/mandos/trunk : revision 780

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

38

43

import socket

39

44

import argparse

40

45

import datetime

45

50

import gnutls.library.functions

46

51

import gnutls.library.constants

47

52

import gnutls.library.types

48

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

49

57

import sys

50

58

import re

51

59

import os

60

68

import struct

61

69

import fcntl

62

70

import functools

63

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

64

75

import multiprocessing

76

import types

77

import binascii

78

import tempfile

79

import itertools

80

import collections

81

import codecs

65

82

66

83

import dbus

67

84

import dbus.service

68

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

69

89

import avahi

70

90

from dbus.mainloop.glib import DBusGMainLoop

71

91

import ctypes

81

101

except ImportError:

82

102

SO_BINDTODEVICE = None

83

103

84

85

version = "1.3.0"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

89

syslogger = (logging.handlers.SysLogHandler

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

108

stored_state_file = "clients.pickle"

109

110

logger = logging.getLogger()

111

syslogger = None

112

113

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

116

except (OSError, AttributeError):

117

118

def if_nametoindex(interface):

119

"Get an interface index the hard way, i.e. using fcntl()"

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

with contextlib.closing(socket.socket()) as s:

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

125

return interface_index

126

127

128

def initlogger(debug, level=logging.WARNING):

129

"""init logger and add loglevel"""

130

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

syslogger.setFormatter(logging.Formatter

136

('Mandos [%(process)d]: %(levelname)s:'

137

' %(message)s'))

138

logger.addHandler(syslogger)

139

140

if debug:

141

console = logging.StreamHandler()

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

147

logger.setLevel(level)

148

149

150

class PGPError(Exception):

151

"""Exception if encryption/decryption fails"""

152

pass

153

154

155

class PGPEngine(object):

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

def __init__(self):

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

165

166

def __enter__(self):

167

return self

168

169

def __exit__(self, exc_type, exc_value, traceback):

170

self._cleanup()

171

return False

172

173

def __del__(self):

174

self._cleanup()

175

176

def _cleanup(self):

177

if self.tempdir is not None:

178

# Delete contents of tempdir

179

for root, dirs, files in os.walk(self.tempdir,

180

topdown = False):

181

for filename in files:

182

os.remove(os.path.join(root, filename))

183

for dirname in dirs:

184

os.rmdir(os.path.join(root, dirname))

185

# Remove tempdir

186

os.rmdir(self.tempdir)

187

self.tempdir = None

188

189

def password_encode(self, password):

190

# Passphrase can not be empty and can not contain newlines or

191

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

199

200

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

216

return ciphertext

217

218

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

234

return decrypted_plaintext

235

102

236

103

237

class AvahiError(Exception):

104

238

def __init__(self, value, *args, **kwargs):

105

239

self.value = value

106

super(AvahiError, self).__init__(value, *args, **kwargs)

107

def __unicode__(self):

108

return unicode(repr(self.value))

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

109

243

110

244

class AvahiServiceError(AvahiError):

111

245

pass

112

246

247

113

248

class AvahiGroupError(AvahiError):

114

249

pass

115

250

122

257

Used to optionally bind to the specified interface.

123

258

name: string; Example: 'Mandos'

124

259

type: string; Example: '_mandos._tcp'.

125

See <http://www.dns-sd.org/ServiceTypes.html>

260

See <https://www.iana.org/assignments/service-names-port-numbers>

126

261

port: integer; what port to announce

127

262

TXT: list of strings; TXT record for the service

128

263

domain: string; Domain to publish on, default to .local if empty.

134

269

server: D-Bus Server

135

270

bus: dbus.SystemBus()

136

271

"""

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

272

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

141

284

self.interface = interface

142

285

self.name = name

143

286

self.type = servicetype

151

294

self.group = None # our entry group

152

295

self.server = None

153

296

self.bus = bus

154

def rename(self):

297

self.entry_group_state_changed_match = None

298

299

def rename(self, remove=True):

155

300

"""Derived from the Avahi example code"""

156

301

if self.rename_count >= self.max_renames:

157

302

logger.critical("No suitable Zeroconf service name found"

158

303

" after %i retries, exiting.",

159

304

self.rename_count)

160

305

raise AvahiServiceError("Too many renames")

161

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

162

309

logger.info("Changing Zeroconf service name to %r ...",

163

310

self.name)

164

syslogger.setFormatter(logging.Formatter

165

('Mandos (%s) [%%(process)d]:'

166

' %%(levelname)s: %%(message)s'

167

% self.name))

168

self.remove()

311

if remove:

312

self.remove()

169

313

try:

170

314

self.add()

171

except dbus.exceptions.DBusException, error:

172

logger.critical("DBusException: %s", error)

173

self.cleanup()

174

os._exit(1)

175

self.rename_count += 1

315

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

324

176

325

def remove(self):

177

326

"""Derived from the Avahi example code"""

327

if self.entry_group_state_changed_match is not None:

328

self.entry_group_state_changed_match.remove()

329

self.entry_group_state_changed_match = None

178

330

if self.group is not None:

179

331

self.group.Reset()

332

180

333

def add(self):

181

334

"""Derived from the Avahi example code"""

335

self.remove()

182

336

if self.group is None:

183

337

self.group = dbus.Interface(

184

338

self.bus.get_object(avahi.DBUS_NAME,

185

339

self.server.EntryGroupNew()),

186

340

avahi.DBUS_INTERFACE_ENTRY_GROUP)

187

self.group.connect_to_signal('StateChanged',

188

self

189

.entry_group_state_changed)

341

self.entry_group_state_changed_match = (

342

self.group.connect_to_signal(

343

'StateChanged', self.entry_group_state_changed))

190

344

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

191

345

self.name, self.type)

192

346

self.group.AddService(

198

352

dbus.UInt16(self.port),

199

353

avahi.string_array_to_txt_array(self.TXT))

200

354

self.group.Commit()

355

201

356

def entry_group_state_changed(self, state, error):

202

357

"""Derived from the Avahi example code"""

203

358

logger.debug("Avahi entry group state change: %i", state)

209

364

self.rename()

210

365

elif state == avahi.ENTRY_GROUP_FAILURE:

211

366

logger.critical("Avahi: Error in group state changed %s",

212

unicode(error))

213

raise AvahiGroupError("State changed: %s"

214

% unicode(error))

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

369

215

370

def cleanup(self):

216

371

"""Derived from the Avahi example code"""

217

372

if self.group is not None:

218

self.group.Free()

373

try:

374

self.group.Free()

375

except (dbus.exceptions.UnknownMethodException,

376

dbus.exceptions.DBusException):

377

pass

219

378

self.group = None

220

def server_state_changed(self, state):

379

self.remove()

380

381

def server_state_changed(self, state, error=None):

221

382

"""Derived from the Avahi example code"""

222

383

logger.debug("Avahi server state change: %i", state)

223

if state == avahi.SERVER_COLLISION:

224

logger.error("Zeroconf server name collision")

225

self.remove()

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

390

if state in bad_states:

391

if bad_states[state] is not None:

392

if error is None:

393

logger.error(bad_states[state])

394

else:

395

logger.error(bad_states[state] + ": %r", error)

396

self.cleanup()

226

397

elif state == avahi.SERVER_RUNNING:

227

self.add()

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

410

else:

411

if error is None:

412

logger.debug("Unknown state: %r", state)

413

else:

414

logger.debug("Unknown state: %r: %r", state, error)

415

228

416

def activate(self):

229

417

"""Derived from the Avahi example code"""

230

418

if self.server is None:

231

419

self.server = dbus.Interface(

232

420

self.bus.get_object(avahi.DBUS_NAME,

233

avahi.DBUS_PATH_SERVER),

421

avahi.DBUS_PATH_SERVER,

422

follow_name_owner_changes=True),

234

423

avahi.DBUS_INTERFACE_SERVER)

235

424

self.server.connect_to_signal("StateChanged",

236

self.server_state_changed)

425

self.server_state_changed)

237

426

self.server_state_changed(self.server.GetState())

238

427

239

428

429

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

431

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

436

return ret

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

240

448

class Client(object):

241

449

"""A representation of a client host served by this server.

242

450

243

451

Attributes:

244

_approved: bool(); 'None' if not yet approved/disapproved

452

approved: bool(); 'None' if not yet approved/disapproved

245

453

approval_delay: datetime.timedelta(); Time to wait for approval

246

454

approval_duration: datetime.timedelta(); Duration of one approval

247

455

checker: subprocess.Popen(); a running checker process used

254

462

instance %(name)s can be used in the command.

255

463

checker_initiator_tag: a gobject event source tag, or None

256

464

created: datetime.datetime(); (UTC) object creation

465

client_structure: Object describing what attributes a client has

466

and is used for storing the client at exit

257

467

current_checker_command: string; current running checker_command

258

disable_hook: If set, called by disable() as disable_hook(self)

259

468

disable_initiator_tag: a gobject event source tag, or None

260

469

enabled: bool()

261

470

fingerprint: string (40 or 32 hexadecimal digits); used to

264

473

interval: datetime.timedelta(); How often to start a new checker

265

474

last_approval_request: datetime.datetime(); (UTC) or None

266

475

last_checked_ok: datetime.datetime(); (UTC) or None

267

last_enabled: datetime.datetime(); (UTC)

476

last_checker_status: integer between 0 and 255 reflecting exit

477

status of last checker. -1 reflects crashed

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

last_enabled: datetime.datetime(); (UTC) or None

268

482

name: string; from the config file, used in log messages and

269

483

D-Bus identifiers

270

484

secret: bytestring; sent verbatim (over TLS) to client

271

485

timeout: datetime.timedelta(); How long from last_checked_ok

272

486

until this client is disabled

487

extended_timeout: extra long timeout when secret has been sent

273

488

runtime_expansions: Allowed attributes for runtime expansion.

489

expires: datetime.datetime(); time (UTC) when a client will be

490

disabled, or None

491

server_settings: The server_settings dict from main()

274

492

"""

275

493

276

494

runtime_expansions = ("approval_delay", "approval_duration",

277

"created", "enabled", "fingerprint",

278

"host", "interval", "last_checked_ok",

495

"created", "enabled", "expires",

496

"fingerprint", "host", "interval",

497

"last_approval_request", "last_checked_ok",

279

498

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

280

510

281

511

@staticmethod

282

def _timedelta_to_milliseconds(td):

283

"Convert a datetime.timedelta() to milliseconds"

284

return ((td.days * 24 * 60 * 60 * 1000)

285

+ (td.seconds * 1000)

286

+ (td.microseconds // 1000))

287

288

def timeout_milliseconds(self):

289

"Return the 'timeout' attribute in milliseconds"

290

return self._timedelta_to_milliseconds(self.timeout)

291

292

def interval_milliseconds(self):

293

"Return the 'interval' attribute in milliseconds"

294

return self._timedelta_to_milliseconds(self.interval)

295

296

def approval_delay_milliseconds(self):

297

return self._timedelta_to_milliseconds(self.approval_delay)

298

299

def __init__(self, name = None, disable_hook=None, config=None):

300

"""Note: the 'checker' key in 'config' sets the

301

'checker_command' attribute and *not* the 'checker'

302

attribute."""

512

def config_parser(config):

513

"""Construct a new dict of client settings of this form:

514

{ client_name: {setting_name: value, ...}, ...}

515

with exceptions for any special settings as defined above.

516

NOTE: Must be a pure function. Must return the same result

517

value given the same arguments.

518

"""

519

settings = {}

520

for client_name in config.sections():

521

section = dict(config.items(client_name))

522

client = settings[client_name] = {}

523

524

client["host"] = section["host"]

525

# Reformat values from string types to Python types

526

client["approved_by_default"] = config.getboolean(

527

client_name, "approved_by_default")

528

client["enabled"] = config.getboolean(client_name,

529

"enabled")

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

535

.replace(" ", ""))

536

if "secret" in section:

537

client["secret"] = section["secret"].decode("base64")

538

elif "secfile" in section:

539

with open(os.path.expanduser(os.path.expandvars

540

(section["secfile"])),

541

"rb") as secfile:

542

client["secret"] = secfile.read()

543

else:

544

raise TypeError("No secret or secfile for section {}"

545

.format(section))

546

client["timeout"] = string_to_delta(section["timeout"])

547

client["extended_timeout"] = string_to_delta(

548

section["extended_timeout"])

549

client["interval"] = string_to_delta(section["interval"])

550

client["approval_delay"] = string_to_delta(

551

section["approval_delay"])

552

client["approval_duration"] = string_to_delta(

553

section["approval_duration"])

554

client["checker_command"] = section["checker"]

555

client["last_approval_request"] = None

556

client["last_checked_ok"] = None

557

client["last_checker_status"] = -2

558

559

return settings

560

561

def __init__(self, settings, name = None, server_settings=None):

303

562

self.name = name

304

if config is None:

305

config = {}

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

566

# adding all client settings

567

for setting, value in settings.items():

568

setattr(self, setting, value)

569

570

if self.enabled:

571

if not hasattr(self, "last_enabled"):

572

self.last_enabled = datetime.datetime.utcnow()

573

if not hasattr(self, "expires"):

574

self.expires = (datetime.datetime.utcnow()

575

+ self.timeout)

576

else:

577

self.last_enabled = None

578

self.expires = None

579

306

580

logger.debug("Creating client %r", self.name)

307

# Uppercase and remove spaces from fingerprint for later

308

# comparison purposes with return value from the fingerprint()

309

# function

310

self.fingerprint = (config["fingerprint"].upper()

311

.replace(" ", ""))

312

581

logger.debug(" Fingerprint: %s", self.fingerprint)

313

if "secret" in config:

314

self.secret = config["secret"].decode("base64")

315

elif "secfile" in config:

316

with open(os.path.expanduser(os.path.expandvars

317

(config["secfile"])),

318

"rb") as secfile:

319

self.secret = secfile.read()

320

else:

321

raise TypeError("No secret or secfile for client %s"

322

% self.name)

323

self.host = config.get("host", "")

324

self.created = datetime.datetime.utcnow()

325

self.enabled = False

326

self.last_approval_request = None

327

self.last_enabled = None

328

self.last_checked_ok = None

329

self.timeout = string_to_delta(config["timeout"])

330

self.interval = string_to_delta(config["interval"])

331

self.disable_hook = disable_hook

582

self.created = settings.get("created",

583

datetime.datetime.utcnow())

584

585

# attributes specific for this server instance

332

586

self.checker = None

333

587

self.checker_initiator_tag = None

334

588

self.disable_initiator_tag = None

335

589

self.checker_callback_tag = None

336

self.checker_command = config["checker"]

337

590

self.current_checker_command = None

338

self.last_connect = None

339

self._approved = None

340

self.approved_by_default = config.get("approved_by_default",

341

True)

591

self.approved = None

342

592

self.approvals_pending = 0

343

self.approval_delay = string_to_delta(

344

config["approval_delay"])

345

self.approval_duration = string_to_delta(

346

config["approval_duration"])

347

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

597

if not attr.startswith("_")]

598

self.client_structure.append("client_structure")

599

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

602

if not name.startswith("_"):

603

self.client_structure.append(name)

348

604

605

# Send notice to process children that client state has changed

349

606

def send_changedstate(self):

350

self.changedstate.acquire()

351

self.changedstate.notify_all()

352

self.changedstate.release()

353

607

with self.changedstate:

608

self.changedstate.notify_all()

609

354

610

def enable(self):

355

611

"""Start this client's checker and timeout hooks"""

356

612

if getattr(self, "enabled", False):

357

613

# Already enabled

358

614

return

359

self.send_changedstate()

615

self.expires = datetime.datetime.utcnow() + self.timeout

616

self.enabled = True

360

617

self.last_enabled = datetime.datetime.utcnow()

361

# Schedule a new checker to be started an 'interval' from now,

362

# and every interval from then on.

363

self.checker_initiator_tag = (gobject.timeout_add

364

(self.interval_milliseconds(),

365

self.start_checker))

366

# Schedule a disable() when 'timeout' has passed

367

self.disable_initiator_tag = (gobject.timeout_add

368

(self.timeout_milliseconds(),

369

self.disable))

370

self.enabled = True

371

# Also start a new checker *right now*.

372

self.start_checker()

618

self.init_checker()

619

self.send_changedstate()

373

620

374

621

def disable(self, quiet=True):

375

622

"""Disable this client."""

376

623

if not getattr(self, "enabled", False):

377

624

return False

378

625

if not quiet:

379

self.send_changedstate()

380

if not quiet:

381

626

logger.info("Disabling client %s", self.name)

382

if getattr(self, "disable_initiator_tag", False):

627

if getattr(self, "disable_initiator_tag", None) is not None:

383

628

gobject.source_remove(self.disable_initiator_tag)

384

629

self.disable_initiator_tag = None

385

if getattr(self, "checker_initiator_tag", False):

630

self.expires = None

631

if getattr(self, "checker_initiator_tag", None) is not None:

386

632

gobject.source_remove(self.checker_initiator_tag)

387

633

self.checker_initiator_tag = None

388

634

self.stop_checker()

389

if self.disable_hook:

390

self.disable_hook(self)

391

635

self.enabled = False

636

if not quiet:

637

self.send_changedstate()

392

638

# Do not run this again if called by a gobject.timeout_add

393

639

return False

394

640

395

641

def __del__(self):

396

self.disable_hook = None

397

642

self.disable()

398

643

399

def checker_callback(self, pid, condition, command):

644

def init_checker(self):

645

# Schedule a new checker to be started an 'interval' from now,

646

# and every interval from then on.

647

if self.checker_initiator_tag is not None:

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

652

# Schedule a disable() when 'timeout' has passed

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

657

# Also start a new checker *right now*.

658

self.start_checker()

659

660

def checker_callback(self, source, condition, connection,

661

command):

400

662

"""The checker has completed, so take appropriate actions."""

401

663

self.checker_callback_tag = None

402

664

self.checker = None

403

if os.WIFEXITED(condition):

404

exitstatus = os.WEXITSTATUS(condition)

405

if exitstatus == 0:

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

672

if self.last_checker_status == 0:

406

673

logger.info("Checker for %(name)s succeeded",

407

674

vars(self))

408

675

self.checked_ok()

409

676

else:

410

logger.info("Checker for %(name)s failed",

411

vars(self))

677

logger.info("Checker for %(name)s failed", vars(self))

412

678

else:

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

413

681

logger.warning("Checker for %(name)s crashed?",

414

682

vars(self))

683

return False

415

684

416

685

def checked_ok(self):

417

"""Bump up the timeout for this client.

418

419

This should only be called when the client has been seen,

420

alive and well.

421

"""

686

"""Assert that the client has been seen, alive and well."""

422

687

self.last_checked_ok = datetime.datetime.utcnow()

423

gobject.source_remove(self.disable_initiator_tag)

424

self.disable_initiator_tag = (gobject.timeout_add

425

(self.timeout_milliseconds(),

426

self.disable))

688

self.last_checker_status = 0

689

self.last_checker_signal = None

690

self.bump_timeout()

691

692

def bump_timeout(self, timeout=None):

693

"""Bump up the timeout for this client."""

694

if timeout is None:

695

timeout = self.timeout

696

if self.disable_initiator_tag is not None:

697

gobject.source_remove(self.disable_initiator_tag)

698

self.disable_initiator_tag = None

699

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

702

self.expires = datetime.datetime.utcnow() + timeout

427

703

428

704

def need_approval(self):

429

705

self.last_approval_request = datetime.datetime.utcnow()

434

710

If a checker already exists, leave it running and do

435

711

nothing."""

436

712

# The reason for not killing a running checker is that if we

437

# did that, then if a checker (for some reason) started

438

# running slowly and taking more than 'interval' time, the

439

# client would inevitably timeout, since no checker would get

440

# a chance to run to completion. If we instead leave running

713

# did that, and if a checker (for some reason) started running

714

# slowly and taking more than 'interval' time, then the client

715

# would inevitably timeout, since no checker would get a

716

# chance to run to completion. If we instead leave running

441

717

# checkers alone, the checker would have to take more time

442

718

# than 'timeout' for the client to be disabled, which is as it

443

719

# should be.

444

720

445

# If a checker exists, make sure it is not a zombie

446

try:

447

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

448

except (AttributeError, OSError), error:

449

if (isinstance(error, OSError)

450

and error.errno != errno.ECHILD):

451

raise error

452

else:

453

if pid:

454

logger.warning("Checker was a zombie")

455

gobject.source_remove(self.checker_callback_tag)

456

self.checker_callback(pid, status,

457

self.current_checker_command)

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

458

725

# Start a new checker if needed

459

726

if self.checker is None:

727

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

460

731

try:

461

# In case checker_command has exactly one % operator

462

command = self.checker_command % self.host

463

except TypeError:

464

# Escape attributes for the shell

465

escaped_attrs = dict(

466

(attr,

467

re.escape(unicode(str(getattr(self, attr, "")),

468

errors=

469

'replace')))

470

for attr in

471

self.runtime_expansions)

472

473

try:

474

command = self.checker_command % escaped_attrs

475

except TypeError, error:

476

logger.error('Could not format string "%s":'

477

' %s', self.checker_command, error)

478

return True # Try again later

732

command = self.checker_command % escaped_attrs

733

except TypeError as error:

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

479

738

self.current_checker_command = command

480

try:

481

logger.info("Starting checker %r for %s",

482

command, self.name)

483

# We don't need to redirect stdout and stderr, since

484

# in normal mode, that is already done by daemon(),

485

# and in debug mode we don't want to. (Stdin is

486

# always replaced by /dev/null.)

487

self.checker = subprocess.Popen(command,

488

close_fds=True,

489

shell=True, cwd="/")

490

self.checker_callback_tag = (gobject.child_watch_add

491

(self.checker.pid,

492

self.checker_callback,

493

data=command))

494

# The checker may have completed before the gobject

495

# watch was added. Check for this.

496

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

497

if pid:

498

gobject.source_remove(self.checker_callback_tag)

499

self.checker_callback(pid, status, command)

500

except OSError, error:

501

logger.error("Failed to start subprocess: %s",

502

error)

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

503

764

# Re-run this periodically if run by gobject.timeout_add

504

765

return True

505

766

511

772

if getattr(self, "checker", None) is None:

512

773

return

513

774

logger.debug("Stopping checker for %(name)s", vars(self))

514

try:

515

os.kill(self.checker.pid, signal.SIGTERM)

516

#time.sleep(0.5)

517

#if self.checker.poll() is None:

518

# os.kill(self.checker.pid, signal.SIGKILL)

519

except OSError, error:

520

if error.errno != errno.ESRCH: # No such process

521

raise

775

self.checker.terminate()

522

776

self.checker = None

523

777

524

def dbus_service_property(dbus_interface, signature="v",

525

access="readwrite", byte_arrays=False):

778

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

526

783

"""Decorators for marking methods of a DBusObjectWithProperties to

527

784

become properties on the D-Bus.

528

785

537

794

# "Set" method, so we fail early here:

538

795

if byte_arrays and signature != "ay":

539

796

raise ValueError("Byte arrays not supported for non-'ay'"

540

" signature %r" % signature)

797

" signature {!r}".format(signature))

798

541

799

def decorator(func):

542

800

func._dbus_is_property = True

543

801

func._dbus_interface = dbus_interface

548

806

func._dbus_name = func._dbus_name[:-14]

549

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

550

808

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

"""

846

847

def decorator(func):

848

func._dbus_annotations = annotations

849

return func

850

551

851

return decorator

552

852

553

853

554

854

class DBusPropertyException(dbus.exceptions.DBusException):

555

855

"""A base class for D-Bus property-related exceptions

556

856

"""

557

def __unicode__(self):

558

return unicode(str(self))

857

pass

559

858

560

859

561

860

class DBusPropertyAccessException(DBusPropertyException):

572

871

573

872

class DBusObjectWithProperties(dbus.service.Object):

574

873

"""A D-Bus object with properties.

575

874

576

875

Classes inheriting from this can use the dbus_service_property

577

876

decorator to expose methods as D-Bus properties. It exposes the

578

877

standard Get(), Set(), and GetAll() methods on the D-Bus.

579

878

"""

580

879

581

880

@staticmethod

582

def _is_dbus_property(obj):

583

return getattr(obj, "_dbus_is_property", False)

881

def _is_dbus_thing(thing):

882

"""Returns a function testing if an attribute is a D-Bus thing

883

884

If called like _is_dbus_thing("method") it returns a function

885

suitable for use as predicate to inspect.getmembers().

886

"""

887

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

888

False)

584

889

585

def _get_all_dbus_properties(self):

890

def _get_all_dbus_things(self, thing):

586

891

"""Returns a generator of (name, attribute) pairs

587

892

"""

588

return ((prop._dbus_name, prop)

589

for name, prop in

590

inspect.getmembers(self, self._is_dbus_property))

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

894

athing.__get__(self))

895

for cls in self.__class__.__mro__

896

for name, athing in

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

591

898

592

899

def _get_dbus_property(self, interface_name, property_name):

593

900

"""Returns a bound method if one exists which is a D-Bus

594

901

property with the specified name and interface.

595

902

"""

596

for name in (property_name,

597

property_name + "_dbus_property"):

598

prop = getattr(self, name, None)

599

if (prop is None

600

or not self._is_dbus_property(prop)

601

or prop._dbus_name != property_name

602

or (interface_name and prop._dbus_interface

603

and interface_name != prop._dbus_interface)):

604

continue

605

return prop

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

906

if (value._dbus_name == property_name

907

and value._dbus_interface == interface_name):

908

return value.__get__(self)

909

606

910

# No such property

607

raise DBusPropertyNotFound(self.dbus_object_path + ":"

608

+ interface_name + "."

609

+ property_name)

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

610

913

611

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

612

916

out_signature="v")

613

917

def Get(self, interface_name, property_name):

614

918

"""Standard D-Bus property Get() method, see D-Bus standard.

632

936

# The byte_arrays option is not supported yet on

633

937

# signatures other than "ay".

634

938

if prop._dbus_signature != "ay":

635

raise ValueError

636

value = dbus.ByteArray(''.join(unichr(byte)

637

for byte in value))

939

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {!r}"

941

.format(prop._dbus_signature))

942

value = dbus.ByteArray(b''.join(chr(byte)

943

for byte in value))

638

944

prop(value)

639

945

640

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

641

948

out_signature="a{sv}")

642

949

def GetAll(self, interface_name):

643

950

"""Standard D-Bus property GetAll() method, see D-Bus

644

951

standard.

645

952

646

953

Note: Will not include properties with access="write".

647

954

"""

648

all = {}

649

for name, prop in self._get_all_dbus_properties():

955

properties = {}

956

for name, prop in self._get_all_dbus_things("property"):

650

957

if (interface_name

651

958

and interface_name != prop._dbus_interface):

652

959

# Interface non-empty but did not match

656

963

continue

657

964

value = prop()

658

965

if not hasattr(value, "variant_level"):

659

all[name] = value

966

properties[name] = value

660

967

continue

661

all[name] = type(value)(value, variant_level=

662

value.variant_level+1)

663

return dbus.Dictionary(all, signature="sv")

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

970

return dbus.Dictionary(properties, signature="sv")

971

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

664

979

665

980

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

666

981

out_signature="s",

667

982

path_keyword='object_path',

668

983

connection_keyword='connection')

669

984

def Introspect(self, object_path, connection):

670

"""Standard D-Bus method, overloaded to insert property tags.

985

"""Overloading of standard D-Bus method.

986

987

Inserts property tags and interface annotation tags.

671

988

"""

672

989

xmlstring = dbus.service.Object.Introspect(self, object_path,

673

990

connection)

674

991

try:

675

992

document = xml.dom.minidom.parseString(xmlstring)

993

676

994

def make_tag(document, name, prop):

677

995

e = document.createElement("property")

678

996

e.setAttribute("name", name)

679

997

e.setAttribute("type", prop._dbus_signature)

680

998

e.setAttribute("access", prop._dbus_access)

681

999

return e

1000

682

1001

for if_tag in document.getElementsByTagName("interface"):

1002

# Add property tags

683

1003

for tag in (make_tag(document, name, prop)

684

1004

for name, prop

685

in self._get_all_dbus_properties()

1005

in self._get_all_dbus_things("property")

686

1006

if prop._dbus_interface

687

1007

== if_tag.getAttribute("name")):

688

1008

if_tag.appendChild(tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

689

1038

# Add the names to the return values for the

690

1039

# "org.freedesktop.DBus.Properties" methods

691

1040

if (if_tag.getAttribute("name")

704

1053

xmlstring = document.toxml("utf-8")

705

1054

document.unlink()

706

1055

except (AttributeError, xml.dom.DOMException,

707

xml.parsers.expat.ExpatError), error:

1056

xml.parsers.expat.ExpatError) as error:

708

1057

logger.error("Failed to override Introspection method",

709

error)

1058

exc_info=error)

710

1059

return xmlstring

711

1060

712

1061

1062

def datetime_to_dbus(dt, variant_level=0):

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1064

if dt is None:

1065

return dbus.String("", variant_level = variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1067

1068

1069

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1070

"""A class decorator; applied to a subclass of

1071

dbus.service.Object, it will add alternate D-Bus attributes with

1072

interface names according to the "alt_interface_names" mapping.

1073

Usage:

1074

1075

@alternate_dbus_interfaces({"org.example.Interface":

1076

"net.example.AlternateInterface"})

1077

class SampleDBusObject(dbus.service.Object):

1078

@dbus.service.method("org.example.Interface")

1079

def SampleDBusMethod():

1080

pass

1081

1082

The above "SampleDBusMethod" on "SampleDBusObject" will be

1083

reachable via two interfaces: "org.example.Interface" and

1084

"net.example.AlternateInterface", the latter of which will have

1085

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1086

"true", unless "deprecate" is passed with a False value.

1087

1088

This works for methods and signals, and also for D-Bus properties

1089

(from DBusObjectWithProperties) and interfaces (from the

1090

dbus_interface_annotations decorator).

1091

"""

1092

1093

def wrapper(cls):

1094

for orig_interface_name, alt_interface_name in (

1095

alt_interface_names.items()):

1096

attr = {}

1097

interface_names = set()

1098

# Go though all attributes of the class

1099

for attrname, attribute in inspect.getmembers(cls):

1100

# Ignore non-D-Bus attributes, and D-Bus attributes

1101

# with the wrong interface name

1102

if (not hasattr(attribute, "_dbus_interface")

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1105

continue

1106

# Create an alternate D-Bus interface name based on

1107

# the current name

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1110

interface_names.add(alt_interface)

1111

# Is this a D-Bus signal?

1112

if getattr(attribute, "_dbus_is_signal", False):

1113

if sys.version_info.major == 2:

1114

# Extract the original non-method undecorated

1115

# function by black magic

1116

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1120

else:

1121

nonmethod_func = attribute

1122

# Create a new, but exactly alike, function

1123

# object, and decorate it to be a new D-Bus signal

1124

# with the alternate D-Bus interface name

1125

if sys.version_info.major == 2:

1126

new_function = types.FunctionType(

1127

nonmethod_func.func_code,

1128

nonmethod_func.func_globals,

1129

nonmethod_func.func_name,

1130

nonmethod_func.func_defaults,

1131

nonmethod_func.func_closure)

1132

else:

1133

new_function = types.FunctionType(

1134

nonmethod_func.__code__,

1135

nonmethod_func.__globals__,

1136

nonmethod_func.__name__,

1137

nonmethod_func.__defaults__,

1138

nonmethod_func.__closure__)

1139

new_function = (dbus.service.signal(

1140

alt_interface,

1141

attribute._dbus_signature)(new_function))

1142

# Copy annotations, if any

1143

try:

1144

new_function._dbus_annotations = dict(

1145

attribute._dbus_annotations)

1146

except AttributeError:

1147

pass

1148

# Define a creator of a function to call both the

1149

# original and alternate functions, so both the

1150

# original and alternate signals gets sent when

1151

# the function is called

1152

def fixscope(func1, func2):

1153

"""This function is a scope container to pass

1154

func1 and func2 to the "call_both" function

1155

outside of its arguments"""

1156

1157

def call_both(*args, **kwargs):

1158

"""This function will emit two D-Bus

1159

signals by calling func1 and func2"""

1160

func1(*args, **kwargs)

1161

func2(*args, **kwargs)

1162

1163

return call_both

1164

# Create the "call_both" function and add it to

1165

# the class

1166

attr[attrname] = fixscope(attribute, new_function)

1167

# Is this a D-Bus method?

1168

elif getattr(attribute, "_dbus_is_method", False):

1169

# Create a new, but exactly alike, function

1170

# object. Decorate it to be a new D-Bus method

1171

# with the alternate D-Bus interface name. Add it

1172

# to the class.

1173

attr[attrname] = (

1174

dbus.service.method(

1175

alt_interface,

1176

attribute._dbus_in_signature,

1177

attribute._dbus_out_signature)

1178

(types.FunctionType(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1183

# Copy annotations, if any

1184

try:

1185

attr[attrname]._dbus_annotations = dict(

1186

attribute._dbus_annotations)

1187

except AttributeError:

1188

pass

1189

# Is this a D-Bus property?

1190

elif getattr(attribute, "_dbus_is_property", False):

1191

# Create a new, but exactly alike, function

1192

# object, and decorate it to be a new D-Bus

1193

# property with the alternate D-Bus interface

1194

# name. Add it to the class.

1195

attr[attrname] = (dbus_service_property(

1196

alt_interface, attribute._dbus_signature,

1197

attribute._dbus_access,

1198

attribute._dbus_get_args_options

1199

["byte_arrays"])

1200

(types.FunctionType(

1201

attribute.func_code,

1202

attribute.func_globals,

1203

attribute.func_name,

1204

attribute.func_defaults,

1205

attribute.func_closure)))

1206

# Copy annotations, if any

1207

try:

1208

attr[attrname]._dbus_annotations = dict(

1209

attribute._dbus_annotations)

1210

except AttributeError:

1211

pass

1212

# Is this a D-Bus interface?

1213

elif getattr(attribute, "_dbus_is_interface", False):

1214

# Create a new, but exactly alike, function

1215

# object. Decorate it to be a new D-Bus interface

1216

# with the alternate D-Bus interface name. Add it

1217

# to the class.

1218

attr[attrname] = (

1219

dbus_interface_annotations(alt_interface)

1220

(types.FunctionType(attribute.func_code,

1221

attribute.func_globals,

1222

attribute.func_name,

1223

attribute.func_defaults,

1224

attribute.func_closure)))

1225

if deprecate:

1226

# Deprecate all alternate interfaces

1227

iname="_AlternateDBusNames_interface_annotation{}"

1228

for interface_name in interface_names:

1229

1230

@dbus_interface_annotations(interface_name)

1231

def func(self):

1232

return { "org.freedesktop.DBus.Deprecated":

1233

"true" }

1234

# Find an unused name

1235

for aname in (iname.format(i)

1236

for i in itertools.count()):

1237

if aname not in attr:

1238

attr[aname] = func

1239

break

1240

if interface_names:

1241

# Replace the class with a new subclass of it with

1242

# methods, signals, etc. as created above.

1243

cls = type(b"{}Alternate".format(cls.__name__),

1244

(cls, ), attr)

1245

return cls

1246

1247

return wrapper

1248

1249

1250

@alternate_dbus_interfaces({"se.recompile.Mandos":

1251

"se.bsnet.fukt.Mandos"})

713

1252

class ClientDBus(Client, DBusObjectWithProperties):

714

1253

"""A Client class using D-Bus

715

1254

719

1258

"""

720

1259

721

1260

runtime_expansions = (Client.runtime_expansions

722

+ ("dbus_object_path",))

1261

+ ("dbus_object_path", ))

1262

1263

_interface = "se.recompile.Mandos.Client"

723

1264

724

1265

# dbus.service.Object doesn't use super(), so we can't either.

725

1266

726

1267

def __init__(self, bus = None, *args, **kwargs):

727

self._approvals_pending = 0

728

1268

self.bus = bus

729

1269

Client.__init__(self, *args, **kwargs)

730

1270

# Only now, when this client is initialized, can it show up on

731

1271

# the D-Bus

732

client_object_name = unicode(self.name).translate(

1272

client_object_name = str(self.name).translate(

733

1273

{ord("."): ord("_"),

734

1274

ord("-"): ord("_")})

735

self.dbus_object_path = (dbus.ObjectPath

736

("/clients/" + client_object_name))

1275

self.dbus_object_path = dbus.ObjectPath(

1276

"/clients/" + client_object_name)

737

1277

DBusObjectWithProperties.__init__(self, self.bus,

738

1278

self.dbus_object_path)

739

740

def _get_approvals_pending(self):

741

return self._approvals_pending

742

def _set_approvals_pending(self, value):

743

old_value = self._approvals_pending

744

self._approvals_pending = value

745

bval = bool(value)

746

if (hasattr(self, "dbus_object_path")

747

and bval is not bool(old_value)):

748

dbus_bool = dbus.Boolean(bval, variant_level=1)

749

self.PropertyChanged(dbus.String("ApprovalPending"),

750

dbus_bool)

751

752

approvals_pending = property(_get_approvals_pending,

753

_set_approvals_pending)

754

del _get_approvals_pending, _set_approvals_pending

755

756

@staticmethod

757

def _datetime_to_dbus(dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

return dbus.String(dt.isoformat(),

760

variant_level=variant_level)

761

762

def enable(self):

763

oldstate = getattr(self, "enabled", False)

764

r = Client.enable(self)

765

if oldstate != self.enabled:

766

# Emit D-Bus signals

767

self.PropertyChanged(dbus.String("Enabled"),

768

dbus.Boolean(True, variant_level=1))

769

self.PropertyChanged(

770

dbus.String("LastEnabled"),

771

self._datetime_to_dbus(self.last_enabled,

772

variant_level=1))

773

return r

774

775

def disable(self, quiet = False):

776

oldstate = getattr(self, "enabled", False)

777

r = Client.disable(self, quiet=quiet)

778

if not quiet and oldstate != self.enabled:

779

# Emit D-Bus signal

780

self.PropertyChanged(dbus.String("Enabled"),

781

dbus.Boolean(False, variant_level=1))

782

return r

1279

1280

def notifychangeproperty(transform_func, dbus_name,

1281

type_func=lambda x: x,

1282

variant_level=1,

1283

invalidate_only=False,

1284

_interface=_interface):

1285

""" Modify a variable so that it's a property which announces

1286

its changes to DBus.

1287

1288

transform_fun: Function that takes a value and a variant_level

1289

and transforms it to a D-Bus type.

1290

dbus_name: D-Bus name of the variable

1291

type_func: Function that transform the value before sending it

1292

to the D-Bus. Default: no transform

1293

variant_level: D-Bus variant level. Default: 1

1294

"""

1295

attrname = "_{}".format(dbus_name)

1296

1297

def setter(self, value):

1298

if hasattr(self, "dbus_object_path"):

1299

if (not hasattr(self, attrname) or

1300

type_func(getattr(self, attrname, None))

1301

!= type_func(value)):

1302

if invalidate_only:

1303

self.PropertiesChanged(

1304

_interface, dbus.Dictionary(),

1305

dbus.Array((dbus_name, )))

1306

else:

1307

dbus_value = transform_func(

1308

type_func(value),

1309

variant_level = variant_level)

1310

self.PropertyChanged(dbus.String(dbus_name),

1311

dbus_value)

1312

self.PropertiesChanged(

1313

_interface,

1314

dbus.Dictionary({ dbus.String(dbus_name):

1315

dbus_value }),

1316

dbus.Array())

1317

setattr(self, attrname, value)

1318

1319

return property(lambda self: getattr(self, attrname), setter)

1320

1321

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1322

approvals_pending = notifychangeproperty(dbus.Boolean,

1323

"ApprovalPending",

1324

type_func = bool)

1325

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1326

last_enabled = notifychangeproperty(datetime_to_dbus,

1327

"LastEnabled")

1328

checker = notifychangeproperty(

1329

dbus.Boolean, "CheckerRunning",

1330

type_func = lambda checker: checker is not None)

1331

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1332

"LastCheckedOK")

1333

last_checker_status = notifychangeproperty(dbus.Int16,

1334

"LastCheckerStatus")

1335

last_approval_request = notifychangeproperty(

1336

datetime_to_dbus, "LastApprovalRequest")

1337

approved_by_default = notifychangeproperty(dbus.Boolean,

1338

"ApprovedByDefault")

1339

approval_delay = notifychangeproperty(

1340

dbus.UInt64, "ApprovalDelay",

1341

type_func = lambda td: td.total_seconds() * 1000)

1342

approval_duration = notifychangeproperty(

1343

dbus.UInt64, "ApprovalDuration",

1344

type_func = lambda td: td.total_seconds() * 1000)

1345

host = notifychangeproperty(dbus.String, "Host")

1346

timeout = notifychangeproperty(

1347

dbus.UInt64, "Timeout",

1348

type_func = lambda td: td.total_seconds() * 1000)

1349

extended_timeout = notifychangeproperty(

1350

dbus.UInt64, "ExtendedTimeout",

1351

type_func = lambda td: td.total_seconds() * 1000)

1352

interval = notifychangeproperty(

1353

dbus.UInt64, "Interval",

1354

type_func = lambda td: td.total_seconds() * 1000)

1355

checker_command = notifychangeproperty(dbus.String, "Checker")

1356

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1357

invalidate_only=True)

1358

1359

del notifychangeproperty

783

1360

784

1361

def __del__(self, *args, **kwargs):

785

1362

try:

790

1367

DBusObjectWithProperties.__del__(self, *args, **kwargs)

791

1368

Client.__del__(self, *args, **kwargs)

792

1369

793

def checker_callback(self, pid, condition, command,

794

*args, **kwargs):

795

self.checker_callback_tag = None

796

self.checker = None

797

# Emit D-Bus signal

798

self.PropertyChanged(dbus.String("CheckerRunning"),

799

dbus.Boolean(False, variant_level=1))

800

if os.WIFEXITED(condition):

801

exitstatus = os.WEXITSTATUS(condition)

1370

def checker_callback(self, source, condition,

1371

connection, command, *args, **kwargs):

1372

ret = Client.checker_callback(self, source, condition,

1373

connection, command, *args,

1374

**kwargs)

1375

exitstatus = self.last_checker_status

1376

if exitstatus >= 0:

802

1377

# Emit D-Bus signal

803

1378

self.CheckerCompleted(dbus.Int16(exitstatus),

804

dbus.Int64(condition),

1379

dbus.Int64(0),

805

1380

dbus.String(command))

806

1381

else:

807

1382

# Emit D-Bus signal

808

1383

self.CheckerCompleted(dbus.Int16(-1),

809

dbus.Int64(condition),

1384

dbus.Int64(

1385

self.last_checker_signal),

810

1386

dbus.String(command))

811

812

return Client.checker_callback(self, pid, condition, command,

813

*args, **kwargs)

814

815

def checked_ok(self, *args, **kwargs):

816

r = Client.checked_ok(self, *args, **kwargs)

817

# Emit D-Bus signal

818

self.PropertyChanged(

819

dbus.String("LastCheckedOK"),

820

(self._datetime_to_dbus(self.last_checked_ok,

821

variant_level=1)))

822

return r

823

824

def need_approval(self, *args, **kwargs):

825

r = Client.need_approval(self, *args, **kwargs)

826

# Emit D-Bus signal

827

self.PropertyChanged(

828

dbus.String("LastApprovalRequest"),

829

(self._datetime_to_dbus(self.last_approval_request,

830

variant_level=1)))

831

return r

1387

return ret

832

1388

833

1389

def start_checker(self, *args, **kwargs):

834

old_checker = self.checker

835

if self.checker is not None:

836

old_checker_pid = self.checker.pid

837

else:

838

old_checker_pid = None

1390

old_checker_pid = getattr(self.checker, "pid", None)

839

1391

r = Client.start_checker(self, *args, **kwargs)

840

1392

# Only if new checker process was started

841

1393

if (self.checker is not None

842

1394

and old_checker_pid != self.checker.pid):

843

1395

# Emit D-Bus signal

844

1396

self.CheckerStarted(self.current_checker_command)

845

self.PropertyChanged(

846

dbus.String("CheckerRunning"),

847

dbus.Boolean(True, variant_level=1))

848

1397

return r

849

1398

850

def stop_checker(self, *args, **kwargs):

851

old_checker = getattr(self, "checker", None)

852

r = Client.stop_checker(self, *args, **kwargs)

853

if (old_checker is not None

854

and getattr(self, "checker", None) is None):

855

self.PropertyChanged(dbus.String("CheckerRunning"),

856

dbus.Boolean(False, variant_level=1))

857

return r

858

859

1399

def _reset_approved(self):

860

self._approved = None

1400

self.approved = None

861

1401

return False

862

1402

863

1403

def approve(self, value=True):

1404

self.approved = value

1405

gobject.timeout_add(int(self.approval_duration.total_seconds()

1406

* 1000), self._reset_approved)

864

1407

self.send_changedstate()

865

self._approved = value

866

gobject.timeout_add(self._timedelta_to_milliseconds

867

(self.approval_duration),

868

self._reset_approved)

869

870

1408

871

1409

## D-Bus methods, signals & properties

872

_interface = "se.bsnet.fukt.Mandos.Client"

1410

1411

## Interfaces

873

1412

874

1413

## Signals

875

1414

886

1425

pass

887

1426

888

1427

# PropertyChanged - signal

1428

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

889

1429

@dbus.service.signal(_interface, signature="sv")

890

1430

def PropertyChanged(self, property, value):

891

1431

"D-Bus signal"

922

1462

# CheckedOK - method

923

1463

@dbus.service.method(_interface)

924

1464

def CheckedOK(self):

925

return self.checked_ok()

1465

self.checked_ok()

926

1466

927

1467

# Enable - method

928

1468

@dbus.service.method(_interface)

955

1495

return dbus.Boolean(bool(self.approvals_pending))

956

1496

957

1497

# ApprovedByDefault - property

958

@dbus_service_property(_interface, signature="b",

1498

@dbus_service_property(_interface,

1499

signature="b",

959

1500

access="readwrite")

960

1501

def ApprovedByDefault_dbus_property(self, value=None):

961

1502

if value is None: # get

962

1503

return dbus.Boolean(self.approved_by_default)

963

1504

self.approved_by_default = bool(value)

964

# Emit D-Bus signal

965

self.PropertyChanged(dbus.String("ApprovedByDefault"),

966

dbus.Boolean(value, variant_level=1))

967

1505

968

1506

# ApprovalDelay - property

969

@dbus_service_property(_interface, signature="t",

1507

@dbus_service_property(_interface,

1508

signature="t",

970

1509

access="readwrite")

971

1510

def ApprovalDelay_dbus_property(self, value=None):

972

1511

if value is None: # get

973

return dbus.UInt64(self.approval_delay_milliseconds())

1512

return dbus.UInt64(self.approval_delay.total_seconds()

1513

* 1000)

974

1514

self.approval_delay = datetime.timedelta(0, 0, 0, value)

975

# Emit D-Bus signal

976

self.PropertyChanged(dbus.String("ApprovalDelay"),

977

dbus.UInt64(value, variant_level=1))

978

1515

979

1516

# ApprovalDuration - property

980

@dbus_service_property(_interface, signature="t",

1517

@dbus_service_property(_interface,

1518

signature="t",

981

1519

access="readwrite")

982

1520

def ApprovalDuration_dbus_property(self, value=None):

983

1521

if value is None: # get

984

return dbus.UInt64(self._timedelta_to_milliseconds(

985

self.approval_duration))

1522

return dbus.UInt64(self.approval_duration.total_seconds()

1523

* 1000)

986

1524

self.approval_duration = datetime.timedelta(0, 0, 0, value)

987

# Emit D-Bus signal

988

self.PropertyChanged(dbus.String("ApprovalDuration"),

989

dbus.UInt64(value, variant_level=1))

990

1525

991

1526

# Name - property

1527

@dbus_annotations(

1528

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

992

1529

@dbus_service_property(_interface, signature="s", access="read")

993

1530

def Name_dbus_property(self):

994

1531

return dbus.String(self.name)

995

1532

996

1533

# Fingerprint - property

1534

@dbus_annotations(

1535

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

997

1536

@dbus_service_property(_interface, signature="s", access="read")

998

1537

def Fingerprint_dbus_property(self):

999

1538

return dbus.String(self.fingerprint)

1000

1539

1001

1540

# Host - property

1002

@dbus_service_property(_interface, signature="s",

1541

@dbus_service_property(_interface,

1542

signature="s",

1003

1543

access="readwrite")

1004

1544

def Host_dbus_property(self, value=None):

1005

1545

if value is None: # get

1006

1546

return dbus.String(self.host)

1007

self.host = value

1008

# Emit D-Bus signal

1009

self.PropertyChanged(dbus.String("Host"),

1010

dbus.String(value, variant_level=1))

1547

self.host = str(value)

1011

1548

1012

1549

# Created - property

1550

@dbus_annotations(

1551

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1013

1552

@dbus_service_property(_interface, signature="s", access="read")

1014

1553

def Created_dbus_property(self):

1015

return dbus.String(self._datetime_to_dbus(self.created))

1554

return datetime_to_dbus(self.created)

1016

1555

1017

1556

# LastEnabled - property

1018

1557

@dbus_service_property(_interface, signature="s", access="read")

1019

1558

def LastEnabled_dbus_property(self):

1020

if self.last_enabled is None:

1021

return dbus.String("")

1022

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1559

return datetime_to_dbus(self.last_enabled)

1023

1560

1024

1561

# Enabled - property

1025

@dbus_service_property(_interface, signature="b",

1562

@dbus_service_property(_interface,

1563

signature="b",

1026

1564

access="readwrite")

1027

1565

def Enabled_dbus_property(self, value=None):

1028

1566

if value is None: # get

1033

1571

self.disable()

1034

1572

1035

1573

# LastCheckedOK - property

1036

@dbus_service_property(_interface, signature="s",

1574

@dbus_service_property(_interface,

1575

signature="s",

1037

1576

access="readwrite")

1038

1577

def LastCheckedOK_dbus_property(self, value=None):

1039

1578

if value is not None:

1040

1579

self.checked_ok()

1041

1580

return

1042

if self.last_checked_ok is None:

1043

return dbus.String("")

1044

return dbus.String(self._datetime_to_dbus(self

1045

.last_checked_ok))

1581

return datetime_to_dbus(self.last_checked_ok)

1582

1583

# LastCheckerStatus - property

1584

@dbus_service_property(_interface, signature="n", access="read")

1585

def LastCheckerStatus_dbus_property(self):

1586

return dbus.Int16(self.last_checker_status)

1587

1588

# Expires - property

1589

@dbus_service_property(_interface, signature="s", access="read")

1590

def Expires_dbus_property(self):

1591

return datetime_to_dbus(self.expires)

1046

1592

1047

1593

# LastApprovalRequest - property

1048

1594

@dbus_service_property(_interface, signature="s", access="read")

1049

1595

def LastApprovalRequest_dbus_property(self):

1050

if self.last_approval_request is None:

1051

return dbus.String("")

1052

return dbus.String(self.

1053

_datetime_to_dbus(self

1054

.last_approval_request))

1596

return datetime_to_dbus(self.last_approval_request)

1055

1597

1056

1598

# Timeout - property

1057

@dbus_service_property(_interface, signature="t",

1599

@dbus_service_property(_interface,

1600

signature="t",

1058

1601

access="readwrite")

1059

1602

def Timeout_dbus_property(self, value=None):

1060

1603

if value is None: # get

1061

return dbus.UInt64(self.timeout_milliseconds())

1604

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1605

old_timeout = self.timeout

1062

1606

self.timeout = datetime.timedelta(0, 0, 0, value)

1063

# Emit D-Bus signal

1064

self.PropertyChanged(dbus.String("Timeout"),

1065

dbus.UInt64(value, variant_level=1))

1066

if getattr(self, "disable_initiator_tag", None) is None:

1067

return

1068

# Reschedule timeout

1069

gobject.source_remove(self.disable_initiator_tag)

1070

self.disable_initiator_tag = None

1071

time_to_die = (self.

1072

_timedelta_to_milliseconds((self

1073

.last_checked_ok

1074

+ self.timeout)

1075

- datetime.datetime

1076

.utcnow()))

1077

if time_to_die <= 0:

1078

# The timeout has passed

1079

self.disable()

1080

else:

1081

self.disable_initiator_tag = (gobject.timeout_add

1082

(time_to_die, self.disable))

1607

# Reschedule disabling

1608

if self.enabled:

1609

now = datetime.datetime.utcnow()

1610

self.expires += self.timeout - old_timeout

1611

if self.expires <= now:

1612

# The timeout has passed

1613

self.disable()

1614

else:

1615

if (getattr(self, "disable_initiator_tag", None)

1616

is None):

1617

return

1618

gobject.source_remove(self.disable_initiator_tag)

1619

self.disable_initiator_tag = gobject.timeout_add(

1620

int((self.expires - now).total_seconds() * 1000),

1621

self.disable)

1622

1623

# ExtendedTimeout - property

1624

@dbus_service_property(_interface,

1625

signature="t",

1626

access="readwrite")

1627

def ExtendedTimeout_dbus_property(self, value=None):

1628

if value is None: # get

1629

return dbus.UInt64(self.extended_timeout.total_seconds()

1630

* 1000)

1631

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1083

1632

1084

1633

# Interval - property

1085

@dbus_service_property(_interface, signature="t",

1634

@dbus_service_property(_interface,

1635

signature="t",

1086

1636

access="readwrite")

1087

1637

def Interval_dbus_property(self, value=None):

1088

1638

if value is None: # get

1089

return dbus.UInt64(self.interval_milliseconds())

1639

return dbus.UInt64(self.interval.total_seconds() * 1000)

1090

1640

self.interval = datetime.timedelta(0, 0, 0, value)

1091

# Emit D-Bus signal

1092

self.PropertyChanged(dbus.String("Interval"),

1093

dbus.UInt64(value, variant_level=1))

1094

1641

if getattr(self, "checker_initiator_tag", None) is None:

1095

1642

return

1096

# Reschedule checker run

1097

gobject.source_remove(self.checker_initiator_tag)

1098

self.checker_initiator_tag = (gobject.timeout_add

1099

(value, self.start_checker))

1100

self.start_checker() # Start one now, too

1101

1643

if self.enabled:

1644

# Reschedule checker run

1645

gobject.source_remove(self.checker_initiator_tag)

1646

self.checker_initiator_tag = gobject.timeout_add(

1647

value, self.start_checker)

1648

self.start_checker() # Start one now, too

1649

1102

1650

# Checker - property

1103

@dbus_service_property(_interface, signature="s",

1651

@dbus_service_property(_interface,

1652

signature="s",

1104

1653

access="readwrite")

1105

1654

def Checker_dbus_property(self, value=None):

1106

1655

if value is None: # get

1107

1656

return dbus.String(self.checker_command)

1108

self.checker_command = value

1109

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Checker"),

1111

dbus.String(self.checker_command,

1112

variant_level=1))

1657

self.checker_command = str(value)

1113

1658

1114

1659

# CheckerRunning - property

1115

@dbus_service_property(_interface, signature="b",

1660

@dbus_service_property(_interface,

1661

signature="b",

1116

1662

access="readwrite")

1117

1663

def CheckerRunning_dbus_property(self, value=None):

1118

1664

if value is None: # get

1123

1669

self.stop_checker()

1124

1670

1125

1671

# ObjectPath - property

1672

@dbus_annotations(

1673

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1126

1674

@dbus_service_property(_interface, signature="o", access="read")

1127

1675

def ObjectPath_dbus_property(self):

1128

1676

return self.dbus_object_path # is already a dbus.ObjectPath

1129

1677

1130

1678

# Secret = property

1131

@dbus_service_property(_interface, signature="ay",

1132

access="write", byte_arrays=True)

1679

@dbus_annotations(

1680

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1681

"invalidates"})

1682

@dbus_service_property(_interface,

1683

signature="ay",

1684

access="write",

1685

byte_arrays=True)

1133

1686

def Secret_dbus_property(self, value):

1134

self.secret = str(value)

1687

self.secret = bytes(value)

1135

1688

1136

1689

del _interface

1137

1690

1141

1694

self._pipe = child_pipe

1142

1695

self._pipe.send(('init', fpr, address))

1143

1696

if not self._pipe.recv():

1144

raise KeyError()

1145

1697

raise KeyError(fpr)

1698

1146

1699

def __getattribute__(self, name):

1147

if(name == '_pipe'):

1700

if name == '_pipe':

1148

1701

return super(ProxyClient, self).__getattribute__(name)

1149

1702

self._pipe.send(('getattr', name))

1150

1703

data = self._pipe.recv()

1151

1704

if data[0] == 'data':

1152

1705

return data[1]

1153

1706

if data[0] == 'function':

1707

1154

1708

def func(*args, **kwargs):

1155

1709

self._pipe.send(('funcall', name, args, kwargs))

1156

1710

return self._pipe.recv()[1]

1711

1157

1712

return func

1158

1713

1159

1714

def __setattr__(self, name, value):

1160

if(name == '_pipe'):

1715

if name == '_pipe':

1161

1716

return super(ProxyClient, self).__setattr__(name, value)

1162

1717

self._pipe.send(('setattr', name, value))

1163

1718

1171

1726

def handle(self):

1172

1727

with contextlib.closing(self.server.child_pipe) as child_pipe:

1173

1728

logger.info("TCP connection from: %s",

1174

unicode(self.client_address))

1729

str(self.client_address))

1175

1730

logger.debug("Pipe FD: %d",

1176

1731

self.server.child_pipe.fileno())

1177

1178

session = (gnutls.connection

1179

.ClientSession(self.request,

1180

gnutls.connection

1181

.X509Credentials()))

1182

1732

1733

session = gnutls.connection.ClientSession(

1734

self.request, gnutls.connection .X509Credentials())

1735

1183

1736

# Note: gnutls.connection.X509Credentials is really a

1184

1737

# generic GnuTLS certificate credentials object so long as

1185

1738

# no X.509 keys are added to it. Therefore, we can use it

1186

1739

# here despite using OpenPGP certificates.

1187

1740

1188

1741

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1189

1742

# "+AES-256-CBC", "+SHA1",

1190

1743

# "+COMP-NULL", "+CTYPE-OPENPGP",

1193

1746

priority = self.server.gnutls_priority

1194

1747

if priority is None:

1195

1748

priority = "NORMAL"

1196

(gnutls.library.functions

1197

.gnutls_priority_set_direct(session._c_object,

1198

priority, None))

1199

1749

gnutls.library.functions.gnutls_priority_set_direct(

1750

session._c_object, priority, None)

1751

1200

1752

# Start communication using the Mandos protocol

1201

1753

# Get protocol number

1202

1754

line = self.request.makefile().readline()

1203

1755

logger.debug("Protocol version: %r", line)

1204

1756

try:

1205

1757

if int(line.strip().split()[0]) > 1:

1206

raise RuntimeError

1207

except (ValueError, IndexError, RuntimeError), error:

1758

raise RuntimeError(line)

1759

except (ValueError, IndexError, RuntimeError) as error:

1208

1760

logger.error("Unknown protocol version: %s", error)

1209

1761

return

1210

1762

1211

1763

# Start GnuTLS connection

1212

1764

try:

1213

1765

session.handshake()

1214

except gnutls.errors.GNUTLSError, error:

1766

except gnutls.errors.GNUTLSError as error:

1215

1767

logger.warning("Handshake failed: %s", error)

1216

1768

# Do not run session.bye() here: the session is not

1217

1769

# established. Just abandon the request.

1218

1770

return

1219

1771

logger.debug("Handshake succeeded")

1220

1772

1221

1773

approval_required = False

1222

1774

try:

1223

1775

try:

1224

fpr = self.fingerprint(self.peer_certificate

1225

(session))

1226

except (TypeError, gnutls.errors.GNUTLSError), error:

1776

fpr = self.fingerprint(

1777

self.peer_certificate(session))

1778

except (TypeError,

1779

gnutls.errors.GNUTLSError) as error:

1227

1780

logger.warning("Bad certificate: %s", error)

1228

1781

return

1229

1782

logger.debug("Fingerprint: %s", fpr)

1230

1783

1231

1784

try:

1232

1785

client = ProxyClient(child_pipe, fpr,

1233

1786

self.client_address)

1241

1794

1242

1795

while True:

1243

1796

if not client.enabled:

1244

logger.warning("Client %s is disabled",

1245

client.name)

1797

logger.info("Client %s is disabled",

1798

client.name)

1246

1799

if self.server.use_dbus:

1247

1800

# Emit D-Bus signal

1248

client.Rejected("Disabled")

1801

client.Rejected("Disabled")

1249

1802

return

1250

1803

1251

if client._approved or not client.approval_delay:

1804

if client.approved or not client.approval_delay:

1252

1805

#We are approved or approval is disabled

1253

1806

break

1254

elif client._approved is None:

1807

elif client.approved is None:

1255

1808

logger.info("Client %s needs approval",

1256

1809

client.name)

1257

1810

if self.server.use_dbus:

1258

1811

# Emit D-Bus signal

1259

1812

client.NeedApproval(

1260

client.approval_delay_milliseconds(),

1261

client.approved_by_default)

1813

client.approval_delay.total_seconds()

1814

* 1000, client.approved_by_default)

1262

1815

else:

1263

1816

logger.warning("Client %s was not approved",

1264

1817

client.name)

1268

1821

return

1269

1822

1270

1823

#wait until timeout or approved

1271

#x = float(client._timedelta_to_milliseconds(delay))

1272

1824

time = datetime.datetime.now()

1273

1825

client.changedstate.acquire()

1274

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1826

client.changedstate.wait(delay.total_seconds())

1275

1827

client.changedstate.release()

1276

1828

time2 = datetime.datetime.now()

1277

1829

if (time2 - time) >= delay:

1292

1844

while sent_size < len(client.secret):

1293

1845

try:

1294

1846

sent = session.send(client.secret[sent_size:])

1295

except (gnutls.errors.GNUTLSError), error:

1296

logger.warning("gnutls send failed")

1847

except gnutls.errors.GNUTLSError as error:

1848

logger.warning("gnutls send failed",

1849

exc_info=error)

1297

1850

return

1298

logger.debug("Sent: %d, remaining: %d",

1299

sent, len(client.secret)

1300

- (sent_size + sent))

1851

logger.debug("Sent: %d, remaining: %d", sent,

1852

len(client.secret) - (sent_size

1853

+ sent))

1301

1854

sent_size += sent

1302

1855

1303

1856

logger.info("Sending secret to %s", client.name)

1304

# bump the timeout as if seen

1305

client.checked_ok()

1857

# bump the timeout using extended_timeout

1858

client.bump_timeout(client.extended_timeout)

1306

1859

if self.server.use_dbus:

1307

1860

# Emit D-Bus signal

1308

1861

client.GotSecret()

1312

1865

client.approvals_pending -= 1

1313

1866

try:

1314

1867

session.bye()

1315

except (gnutls.errors.GNUTLSError), error:

1316

logger.warning("GnuTLS bye failed")

1868

except gnutls.errors.GNUTLSError as error:

1869

logger.warning("GnuTLS bye failed",

1870

exc_info=error)

1317

1871

1318

1872

@staticmethod

1319

1873

def peer_certificate(session):

1320

1874

"Return the peer's OpenPGP certificate as a bytestring"

1321

1875

# If not an OpenPGP certificate...

1322

if (gnutls.library.functions

1323

.gnutls_certificate_type_get(session._c_object)

1876

if (gnutls.library.functions.gnutls_certificate_type_get(

1877

session._c_object)

1324

1878

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1325

1879

# ...do the normal thing

1326

1880

return session.peer_certificate

1340

1894

def fingerprint(openpgp):

1341

1895

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1342

1896

# New GnuTLS "datum" with the OpenPGP public key

1343

datum = (gnutls.library.types

1344

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1345

ctypes.POINTER

1346

(ctypes.c_ubyte)),

1347

ctypes.c_uint(len(openpgp))))

1897

datum = gnutls.library.types.gnutls_datum_t(

1898

ctypes.cast(ctypes.c_char_p(openpgp),

1899

ctypes.POINTER(ctypes.c_ubyte)),

1900

ctypes.c_uint(len(openpgp)))

1348

1901

# New empty GnuTLS certificate

1349

1902

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1350

(gnutls.library.functions

1351

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1903

gnutls.library.functions.gnutls_openpgp_crt_init(

1904

ctypes.byref(crt))

1352

1905

# Import the OpenPGP public key into the certificate

1353

(gnutls.library.functions

1354

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1355

gnutls.library.constants

1356

.GNUTLS_OPENPGP_FMT_RAW))

1906

gnutls.library.functions.gnutls_openpgp_crt_import(

1907

crt, ctypes.byref(datum),

1908

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1357

1909

# Verify the self signature in the key

1358

1910

crtverify = ctypes.c_uint()

1359

(gnutls.library.functions

1360

.gnutls_openpgp_crt_verify_self(crt, 0,

1361

ctypes.byref(crtverify)))

1911

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1912

crt, 0, ctypes.byref(crtverify))

1362

1913

if crtverify.value != 0:

1363

1914

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1364

raise (gnutls.errors.CertificateSecurityError

1365

("Verify failed"))

1915

raise gnutls.errors.CertificateSecurityError(

1916

"Verify failed")

1366

1917

# New buffer for the fingerprint

1367

1918

buf = ctypes.create_string_buffer(20)

1368

1919

buf_len = ctypes.c_size_t()

1369

1920

# Get the fingerprint from the certificate into the buffer

1370

(gnutls.library.functions

1371

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1372

ctypes.byref(buf_len)))

1921

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1922

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1373

1923

# Deinit the certificate

1374

1924

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1375

1925

# Convert the buffer to a Python bytestring

1376

1926

fpr = ctypes.string_at(buf, buf_len.value)

1377

1927

# Convert the bytestring to hexadecimal notation

1378

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1928

hex_fpr = binascii.hexlify(fpr).upper()

1379

1929

return hex_fpr

1380

1930

1381

1931

1382

1932

class MultiprocessingMixIn(object):

1383

1933

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1934

1384

1935

def sub_process_main(self, request, address):

1385

1936

try:

1386

1937

self.finish_request(request, address)

1387

except:

1938

except Exception:

1388

1939

self.handle_error(request, address)

1389

1940

self.close_request(request)

1390

1941

1391

1942

def process_request(self, request, address):

1392

1943

"""Start a new process to process the request."""

1393

multiprocessing.Process(target = self.sub_process_main,

1394

args = (request, address)).start()

1944

proc = multiprocessing.Process(target = self.sub_process_main,

1945

args = (request, address))

1946

proc.start()

1947

return proc

1948

1395

1949

1396

1950

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1397

1951

""" adds a pipe to the MixIn """

1952

1398

1953

def process_request(self, request, client_address):

1399

1954

"""Overrides and wraps the original process_request().

1400

1955

1401

1956

This function creates a new pipe in self.pipe

1402

1957

"""

1403

1958

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1404

1405

super(MultiprocessingMixInWithPipe,

1406

self).process_request(request, client_address)

1959

1960

proc = MultiprocessingMixIn.process_request(self, request,

1961

client_address)

1407

1962

self.child_pipe.close()

1408

self.add_pipe(parent_pipe)

1409

1410

def add_pipe(self, parent_pipe):

1963

self.add_pipe(parent_pipe, proc)

1964

1965

def add_pipe(self, parent_pipe, proc):

1411

1966

"""Dummy function; override as necessary"""

1412

raise NotImplementedError

1967

raise NotImplementedError()

1968

1413

1969

1414

1970

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1415

1971

socketserver.TCPServer, object):

1420

1976

interface: None or a network interface name (string)

1421

1977

use_ipv6: Boolean; to use IPv6 or not

1422

1978

"""

1979

1423

1980

def __init__(self, server_address, RequestHandlerClass,

1424

interface=None, use_ipv6=True):

1981

interface=None,

1982

use_ipv6=True,

1983

socketfd=None):

1984

"""If socketfd is set, use that file descriptor instead of

1985

creating a new one with socket.socket().

1986

"""

1425

1987

self.interface = interface

1426

1988

if use_ipv6:

1427

1989

self.address_family = socket.AF_INET6

1990

if socketfd is not None:

1991

# Save the file descriptor

1992

self.socketfd = socketfd

1993

# Save the original socket.socket() function

1994

self.socket_socket = socket.socket

1995

# To implement --socket, we monkey patch socket.socket.

1996

#

1997

# (When socketserver.TCPServer is a new-style class, we

1998

# could make self.socket into a property instead of monkey

1999

# patching socket.socket.)

2000

#

2001

# Create a one-time-only replacement for socket.socket()

2002

@functools.wraps(socket.socket)

2003

def socket_wrapper(*args, **kwargs):

2004

# Restore original function so subsequent calls are

2005

# not affected.

2006

socket.socket = self.socket_socket

2007

del self.socket_socket

2008

# This time only, return a new socket object from the

2009

# saved file descriptor.

2010

return socket.fromfd(self.socketfd, *args, **kwargs)

2011

# Replace socket.socket() function with wrapper

2012

socket.socket = socket_wrapper

2013

# The socketserver.TCPServer.__init__ will call

2014

# socket.socket(), which might be our replacement,

2015

# socket_wrapper(), if socketfd was set.

1428

2016

socketserver.TCPServer.__init__(self, server_address,

1429

2017

RequestHandlerClass)

2018

1430

2019

def server_bind(self):

1431

2020

"""This overrides the normal server_bind() function

1432

2021

to bind to an interface if one was specified, and also NOT to

1438

2027

self.interface)

1439

2028

else:

1440

2029

try:

1441

self.socket.setsockopt(socket.SOL_SOCKET,

1442

SO_BINDTODEVICE,

1443

str(self.interface

1444

+ '\0'))

1445

except socket.error, error:

1446

if error[0] == errno.EPERM:

1447

logger.error("No permission to"

1448

" bind to interface %s",

1449

self.interface)

1450

elif error[0] == errno.ENOPROTOOPT:

2030

self.socket.setsockopt(

2031

socket.SOL_SOCKET, SO_BINDTODEVICE,

2032

(self.interface + "\0").encode("utf-8"))

2033

except socket.error as error:

2034

if error.errno == errno.EPERM:

2035

logger.error("No permission to bind to"

2036

" interface %s", self.interface)

2037

elif error.errno == errno.ENOPROTOOPT:

1451

2038

logger.error("SO_BINDTODEVICE not available;"

1452

2039

" cannot bind to interface %s",

1453

2040

self.interface)

2041

elif error.errno == errno.ENODEV:

2042

logger.error("Interface %s does not exist,"

2043

" cannot bind", self.interface)

1454

2044

else:

1455

2045

raise

1456

2046

# Only bind(2) the socket if we really need to.

1459

2049

if self.address_family == socket.AF_INET6:

1460

2050

any_address = "::" # in6addr_any

1461

2051

else:

1462

any_address = socket.INADDR_ANY

2052

any_address = "0.0.0.0" # INADDR_ANY

1463

2053

self.server_address = (any_address,

1464

2054

self.server_address[1])

1465

2055

elif not self.server_address[1]:

1466

self.server_address = (self.server_address[0],

1467

0)

2056

self.server_address = (self.server_address[0], 0)

1468

2057

# if self.interface:

1469

2058

# self.server_address = (self.server_address[0],

1470

2059

# 0, # port

1484

2073

1485

2074

Assumes a gobject.MainLoop event loop.

1486

2075

"""

2076

1487

2077

def __init__(self, server_address, RequestHandlerClass,

1488

interface=None, use_ipv6=True, clients=None,

1489

gnutls_priority=None, use_dbus=True):

2078

interface=None,

2079

use_ipv6=True,

2080

clients=None,

2081

gnutls_priority=None,

2082

use_dbus=True,

2083

socketfd=None):

1490

2084

self.enabled = False

1491

2085

self.clients = clients

1492

2086

if self.clients is None:

1493

self.clients = set()

2087

self.clients = {}

1494

2088

self.use_dbus = use_dbus

1495

2089

self.gnutls_priority = gnutls_priority

1496

2090

IPv6_TCPServer.__init__(self, server_address,

1497

2091

RequestHandlerClass,

1498

2092

interface = interface,

1499

use_ipv6 = use_ipv6)

2093

use_ipv6 = use_ipv6,

2094

socketfd = socketfd)

2095

1500

2096

def server_activate(self):

1501

2097

if self.enabled:

1502

2098

return socketserver.TCPServer.server_activate(self)

2099

1503

2100

def enable(self):

1504

2101

self.enabled = True

1505

def add_pipe(self, parent_pipe):

2102

2103

def add_pipe(self, parent_pipe, proc):

1506

2104

# Call "handle_ipc" for both data and EOF events

1507

gobject.io_add_watch(parent_pipe.fileno(),

1508

gobject.IO_IN | gobject.IO_HUP,

1509

functools.partial(self.handle_ipc,

1510

parent_pipe = parent_pipe))

1511

1512

def handle_ipc(self, source, condition, parent_pipe=None,

2105

gobject.io_add_watch(

2106

parent_pipe.fileno(),

2107

gobject.IO_IN | gobject.IO_HUP,

2108

functools.partial(self.handle_ipc,

2109

parent_pipe = parent_pipe,

2110

proc = proc))

2111

2112

def handle_ipc(self, source, condition,

2113

parent_pipe=None,

2114

proc = None,

1513

2115

client_object=None):

1514

condition_names = {

1515

gobject.IO_IN: "IN", # There is data to read.

1516

gobject.IO_OUT: "OUT", # Data can be written (without

1517

# blocking).

1518

gobject.IO_PRI: "PRI", # There is urgent data to read.

1519

gobject.IO_ERR: "ERR", # Error condition.

1520

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1521

# broken, usually for pipes and

1522

# sockets).

1523

}

1524

conditions_string = ' | '.join(name

1525

for cond, name in

1526

condition_names.iteritems()

1527

if cond & condition)

1528

# error or the other end of multiprocessing.Pipe has closed

1529

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2116

# error, or the other end of multiprocessing.Pipe has closed

2117

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2118

# Wait for other process to exit

2119

proc.join()

1530

2120

return False

1531

2121

1532

2122

# Read a request from the child

1537

2127

fpr = request[1]

1538

2128

address = request[2]

1539

2129

1540

for c in self.clients:

2130

for c in self.clients.itervalues():

1541

2131

if c.fingerprint == fpr:

1542

2132

client = c

1543

2133

break

1544

2134

else:

1545

logger.warning("Client not found for fingerprint: %s, ad"

1546

"dress: %s", fpr, address)

2135

logger.info("Client not found for fingerprint: %s, ad"

2136

"dress: %s", fpr, address)

1547

2137

if self.use_dbus:

1548

2138

# Emit D-Bus signal

1549

mandos_dbus_service.ClientNotFound(fpr, address[0])

2139

mandos_dbus_service.ClientNotFound(fpr,

2140

address[0])

1550

2141

parent_pipe.send(False)

1551

2142

return False

1552

2143

1553

gobject.io_add_watch(parent_pipe.fileno(),

1554

gobject.IO_IN | gobject.IO_HUP,

1555

functools.partial(self.handle_ipc,

1556

parent_pipe = parent_pipe,

1557

client_object = client))

2144

gobject.io_add_watch(

2145

parent_pipe.fileno(),

2146

gobject.IO_IN | gobject.IO_HUP,

2147

functools.partial(self.handle_ipc,

2148

parent_pipe = parent_pipe,

2149

proc = proc,

2150

client_object = client))

1558

2151

parent_pipe.send(True)

1559

# remove the old hook in favor of the new above hook on same fileno

2152

# remove the old hook in favor of the new above hook on

2153

# same fileno

1560

2154

return False

1561

2155

if command == 'funcall':

1562

2156

funcname = request[1]

1563

2157

args = request[2]

1564

2158

kwargs = request[3]

1565

2159

1566

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1567

2160

parent_pipe.send(('data', getattr(client_object,

2161

funcname)(*args,

2162

**kwargs)))

2163

1568

2164

if command == 'getattr':

1569

2165

attrname = request[1]

1570

if callable(client_object.__getattribute__(attrname)):

1571

parent_pipe.send(('function',))

2166

if isinstance(client_object.__getattribute__(attrname),

2167

collections.Callable):

2168

parent_pipe.send(('function', ))

1572

2169

else:

1573

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2170

parent_pipe.send((

2171

'data', client_object.__getattribute__(attrname)))

1574

2172

1575

2173

if command == 'setattr':

1576

2174

attrname = request[1]

1577

2175

value = request[2]

1578

2176

setattr(client_object, attrname, value)

1579

2177

1580

2178

return True

1581

2179

1582

2180

2181

def rfc3339_duration_to_delta(duration):

2182

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2183

2184

>>> rfc3339_duration_to_delta("P7D")

2185

datetime.timedelta(7)

2186

>>> rfc3339_duration_to_delta("PT60S")

2187

datetime.timedelta(0, 60)

2188

>>> rfc3339_duration_to_delta("PT60M")

2189

datetime.timedelta(0, 3600)

2190

>>> rfc3339_duration_to_delta("PT24H")

2191

datetime.timedelta(1)

2192

>>> rfc3339_duration_to_delta("P1W")

2193

datetime.timedelta(7)

2194

>>> rfc3339_duration_to_delta("PT5M30S")

2195

datetime.timedelta(0, 330)

2196

>>> rfc3339_duration_to_delta("P1DT3M20S")

2197

datetime.timedelta(1, 200)

2198

"""

2199

2200

# Parsing an RFC 3339 duration with regular expressions is not

2201

# possible - there would have to be multiple places for the same

2202

# values, like seconds. The current code, while more esoteric, is

2203

# cleaner without depending on a parsing library. If Python had a

2204

# built-in library for parsing we would use it, but we'd like to

2205

# avoid excessive use of external libraries.

2206

2207

# New type for defining tokens, syntax, and semantics all-in-one

2208

Token = collections.namedtuple("Token", (

2209

"regexp", # To match token; if "value" is not None, must have

2210

# a "group" containing digits

2211

"value", # datetime.timedelta or None

2212

"followers")) # Tokens valid after this token

2213

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2214

# the "duration" ABNF definition in RFC 3339, Appendix A.

2215

token_end = Token(re.compile(r"$"), None, frozenset())

2216

token_second = Token(re.compile(r"(\d+)S"),

2217

datetime.timedelta(seconds=1),

2218

frozenset((token_end, )))

2219

token_minute = Token(re.compile(r"(\d+)M"),

2220

datetime.timedelta(minutes=1),

2221

frozenset((token_second, token_end)))

2222

token_hour = Token(re.compile(r"(\d+)H"),

2223

datetime.timedelta(hours=1),

2224

frozenset((token_minute, token_end)))

2225

token_time = Token(re.compile(r"T"),

2226

None,

2227

frozenset((token_hour, token_minute,

2228

token_second)))

2229

token_day = Token(re.compile(r"(\d+)D"),

2230

datetime.timedelta(days=1),

2231

frozenset((token_time, token_end)))

2232

token_month = Token(re.compile(r"(\d+)M"),

2233

datetime.timedelta(weeks=4),

2234

frozenset((token_day, token_end)))

2235

token_year = Token(re.compile(r"(\d+)Y"),

2236

datetime.timedelta(weeks=52),

2237

frozenset((token_month, token_end)))

2238

token_week = Token(re.compile(r"(\d+)W"),

2239

datetime.timedelta(weeks=1),

2240

frozenset((token_end, )))

2241

token_duration = Token(re.compile(r"P"), None,

2242

frozenset((token_year, token_month,

2243

token_day, token_time,

2244

token_week)))

2245

# Define starting values

2246

value = datetime.timedelta() # Value so far

2247

found_token = None

2248

followers = frozenset((token_duration, )) # Following valid tokens

2249

s = duration # String left to parse

2250

# Loop until end token is found

2251

while found_token is not token_end:

2252

# Search for any currently valid tokens

2253

for token in followers:

2254

match = token.regexp.match(s)

2255

if match is not None:

2256

# Token found

2257

if token.value is not None:

2258

# Value found, parse digits

2259

factor = int(match.group(1), 10)

2260

# Add to value so far

2261

value += factor * token.value

2262

# Strip token from string

2263

s = token.regexp.sub("", s, 1)

2264

# Go to found token

2265

found_token = token

2266

# Set valid next tokens

2267

followers = found_token.followers

2268

break

2269

else:

2270

# No currently valid tokens were found

2271

raise ValueError("Invalid RFC 3339 duration: {!r}"

2272

.format(duration))

2273

# End token found

2274

return value

2275

2276

1583

2277

def string_to_delta(interval):

1584

2278

"""Parse a string and return a datetime.timedelta

1585

2279

1596

2290

>>> string_to_delta('5m 30s')

1597

2291

datetime.timedelta(0, 330)

1598

2292

"""

2293

2294

try:

2295

return rfc3339_duration_to_delta(interval)

2296

except ValueError:

2297

pass

2298

1599

2299

timevalue = datetime.timedelta(0)

1600

2300

for s in interval.split():

1601

2301

try:

1602

suffix = unicode(s[-1])

2302

suffix = s[-1]

1603

2303

value = int(s[:-1])

1604

2304

if suffix == "d":

1605

2305

delta = datetime.timedelta(value)

1612

2312

elif suffix == "w":

1613

2313

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1614

2314

else:

1615

raise ValueError("Unknown suffix %r" % suffix)

1616

except (ValueError, IndexError), e:

2315

raise ValueError("Unknown suffix {!r}".format(suffix))

2316

except IndexError as e:

1617

2317

raise ValueError(*(e.args))

1618

2318

timevalue += delta

1619

2319

return timevalue

1620

2320

1621

2321

1622

def if_nametoindex(interface):

1623

"""Call the C function if_nametoindex(), or equivalent

1624

1625

Note: This function cannot accept a unicode string."""

1626

global if_nametoindex

1627

try:

1628

if_nametoindex = (ctypes.cdll.LoadLibrary

1629

(ctypes.util.find_library("c"))

1630

.if_nametoindex)

1631

except (OSError, AttributeError):

1632

logger.warning("Doing if_nametoindex the hard way")

1633

def if_nametoindex(interface):

1634

"Get an interface index the hard way, i.e. using fcntl()"

1635

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1636

with contextlib.closing(socket.socket()) as s:

1637

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1638

struct.pack(str("16s16x"),

1639

interface))

1640

interface_index = struct.unpack(str("I"),

1641

ifreq[16:20])[0]

1642

return interface_index

1643

return if_nametoindex(interface)

1644

1645

1646

2322

def daemon(nochdir = False, noclose = False):

1647

2323

"""See daemon(3). Standard BSD Unix function.

1648

2324

1656

2332

sys.exit()

1657

2333

if not noclose:

1658

2334

# Close all standard open file descriptors

1659

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2335

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1660

2336

if not stat.S_ISCHR(os.fstat(null).st_mode):

1661

2337

raise OSError(errno.ENODEV,

1662

"%s not a character device"

1663

% os.path.devnull)

2338

"{} not a character device"

2339

.format(os.devnull))

1664

2340

os.dup2(null, sys.stdin.fileno())

1665

2341

os.dup2(null, sys.stdout.fileno())

1666

2342

os.dup2(null, sys.stderr.fileno())

1675

2351

1676

2352

parser = argparse.ArgumentParser()

1677

2353

parser.add_argument("-v", "--version", action="version",

1678

version = "%%(prog)s %s" % version,

2354

version = "%(prog)s {}".format(version),

1679

2355

help="show version number and exit")

1680

2356

parser.add_argument("-i", "--interface", metavar="IF",

1681

2357

help="Bind to interface IF")

1687

2363

help="Run self-test")

1688

2364

parser.add_argument("--debug", action="store_true",

1689

2365

help="Debug mode; run in foreground and log"

1690

" to terminal")

2366

" to terminal", default=None)

1691

2367

parser.add_argument("--debuglevel", metavar="LEVEL",

1692

2368

help="Debug level for stdout output")

1693

2369

parser.add_argument("--priority", help="GnuTLS"

1700

2376

" files")

1701

2377

parser.add_argument("--no-dbus", action="store_false",

1702

2378

dest="use_dbus", help="Do not provide D-Bus"

1703

" system bus interface")

2379

" system bus interface", default=None)

1704

2380

parser.add_argument("--no-ipv6", action="store_false",

1705

dest="use_ipv6", help="Do not use IPv6")

2381

dest="use_ipv6", help="Do not use IPv6",

2382

default=None)

2383

parser.add_argument("--no-restore", action="store_false",

2384

dest="restore", help="Do not restore stored"

2385

" state", default=None)

2386

parser.add_argument("--socket", type=int,

2387

help="Specify a file descriptor to a network"

2388

" socket to use instead of creating one")

2389

parser.add_argument("--statedir", metavar="DIR",

2390

help="Directory to save/restore state in")

2391

parser.add_argument("--foreground", action="store_true",

2392

help="Run in foreground", default=None)

2393

parser.add_argument("--no-zeroconf", action="store_false",

2394

dest="zeroconf", help="Do not use Zeroconf",

2395

default=None)

2396

1706

2397

options = parser.parse_args()

1707

2398

1708

2399

if options.check:

1709

2400

import doctest

1710

doctest.testmod()

1711

sys.exit()

2401

fail_count, test_count = doctest.testmod()

2402

sys.exit(os.EX_OK if fail_count == 0 else 1)

1712

2403

1713

2404

# Default values for config file for server-global settings

1714

2405

server_defaults = { "interface": "",

1716

2407

"port": "",

1717

2408

"debug": "False",

1718

2409

"priority":

1719

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2410

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2411

":+SIGN-DSA-SHA256",

1720

2412

"servicename": "Mandos",

1721

2413

"use_dbus": "True",

1722

2414

"use_ipv6": "True",

1723

2415

"debuglevel": "",

1724

}

2416

"restore": "True",

2417

"socket": "",

2418

"statedir": "/var/lib/mandos",

2419

"foreground": "False",

2420

"zeroconf": "True",

2421

}

1725

2422

1726

2423

# Parse config file for server-global settings

1727

2424

server_config = configparser.SafeConfigParser(server_defaults)

1728

2425

del server_defaults

1729

server_config.read(os.path.join(options.configdir,

1730

"mandos.conf"))

2426

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1731

2427

# Convert the SafeConfigParser object to a dict

1732

2428

server_settings = server_config.defaults()

1733

2429

# Use the appropriate methods on the non-string config options

1734

for option in ("debug", "use_dbus", "use_ipv6"):

2430

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1735

2431

server_settings[option] = server_config.getboolean("DEFAULT",

1736

2432

option)

1737

2433

if server_settings["port"]:

1738

2434

server_settings["port"] = server_config.getint("DEFAULT",

1739

2435

"port")

2436

if server_settings["socket"]:

2437

server_settings["socket"] = server_config.getint("DEFAULT",

2438

"socket")

2439

# Later, stdin will, and stdout and stderr might, be dup'ed

2440

# over with an opened os.devnull. But we don't want this to

2441

# happen with a supplied network socket.

2442

if 0 <= server_settings["socket"] <= 2:

2443

server_settings["socket"] = os.dup(server_settings

2444

["socket"])

1740

2445

del server_config

1741

2446

1742

2447

# Override the settings from the config file with command line

1743

2448

# options, if set.

1744

2449

for option in ("interface", "address", "port", "debug",

1745

"priority", "servicename", "configdir",

1746

"use_dbus", "use_ipv6", "debuglevel"):

2450

"priority", "servicename", "configdir", "use_dbus",

2451

"use_ipv6", "debuglevel", "restore", "statedir",

2452

"socket", "foreground", "zeroconf"):

1747

2453

value = getattr(options, option)

1748

2454

if value is not None:

1749

2455

server_settings[option] = value

1750

2456

del options

1751

2457

# Force all strings to be unicode

1752

2458

for option in server_settings.keys():

1753

if type(server_settings[option]) is str:

1754

server_settings[option] = unicode(server_settings[option])

2459

if isinstance(server_settings[option], bytes):

2460

server_settings[option] = (server_settings[option]

2461

.decode("utf-8"))

2462

# Force all boolean options to be boolean

2463

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2464

"foreground", "zeroconf"):

2465

server_settings[option] = bool(server_settings[option])

2466

# Debug implies foreground

2467

if server_settings["debug"]:

2468

server_settings["foreground"] = True

1755

2469

# Now we have our good server settings in "server_settings"

1756

2470

1757

2471

##################################################################

1758

2472

2473

if (not server_settings["zeroconf"]

2474

and not (server_settings["port"]

2475

or server_settings["socket"] != "")):

2476

parser.error("Needs port or socket to work without Zeroconf")

2477

1759

2478

# For convenience

1760

2479

debug = server_settings["debug"]

1761

2480

debuglevel = server_settings["debuglevel"]

1762

2481

use_dbus = server_settings["use_dbus"]

1763

2482

use_ipv6 = server_settings["use_ipv6"]

1764

2483

stored_state_path = os.path.join(server_settings["statedir"],

2484

stored_state_file)

2485

foreground = server_settings["foreground"]

2486

zeroconf = server_settings["zeroconf"]

2487

2488

if debug:

2489

initlogger(debug, logging.DEBUG)

2490

else:

2491

if not debuglevel:

2492

initlogger(debug)

2493

else:

2494

level = getattr(logging, debuglevel.upper())

2495

initlogger(debug, level)

2496

1765

2497

if server_settings["servicename"] != "Mandos":

1766

syslogger.setFormatter(logging.Formatter

1767

('Mandos (%s) [%%(process)d]:'

1768

' %%(levelname)s: %%(message)s'

1769

% server_settings["servicename"]))

2498

syslogger.setFormatter(

2499

logging.Formatter('Mandos ({}) [%(process)d]:'

2500

' %(levelname)s: %(message)s'.format(

2501

server_settings["servicename"])))

1770

2502

1771

2503

# Parse config file with clients

1772

client_defaults = { "timeout": "1h",

1773

"interval": "5m",

1774

"checker": "fping -q -- %%(host)s",

1775

"host": "",

1776

"approval_delay": "0s",

1777

"approval_duration": "1s",

1778

}

1779

client_config = configparser.SafeConfigParser(client_defaults)

2504

client_config = configparser.SafeConfigParser(Client

2505

.client_defaults)

1780

2506

client_config.read(os.path.join(server_settings["configdir"],

1781

2507

"clients.conf"))

1782

2508

1783

2509

global mandos_dbus_service

1784

2510

mandos_dbus_service = None

1785

2511

1786

tcp_server = MandosServer((server_settings["address"],

1787

server_settings["port"]),

1788

ClientHandler,

1789

interface=(server_settings["interface"]

1790

or None),

1791

use_ipv6=use_ipv6,

1792

gnutls_priority=

1793

server_settings["priority"],

1794

use_dbus=use_dbus)

1795

if not debug:

1796

pidfilename = "/var/run/mandos.pid"

2512

socketfd = None

2513

if server_settings["socket"] != "":

2514

socketfd = server_settings["socket"]

2515

tcp_server = MandosServer(

2516

(server_settings["address"], server_settings["port"]),

2517

ClientHandler,

2518

interface=(server_settings["interface"] or None),

2519

use_ipv6=use_ipv6,

2520

gnutls_priority=server_settings["priority"],

2521

use_dbus=use_dbus,

2522

socketfd=socketfd)

2523

if not foreground:

2524

pidfilename = "/run/mandos.pid"

2525

if not os.path.isdir("/run/."):

2526

pidfilename = "/var/run/mandos.pid"

2527

pidfile = None

1797

2528

try:

1798

pidfile = open(pidfilename, "w")

1799

except IOError:

1800

logger.error("Could not open file %r", pidfilename)

2529

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2530

except IOError as e:

2531

logger.error("Could not open file %r", pidfilename,

2532

exc_info=e)

1801

2533

1802

try:

1803

uid = pwd.getpwnam("_mandos").pw_uid

1804

gid = pwd.getpwnam("_mandos").pw_gid

1805

except KeyError:

2534

for name in ("_mandos", "mandos", "nobody"):

1806

2535

try:

1807

uid = pwd.getpwnam("mandos").pw_uid

1808

gid = pwd.getpwnam("mandos").pw_gid

2536

uid = pwd.getpwnam(name).pw_uid

2537

gid = pwd.getpwnam(name).pw_gid

2538

break

1809

2539

except KeyError:

1810

try:

1811

uid = pwd.getpwnam("nobody").pw_uid

1812

gid = pwd.getpwnam("nobody").pw_gid

1813

except KeyError:

1814

uid = 65534

1815

gid = 65534

2540

continue

2541

else:

2542

uid = 65534

2543

gid = 65534

1816

2544

try:

1817

2545

os.setgid(gid)

1818

2546

os.setuid(uid)

1819

except OSError, error:

1820

if error[0] != errno.EPERM:

1821

raise error

2547

except OSError as error:

2548

if error.errno != errno.EPERM:

2549

raise

1822

2550

1823

if not debug and not debuglevel:

1824

syslogger.setLevel(logging.WARNING)

1825

console.setLevel(logging.WARNING)

1826

if debuglevel:

1827

level = getattr(logging, debuglevel.upper())

1828

syslogger.setLevel(level)

1829

console.setLevel(level)

1830

1831

2551

if debug:

1832

2552

# Enable all possible GnuTLS debugging

1833

2553

1839

2559

def debug_gnutls(level, string):

1840

2560

logger.debug("GnuTLS: %s", string[:-1])

1841

2561

1842

(gnutls.library.functions

1843

.gnutls_global_set_log_function(debug_gnutls))

2562

gnutls.library.functions.gnutls_global_set_log_function(

2563

debug_gnutls)

1844

2564

1845

2565

# Redirect stdin so all checkers get /dev/null

1846

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2566

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1847

2567

os.dup2(null, sys.stdin.fileno())

1848

2568

if null > 2:

1849

2569

os.close(null)

1850

else:

1851

# No console logging

1852

logger.removeHandler(console)

1853

2570

1854

2571

# Need to fork before connecting to D-Bus

1855

if not debug:

2572

if not foreground:

1856

2573

# Close all input and output, do double fork, etc.

1857

2574

daemon()

1858

2575

2576

# multiprocessing will use threads, so before we use gobject we

2577

# need to inform gobject that threads will be used.

2578

gobject.threads_init()

2579

1859

2580

global main_loop

1860

2581

# From the Avahi example code

1861

DBusGMainLoop(set_as_default=True )

2582

DBusGMainLoop(set_as_default=True)

1862

2583

main_loop = gobject.MainLoop()

1863

2584

bus = dbus.SystemBus()

1864

2585

# End of Avahi example code

1865

2586

if use_dbus:

1866

2587

try:

1867

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1868

bus, do_not_queue=True)

1869

except dbus.exceptions.NameExistsException, e:

1870

logger.error(unicode(e) + ", disabling D-Bus")

2588

bus_name = dbus.service.BusName("se.recompile.Mandos",

2589

bus,

2590

do_not_queue=True)

2591

old_bus_name = dbus.service.BusName(

2592

"se.bsnet.fukt.Mandos", bus,

2593

do_not_queue=True)

2594

except dbus.exceptions.DBusException as e:

2595

logger.error("Disabling D-Bus:", exc_info=e)

1871

2596

use_dbus = False

1872

2597

server_settings["use_dbus"] = False

1873

2598

tcp_server.use_dbus = False

1874

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1875

service = AvahiService(name = server_settings["servicename"],

1876

servicetype = "_mandos._tcp",

1877

protocol = protocol, bus = bus)

1878

if server_settings["interface"]:

1879

service.interface = (if_nametoindex

1880

(str(server_settings["interface"])))

2599

if zeroconf:

2600

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2601

service = AvahiServiceToSyslog(

2602

name = server_settings["servicename"],

2603

servicetype = "_mandos._tcp",

2604

protocol = protocol,

2605

bus = bus)

2606

if server_settings["interface"]:

2607

service.interface = if_nametoindex(

2608

server_settings["interface"].encode("utf-8"))

1881

2609

1882

2610

global multiprocessing_manager

1883

2611

multiprocessing_manager = multiprocessing.Manager()

1885

2613

client_class = Client

1886

2614

if use_dbus:

1887

2615

client_class = functools.partial(ClientDBus, bus = bus)

1888

def client_config_items(config, section):

1889

special_settings = {

1890

"approved_by_default":

1891

lambda: config.getboolean(section,

1892

"approved_by_default"),

1893

}

1894

for name, value in config.items(section):

2616

2617

client_settings = Client.config_parser(client_config)

2618

old_client_settings = {}

2619

clients_data = {}

2620

2621

# This is used to redirect stdout and stderr for checker processes

2622

global wnull

2623

wnull = open(os.devnull, "w") # A writable /dev/null

2624

# Only used if server is running in foreground but not in debug

2625

# mode

2626

if debug or not foreground:

2627

wnull.close()

2628

2629

# Get client data and settings from last running state.

2630

if server_settings["restore"]:

2631

try:

2632

with open(stored_state_path, "rb") as stored_state:

2633

clients_data, old_client_settings = pickle.load(

2634

stored_state)

2635

os.remove(stored_state_path)

2636

except IOError as e:

2637

if e.errno == errno.ENOENT:

2638

logger.warning("Could not load persistent state:"

2639

" {}".format(os.strerror(e.errno)))

2640

else:

2641

logger.critical("Could not load persistent state:",

2642

exc_info=e)

2643

raise

2644

except EOFError as e:

2645

logger.warning("Could not load persistent state: "

2646

"EOFError:",

2647

exc_info=e)

2648

2649

with PGPEngine() as pgp:

2650

for client_name, client in clients_data.items():

2651

# Skip removed clients

2652

if client_name not in client_settings:

2653

continue

2654

2655

# Decide which value to use after restoring saved state.

2656

# We have three different values: Old config file,

2657

# new config file, and saved state.

2658

# New config value takes precedence if it differs from old

2659

# config value, otherwise use saved state.

2660

for name, value in client_settings[client_name].items():

2661

try:

2662

# For each value in new config, check if it

2663

# differs from the old config value (Except for

2664

# the "secret" attribute)

2665

if (name != "secret"

2666

and (value !=

2667

old_client_settings[client_name][name])):

2668

client[name] = value

2669

except KeyError:

2670

pass

2671

2672

# Clients who has passed its expire date can still be

2673

# enabled if its last checker was successful. A Client

2674

# whose checker succeeded before we stored its state is

2675

# assumed to have successfully run all checkers during

2676

# downtime.

2677

if client["enabled"]:

2678

if datetime.datetime.utcnow() >= client["expires"]:

2679

if not client["last_checked_ok"]:

2680

logger.warning(

2681

"disabling client {} - Client never "

2682

"performed a successful checker".format(

2683

client_name))

2684

client["enabled"] = False

2685

elif client["last_checker_status"] != 0:

2686

logger.warning(

2687

"disabling client {} - Client last"

2688

" checker failed with error code"

2689

" {}".format(

2690

client_name,

2691

client["last_checker_status"]))

2692

client["enabled"] = False

2693

else:

2694

client["expires"] = (

2695

datetime.datetime.utcnow()

2696

+ client["timeout"])

2697

logger.debug("Last checker succeeded,"

2698

" keeping {} enabled".format(

2699

client_name))

1895

2700

try:

1896

yield (name, special_settings[name]())

1897

except KeyError:

1898

yield (name, value)

1899

1900

tcp_server.clients.update(set(

1901

client_class(name = section,

1902

config= dict(client_config_items(

1903

client_config, section)))

1904

for section in client_config.sections()))

2701

client["secret"] = pgp.decrypt(

2702

client["encrypted_secret"],

2703

client_settings[client_name]["secret"])

2704

except PGPError:

2705

# If decryption fails, we use secret from new settings

2706

logger.debug("Failed to decrypt {} old secret".format(

2707

client_name))

2708

client["secret"] = (client_settings[client_name]

2709

["secret"])

2710

2711

# Add/remove clients based on new changes made to config

2712

for client_name in (set(old_client_settings)

2713

- set(client_settings)):

2714

del clients_data[client_name]

2715

for client_name in (set(client_settings)

2716

- set(old_client_settings)):

2717

clients_data[client_name] = client_settings[client_name]

2718

2719

# Create all client objects

2720

for client_name, client in clients_data.items():

2721

tcp_server.clients[client_name] = client_class(

2722

name = client_name,

2723

settings = client,

2724

server_settings = server_settings)

2725

1905

2726

if not tcp_server.clients:

1906

2727

logger.warning("No clients defined")

1907

1908

if not debug:

1909

try:

1910

with pidfile:

1911

pid = os.getpid()

1912

pidfile.write(str(pid) + "\n".encode("utf-8"))

1913

del pidfile

1914

except IOError:

1915

logger.error("Could not write to file %r with PID %d",

1916

pidfilename, pid)

1917

except NameError:

1918

# "pidfile" was never created

1919

pass

2728

2729

if not foreground:

2730

if pidfile is not None:

2731

pid = os.getpid()

2732

try:

2733

with pidfile:

2734

print(pid, file=pidfile)

2735

except IOError:

2736

logger.error("Could not write to file %r with PID %d",

2737

pidfilename, pid)

2738

del pidfile

1920

2739

del pidfilename

1921

1922

signal.signal(signal.SIGINT, signal.SIG_IGN)

1923

2740

1924

2741

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1925

2742

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1926

2743

1927

2744

if use_dbus:

1928

class MandosDBusService(dbus.service.Object):

2745

2746

@alternate_dbus_interfaces(

2747

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2748

class MandosDBusService(DBusObjectWithProperties):

1929

2749

"""A D-Bus proxy object"""

2750

1930

2751

def __init__(self):

1931

2752

dbus.service.Object.__init__(self, bus, "/")

1932

_interface = "se.bsnet.fukt.Mandos"

2753

2754

_interface = "se.recompile.Mandos"

2755

2756

@dbus_interface_annotations(_interface)

2757

def _foo(self):

2758

return {

2759

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2760

"false" }

1933

2761

1934

2762

@dbus.service.signal(_interface, signature="o")

1935

2763

def ClientAdded(self, objpath):

1949

2777

@dbus.service.method(_interface, out_signature="ao")

1950

2778

def GetAllClients(self):

1951

2779

"D-Bus method"

1952

return dbus.Array(c.dbus_object_path

1953

for c in tcp_server.clients)

2780

return dbus.Array(c.dbus_object_path for c in

2781

tcp_server.clients.itervalues())

1954

2782

1955

2783

@dbus.service.method(_interface,

1956

2784

out_signature="a{oa{sv}}")

1957

2785

def GetAllClientsWithProperties(self):

1958

2786

"D-Bus method"

1959

2787

return dbus.Dictionary(

1960

((c.dbus_object_path, c.GetAll(""))

1961

for c in tcp_server.clients),

2788

{ c.dbus_object_path: c.GetAll("")

2789

for c in tcp_server.clients.itervalues() },

1962

2790

signature="oa{sv}")

1963

2791

1964

2792

@dbus.service.method(_interface, in_signature="o")

1965

2793

def RemoveClient(self, object_path):

1966

2794

"D-Bus method"

1967

for c in tcp_server.clients:

2795

for c in tcp_server.clients.itervalues():

1968

2796

if c.dbus_object_path == object_path:

1969

tcp_server.clients.remove(c)

2797

del tcp_server.clients[c.name]

1970

2798

c.remove_from_connection()

1971

2799

# Don't signal anything except ClientRemoved

1972

2800

c.disable(quiet=True)

1981

2809

1982

2810

def cleanup():

1983

2811

"Cleanup function; run on exit"

1984

service.cleanup()

1985

2812

if zeroconf:

2813

service.cleanup()

2814

2815

multiprocessing.active_children()

2816

wnull.close()

2817

if not (tcp_server.clients or client_settings):

2818

return

2819

2820

# Store client before exiting. Secrets are encrypted with key

2821

# based on what config file has. If config file is

2822

# removed/edited, old secret will thus be unrecovable.

2823

clients = {}

2824

with PGPEngine() as pgp:

2825

for client in tcp_server.clients.itervalues():

2826

key = client_settings[client.name]["secret"]

2827

client.encrypted_secret = pgp.encrypt(client.secret,

2828

key)

2829

client_dict = {}

2830

2831

# A list of attributes that can not be pickled

2832

# + secret.

2833

exclude = { "bus", "changedstate", "secret",

2834

"checker", "server_settings" }

2835

for name, typ in inspect.getmembers(dbus.service

2836

.Object):

2837

exclude.add(name)

2838

2839

client_dict["encrypted_secret"] = (client

2840

.encrypted_secret)

2841

for attr in client.client_structure:

2842

if attr not in exclude:

2843

client_dict[attr] = getattr(client, attr)

2844

2845

clients[client.name] = client_dict

2846

del client_settings[client.name]["secret"]

2847

2848

try:

2849

with tempfile.NamedTemporaryFile(

2850

mode='wb',

2851

suffix=".pickle",

2852

prefix='clients-',

2853

dir=os.path.dirname(stored_state_path),

2854

delete=False) as stored_state:

2855

pickle.dump((clients, client_settings), stored_state)

2856

tempname = stored_state.name

2857

os.rename(tempname, stored_state_path)

2858

except (IOError, OSError) as e:

2859

if not debug:

2860

try:

2861

os.remove(tempname)

2862

except NameError:

2863

pass

2864

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2865

logger.warning("Could not save persistent state: {}"

2866

.format(os.strerror(e.errno)))

2867

else:

2868

logger.warning("Could not save persistent state:",

2869

exc_info=e)

2870

raise

2871

2872

# Delete all clients, and settings from config

1986

2873

while tcp_server.clients:

1987

client = tcp_server.clients.pop()

2874

name, client = tcp_server.clients.popitem()

1988

2875

if use_dbus:

1989

2876

client.remove_from_connection()

1990

client.disable_hook = None

1991

2877

# Don't signal anything except ClientRemoved

1992

2878

client.disable(quiet=True)

1993

2879

if use_dbus:

1994

2880

# Emit D-Bus signal

1995

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1996

client.name)

2881

mandos_dbus_service.ClientRemoved(

2882

client.dbus_object_path, client.name)

2883

client_settings.clear()

1997

2884

1998

2885

atexit.register(cleanup)

1999

2886

2000

for client in tcp_server.clients:

2887

for client in tcp_server.clients.itervalues():

2001

2888

if use_dbus:

2002

2889

# Emit D-Bus signal

2003

2890

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2004

client.enable()

2891

# Need to initiate checking of clients

2892

if client.enabled:

2893

client.init_checker()

2005

2894

2006

2895

tcp_server.enable()

2007

2896

tcp_server.server_activate()

2008

2897

2009

2898

# Find out what port we got

2010

service.port = tcp_server.socket.getsockname()[1]

2899

if zeroconf:

2900

service.port = tcp_server.socket.getsockname()[1]

2011

2901

if use_ipv6:

2012

2902

logger.info("Now listening on address %r, port %d,"

2013

" flowinfo %d, scope_id %d"

2014

% tcp_server.socket.getsockname())

2903

" flowinfo %d, scope_id %d",

2904

*tcp_server.socket.getsockname())

2015

2905

else: # IPv4

2016

logger.info("Now listening on address %r, port %d"

2017

% tcp_server.socket.getsockname())

2906

logger.info("Now listening on address %r, port %d",

2907

*tcp_server.socket.getsockname())

2018

2908

2019

2909

#service.interface = tcp_server.socket.getsockname()[3]

2020

2910

2021

2911

try:

2022

# From the Avahi example code

2023

try:

2024

service.activate()

2025

except dbus.exceptions.DBusException, error:

2026

logger.critical("DBusException: %s", error)

2027

cleanup()

2028

sys.exit(1)

2029

# End of Avahi example code

2912

if zeroconf:

2913

# From the Avahi example code

2914

try:

2915

service.activate()

2916

except dbus.exceptions.DBusException as error:

2917

logger.critical("D-Bus Exception", exc_info=error)

2918

cleanup()

2919

sys.exit(1)

2920

# End of Avahi example code

2030

2921

2031

2922

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2032

2923

lambda *args, **kwargs:

2035

2926

2036

2927

logger.debug("Starting main loop")

2037

2928

main_loop.run()

2038

except AvahiError, error:

2039

logger.critical("AvahiError: %s", error)

2929

except AvahiError as error:

2930

logger.critical("Avahi Error", exc_info=error)

2040

2931

cleanup()

2041

2932

sys.exit(1)

2042

2933

except KeyboardInterrupt:

2047

2938

# Must run before the D-Bus bus name gets deregistered

2048

2939

cleanup()

2049

2940

2941

2050

2942

if __name__ == '__main__':

2051

2943

main()