition(multiprocessing_manager
554
.Lock()))
555
self.client_structure = [attr for attr in
556
self.__dict__.iterkeys()
593
self.changedstate = multiprocessing_manager.Condition(
594
multiprocessing_manager.Lock())
595
self.client_structure = [attr
596
for attr in self.__dict__.iterkeys()
557
597
if not attr.startswith("_")]
558
598
self.client_structure.append("client_structure")
559
599
560
for name, t in inspect.getmembers(type(self),
561
lambda obj:
562
isinstance(obj,
563
property)):
600
for name, t in inspect.getmembers(
601
type(self), lambda obj: isinstance(obj, property)):
564
602
if not name.startswith("_"):
565
603
self.client_structure.append(name)
566
604
608
646
# and every interval from then on.
609
647
if self.checker_initiator_tag is not None:
610
648
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
612
(int(self.interval
613
.total_seconds() * 1000),
614
self.start_checker))
649
self.checker_initiator_tag = gobject.timeout_add(
650
int(self.interval.total_seconds() * 1000),
651
self.start_checker)
615
652
# Schedule a disable() when 'timeout' has passed
616
653
if self.disable_initiator_tag is not None:
617
654
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
619
(int(self.timeout
620
.total_seconds() * 1000),
621
self.disable))
655
self.disable_initiator_tag = gobject.timeout_add(
656
int(self.timeout.total_seconds() * 1000), self.disable)
622
657
# Also start a new checker *right now*.
623
658
self.start_checker()
624
659
625
def checker_callback(self, pid, condition, command):
660
def checker_callback(self, source, condition, connection,
661
command):
626
662
"""The checker has completed, so take appropriate actions."""
627
663
self.checker_callback_tag = None
628
664
self.checker = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
665
# Read return code from connection (see call_pipe)
666
returncode = connection.recv()
667
connection.close()
668
669
if returncode >= 0:
670
self.last_checker_status = returncode
671
self.last_checker_signal = None
631
672
if self.last_checker_status == 0:
632
673
logger.info("Checker for %(name)s succeeded",
633
674
vars(self))
634
675
self.checked_ok()
635
676
else:
636
logger.info("Checker for %(name)s failed",
637
vars(self))
677
logger.info("Checker for %(name)s failed", vars(self))
638
678
else:
639
679
self.last_checker_status = -1
680
self.last_checker_signal = -returncode
640
681
logger.warning("Checker for %(name)s crashed?",
641
682
vars(self))
683
return False
642
684
643
685
def checked_ok(self):
644
686
"""Assert that the client has been seen, alive and well."""
645
687
self.last_checked_ok = datetime.datetime.utcnow()
646
688
self.last_checker_status = 0
689
self.last_checker_signal = None
647
690
self.bump_timeout()
648
691
649
692
def bump_timeout(self, timeout=None):
654
697
gobject.source_remove(self.disable_initiator_tag)
655
698
self.disable_initiator_tag = None
656
699
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
700
self.disable_initiator_tag = gobject.timeout_add(
701
int(timeout.total_seconds() * 1000), self.disable)
660
702
self.expires = datetime.datetime.utcnow() + timeout
661
703
662
704
def need_approval(self):
676
718
# than 'timeout' for the client to be disabled, which is as it
677
719
# should be.
678
720
679
# If a checker exists, make sure it is not a zombie
680
try:
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except AttributeError:
683
pass
684
except OSError as error:
685
if error.errno != errno.ECHILD:
686
raise
687
else:
688
if pid:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
721
if self.checker is not None and not self.checker.is_alive():
722
logger.warning("Checker was not alive; joining")
723
self.checker.join()
724
self.checker = None
693
725
# Start a new checker if needed
694
726
if self.checker is None:
695
727
# Escape attributes for the shell
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
728
escaped_attrs = {
729
attr: re.escape(str(getattr(self, attr)))
730
for attr in self.runtime_expansions }
699
731
try:
700
732
command = self.checker_command % escaped_attrs
701
733
except TypeError as error:
702
734
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
735
self.checker_command,
736
exc_info=error)
737
return True # Try again later
705
738
self.current_checker_command = command
706
try:
707
logger.info("Starting checker %r for %s",
708
command, self.name)
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
# The exception is when not debugging but nevertheless
714
# running in the foreground; use the previously
715
# created wnull.
716
popen_args = {}
717
if (not self.server_settings["debug"]
718
and self.server_settings["foreground"]):
719
popen_args.update({"stdout": wnull,
720
"stderr": wnull })
721
self.checker = subprocess.Popen(command,
722
close_fds=True,
723
shell=True, cwd="/",
724
**popen_args)
725
except OSError as error:
726
logger.error("Failed to start subprocess",
727
exc_info=error)
728
return True
729
self.checker_callback_tag = (gobject.child_watch_add
730
(self.checker.pid,
731
self.checker_callback,
732
data=command))
733
# The checker may have completed before the gobject
734
# watch was added. Check for this.
735
try:
736
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
737
except OSError as error:
738
if error.errno == errno.ECHILD:
739
# This should never happen
740
logger.error("Child process vanished",
741
exc_info=error)
742
return True
743
raise
744
if pid:
745
gobject.source_remove(self.checker_callback_tag)
746
self.checker_callback(pid, status, command)
739
logger.info("Starting checker %r for %s", command,
740
self.name)
741
# We don't need to redirect stdout and stderr, since
742
# in normal mode, that is already done by daemon(),
743
# and in debug mode we don't want to. (Stdin is
744
# always replaced by /dev/null.)
745
# The exception is when not debugging but nevertheless
746
# running in the foreground; use the previously
747
# created wnull.
748
popen_args = { "close_fds": True,
749
"shell": True,
750
"cwd": "/" }
751
if (not self.server_settings["debug"]
752
and self.server_settings["foreground"]):
753
popen_args.update({"stdout": wnull,
754
"stderr": wnull })
755
pipe = multiprocessing.Pipe(duplex = False)
756
self.checker = multiprocessing.Process(
757
target = call_pipe,
758
args = (pipe[1], subprocess.call, command),
759
kwargs = popen_args)
760
self.checker.start()
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
763
self.checker_callback, pipe[0], command)
747
764
# Re-run this periodically if run by gobject.timeout_add
748
765
return True
749
766
755
772
if getattr(self, "checker", None) is None:
756
773
return
757
774
logger.debug("Stopping checker for %(name)s", vars(self))
758
try:
759
self.checker.terminate()
760
#time.sleep(0.5)
761
#if self.checker.poll() is None:
762
# self.checker.kill()
763
except OSError as error:
764
if error.errno != errno.ESRCH: # No such process
765
raise
775
self.checker.terminate()
766
776
self.checker = None
767
777
768
778
769
def dbus_service_property(dbus_interface, signature="v",
770
access="readwrite", byte_arrays=False):
779
def dbus_service_property(dbus_interface,
780
signature="v",
781
access="readwrite",
782
byte_arrays=False):
771
783
"""Decorators for marking methods of a DBusObjectWithProperties to
772
784
become properties on the D-Bus.
773
785
783
795
if byte_arrays and signature != "ay":
784
796
raise ValueError("Byte arrays not supported for non-'ay'"
785
797
" signature {!r}".format(signature))
798
786
799
def decorator(func):
787
800
func._dbus_is_property = True
788
801
func._dbus_interface = dbus_interface
793
806
func._dbus_name = func._dbus_name[:-14]
794
807
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
795
808
return func
809
796
810
return decorator
797
811
798
812
807
821
"org.freedesktop.DBus.Property.EmitsChangedSignal":
808
822
"false"}
809
823
"""
824
810
825
def decorator(func):
811
826
func._dbus_is_interface = True
812
827
func._dbus_interface = dbus_interface
813
828
func._dbus_name = dbus_interface
814
829
return func
830
815
831
return decorator
816
832
817
833
827
843
def Property_dbus_property(self):
828
844
return dbus.Boolean(False)
829
845
"""
846
830
847
def decorator(func):
831
848
func._dbus_annotations = annotations
832
849
return func
850
833
851
return decorator
834
852
835
853
838
856
"""
839
857
pass
840
858
859
841
860
class DBusPropertyAccessException(DBusPropertyException):
842
861
"""A property's access permissions disallows an operation.
843
862
"""
871
890
def _get_all_dbus_things(self, thing):
872
891
"""Returns a generator of (name, attribute) pairs
873
892
"""
874
return ((getattr(athing.__get__(self), "_dbus_name",
875
name),
893
return ((getattr(athing.__get__(self), "_dbus_name", name),
876
894
athing.__get__(self))
877
895
for cls in self.__class__.__mro__
878
896
for name, athing in
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
881
898
882
899
def _get_dbus_property(self, interface_name, property_name):
883
900
"""Returns a bound method if one exists which is a D-Bus
884
901
property with the specified name and interface.
885
902
"""
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
888
(cls,
889
self._is_dbus_thing("property"))):
903
for cls in self.__class__.__mro__:
904
for name, value in inspect.getmembers(
905
cls, self._is_dbus_thing("property")):
890
906
if (value._dbus_name == property_name
891
907
and value._dbus_interface == interface_name):
892
908
return value.__get__(self)
893
909
894
910
# No such property
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
897
+ property_name)
911
raise DBusPropertyNotFound("{}:{}.{}".format(
912
self.dbus_object_path, interface_name, property_name))
898
913
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
914
@dbus.service.method(dbus.PROPERTIES_IFACE,
915
in_signature="ss",
900
916
out_signature="v")
901
917
def Get(self, interface_name, property_name):
902
918
"""Standard D-Bus property Get() method, see D-Bus standard.
927
943
for byte in value))
928
944
prop(value)
929
945
930
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
946
@dbus.service.method(dbus.PROPERTIES_IFACE,
947
in_signature="s",
931
948
out_signature="a{sv}")
932
949
def GetAll(self, interface_name):
933
950
"""Standard D-Bus property GetAll() method, see D-Bus
948
965
if not hasattr(value, "variant_level"):
949
966
properties[name] = value
950
967
continue
951
properties[name] = type(value)(value, variant_level=
952
value.variant_level+1)
968
properties[name] = type(value)(
969
value, variant_level = value.variant_level + 1)
953
970
return dbus.Dictionary(properties, signature="sv")
954
971
955
972
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
990
connection)
974
991
try:
975
992
document = xml.dom.minidom.parseString(xmlstring)
993
976
994
def make_tag(document, name, prop):
977
995
e = document.createElement("property")
978
996
e.setAttribute("name", name)
979
997
e.setAttribute("type", prop._dbus_signature)
980
998
e.setAttribute("access", prop._dbus_access)
981
999
return e
1000
982
1001
for if_tag in document.getElementsByTagName("interface"):
983
1002
# Add property tags
984
1003
for tag in (make_tag(document, name, prop)
996
1015
if (name == tag.getAttribute("name")
997
1016
and prop._dbus_interface
998
1017
== if_tag.getAttribute("name")):
999
annots.update(getattr
1000
(prop,
1001
"_dbus_annotations",
1002
{}))
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1003
1020
for name, value in annots.items():
1004
1021
ann_tag = document.createElement(
1005
1022
"annotation")
1010
1027
for annotation, value in dict(
1011
1028
itertools.chain.from_iterable(
1012
1029
annotations().items()
1013
for name, annotations in
1014
self._get_all_dbus_things("interface")
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1015
1032
if name == if_tag.getAttribute("name")
1016
1033
)).items():
1017
1034
ann_tag = document.createElement("annotation")
1046
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1047
1064
if dt is None:
1048
1065
return dbus.String("", variant_level = variant_level)
1049
return dbus.String(dt.isoformat(),
1050
variant_level=variant_level)
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
1051
1067
1052
1068
1053
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1073
1089
(from DBusObjectWithProperties) and interfaces (from the
1074
1090
dbus_interface_annotations decorator).
1075
1091
"""
1092
1076
1093
def wrapper(cls):
1077
1094
for orig_interface_name, alt_interface_name in (
1078
alt_interface_names.items()):
1095
alt_interface_names.items()):
1079
1096
attr = {}
1080
1097
interface_names = set()
1081
1098
# Go though all attributes of the class
1083
1100
# Ignore non-D-Bus attributes, and D-Bus attributes
1084
1101
# with the wrong interface name
1085
1102
if (not hasattr(attribute, "_dbus_interface")
1086
or not attribute._dbus_interface
1087
.startswith(orig_interface_name)):
1103
or not attribute._dbus_interface.startswith(
1104
orig_interface_name)):
1088
1105
continue
1089
1106
# Create an alternate D-Bus interface name based on
1090
1107
# the current name
1091
alt_interface = (attribute._dbus_interface
1092
.replace(orig_interface_name,
1093
alt_interface_name))
1108
alt_interface = attribute._dbus_interface.replace(
1109
orig_interface_name, alt_interface_name)
1094
1110
interface_names.add(alt_interface)
1095
1111
# Is this a D-Bus signal?
1096
1112
if getattr(attribute, "_dbus_is_signal", False):
1097
# Extract the original non-method undecorated
1098
# function by black magic
1099
nonmethod_func = (dict(
1113
if sys.version_info.major == 2:
1114
# Extract the original non-method undecorated
1115
# function by black magic
1116
nonmethod_func = (dict(
1100
1117
zip(attribute.func_code.co_freevars,
1101
attribute.__closure__))["func"]
1102
.cell_contents)
1118
attribute.__closure__))
1119
["func"].cell_contents)
1120
else:
1121
nonmethod_func = attribute
1103
1122
# Create a new, but exactly alike, function
1104
1123
# object, and decorate it to be a new D-Bus signal
1105
1124
# with the alternate D-Bus interface name
1106
new_function = (dbus.service.signal
1107
(alt_interface,
1108
attribute._dbus_signature)
1109
(types.FunctionType(
1110
nonmethod_func.func_code,
1111
nonmethod_func.func_globals,
1112
nonmethod_func.func_name,
1113
nonmethod_func.func_defaults,
1114
nonmethod_func.func_closure)))
1125
if sys.version_info.major == 2:
1126
new_function = types.FunctionType(
1127
nonmethod_func.func_code,
1128
nonmethod_func.func_globals,
1129
nonmethod_func.func_name,
1130
nonmethod_func.func_defaults,
1131
nonmethod_func.func_closure)
1132
else:
1133
new_function = types.FunctionType(
1134
nonmethod_func.__code__,
1135
nonmethod_func.__globals__,
1136
nonmethod_func.__name__,
1137
nonmethod_func.__defaults__,
1138
nonmethod_func.__closure__)
1139
new_function = (dbus.service.signal(
1140
alt_interface,
1141
attribute._dbus_signature)(new_function))
1115
1142
# Copy annotations, if any
1116
1143
try:
1117
new_function._dbus_annotations = (
1118
dict(attribute._dbus_annotations))
1144
new_function._dbus_annotations = dict(
1145
attribute._dbus_annotations)
1119
1146
except AttributeError:
1120
1147
pass
1121
1148
# Define a creator of a function to call both the
1126
1153
"""This function is a scope container to pass
1127
1154
func1 and func2 to the "call_both" function
1128
1155
outside of its arguments"""
1156
1129
1157
def call_both(*args, **kwargs):
1130
1158
"""This function will emit two D-Bus
1131
1159
signals by calling func1 and func2"""
1132
1160
func1(*args, **kwargs)
1133
1161
func2(*args, **kwargs)
1162
1134
1163
return call_both
1135
1164
# Create the "call_both" function and add it to
1136
1165
# the class
1141
1170
# object. Decorate it to be a new D-Bus method
1142
1171
# with the alternate D-Bus interface name. Add it
1143
1172
# to the class.
1144
attr[attrname] = (dbus.service.method
1145
(alt_interface,
1146
attribute._dbus_in_signature,
1147
attribute._dbus_out_signature)
1148
(types.FunctionType
1149
(attribute.func_code,
1150
attribute.func_globals,
1151
attribute.func_name,
1152
attribute.func_defaults,
1153
attribute.func_closure)))
1173
attr[attrname] = (
1174
dbus.service.method(
1175
alt_interface,
1176
attribute._dbus_in_signature,
1177
attribute._dbus_out_signature)
1178
(types.FunctionType(attribute.func_code,
1179
attribute.func_globals,
1180
attribute.func_name,
1181
attribute.func_defaults,
1182
attribute.func_closure)))
1154
1183
# Copy annotations, if any
1155
1184
try:
1156
attr[attrname]._dbus_annotations = (
1157
dict(attribute._dbus_annotations))
1185
attr[attrname]._dbus_annotations = dict(
1186
attribute._dbus_annotations)
1158
1187
except AttributeError:
1159
1188
pass
1160
1189
# Is this a D-Bus property?
1163
1192
# object, and decorate it to be a new D-Bus
1164
1193
# property with the alternate D-Bus interface
1165
1194
# name. Add it to the class.
1166
attr[attrname] = (dbus_service_property
1167
(alt_interface,
1168
attribute._dbus_signature,
1169
attribute._dbus_access,
1170
attribute
1171
._dbus_get_args_options
1172
["byte_arrays"])
1173
(types.FunctionType
1174
(attribute.func_code,
1175
attribute.func_globals,
1176
attribute.func_name,
1177
attribute.func_defaults,
1178
attribute.func_closure)))
1195
attr[attrname] = (dbus_service_property(
1196
alt_interface, attribute._dbus_signature,
1197
attribute._dbus_access,
1198
attribute._dbus_get_args_options
1199
["byte_arrays"])
1200
(types.FunctionType(
1201
attribute.func_code,
1202
attribute.func_globals,
1203
attribute.func_name,
1204
attribute.func_defaults,
1205
attribute.func_closure)))
1179
1206
# Copy annotations, if any
1180
1207
try:
1181
attr[attrname]._dbus_annotations = (
1182
dict(attribute._dbus_annotations))
1208
attr[attrname]._dbus_annotations = dict(
1209
attribute._dbus_annotations)
1183
1210
except AttributeError:
1184
1211
pass
1185
1212
# Is this a D-Bus interface?
1188
1215
# object. Decorate it to be a new D-Bus interface
1189
1216
# with the alternate D-Bus interface name. Add it
1190
1217
# to the class.
1191
attr[attrname] = (dbus_interface_annotations
1192
(alt_interface)
1193
(types.FunctionType
1194
(attribute.func_code,
1195
attribute.func_globals,
1196
attribute.func_name,
1197
attribute.func_defaults,
1198
attribute.func_closure)))
1218
attr[attrname] = (
1219
dbus_interface_annotations(alt_interface)
1220
(types.FunctionType(attribute.func_code,
1221
attribute.func_globals,
1222
attribute.func_name,
1223
attribute.func_defaults,
1224
attribute.func_closure)))
1199
1225
if deprecate:
1200
1226
# Deprecate all alternate interfaces
1201
1227
iname="_AlternateDBusNames_interface_annotation{}"
1202
1228
for interface_name in interface_names:
1229
1203
1230
@dbus_interface_annotations(interface_name)
1204
1231
def func(self):
1205
1232
return { "org.freedesktop.DBus.Deprecated":
1206
"true" }
1233
"true" }
1207
1234
# Find an unused name
1208
1235
for aname in (iname.format(i)
1209
1236
for i in itertools.count()):
1214
1241
# Replace the class with a new subclass of it with
1215
1242
# methods, signals, etc. as created above.
1216
1243
cls = type(b"{}Alternate".format(cls.__name__),
1217
(cls,), attr)
1244
(cls, ), attr)
1218
1245
return cls
1246
1219
1247
return wrapper
1220
1248
1221
1249
1222
1250
@alternate_dbus_interfaces({"se.recompile.Mandos":
1223
"se.bsnet.fukt.Mandos"})
1251
"se.bsnet.fukt.Mandos"})
1224
1252
class ClientDBus(Client, DBusObjectWithProperties):
1225
1253
"""A Client class using D-Bus
1226
1254
1230
1258
"""
1231
1259
1232
1260
runtime_expansions = (Client.runtime_expansions
1233
+ ("dbus_object_path",))
1261
+ ("dbus_object_path", ))
1234
1262
1235
1263
_interface = "se.recompile.Mandos.Client"
1236
1264
1244
1272
client_object_name = str(self.name).translate(
1245
1273
{ord("."): ord("_"),
1246
1274
ord("-"): ord("_")})
1247
self.dbus_object_path = (dbus.ObjectPath
1248
("/clients/" + client_object_name))
1275
self.dbus_object_path = dbus.ObjectPath(
1276
"/clients/" + client_object_name)
1249
1277
DBusObjectWithProperties.__init__(self, self.bus,
1250
1278
self.dbus_object_path)
1251
1279
1252
def notifychangeproperty(transform_func,
1253
dbus_name, type_func=lambda x: x,
1254
variant_level=1, invalidate_only=False,
1280
def notifychangeproperty(transform_func, dbus_name,
1281
type_func=lambda x: x,
1282
variant_level=1,
1283
invalidate_only=False,
1255
1284
_interface=_interface):
1256
1285
""" Modify a variable so that it's a property which announces
1257
1286
its changes to DBus.
1264
1293
variant_level: D-Bus variant level. Default: 1
1265
1294
"""
1266
1295
attrname = "_{}".format(dbus_name)
1296
1267
1297
def setter(self, value):
1268
1298
if hasattr(self, "dbus_object_path"):
1269
1299
if (not hasattr(self, attrname) or
1270
1300
type_func(getattr(self, attrname, None))
1271
1301
!= type_func(value)):
1272
1302
if invalidate_only:
1273
self.PropertiesChanged(_interface,
1274
dbus.Dictionary(),
1275
dbus.Array
1276
((dbus_name,)))
1303
self.PropertiesChanged(
1304
_interface, dbus.Dictionary(),
1305
dbus.Array((dbus_name, )))
1277
1306
else:
1278
dbus_value = transform_func(type_func(value),
1279
variant_level
1280
=variant_level)
1307
dbus_value = transform_func(
1308
type_func(value),
1309
variant_level = variant_level)
1281
1310
self.PropertyChanged(dbus.String(dbus_name),
1282
1311
dbus_value)
1283
self.PropertiesChanged(_interface,
1284
dbus.Dictionary({
1285
dbus.String(dbus_name):
1286
dbus_value }), dbus.Array())
1312
self.PropertiesChanged(
1313
_interface,
1314
dbus.Dictionary({ dbus.String(dbus_name):
1315
dbus_value }),
1316
dbus.Array())
1287
1317
setattr(self, attrname, value)
1288
1318
1289
1319
return property(lambda self: getattr(self, attrname), setter)
1295
1325
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1296
1326
last_enabled = notifychangeproperty(datetime_to_dbus,
1297
1327
"LastEnabled")
1298
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
type_func = lambda checker:
1300
checker is not None)
1328
checker = notifychangeproperty(
1329
dbus.Boolean, "CheckerRunning",
1330
type_func = lambda checker: checker is not None)
1301
1331
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1302
1332
"LastCheckedOK")
1303
1333
last_checker_status = notifychangeproperty(dbus.Int16,
1306
1336
datetime_to_dbus, "LastApprovalRequest")
1307
1337
approved_by_default = notifychangeproperty(dbus.Boolean,
1308
1338
"ApprovedByDefault")
1309
approval_delay = notifychangeproperty(dbus.UInt64,
1310
"ApprovalDelay",
1311
type_func =
1312
lambda td: td.total_seconds()
1313
* 1000)
1339
approval_delay = notifychangeproperty(
1340
dbus.UInt64, "ApprovalDelay",
1341
type_func = lambda td: td.total_seconds() * 1000)
1314
1342
approval_duration = notifychangeproperty(
1315
1343
dbus.UInt64, "ApprovalDuration",
1316
1344
type_func = lambda td: td.total_seconds() * 1000)
1317
1345
host = notifychangeproperty(dbus.String, "Host")
1318
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1319
type_func = lambda td:
1320
td.total_seconds() * 1000)
1346
timeout = notifychangeproperty(
1347
dbus.UInt64, "Timeout",
1348
type_func = lambda td: td.total_seconds() * 1000)
1321
1349
extended_timeout = notifychangeproperty(
1322
1350
dbus.UInt64, "ExtendedTimeout",
1323
1351
type_func = lambda td: td.total_seconds() * 1000)
1324
interval = notifychangeproperty(dbus.UInt64,
1325
"Interval",
1326
type_func =
1327
lambda td: td.total_seconds()
1328
* 1000)
1352
interval = notifychangeproperty(
1353
dbus.UInt64, "Interval",
1354
type_func = lambda td: td.total_seconds() * 1000)
1329
1355
checker_command = notifychangeproperty(dbus.String, "Checker")
1330
1356
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1331
1357
invalidate_only=True)
1341
1367
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1342
1368
Client.__del__(self, *args, **kwargs)
1343
1369
1344
def checker_callback(self, pid, condition, command,
1345
*args, **kwargs):
1346
self.checker_callback_tag = None
1347
self.checker = None
1348
if os.WIFEXITED(condition):
1349
exitstatus = os.WEXITSTATUS(condition)
1370
def checker_callback(self, source, condition,
1371
connection, command, *args, **kwargs):
1372
ret = Client.checker_callback(self, source, condition,
1373
connection, command, *args,
1374
**kwargs)
1375
exitstatus = self.last_checker_status
1376
if exitstatus >= 0:
1350
1377
# Emit D-Bus signal
1351
1378
self.CheckerCompleted(dbus.Int16(exitstatus),
1352
dbus.Int64(condition),
1379
dbus.Int64(0),
1353
1380
dbus.String(command))
1354
1381
else:
1355
1382
# Emit D-Bus signal
1356
1383
self.CheckerCompleted(dbus.Int16(-1),
1357
dbus.Int64(condition),
1384
dbus.Int64(
1385
self.last_checker_signal),
1358
1386
dbus.String(command))
1359
1360
return Client.checker_callback(self, pid, condition, command,
1361
*args, **kwargs)
1387
return ret
1362
1388
1363
1389
def start_checker(self, *args, **kwargs):
1364
1390
old_checker_pid = getattr(self.checker, "pid", None)
1469
1495
return dbus.Boolean(bool(self.approvals_pending))
1470
1496
1471
1497
# ApprovedByDefault - property
1472
@dbus_service_property(_interface, signature="b",
1498
@dbus_service_property(_interface,
1499
signature="b",
1473
1500
access="readwrite")
1474
1501
def ApprovedByDefault_dbus_property(self, value=None):
1475
1502
if value is None: # get
1477
1504
self.approved_by_default = bool(value)
1478
1505
1479
1506
# ApprovalDelay - property
1480
@dbus_service_property(_interface, signature="t",
1507
@dbus_service_property(_interface,
1508
signature="t",
1481
1509
access="readwrite")
1482
1510
def ApprovalDelay_dbus_property(self, value=None):
1483
1511
if value is None: # get
1486
1514
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
1515
1488
1516
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
1517
@dbus_service_property(_interface,
1518
signature="t",
1490
1519
access="readwrite")
1491
1520
def ApprovalDuration_dbus_property(self, value=None):
1492
1521
if value is None: # get
1505
1534
return dbus.String(self.fingerprint)
1506
1535
1507
1536
# Host - property
1508
@dbus_service_property(_interface, signature="s",
1537
@dbus_service_property(_interface,
1538
signature="s",
1509
1539
access="readwrite")
1510
1540
def Host_dbus_property(self, value=None):
1511
1541
if value is None: # get
1523
1553
return datetime_to_dbus(self.last_enabled)
1524
1554
1525
1555
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
1556
@dbus_service_property(_interface,
1557
signature="b",
1527
1558
access="readwrite")
1528
1559
def Enabled_dbus_property(self, value=None):
1529
1560
if value is None: # get
1534
1565
self.disable()
1535
1566
1536
1567
# LastCheckedOK - property
1537
@dbus_service_property(_interface, signature="s",
1568
@dbus_service_property(_interface,
1569
signature="s",
1538
1570
access="readwrite")
1539
1571
def LastCheckedOK_dbus_property(self, value=None):
1540
1572
if value is not None:
1543
1575
return datetime_to_dbus(self.last_checked_ok)
1544
1576
1545
1577
# LastCheckerStatus - property
1546
@dbus_service_property(_interface, signature="n",
1547
access="read")
1578
@dbus_service_property(_interface, signature="n", access="read")
1548
1579
def LastCheckerStatus_dbus_property(self):
1549
1580
return dbus.Int16(self.last_checker_status)
1550
1581
1559
1590
return datetime_to_dbus(self.last_approval_request)
1560
1591
1561
1592
# Timeout - property
1562
@dbus_service_property(_interface, signature="t",
1593
@dbus_service_property(_interface,
1594
signature="t",
1563
1595
access="readwrite")
1564
1596
def Timeout_dbus_property(self, value=None):
1565
1597
if value is None: # get
1578
1610
is None):
1579
1611
return
1580
1612
gobject.source_remove(self.disable_initiator_tag)
1581
self.disable_initiator_tag = (
1582
gobject.timeout_add(
1583
int((self.expires - now).total_seconds()
1584
* 1000), self.disable))
1613
self.disable_initiator_tag = gobject.timeout_add(
1614
int((self.expires - now).total_seconds() * 1000),
1615
self.disable)
1585
1616
1586
1617
# ExtendedTimeout - property
1587
@dbus_service_property(_interface, signature="t",
1618
@dbus_service_property(_interface,
1619
signature="t",
1588
1620
access="readwrite")
1589
1621
def ExtendedTimeout_dbus_property(self, value=None):
1590
1622
if value is None: # get
1593
1625
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1594
1626
1595
1627
# Interval - property
1596
@dbus_service_property(_interface, signature="t",
1628
@dbus_service_property(_interface,
1629
signature="t",
1597
1630
access="readwrite")
1598
1631
def Interval_dbus_property(self, value=None):
1599
1632
if value is None: # get
1604
1637
if self.enabled:
1605
1638
# Reschedule checker run
1606
1639
gobject.source_remove(self.checker_initiator_tag)
1607
self.checker_initiator_tag = (gobject.timeout_add
1608
(value, self.start_checker))
1609
self.start_checker() # Start one now, too
1640
self.checker_initiator_tag = gobject.timeout_add(
1641
value, self.start_checker)
1642
self.start_checker() # Start one now, too
1610
1643
1611
1644
# Checker - property
1612
@dbus_service_property(_interface, signature="s",
1645
@dbus_service_property(_interface,
1646
signature="s",
1613
1647
access="readwrite")
1614
1648
def Checker_dbus_property(self, value=None):
1615
1649
if value is None: # get
1617
1651
self.checker_command = str(value)
1618
1652
1619
1653
# CheckerRunning - property
1620
@dbus_service_property(_interface, signature="b",
1654
@dbus_service_property(_interface,
1655
signature="b",
1621
1656
access="readwrite")
1622
1657
def CheckerRunning_dbus_property(self, value=None):
1623
1658
if value is None: # get
1633
1668
return self.dbus_object_path # is already a dbus.ObjectPath
1634
1669
1635
1670
# Secret = property
1636
@dbus_service_property(_interface, signature="ay",
1637
access="write", byte_arrays=True)
1671
@dbus_service_property(_interface,
1672
signature="ay",
1673
access="write",
1674
byte_arrays=True)
1638
1675
def Secret_dbus_property(self, value):
1639
1676
self.secret = bytes(value)
1640
1677
1646
1683
self._pipe = child_pipe
1647
1684
self._pipe.send(('init', fpr, address))
1648
1685
if not self._pipe.recv():
1649
raise KeyError()
1686
raise KeyError(fpr)
1650
1687
1651
1688
def __getattribute__(self, name):
1652
1689
if name == '_pipe':
1656
1693
if data[0] == 'data':
1657
1694
return data[1]
1658
1695
if data[0] == 'function':
1696
1659
1697
def func(*args, **kwargs):
1660
1698
self._pipe.send(('funcall', name, args, kwargs))
1661
1699
return self._pipe.recv()[1]
1700
1662
1701
return func
1663
1702
1664
1703
def __setattr__(self, name, value):
1680
1719
logger.debug("Pipe FD: %d",
1681
1720
self.server.child_pipe.fileno())
1682
1721
1683
session = (gnutls.connection
1684
.ClientSession(self.request,
1685
gnutls.connection
1686
.X509Credentials()))
1722
session = gnutls.connection.ClientSession(
1723
self.request, gnutls.connection .X509Credentials())
1687
1724
1688
1725
# Note: gnutls.connection.X509Credentials is really a
1689
1726
# generic GnuTLS certificate credentials object so long as
1698
1735
priority = self.server.gnutls_priority
1699
1736
if priority is None:
1700
1737
priority = "NORMAL"
1701
(gnutls.library.functions
1702
.gnutls_priority_set_direct(session._c_object,
1703
priority, None))
1738
gnutls.library.functions.gnutls_priority_set_direct(
1739
session._c_object, priority, None)
1704
1740
1705
1741
# Start communication using the Mandos protocol
1706
1742
# Get protocol number
1726
1762
approval_required = False
1727
1763
try:
1728
1764
try:
1729
fpr = self.fingerprint(self.peer_certificate
1730
(session))
1765
fpr = self.fingerprint(
1766
self.peer_certificate(session))
1731
1767
except (TypeError,
1732
1768
gnutls.errors.GNUTLSError) as error:
1733
1769
logger.warning("Bad certificate: %s", error)
1748
1784
while True:
1749
1785
if not client.enabled:
1750
1786
logger.info("Client %s is disabled",
1751
client.name)
1787
client.name)
1752
1788
if self.server.use_dbus:
1753
1789
# Emit D-Bus signal
1754
1790
client.Rejected("Disabled")
1801
1837
logger.warning("gnutls send failed",
1802
1838
exc_info=error)
1803
1839
return
1804
logger.debug("Sent: %d, remaining: %d",
1805
sent, len(client.secret)
1806
- (sent_size + sent))
1840
logger.debug("Sent: %d, remaining: %d", sent,
1841
len(client.secret) - (sent_size
1842
+ sent))
1807
1843
sent_size += sent
1808
1844
1809
1845
logger.info("Sending secret to %s", client.name)
1826
1862
def peer_certificate(session):
1827
1863
"Return the peer's OpenPGP certificate as a bytestring"
1828
1864
# If not an OpenPGP certificate...
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
1865
if (gnutls.library.functions.gnutls_certificate_type_get(
1866
session._c_object)
1831
1867
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
1868
# ...do the normal thing
1833
1869
return session.peer_certificate
1847
1883
def fingerprint(openpgp):
1848
1884
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
1885
# New GnuTLS "datum" with the OpenPGP public key
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.POINTER
1853
(ctypes.c_ubyte)),
1854
ctypes.c_uint(len(openpgp))))
1886
datum = gnutls.library.types.gnutls_datum_t(
1887
ctypes.cast(ctypes.c_char_p(openpgp),
1888
ctypes.POINTER(ctypes.c_ubyte)),
1889
ctypes.c_uint(len(openpgp)))
1855
1890
# New empty GnuTLS certificate
1856
1891
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1892
gnutls.library.functions.gnutls_openpgp_crt_init(
1893
ctypes.byref(crt))
1859
1894
# Import the OpenPGP public key into the certificate
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
1895
gnutls.library.functions.gnutls_openpgp_crt_import(
1896
crt, ctypes.byref(datum),
1897
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1864
1898
# Verify the self signature in the key
1865
1899
crtverify = ctypes.c_uint()
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
1900
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
crt, 0, ctypes.byref(crtverify))
1869
1902
if crtverify.value != 0:
1870
1903
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
1872
("Verify failed"))
1904
raise gnutls.errors.CertificateSecurityError(
1905
"Verify failed")
1873
1906
# New buffer for the fingerprint
1874
1907
buf = ctypes.create_string_buffer(20)
1875
1908
buf_len = ctypes.c_size_t()
1876
1909
# Get the fingerprint from the certificate into the buffer
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
1910
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
crt, ctypes.byref(buf), ctypes.byref(buf_len))
1880
1912
# Deinit the certificate
1881
1913
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1882
1914
# Convert the buffer to a Python bytestring
1888
1920
1889
1921
class MultiprocessingMixIn(object):
1890
1922
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1923
1891
1924
def sub_process_main(self, request, address):
1892
1925
try:
1893
1926
self.finish_request(request, address)
1905
1938
1906
1939
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1907
1940
""" adds a pipe to the MixIn """
1941
1908
1942
def process_request(self, request, client_address):
1909
1943
"""Overrides and wraps the original process_request().
1910
1944
1931
1965
interface: None or a network interface name (string)
1932
1966
use_ipv6: Boolean; to use IPv6 or not
1933
1967
"""
1968
1934
1969
def __init__(self, server_address, RequestHandlerClass,
1935
interface=None, use_ipv6=True, socketfd=None):
1970
interface=None,
1971
use_ipv6=True,
1972
socketfd=None):
1936
1973
"""If socketfd is set, use that file descriptor instead of
1937
1974
creating a new one with socket.socket().
1938
1975
"""
1979
2016
self.interface)
1980
2017
else:
1981
2018
try:
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1983
SO_BINDTODEVICE,
1984
(self.interface + "\0")
1985
.encode("utf-8"))
2019
self.socket.setsockopt(
2020
socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
(self.interface + "\0").encode("utf-8"))
1986
2022
except socket.error as error:
1987
2023
if error.errno == errno.EPERM:
1988
2024
logger.error("No permission to bind to"
2006
2042
self.server_address = (any_address,
2007
2043
self.server_address[1])
2008
2044
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2010
0)
2045
self.server_address = (self.server_address[0], 0)
2011
2046
# if self.interface:
2012
2047
# self.server_address = (self.server_address[0],
2013
2048
# 0, # port
2027
2062
2028
2063
Assumes a gobject.MainLoop event loop.
2029
2064
"""
2065
2030
2066
def __init__(self, server_address, RequestHandlerClass,
2031
interface=None, use_ipv6=True, clients=None,
2032
gnutls_priority=None, use_dbus=True, socketfd=None):
2067
interface=None,
2068
use_ipv6=True,
2069
clients=None,
2070
gnutls_priority=None,
2071
use_dbus=True,
2072
socketfd=None):
2033
2073
self.enabled = False
2034
2074
self.clients = clients
2035
2075
if self.clients is None:
2041
2081
interface = interface,
2042
2082
use_ipv6 = use_ipv6,
2043
2083
socketfd = socketfd)
2084
2044
2085
def server_activate(self):
2045
2086
if self.enabled:
2046
2087
return socketserver.TCPServer.server_activate(self)
2050
2091
2051
2092
def add_pipe(self, parent_pipe, proc):
2052
2093
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2056
parent_pipe =
2057
parent_pipe,
2058
proc = proc))
2094
gobject.io_add_watch(
2095
parent_pipe.fileno(),
2096
gobject.IO_IN | gobject.IO_HUP,
2097
functools.partial(self.handle_ipc,
2098
parent_pipe = parent_pipe,
2099
proc = proc))
2059
2100
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2101
def handle_ipc(self, source, condition,
2102
parent_pipe=None,
2103
proc = None,
2104
client_object=None):
2062
2105
# error, or the other end of multiprocessing.Pipe has closed
2063
2106
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2064
2107
# Wait for other process to exit
2087
2130
parent_pipe.send(False)
2088
2131
return False
2089
2132
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2093
parent_pipe =
2094
parent_pipe,
2095
proc = proc,
2096
client_object =
2097
client))
2133
gobject.io_add_watch(
2134
parent_pipe.fileno(),
2135
gobject.IO_IN | gobject.IO_HUP,
2136
functools.partial(self.handle_ipc,
2137
parent_pipe = parent_pipe,
2138
proc = proc,
2139
client_object = client))
2098
2140
parent_pipe.send(True)
2099
2141
# remove the old hook in favor of the new above hook on
2100
2142
# same fileno
2106
2148
2107
2149
parent_pipe.send(('data', getattr(client_object,
2108
2150
funcname)(*args,
2109
**kwargs)))
2151
**kwargs)))
2110
2152
2111
2153
if command == 'getattr':
2112
2154
attrname = request[1]
2113
if callable(client_object.__getattribute__(attrname)):
2114
parent_pipe.send(('function',))
2155
if isinstance(client_object.__getattribute__(attrname),
2156
collections.Callable):
2157
parent_pipe.send(('function', ))
2115
2158
else:
2116
parent_pipe.send(('data', client_object
2117
.__getattribute__(attrname)))
2159
parent_pipe.send((
2160
'data', client_object.__getattribute__(attrname)))
2118
2161
2119
2162
if command == 'setattr':
2120
2163
attrname = request[1]
2151
2194
# avoid excessive use of external libraries.
2152
2195
2153
2196
# New type for defining tokens, syntax, and semantics all-in-one
2154
Token = collections.namedtuple("Token",
2155
("regexp", # To match token; if
2156
# "value" is not None,
2157
# must have a "group"
2158
# containing digits
2159
"value", # datetime.timedelta or
2160
# None
2161
"followers")) # Tokens valid after
2162
# this token
2197
Token = collections.namedtuple("Token", (
2198
"regexp", # To match token; if "value" is not None, must have
2199
# a "group" containing digits
2200
"value", # datetime.timedelta or None
2201
"followers")) # Tokens valid after this token
2163
2202
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2203
# the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2204
token_end = Token(re.compile(r"$"), None, frozenset())
2166
2205
token_second = Token(re.compile(r"(\d+)S"),
2167
2206
datetime.timedelta(seconds=1),
2168
frozenset((token_end,)))
2207
frozenset((token_end, )))
2169
2208
token_minute = Token(re.compile(r"(\d+)M"),
2170
2209
datetime.timedelta(minutes=1),
2171
2210
frozenset((token_second, token_end)))
2187
2226
frozenset((token_month, token_end)))
2188
2227
token_week = Token(re.compile(r"(\d+)W"),
2189
2228
datetime.timedelta(weeks=1),
2190
frozenset((token_end,)))
2229
frozenset((token_end, )))
2191
2230
token_duration = Token(re.compile(r"P"), None,
2192
2231
frozenset((token_year, token_month,
2193
2232
token_day, token_time,
2195
2234
# Define starting values
2196
2235
value = datetime.timedelta() # Value so far
2197
2236
found_token = None
2198
followers = frozenset((token_duration,)) # Following valid tokens
2237
followers = frozenset((token_duration, )) # Following valid tokens
2199
2238
s = duration # String left to parse
2200
2239
# Loop until end token is found
2201
2240
while found_token is not token_end:
2218
2257
break
2219
2258
else:
2220
2259
# No currently valid tokens were found
2221
raise ValueError("Invalid RFC 3339 duration")
2260
raise ValueError("Invalid RFC 3339 duration: {!r}"
2261
.format(duration))
2222
2262
# End token found
2223
2263
return value
2224
2264
2261
2301
elif suffix == "w":
2262
2302
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
2303
else:
2264
raise ValueError("Unknown suffix {!r}"
2265
.format(suffix))
2304
raise ValueError("Unknown suffix {!r}".format(suffix))
2266
2305
except IndexError as e:
2267
2306
raise ValueError(*(e.args))
2268
2307
timevalue += delta
2284
2323
# Close all standard open file descriptors
2285
2324
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2325
if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
raise OSError(errno.ENODEV, "{} not a character device"
2326
raise OSError(errno.ENODEV,
2327
"{} not a character device"
2288
2328
.format(os.devnull))
2289
2329
os.dup2(null, sys.stdin.fileno())
2290
2330
os.dup2(null, sys.stdout.fileno())
2356
2396
"port": "",
2357
2397
"debug": "False",
2358
2398
"priority":
2359
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2399
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2400
":+SIGN-DSA-SHA256",
2360
2401
"servicename": "Mandos",
2361
2402
"use_dbus": "True",
2362
2403
"use_ipv6": "True",
2366
2407
"statedir": "/var/lib/mandos",
2367
2408
"foreground": "False",
2368
2409
"zeroconf": "True",
2369
}
2410
}
2370
2411
2371
2412
# Parse config file for server-global settings
2372
2413
server_config = configparser.SafeConfigParser(server_defaults)
2373
2414
del server_defaults
2374
server_config.read(os.path.join(options.configdir,
2375
"mandos.conf"))
2415
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2376
2416
# Convert the SafeConfigParser object to a dict
2377
2417
server_settings = server_config.defaults()
2378
2418
# Use the appropriate methods on the non-string config options
2396
2436
# Override the settings from the config file with command line
2397
2437
# options, if set.
2398
2438
for option in ("interface", "address", "port", "debug",
2399
"priority", "servicename", "configdir",
2400
"use_dbus", "use_ipv6", "debuglevel", "restore",
2401
"statedir", "socket", "foreground", "zeroconf"):
2439
"priority", "servicename", "configdir", "use_dbus",
2440
"use_ipv6", "debuglevel", "restore", "statedir",
2441
"socket", "foreground", "zeroconf"):
2402
2442
value = getattr(options, option)
2403
2443
if value is not None:
2404
2444
server_settings[option] = value
2419
2459
2420
2460
##################################################################
2421
2461
2422
if (not server_settings["zeroconf"] and
2423
not (server_settings["port"]
2424
or server_settings["socket"] != "")):
2425
parser.error("Needs port or socket to work without"
2426
" Zeroconf")
2462
if (not server_settings["zeroconf"]
2463
and not (server_settings["port"]
2464
or server_settings["socket"] != "")):
2465
parser.error("Needs port or socket to work without Zeroconf")
2427
2466
2428
2467
# For convenience
2429
2468
debug = server_settings["debug"]
2445
2484
initlogger(debug, level)
2446
2485
2447
2486
if server_settings["servicename"] != "Mandos":
2448
syslogger.setFormatter(logging.Formatter
2449
('Mandos ({}) [%(process)d]:'
2450
' %(levelname)s: %(message)s'
2451
.format(server_settings
2452
["servicename"])))
2487
syslogger.setFormatter(
2488
logging.Formatter('Mandos ({}) [%(process)d]:'
2489
' %(levelname)s: %(message)s'.format(
2490
server_settings["servicename"])))
2453
2491
2454
2492
# Parse config file with clients
2455
2493
client_config = configparser.SafeConfigParser(Client
2463
2501
socketfd = None
2464
2502
if server_settings["socket"] != "":
2465
2503
socketfd = server_settings["socket"]
2466
tcp_server = MandosServer((server_settings["address"],
2467
server_settings["port"]),
2468
ClientHandler,
2469
interface=(server_settings["interface"]
2470
or None),
2471
use_ipv6=use_ipv6,
2472
gnutls_priority=
2473
server_settings["priority"],
2474
use_dbus=use_dbus,
2475
socketfd=socketfd)
2504
tcp_server = MandosServer(
2505
(server_settings["address"], server_settings["port"]),
2506
ClientHandler,
2507
interface=(server_settings["interface"] or None),
2508
use_ipv6=use_ipv6,
2509
gnutls_priority=server_settings["priority"],
2510
use_dbus=use_dbus,
2511
socketfd=socketfd)
2476
2512
if not foreground:
2477
2513
pidfilename = "/run/mandos.pid"
2478
2514
if not os.path.isdir("/run/."):
2479
2515
pidfilename = "/var/run/mandos.pid"
2480
2516
pidfile = None
2481
2517
try:
2482
pidfile = open(pidfilename, "w")
2518
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2483
2519
except IOError as e:
2484
2520
logger.error("Could not open file %r", pidfilename,
2485
2521
exc_info=e)
2512
2548
def debug_gnutls(level, string):
2513
2549
logger.debug("GnuTLS: %s", string[:-1])
2514
2550
2515
(gnutls.library.functions
2516
.gnutls_global_set_log_function(debug_gnutls))
2551
gnutls.library.functions.gnutls_global_set_log_function(
2552
debug_gnutls)
2517
2553
2518
2554
# Redirect stdin so all checkers get /dev/null
2519
2555
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2539
2575
if use_dbus:
2540
2576
try:
2541
2577
bus_name = dbus.service.BusName("se.recompile.Mandos",
2542
bus, do_not_queue=True)
2543
old_bus_name = (dbus.service.BusName
2544
("se.bsnet.fukt.Mandos", bus,
2545
do_not_queue=True))
2546
except dbus.exceptions.NameExistsException as e:
2578
bus,
2579
do_not_queue=True)
2580
old_bus_name = dbus.service.BusName(
2581
"se.bsnet.fukt.Mandos", bus,
2582
do_not_queue=True)
2583
except dbus.exceptions.DBusException as e:
2547
2584
logger.error("Disabling D-Bus:", exc_info=e)
2548
2585
use_dbus = False
2549
2586
server_settings["use_dbus"] = False
2550
2587
tcp_server.use_dbus = False
2551
2588
if zeroconf:
2552
2589
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2553
service = AvahiServiceToSyslog(name =
2554
server_settings["servicename"],
2555
servicetype = "_mandos._tcp",
2556
protocol = protocol, bus = bus)
2590
service = AvahiServiceToSyslog(
2591
name = server_settings["servicename"],
2592
servicetype = "_mandos._tcp",
2593
protocol = protocol,
2594
bus = bus)
2557
2595
if server_settings["interface"]:
2558
service.interface = (if_nametoindex
2559
(server_settings["interface"]
2560
.encode("utf-8")))
2596
service.interface = if_nametoindex(
2597
server_settings["interface"].encode("utf-8"))
2561
2598
2562
2599
global multiprocessing_manager
2563
2600
multiprocessing_manager = multiprocessing.Manager()
2582
2619
if server_settings["restore"]:
2583
2620
try:
2584
2621
with open(stored_state_path, "rb") as stored_state:
2585
clients_data, old_client_settings = (pickle.load
2586
(stored_state))
2622
clients_data, old_client_settings = pickle.load(
2623
stored_state)
2587
2624
os.remove(stored_state_path)
2588
2625
except IOError as e:
2589
2626
if e.errno == errno.ENOENT:
2590
logger.warning("Could not load persistent state: {}"
2591
.format(os.strerror(e.errno)))
2627
logger.warning("Could not load persistent state:"
2628
" {}".format(os.strerror(e.errno)))
2592
2629
else:
2593
2630
logger.critical("Could not load persistent state:",
2594
2631
exc_info=e)
2595
2632
raise
2596
2633
except EOFError as e:
2597
2634
logger.warning("Could not load persistent state: "
2598
"EOFError:", exc_info=e)
2635
"EOFError:",
2636
exc_info=e)
2599
2637
2600
2638
with PGPEngine() as pgp:
2601
2639
for client_name, client in clients_data.items():
2613
2651
# For each value in new config, check if it
2614
2652
# differs from the old config value (Except for
2615
2653
# the "secret" attribute)
2616
if (name != "secret" and
2617
value != old_client_settings[client_name]
2618
[name]):
2654
if (name != "secret"
2655
and (value !=
2656
old_client_settings[client_name][name])):
2619
2657
client[name] = value
2620
2658
except KeyError:
2621
2659
pass
2622
2660
2623
2661
# Clients who has passed its expire date can still be
2624
# enabled if its last checker was successful. Clients
2662
# enabled if its last checker was successful. A Client
2625
2663
# whose checker succeeded before we stored its state is
2626
2664
# assumed to have successfully run all checkers during
2627
2665
# downtime.
2630
2668
if not client["last_checked_ok"]:
2631
2669
logger.warning(
2632
2670
"disabling client {} - Client never "
2633
"performed a successful checker"
2634
.format(client_name))
2671
"performed a successful checker".format(
2672
client_name))
2635
2673
client["enabled"] = False
2636
2674
elif client["last_checker_status"] != 0:
2637
2675
logger.warning(
2638
2676
"disabling client {} - Client last"
2639
" checker failed with error code {}"
2640
.format(client_name,
2641
client["last_checker_status"]))
2677
" checker failed with error code"
2678
" {}".format(
2679
client_name,
2680
client["last_checker_status"]))
2642
2681
client["enabled"] = False
2643
2682
else:
2644
client["expires"] = (datetime.datetime
2645
.utcnow()
2646
+ client["timeout"])
2683
client["expires"] = (
2684
datetime.datetime.utcnow()
2685
+ client["timeout"])
2647
2686
logger.debug("Last checker succeeded,"
2648
" keeping {} enabled"
2649
.format(client_name))
2687
" keeping {} enabled".format(
2688
client_name))
2650
2689
try:
2651
client["secret"] = (
2652
pgp.decrypt(client["encrypted_secret"],
2653
client_settings[client_name]
2654
["secret"]))
2690
client["secret"] = pgp.decrypt(
2691
client["encrypted_secret"],
2692
client_settings[client_name]["secret"])
2655
2693
except PGPError:
2656
2694
# If decryption fails, we use secret from new settings
2657
logger.debug("Failed to decrypt {} old secret"
2658
.format(client_name))
2659
client["secret"] = (
2660
client_settings[client_name]["secret"])
2695
logger.debug("Failed to decrypt {} old secret".format(
2696
client_name))
2697
client["secret"] = (client_settings[client_name]
2698
["secret"])
2661
2699
2662
2700
# Add/remove clients based on new changes made to config
2663
2701
for client_name in (set(old_client_settings)
2670
2708
# Create all client objects
2671
2709
for client_name, client in clients_data.items():
2672
2710
tcp_server.clients[client_name] = client_class(
2673
name = client_name, settings = client,
2711
name = client_name,
2712
settings = client,
2674
2713
server_settings = server_settings)
2675
2714
2676
2715
if not tcp_server.clients:
2678
2717
2679
2718
if not foreground:
2680
2719
if pidfile is not None:
2720
pid = os.getpid()
2681
2721
try:
2682
2722
with pidfile:
2683
pid = os.getpid()
2684
pidfile.write("{}\n".format(pid).encode("utf-8"))
2723
print(pid, file=pidfile)
2685
2724
except IOError:
2686
2725
logger.error("Could not write to file %r with PID %d",
2687
2726
pidfilename, pid)
2692
2731
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2693
2732
2694
2733
if use_dbus:
2695
@alternate_dbus_interfaces({"se.recompile.Mandos":
2696
"se.bsnet.fukt.Mandos"})
2734
2735
@alternate_dbus_interfaces(
2736
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2697
2737
class MandosDBusService(DBusObjectWithProperties):
2698
2738
"""A D-Bus proxy object"""
2739
2699
2740
def __init__(self):
2700
2741
dbus.service.Object.__init__(self, bus, "/")
2742
2701
2743
_interface = "se.recompile.Mandos"
2702
2744
2703
2745
@dbus_interface_annotations(_interface)
2704
2746
def _foo(self):
2705
return { "org.freedesktop.DBus.Property"
2706
".EmitsChangedSignal":
2707
"false"}
2747
return {
2748
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
"false" }
2708
2750
2709
2751
@dbus.service.signal(_interface, signature="o")
2710
2752
def ClientAdded(self, objpath):
2724
2766
@dbus.service.method(_interface, out_signature="ao")
2725
2767
def GetAllClients(self):
2726
2768
"D-Bus method"
2727
return dbus.Array(c.dbus_object_path
2728
for c in
2769
return dbus.Array(c.dbus_object_path for c in
2729
2770
tcp_server.clients.itervalues())
2730
2771
2731
2772
@dbus.service.method(_interface,
2780
2821
# + secret.
2781
2822
exclude = { "bus", "changedstate", "secret",
2782
2823
"checker", "server_settings" }
2783
for name, typ in (inspect.getmembers
2784
(dbus.service.Object)):
2824
for name, typ in inspect.getmembers(dbus.service
2825
.Object):
2785
2826
exclude.add(name)
2786
2827
2787
2828
client_dict["encrypted_secret"] = (client
2794
2835
del client_settings[client.name]["secret"]
2795
2836
2796
2837
try:
2797
with (tempfile.NamedTemporaryFile
2798
(mode='wb', suffix=".pickle", prefix='clients-',
2799
dir=os.path.dirname(stored_state_path),
2800
delete=False)) as stored_state:
2838
with tempfile.NamedTemporaryFile(
2839
mode='wb',
2840
suffix=".pickle",
2841
prefix='clients-',
2842
dir=os.path.dirname(stored_state_path),
2843
delete=False) as stored_state:
2801
2844
pickle.dump((clients, client_settings), stored_state)
2802
tempname=stored_state.name
2845
tempname = stored_state.name
2803
2846
os.rename(tempname, stored_state_path)
2804
2847
except (IOError, OSError) as e:
2805
2848
if not debug:
2824
2867
client.disable(quiet=True)
2825
2868
if use_dbus:
2826
2869
# Emit D-Bus signal
2827
mandos_dbus_service.ClientRemoved(client
2828
.dbus_object_path,
2829
client.name)
2870
mandos_dbus_service.ClientRemoved(
2871
client.dbus_object_path, client.name)
2830
2872
client_settings.clear()
2831
2873
2832
2874
atexit.register(cleanup)
2885
2927
# Must run before the D-Bus bus name gets deregistered
2886
2928
cleanup()
2887
2929
2930
2888
2931
if __name__ == '__main__':
2889
2932
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0